@rhinestone/shared-configs 2.36.2 → 2.36.4

package/README.md

@@ -18,6 +18,10 @@ Source-of-truth lives in Yeet Jsonnet config:
 2. Regenerate configs with `bun run generate` from this directory (requires Go)
 3. Merge to `main` to publish `@rhinestone/shared-configs`
 
+App-fee custody lives in `config/app-fees.json`. Generation verifies its signed
+ownership proofs and version-pinned SDK account derivations. See
+[`docs/app-fees.md`](../docs/app-fees.md) for verification and rollout commands.
+
 ## Token authorizations
 
 An EVM token with verified token-native signed authorization support carries an

package/dist/configs/chain-indexer.json

@@ -394,7 +394,7 @@
         "max_catchup_signatures": 5000,
         "overlap_slots": 300,
         "page_limit": 1000,
-        "poll_interval_ms": 2000,
+        "poll_interval_ms": 10000,
         "topics": [
             "5q44zFF8gziimbCipqNQ7GYed8pkTRDmUKFUFTwd4DjB"
         ],
@@ -405,7 +405,7 @@
         "max_catchup_signatures": 5000,
         "overlap_slots": 300,
         "page_limit": 1000,
-        "poll_interval_ms": 2000,
+        "poll_interval_ms": 5000,
         "topics": [
             "5q44zFF8gziimbCipqNQ7GYed8pkTRDmUKFUFTwd4DjB"
         ],

package/dist/configs/contracts.json

@@ -242,8 +242,8 @@
         "compact": "0x00000000000000171ede64904551eeDF3C6C9788",
         "permit2": "0x000000000022D473030F116dDEE9F6B43aC78BA3",
         "feeCollector": "0xfeebabe17996b3346cf80f04a1f072102a90cf09",
-        "appFeeCollector": "0xdcc703c0E500B653Ca82273B7BFAd8045D85a470",
-        "appFeePot": "0x134760a4cC835c4031d772B10D639004443D2A1c",
+        "appFeeCollector": "0x86DB034A82072141D286e4e8dfcE653B75b3B5bd",
+        "appFeePot": "0x2Aaac3FEd8b9A1e7114620D395ACF604772eF2B0",
         "tokenTransferProxy": "0x5afce415b4370e5efd8b9be784d21c331beab965"
     }
 }

