@toon-protocol/client 0.19.0 → 0.20.1

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export { UI_RENDERER_KIND, UI_TAG, UiCoordinate, buildUiCoordinate, getUiCoordin
 import { NostrEvent, EventTemplate } from 'nostr-tools/pure';
 import { MinaSignerClientLike, SettlementBundle } from '@toon-protocol/sdk';
 import { AccumulatedClaim } from '@toon-protocol/sdk/swap';
-import { PrivateKeyAccount, Hex } from 'viem';
+import { PrivateKeyAccount, Hex, Address } from 'viem';
 import { PrivateKeyAccount as PrivateKeyAccount$1 } from 'viem/accounts';
 export { A2uiDecision, ConsentDecision, ConsentRequest, DispatchGuardInfo, DispatchInput, GenerateContext, GeneratedRenderer, GenerativeDecision, GenerativeFallbackOptions, GenerativeFallbackRenderer, GenerativeFallbackResult, GuardedDispatchInput, IntentClassification, KindRegistry, MIME_A2UI, MIME_MCP_APP, McpUiDecision, NativeDecision, PublishBackOptions, RenderBranch, RenderDecision, RenderTrust, RendererGenerator, RendererPin, RendererPinStore, RendererPublisher, RendererSigner, ResolvedCoordinate, SwapApproval, SwapDecision, SwapRejection, SwapRejectionReason, UiResource, VerifyRendererInput, WidgetIntent, buildConsentRequest, buildRendererEventTemplate, classifyIntent, deterministicGenerator, extractUiResource, guardedRenderDispatch, isTrustDowngrade, publishBackCoordinate, renderDeterministicHtml, renderDispatch, resolveRendererMime, resolveUiCoordinate, resolveUiRenderer, verifyRendererTrust } from './render/index.js';
 
@@ -1262,6 +1262,21 @@ interface BuildSwapSettlementsParams {
     tokenNetworks?: Record<string, string>;
     /** Pre-loaded `mina-signer` client for `mina:*` re-verification. */
     minaSignerClient?: MinaSignerClientLike;
+    /**
+     * Re-verify the stored claim's signature at settle time (defense in depth
+     * over the store file). Default `true` — the published **v2** sdk
+     * (`@toon-protocol/sdk@^3`, connector#324 finding #1) verifies EVM claims
+     * against the **v2** EIP-712 domain-separated balance-proof digest, the SAME
+     * digest the receive-side used (`ingestReceivedClaims`). Reconstructing that
+     * EIP-712 domain needs `chainId` + `verifyingContract`, which this builder
+     * threads into the sdk signer config from `tokenNetworks` (for EVM claims) —
+     * so a claim verified at receipt re-verifies correctly here.
+     *
+     * Set `false` only to skip the settle-time re-verify entirely (e.g. when the
+     * receive-side verify is treated as the sole authoritative gate); the sdk is
+     * then used only to BUILD the settlement calldata.
+     */
+    verifySignatures?: boolean;
 }
 /** Rebuild the sdk `AccumulatedClaim` shape from a persisted entry. */
 declare function entryToAccumulatedClaim(entry: ReceivedClaimEntry): AccumulatedClaim;
@@ -3017,10 +3032,15 @@ declare function readMinaChannelState(graphqlUrl: string, zkAppAddress: string,
  *      `swapSignerAddress` (kind:10032 discovery / operator config), the
  *      claim's self-reported signer must match (`SWAP_SIGNER_MISMATCH`,
  *      sdk 2.x vocabulary).
- *   5. signature — `verifyAccumulatedClaim` (sdk) against the expected signer:
- *      the advertised address when given, else the claim's self-reported one
- *      (which then still proves the claim is internally consistent and pins
- *      the address the settlement tx will verify against on-chain).
+ *   5. signature — against the expected signer (advertised address when given,
+ *      else the claim's self-reported one). EVM claims verify against the
+ *      **v2 EIP-712 domain-separated** balance-proof digest
+ *      (`verifyEvmClaimSignature`, connector#324 finding #1) — the digest binds
+ *      `chainId` + `verifyingContract`, so `tokenNetworks[chain]` (the
+ *      RollingSwapChannel address) and a numeric chain id are REQUIRED (an EVM
+ *      claim without them is rejected `MISSING_CHAIN_CONFIG`, fail-closed).
+ *      Solana/Mina keep the sdk `verifyAccumulatedClaim` path (their domain is
+ *      folded into the message).
  *   6. signer pinning — a claim may not silently rotate the signer of an
  *      already-persisted watermark for the same channel.
  *   7. nonce/cumulative monotonicity vs the locally persisted watermark —
@@ -3030,7 +3050,7 @@ declare function readMinaChannelState(graphqlUrl: string, zkAppAddress: string,
  */
 
