@swarm-tips/client 0.2.12 → 0.2.13

package/SBOM.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@swarm-tips/client-0.2.12",
-  "documentNamespace": "https://swarm.tips/sbom/client/0.2.12",
+  "name": "@swarm-tips/client-0.2.13",
+  "documentNamespace": "https://swarm.tips/sbom/client/0.2.13",
   "creationInfo": {
-    "created": "2026-10-16T05:41:05.183Z",
+    "created": "2026-11-06T04:27:18.192Z",
     "creators": [
       "Tool: sdk/client/scripts/generate-sbom.mjs",
       "Organization: Swarm Tips"
@@ -15,8 +15,8 @@
     {
       "name": "@swarm-tips/client",
       "SPDXID": "SPDXRef-Package",
-      "versionInfo": "0.2.12",
-      "downloadLocation": "https://www.npmjs.com/package/@swarm-tips/client/v/0.2.12",
+      "versionInfo": "0.2.13",
+      "downloadLocation": "https://www.npmjs.com/package/@swarm-tips/client/v/0.2.13",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
       "licenseDeclared": "MIT"

package/dist/contracts/generated/shillbot.d.ts

@@ -2114,9 +2114,10 @@ export type Shillbot = {
                 {
                     "name": "switchboardFeed";
                     "docs": [
-                        "The Switchboard pull feed account containing the oracle-attested composite score.",
-                        "`PullFeedAccountData::parse()` which checks the account discriminator.",
-                        "Account ownership is verified by Switchboard's `Owner` implementation."
+                        "The oracle authority signer (`GlobalState.oracle_authority` or",
+                        "`GlobalState.authority`) or legacy Switchboard pull feed account.",
+                        "/ `global_state.authority`, or validated against `global_state.switchboard_feed`",
+                        "and parsed via `PullFeedAccountData::parse()`."
                     ];
                 }
             ];
@@ -2888,6 +2889,11 @@ export type Shillbot = {
             "code": 6056;
             "name": "invalidAccountOwner";
             "msg": "Account is not owned by this program";
+        },
+        {
+            "code": 6057;
+            "name": "invalidTimeoutOrdering";
+            "msg": "verification_timeout must exceed attestation_delay + staleness_window";
         }
     ];
     "types": [

package/dist/contracts/idl/shillbot.json

@@ -2108,9 +2108,10 @@
                 {
                     "name": "switchboard_feed",
                     "docs": [
-                        "The Switchboard pull feed account containing the oracle-attested composite score.",
-                        "`PullFeedAccountData::parse()` which checks the account discriminator.",
-                        "Account ownership is verified by Switchboard's `Owner` implementation."
+                        "The oracle authority signer (`GlobalState.oracle_authority` or",
+                        "`GlobalState.authority`) or legacy Switchboard pull feed account.",
+                        "/ `global_state.authority`, or validated against `global_state.switchboard_feed`",
+                        "and parsed via `PullFeedAccountData::parse()`."
                     ]
                 }
             ],
@@ -2882,6 +2883,11 @@
             "code": 6056,
             "name": "InvalidAccountOwner",
             "msg": "Account is not owned by this program"
+        },
+        {
+            "code": 6057,
+            "name": "InvalidTimeoutOrdering",
+            "msg": "verification_timeout must exceed attestation_delay + staleness_window"
         }
     ],
     "types": [

package/dist/vow/decoders/shillbot.d.ts

@@ -56,5 +56,6 @@ export declare const resolveShillbotState: StateResolver;
  *  account, so post-finalize the attestation is permanently unverifiable. */
 export declare const shillbotValidStates: (accountKind: string) => readonly string[];
 export declare const SHILLBOT_VOW_PROGRAM_ID = "2tR37nqMpwdV4DVUHjzUmL1rH2DtkA8zrRA4EAhT7KMi";
+export declare const SHILLBOT_SCORE_MAX = 1000000n;
 /** Convenience bundle for callers that just want the canonical Shillbot triple. */
 export declare const shillbotProtocol: ProtocolHandler;

package/dist/vow/decoders/shillbot.js

@@ -114,12 +114,14 @@ export const shillbotValidStates = (accountKind) => {
     return ["verified"];
 };
 export const SHILLBOT_VOW_PROGRAM_ID = "2tR37nqMpwdV4DVUHjzUmL1rH2DtkA8zrRA4EAhT7KMi";
+export const SHILLBOT_SCORE_MAX = 1000000n;
 /** Convenience bundle for callers that just want the canonical Shillbot triple. */
 export const shillbotProtocol = {
     decode: decodeShillbotTask,
     resolveState: resolveShillbotState,
     validStates: shillbotValidStates,
     programId: SHILLBOT_VOW_PROGRAM_ID,
+    scoreMax: SHILLBOT_SCORE_MAX,
 };
 function bytesToHex(b) {
     let s = "";