package/dist/scripts/__tests__/app-fees.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/__tests__/app-fees.test.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const bun_test_1 = require("bun:test");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const secp256k1_1 = require("@noble/curves/secp256k1");
+const viem_1 = require("viem");
+const app_fees_1 = require("../app-fees");
+const root = node_path_1.default.resolve(__dirname, '../../..');
+const profiles = (0, app_fees_1.loadAppFeeProfiles)(root);
+const emptyHashAddress = '0xdcc703c0E500B653Ca82273B7BFAd8045D85a470';
+function ownershipProof(env) {
+    return JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join(root, `docs/app-fee-collector.${env}.json`), 'utf8'));
+}
+(0, bun_test_1.describe)('KMS public-key derivation', () => {
+    // Source: SEC 2 secp256k1 generator point, encoded as DER SPKI.
+    const publicKey = Buffer.from('3056301006072a8648ce3d020106052b8104000a03420004' +
+        '79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798' +
+        '483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8', 'hex');
+    (0, bun_test_1.test)("derives the standard generator's Ethereum address", () => {
+        (0, bun_test_1.expect)((0, app_fees_1.collectorFromKmsPublicKey)({
+            KeySpec: 'ECC_SECG_P256K1',
+            PublicKey: publicKey.toString('base64'),
+        })).toBe('0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf');
+    });
+    (0, bun_test_1.test)('refuses empty and truncated KMS responses instead of hashing empty bytes', () => {
+        for (const value of [
+            undefined,
+            '',
+            publicKey.subarray(0, 30).toString('base64'),
+        ]) {
+            (0, bun_test_1.expect)(() => (0, app_fees_1.collectorFromKmsPublicKey)({
+                KeySpec: 'ECC_SECG_P256K1',
+                PublicKey: value,
+            })).toThrow();
+        }
+    });
+    (0, bun_test_1.test)('refuses a different elliptic curve even when it has 32-byte coordinates', () => {
+        const { publicKey: p256 } = (0, node_crypto_1.generateKeyPairSync)('ec', {
+            namedCurve: 'prime256v1',
+        });
+        (0, bun_test_1.expect)(() => (0, app_fees_1.collectorFromKmsPublicKey)({
+            KeySpec: 'ECC_SECG_P256K1',
+            PublicKey: p256
+                .export({ format: 'der', type: 'spki' })
+                .toString('base64'),
+        })).toThrow('secp256k1');
+    });
+});
+(0, bun_test_1.describe)('app-fee custody profiles', () => {
+    for (const env of ['prod', 'staging']) {
+        (0, bun_test_1.test)(`${env} factory calldata installs its configured KMS owner`, async () => {
+            const profile = profiles[env];
+            const account = await (0, app_fees_1.deriveAppFeeAccount)(profile);
+            const factory = (0, viem_1.decodeFunctionData)({
+                abi: (0, viem_1.parseAbi)(['function createAccount(bytes,bytes32)']),
+                data: account.factoryData,
+            });
+            const [, bootstrapData] = (0, viem_1.decodeAbiParameters)([{ type: 'address' }, { type: 'bytes' }], factory.args[0]);
+            const bootstrap = (0, viem_1.decodeFunctionData)({
+                abi: (0, viem_1.parseAbi)([
+                    'struct BootstrapConfig {address module;bytes initData;}',
+                    'struct BootstrapPreValidationHookConfig {uint256 hookType;address module;bytes data;}',
+                    'function initNexusWithDefaultValidatorAndOtherModulesNoRegistry(bytes defaultValidatorInitData,BootstrapConfig[] validators,BootstrapConfig[] executors,BootstrapConfig hook,BootstrapConfig[] fallbacks,BootstrapPreValidationHookConfig[] preValidationHooks)',
+                ]),
+                data: bootstrapData,
+            });
+            const [threshold, owners] = (0, viem_1.decodeAbiParameters)([{ type: 'uint256' }, { type: 'address[]' }], bootstrap.args[0]);
+            (0, bun_test_1.expect)(threshold).toBe(1n);
+            (0, bun_test_1.expect)(owners).toEqual([profile.collectorAddress]);
+            // Source: deployed IntentExecutor addresses; the dev contract set must
+            // preserve the existing pot's executor rather than use SDK defaults.
+            (0, bun_test_1.expect)(bootstrap.args[2].map((executor) => executor.module.toLowerCase())).toEqual([
+                env === 'prod'
+                    ? '0x00000000005ad9ce1f5035fd62ca96cef16adaaf'