package/dist/vow/types.d.ts

@@ -106,4 +106,5 @@ export interface ProtocolHandler {
     resolveState: StateResolver;
     validStates: ValidStates;
     programId?: string;
+    scoreMax?: bigint | number | string;
 }

package/dist/vow/verify.d.ts

@@ -1,5 +1,6 @@
 import { Connection } from "@solana/web3.js";
 import type { AasV1Attestation, FailureReason, ProtocolHandler, Verdict } from "./types.js";
+export declare const DEFAULT_SCORE_MAX = 1000000n;
 /**
  * Step-by-step verifier per `docs/specs/vow-v1.md` §4.
  *
@@ -10,7 +11,7 @@ import type { AasV1Attestation, FailureReason, ProtocolHandler, Verdict } from "
  *
  * Splitting lets unit tests cover the pure parts without an RPC.
  */
-export declare function verifyV1(attestation: unknown, protocol: ProtocolHandler, rpc: Connection): Promise<Verdict>;
+export declare function verifyV1(attestation: unknown, protocol: ProtocolHandler, rpc: Connection, expectedScoreMax?: bigint | number | string): Promise<Verdict>;
 /**
  * Pure step 1 + step 6 of the protocol. Returns null on success or
  * the first failure reason.
@@ -20,4 +21,4 @@ export declare function verifyV1Schema(attestation: unknown): FailureReason | nu
  * Steps 2-5 + 7 — touches RPC. Returns null on success or the first
  * failure reason.
  */
-export declare function verifyV1OnChain(a: AasV1Attestation, protocol: ProtocolHandler, rpc: Connection): Promise<FailureReason | null>;
+export declare function verifyV1OnChain(a: AasV1Attestation, protocol: ProtocolHandler, rpc: Connection, expectedScoreMax?: bigint | number | string): Promise<FailureReason | null>;

package/dist/vow/verify.js

@@ -1,6 +1,7 @@
 import { PublicKey } from "@solana/web3.js";
 import { anchorDiscriminator, bytesEqual } from "./discriminator.js";
 import { asV1, checkSchema } from "./schema.js";
+export const DEFAULT_SCORE_MAX = 1000000n;
 /**
  * Step-by-step verifier per `docs/specs/vow-v1.md` §4.
  *
@@ -11,7 +12,7 @@ import { asV1, checkSchema } from "./schema.js";
  *
  * Splitting lets unit tests cover the pure parts without an RPC.
  */
-export async function verifyV1(attestation, protocol, rpc) {
+export async function verifyV1(attestation, protocol, rpc, expectedScoreMax) {
     const checkedAt = nowRfc3339();
     const rpcEndpoint = rpc.rpcEndpoint;
     const schemaFail = verifyV1Schema(attestation);
@@ -25,7 +26,7 @@ export async function verifyV1(attestation, protocol, rpc) {
         };
     }
     const a = asV1(attestation);
-    const onChainFail = await verifyV1OnChain(a, protocol, rpc);
+    const onChainFail = await verifyV1OnChain(a, protocol, rpc, expectedScoreMax);
     if (onChainFail) {
         return {
             valid: false,
@@ -61,7 +62,11 @@ export function verifyV1Schema(attestation) {
  * Steps 2-5 + 7 — touches RPC. Returns null on success or the first
  * failure reason.
  */
-export async function verifyV1OnChain(a, protocol, rpc) {
+export async function verifyV1OnChain(a, protocol, rpc, expectedScoreMax) {
+    const expectedMax = BigInt(expectedScoreMax ?? protocol.scoreMax ?? DEFAULT_SCORE_MAX);
+    if (BigInt(a.score_max) !== expectedMax) {
+        return "field_mismatch:score_max";
+    }
     // Step 2 — fetch the on-chain account.
     const accountInfo = await rpc.getAccountInfo(new PublicKey(a.account));
     if (accountInfo === null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarm-tips/client",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Typed browser and Node.js clients for Swarm Tips, Shillbot, and Coordination Game",
   "type": "module",
   "main": "dist/index.js",