+                    : '0xbf9b5b917a83f8adac17b0752846d41d8d7b7e17',
+            ]);
+        });
+        (0, bun_test_1.test)(`${env} published recipients match the custody profile`, () => {
+            const file = env === 'prod' ? 'contracts.json' : 'contracts.dev.json';
+            const contracts = JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join(root, 'shared-configs/configs', file), 'utf8'));
+            (0, bun_test_1.expect)(() => (0, app_fees_1.validateAppFeeContracts)(contracts, profiles[env])).not.toThrow();
+        });
+        (0, bun_test_1.test)(`${env} collector has a valid KMS ownership signature`, async () => {
+            await (0, app_fees_1.verifyOwnershipProof)(ownershipProof(env), env, profiles[env]);
+        });
+    }
+    (0, bun_test_1.test)('refuses the empty-hash owner and a pot derived with a different owner', async () => {
+        await (0, bun_test_1.expect)((0, app_fees_1.deriveAppFeeAccount)({
+            ...profiles.prod,
+            collectorAddress: emptyHashAddress,
+        })).rejects.toThrow('empty hash');
+        await (0, bun_test_1.expect)((0, app_fees_1.deriveAppFeeAccount)({
+            ...profiles.prod,
+            potAddress: profiles.staging.potAddress,
+        })).rejects.toThrow('does not match SDK derivation');
+    });
+    (0, bun_test_1.test)('refuses a chain override that changes the collector', () => {
+        (0, bun_test_1.expect)(() => (0, app_fees_1.validateAppFeeContracts)({
+            '*': {
+                appFeeCollector: profiles.prod.collectorAddress,
+                appFeePot: profiles.prod.potAddress,
+            },
+            '1': { appFeeCollector: emptyHashAddress },
+        }, profiles.prod)).toThrow('chain 1');
+    });
+    (0, bun_test_1.test)('a modified challenge cannot reuse the recorded ownership signature', async () => {
+        const proof = ownershipProof('prod');
+        proof.message = proof.message.replace('Challenge: ', 'Challenge: altered-');
+        proof.digest = (0, viem_1.hashMessage)(proof.message);
+        await (0, bun_test_1.expect)((0, app_fees_1.verifyOwnershipProof)(proof, 'prod', profiles.prod)).rejects.toThrow('does not verify');
+    });
+    (0, bun_test_1.test)('KMS DER signatures recover correctly with either S normalization', async () => {
+        // Source: production KMS challenge signed 2026-10-20; Foundry independently
+        // verified this public fixture against the collector address.
+        const proof = ownershipProof('prod');
+        const r = BigInt(proof.signature.slice(0, 66));
+        const s = BigInt(`0x${proof.signature.slice(66, 130)}`);
+        for (const candidate of [s, secp256k1_1.secp256k1.CURVE.n - s]) {
+            const der = new secp256k1_1.secp256k1.Signature(r, candidate).toDERRawBytes();
+            (0, bun_test_1.expect)(await (0, app_fees_1.recoverOwnershipSignature)(proof.message, der, profiles.prod.collectorAddress)).toBe(proof.signature);
+        }
+    });
+    (0, bun_test_1.test)('published swap contracts preserve their deployed addresses', () => {
+        // Source: published production/dev Plasma registry before this correction.
+        const expected = {
+            prod: [
+                '0x40CE38e0cbB8ec54a601256E4FacfED5679bccD0',
+                '0x5afce415b4370e5efd8b9be784d21c331beab965',
+                '0xaE448E141F230AC3c6F6dA981C0882356c9B91a6',
+                '0x3115c923734471b9da1d5bfef161d9c9e9963859',
+            ],
+            staging: [
+                '0x8206052a213AA7cafB18ec7898e8D1D421C02100',
+                '0x21416a06e81fe115a5c8bf554b2b01383bd9b9f3',
+                '0x58BC7d9279A38a1537c2f74426dBDbD804AD3A18',
+                '0xc5f6641b3ade357c5df77a1859d16528fe8b3e93',
+            ],
+        };
+        for (const env of ['prod', 'staging']) {
+            const file = env === 'prod' ? 'contracts.json' : 'contracts.dev.json';
+            const registry = JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join(root, 'shared-configs/configs', file), 'utf8'));
+            const contracts = { ...registry['*'], ...registry['9745'] };
+            (0, bun_test_1.expect)([
+                contracts.swapper,
+                contracts.tokenTransferProxy,
+                contracts.swapAdapter,
+                contracts.swapAdapterTokenSpender,
+            ]).toEqual(expected[env]);
+        }
+    });
+});

package/dist/scripts/app-fees.d.ts

@@ -0,0 +1,52 @@
+import { type Address, type Hex } from 'viem';
+export type AppFeeProfile = {
+    kmsKeyId: string;
+    collectorAddress: Address;
+    potAddress: Address;
+    nexusVersion: '1.2.0' | '1.2.1';
+    useDevContracts: boolean;
+};
+export type AppFeeProfiles = Record<'prod' | 'staging', AppFeeProfile>;
+export type OwnershipProof = {
+    environment: string;
+    keyId: string;
+    message: string;
+    digest: Hex;
+    signature: Hex;
+};
+export declare function loadAppFeeProfiles(yeetRoot: string): AppFeeProfiles;
+export declare function collectorFromKmsPublicKey(response: {
+    KeySpec?: string;
+    PublicKey?: string;
+}): Address;
+export declare function ownershipChallenge(env: string, profile: AppFeeProfile): string;
+export declare function recoverOwnershipSignature(message: string, der: Uint8Array, expected: Address): Promise<Hex>;
+export declare function verifyOwnershipProof(proof: OwnershipProof, env: string, profile: AppFeeProfile): Promise<void>;
+export declare function verifyAppFeeOwnershipProofs(yeetRoot: string, profiles: AppFeeProfiles): Promise<void>;
+export declare function deriveAppFeeAccount(profile: AppFeeProfile): Promise<{
+    factory: Address;
+    factoryData: Hex;
+    collectorAddress: `0x${string}`;
+    potAddress: `0x${string}`;
+    nexusVersion: "1.2.0" | "1.2.1";
+    salt: `0x${string}`;
+}>;
+export declare function deriveAppFeeAccounts(profiles: AppFeeProfiles): Promise<{
+    prod: {
+        factory: Address;
+        factoryData: Hex;
+        collectorAddress: `0x${string}`;
+        potAddress: `0x${string}`;
+        nexusVersion: "1.2.0" | "1.2.1";
+        salt: `0x${string}`;
+    };
+    staging: {
+        factory: Address;
+        factoryData: Hex;
+        collectorAddress: `0x${string}`;
+        potAddress: `0x${string}`;
+        nexusVersion: "1.2.0" | "1.2.1";
+        salt: `0x${string}`;
+    };
+}>;
+export declare function validateAppFeeContracts(contracts: Record<string, Record<string, string>>, profile: AppFeeProfile): void;

package/dist/scripts/app-fees.js

@@ -0,0 +1,145 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadAppFeeProfiles = loadAppFeeProfiles;
+exports.collectorFromKmsPublicKey = collectorFromKmsPublicKey;
+exports.ownershipChallenge = ownershipChallenge;
+exports.recoverOwnershipSignature = recoverOwnershipSignature;
+exports.verifyOwnershipProof = verifyOwnershipProof;
+exports.verifyAppFeeOwnershipProofs = verifyAppFeeOwnershipProofs;
+exports.deriveAppFeeAccount = deriveAppFeeAccount;
+exports.deriveAppFeeAccounts = deriveAppFeeAccounts;
+exports.validateAppFeeContracts = validateAppFeeContracts;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const secp256k1_1 = require("@noble/curves/secp256k1");
+const sdk_1 = require("@rhinestone/sdk");
+const viem_1 = require("viem");
+const accounts_1 = require("viem/accounts");
+function loadAppFeeProfiles(yeetRoot) {
+    return JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join(yeetRoot, 'config/app-fees.json'), 'utf8'));
+}
+function collectorAddress(value) {
+    const address = (0, viem_1.getAddress)(value);
+    const emptyHashAddress = (0, viem_1.getAddress)(`0x${(0, viem_1.keccak256)('0x').slice(-40)}`);
+    if (address === viem_1.zeroAddress || address === emptyHashAddress) {
+        throw new Error('App-fee collector must be a valid KMS identity, not zero or the empty hash');
+    }
+    return address;
+}
+function collectorFromKmsPublicKey(response) {
+    if (response.KeySpec !== 'ECC_SECG_P256K1' || !response.PublicKey) {
+        throw new Error('KMS must return an ECC_SECG_P256K1 public key');
+    }
+    const der = Buffer.from(response.PublicKey, 'base64');
+    // DER SPKI: id-ecPublicKey, secp256k1, uncompressed 65-byte point.
+    const header = Buffer.from('3056301006072a8648ce3d020106052b8104000a034200', 'hex');
+    if (der.length !== 88 || !der.subarray(0, header.length).equals(header)) {
+        throw new Error('KMS public key must be a secp256k1 SubjectPublicKeyInfo');
+    }
+    const point = secp256k1_1.secp256k1.ProjectivePoint.fromHex(der.subarray(header.length));
+    return collectorAddress((0, accounts_1.publicKeyToAddress)(`0x${Buffer.from(point.toRawBytes(false)).toString('hex')}`));
+}
+function ownershipChallenge(env, profile) {
+    return [
+        'Rhinestone app-fee collector ownership verification',
+        `Environment: ${env}`,
+        `KMS key: ${profile.kmsKeyId}`,
+        `Collector: ${profile.collectorAddress}`,
+        `Issued at: ${new Date().toISOString()}`,
+        `Challenge: ${(0, node_crypto_1.randomUUID)()}`,
+        'Purpose: prove signing control only. No transaction, intent, transfer, or spending authorization.',
+    ].join('\n');
+}
+async function recoverOwnershipSignature(message, der, expected) {
+    const { r, s } = secp256k1_1.secp256k1.Signature.fromDER(der).normalizeS();
+    for (const v of [27n, 28n]) {
+        const signature = (0, viem_1.serializeSignature)({
+            r: (0, viem_1.toHex)(r, { size: 32 }),
+            s: (0, viem_1.toHex)(s, { size: 32 }),
+            v,
+        });
+        if ((0, viem_1.getAddress)(await (0, viem_1.recoverMessageAddress)({ message, signature })) ===
+            (0, viem_1.getAddress)(expected)) {
+            return signature;
+        }
+    }
+    throw new Error('KMS ownership signature does not recover to the configured collector');
+}
+async function verifyOwnershipProof(proof, env, profile) {
+    const lines = proof.message.split('\n');
+    if (proof.environment !== env ||
+        proof.keyId !== profile.kmsKeyId ||
+        lines[0] !== 'Rhinestone app-fee collector ownership verification' ||
+        !lines.includes(`Environment: ${env}`) ||
+        !lines.includes(`KMS key: ${profile.kmsKeyId}`) ||
+        !lines.includes(`Collector: ${profile.collectorAddress}`) ||
+        (0, viem_1.hashMessage)(proof.message) !== proof.digest ||
+        (0, viem_1.getAddress)(await (0, viem_1.recoverMessageAddress)({
+            message: proof.message,
+            signature: proof.signature,
+        })) !== collectorAddress(profile.collectorAddress)) {
+        throw new Error(`App-fee ownership proof does not verify for ${env}`);
+    }
+}
+async function verifyAppFeeOwnershipProofs(yeetRoot, profiles) {
+    for (const env of ['prod', 'staging']) {
+        const proof = JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join(yeetRoot, `docs/app-fee-collector.${env}.json`), 'utf8'));
+        await verifyOwnershipProof(proof, env, profiles[env]);
+    }
+}
+async function deriveAppFeeAccount(profile) {
+    if (!['1.2.0', '1.2.1'].includes(profile.nexusVersion) ||
+        typeof profile.useDevContracts !== 'boolean') {
+        throw new Error('App-fee account requires an explicit Nexus version and contract set');
+    }
+    const collector = collectorAddress(profile.collectorAddress);
+    const refuseSigning = async () => {
+        throw new Error('Address derivation cannot sign');
+    };
+    const owner = (0, accounts_1.toAccount)({
+        address: collector,
+        signMessage: refuseSigning,
+        signTransaction: refuseSigning,
+        signTypedData: refuseSigning,
+    });
+    const sdk = new sdk_1.RhinestoneSDK({
+        auth: { mode: 'apiKey', apiKey: 'offline-address-derivation' },
+        useDevContracts: profile.useDevContracts,
+    });
+    const account = await sdk.createAccount({
+        account: { type: 'nexus', version: profile.nexusVersion },
+        owners: { type: 'ecdsa', accounts: [owner] },
+    });
+    const pot = account.getAddress();
+    if ((0, viem_1.getAddress)(profile.potAddress) !== pot) {
+        throw new Error(`App-fee pot ${profile.potAddress} does not match SDK derivation ${pot}`);
+    }
+    return {
+        collectorAddress: collector,
+        potAddress: pot,
+        nexusVersion: profile.nexusVersion,
+        salt: (0, viem_1.keccak256)('0x'),
+        ...account.getInitData(),
+    };
+}
+async function deriveAppFeeAccounts(profiles) {
+    return {
+        prod: await deriveAppFeeAccount(profiles.prod),
+        staging: await deriveAppFeeAccount(profiles.staging),
+    };
+}
+function validateAppFeeContracts(contracts, profile) {
+    const expectedCollector = collectorAddress(profile.collectorAddress);
+    const expectedPot = (0, viem_1.getAddress)(profile.potAddress);
+    for (const [chainId, entry] of Object.entries(contracts)) {
+        const merged = { ...contracts['*'], ...entry };
+        if ((0, viem_1.getAddress)(merged.appFeeCollector) !== expectedCollector ||
+            (0, viem_1.getAddress)(merged.appFeePot) !== expectedPot) {
+            throw new Error(`App-fee contract addresses on chain ${chainId} differ from the custody profile`);
+        }
+    }
+}

package/dist/scripts/check-app-fees.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/check-app-fees.js

@@ -0,0 +1,92 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const viem_1 = require("viem");
+const app_fees_1 = require("./app-fees");
+async function main() {
+    const args = process.argv.slice(2);
+    const envIndex = args.indexOf('--env');
+    const env = envIndex === -1 ? undefined : args[envIndex + 1];
+    if (env !== 'prod' && env !== 'staging') {
+        throw new Error('Usage: bun run check:app-fees --env <prod|staging> [--kms] [--sign]');
+    }
+    const yeetRoot = node_path_1.default.resolve(process.cwd(), '..');
+    const profiles = (0, app_fees_1.loadAppFeeProfiles)(yeetRoot);
+    await (0, app_fees_1.verifyAppFeeOwnershipProofs)(yeetRoot, profiles);
+    const accounts = await (0, app_fees_1.deriveAppFeeAccounts)(profiles);
+    const profile = profiles[env];
+    const file = env === 'prod' ? 'contracts.json' : 'contracts.dev.json';
+    (0, app_fees_1.validateAppFeeContracts)(JSON.parse((0, node_fs_1.readFileSync)(node_path_1.default.join('configs', file), 'utf8')), profile);
+    let proof = {};
+    if (args.includes('--kms') || args.includes('--sign')) {
+        const response = JSON.parse((0, node_child_process_1.execFileSync)('aws', [
+            'kms',
+            'get-public-key',
+            '--key-id',
+            profile.kmsKeyId,
+            '--region',
+            'us-east-1',
+            '--output',
+            'json',
+        ], { encoding: 'utf8' }));
+        if (response.KeyId !== profile.kmsKeyId) {
+            throw new Error('KMS returned a different key ID');
+        }
+        const collector = (0, app_fees_1.collectorFromKmsPublicKey)(response);
+        if (collector !== accounts[env].collectorAddress) {
+            throw new Error(`KMS collector ${collector} differs from configured collector ${profile.collectorAddress}`);
+        }
+        if (args.includes('--sign')) {
+            const message = (0, app_fees_1.ownershipChallenge)(env, profile);
+            const digest = (0, viem_1.hashMessage)(message);
+            const signed = JSON.parse((0, node_child_process_1.execFileSync)('aws', [
+                'kms',
+                'sign',
+                '--key-id',
+                profile.kmsKeyId,
+                '--region',
+                'us-east-1',
+                '--message-type',
+                'DIGEST',
+                '--signing-algorithm',
+                'ECDSA_SHA_256',
+                '--message',
+                Buffer.from(digest.slice(2), 'hex').toString('base64'),
+                '--cli-binary-format',
+                'base64',
+                '--output',
+                'json',
+            ], { encoding: 'utf8' }));
+            if (signed.KeyId !== profile.kmsKeyId || !signed.Signature) {
+                throw new Error('KMS did not return a signature from the configured key');
+            }
+            const signature = await (0, app_fees_1.recoverOwnershipSignature)(message, Buffer.from(signed.Signature, 'base64'), collector);
+            proof = {
+                keyId: profile.kmsKeyId,
+                message,
+                digest,
+                signature,
+                recoveredCollector: collector,
+                verified: true,
+            };
+        }
+    }
+    const { collectorAddress, potAddress, nexusVersion, factory } = accounts[env];
+    console.log(JSON.stringify({
+        environment: env,
+        collectorAddress,
+        potAddress,
+        nexusVersion,
+        factory,
+        ...proof,
+    }, null, 2));
+}
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exitCode = 1;
+});

package/dist/scripts/generate.js

@@ -10,6 +10,7 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const validation_1 = require("./validation");
 const hoistUniform_1 = require("./hoistUniform");
+const app_fees_1 = require("./app-fees");
 function renderNetworkEnum(name, entries) {
     const lines = entries.map((entry) => entry.viemChain
         ? `  ${entry.enumKey} = ${entry.viemChain}.id,`
@@ -434,6 +435,9 @@ async function generate() {
     const yeetRoot = node_path_1.default.resolve(sharedConfigsRoot, "..");
     const configsDir = node_path_1.default.join(sharedConfigsRoot, "configs");
     const generatedDir = node_path_1.default.join(sharedConfigsRoot, "src", "generated");
+    const appFeeProfiles = (0, app_fees_1.loadAppFeeProfiles)(yeetRoot);
+    await (0, app_fees_1.verifyAppFeeOwnershipProofs)(yeetRoot, appFeeProfiles);
+    const appFeeAccounts = await (0, app_fees_1.deriveAppFeeAccounts)(appFeeProfiles);
     const output = runJsonnet(yeetRoot);
     await (0, promises_1.mkdir)(configsDir, { recursive: true });
     await (0, promises_1.mkdir)(generatedDir, { recursive: true });
@@ -538,6 +542,9 @@ async function generate() {
     // (or breaks its uniformity) is reflected in what lands in the wildcard.
     const prodContractsMerged = (0, hoistUniform_1.hoistUniformAddresses)(mergeContracts(prodContracts, overrides.prod ?? {}));
     const stagingContractsMerged = (0, hoistUniform_1.hoistUniformAddresses)(mergeContracts(stagingContracts, devOverrides));
+    (0, app_fees_1.validateAppFeeContracts)(prodContractsMerged, appFeeProfiles.prod);
+    (0, app_fees_1.validateAppFeeContracts)(stagingContractsMerged, appFeeProfiles.staging);
+    await (0, promises_1.writeFile)(node_path_1.default.join(configsDir, "app-fee-accounts.json"), `${JSON.stringify(appFeeAccounts, null, 2)}\n`);
     await (0, promises_1.writeFile)(node_path_1.default.join(generatedDir, "contracts.ts"), `${renderContracts(prodContractsMerged)}\n`);
     await (0, promises_1.writeFile)(node_path_1.default.join(configsDir, "contracts.json"), `${JSON.stringify(prodContractsMerged, null, 2)}\n`);
     await (0, promises_1.writeFile)(node_path_1.default.join(generatedDir, "contracts.dev.ts"), `${renderContracts(stagingContractsMerged)}\n`);

package/dist/src/generated/contracts.js

@@ -245,8 +245,8 @@ const contractAddresses = {
         "compact": "0x00000000000000171ede64904551eeDF3C6C9788",
         "permit2": "0x000000000022D473030F116dDEE9F6B43aC78BA3",
         "feeCollector": "0xfeebabe17996b3346cf80f04a1f072102a90cf09",
-        "appFeeCollector": "0xdcc703c0E500B653Ca82273B7BFAd8045D85a470",
-        "appFeePot": "0x134760a4cC835c4031d772B10D639004443D2A1c",
+        "appFeeCollector": "0x86DB034A82072141D286e4e8dfcE653B75b3B5bd",
+        "appFeePot": "0x2Aaac3FEd8b9A1e7114620D395ACF604772eF2B0",
         "tokenTransferProxy": "0x5afce415b4370e5efd8b9be784d21c331beab965"
     }
 };

package/dist/src/generated/packageVersion.d.ts

@@ -1,2 +1,2 @@
-declare const PACKAGE_VERSION = "2.36.2";
+declare const PACKAGE_VERSION = "2.36.4";
 export { PACKAGE_VERSION };

package/dist/src/generated/packageVersion.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PACKAGE_VERSION = void 0;
 // Auto-generated by scripts/generate.ts. Do not edit manually.
-const PACKAGE_VERSION = "2.36.2";
+const PACKAGE_VERSION = "2.36.4";
 exports.PACKAGE_VERSION = PACKAGE_VERSION;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinestone/shared-configs",
-  "version": "2.36.2",
+  "version": "2.36.4",
   "description": "Reusable configuration files for Rhinestone services",
   "author": {
     "name": "Rhinestone",
@@ -29,14 +29,17 @@
     "sync:abis": "bun run scripts/sync-abis.ts",
     "audit:token-authorizations": "bun run scripts/audit-token-authorizations.ts",
     "check:vendor-drift": "bun run scripts/vendor-drift/main.ts",
+    "check:app-fees": "bun run scripts/check-app-fees.ts",
     "compile": "tsc",
-    "test": "bun test",
+    "test": "bun test ./src ./scripts",
     "build": "bun run clean && bun run generate && bun run sync:abis --generate && bun run compile",
     "changeset:release": "bun run build && changeset publish"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.1.4",
     "@changesets/cli": "^2.27.7",
+    "@noble/curves": "1.9.1",
+    "@rhinestone/sdk": "2.0.0",
     "@types/bun": "latest",
     "rimraf": "^6.0.1",
     "typescript": "^5.6.3",