 /** Why a claim was rejected at receipt time. Codes are stable API. */
-type ReceivedClaimRejectionCode = 'CHAIN_MISMATCH' | 'RECIPIENT_MISMATCH' | 'SWAP_SIGNER_MISMATCH' | 'SIGNER_MISMATCH' | 'SIGNATURE_INVALID' | 'MINA_VERIFICATION_UNSUPPORTED' | 'UNSUPPORTED_CHAIN' | 'NON_MONOTONIC_NONCE' | 'NON_MONOTONIC_CUMULATIVE' | 'CUMULATIVE_SHORTFALL' | 'MALFORMED_METADATA';
+type ReceivedClaimRejectionCode = 'CHAIN_MISMATCH' | 'RECIPIENT_MISMATCH' | 'SWAP_SIGNER_MISMATCH' | 'SIGNER_MISMATCH' | 'SIGNATURE_INVALID' | 'MINA_VERIFICATION_UNSUPPORTED' | 'UNSUPPORTED_CHAIN' | 'NON_MONOTONIC_NONCE' | 'NON_MONOTONIC_CUMULATIVE' | 'CUMULATIVE_SHORTFALL' | 'MISSING_CHAIN_CONFIG' | 'MALFORMED_METADATA';
 interface ReceivedClaimRejection {
     claim: AccumulatedClaim;
     code: ReceivedClaimRejectionCode;
@@ -3056,6 +3076,21 @@ interface IngestReceivedClaimsParams {
      * never the claim's own.
      */
     expectedSignerAddress?: string;
+    /**
+     * Per-chain settlement contract addresses (the deployed `RollingSwapChannel`
+     * / `verifyingContract`), keyed by the FULL chain key (e.g. `evm:base:8453`).
+     * Matches the daemon config's `tokenNetworks` map and what
+     * `buildSwapSettlements` already threads on the submit side.
+     *
+     * REQUIRED for EVM claims under the v2 EIP-712 digest (connector#324 finding
+     * #1): the claim signature is domain-separated over `(chainId,
+     * verifyingContract)`, so an EVM claim whose chain key lacks a `tokenNetworks`
+     * entry (or a numeric chain id) is rejected `MISSING_CHAIN_CONFIG` — it cannot
+     * be verified fail-closed without the domain. Supplied by the connector/swap
+     * session context (the RollingSwapChannel the client settles against). Unused
+     * for Solana/Mina claims, which fold their domain into the message itself.
+     */
+    tokenNetworks?: Record<string, string>;
     /** Durable watermark store; verified claims are persisted here. */
     store: ReceivedClaimStore;
     /** Pre-loaded `mina-signer` client — required to verify `mina:*` claims. */
@@ -3089,6 +3124,134 @@ declare function hasSettlementMetadata(claim: AccumulatedClaim): claim is Accumu
  */
 declare function ingestReceivedClaims(params: IngestReceivedClaimsParams): IngestReceivedClaimsResult;
 
+/**
+ * EVM rolling-swap **v2** balance-proof claim digest (EIP-712 domain-separated).
+ *
+ * Refs connector#324 **finding #1** / connector#325 (canonical spec:
+ * `docs/rolling-swap-v2-digest-spec.md`). This is the client's byte-for-byte
+ * conformance anchor for the v2 migration.
+ *
+ * ## Why this exists in the client
+ *
+ * The v1 digest that shipped in `@toon-protocol/core` `balanceProofHashEvm`
+ * (imported transitively by the sdk's `verifyAccumulatedClaim` /
+ * `buildSettlementTx`, which is what this repo used to lean on) was
+ *
+ *     keccak256( channelId(32) || cumulativeAmount(32BE)
+ *                 || nonce(32BE) || recipient(20) )
+ *
+ * — it bound **neither** `chainId` **nor** the settling contract address, so a
+ * signer-signed claim redeemed on one (chain, deployment) could be replayed
+ * verbatim on another for the same tuple (cross-chain / cross-deployment
+ * replay). v2 folds `chainId` **and** `verifyingContract` into the signed
+ * preimage via a standard **EIP-712** typed-data domain, so a signature is
+ * valid on **exactly one `(chainId, contract)` pair**, and the `version="2"`
+ * string makes the cutover fail-closed (a v1 raw-keccak sig can never validate
+ * as v2 and vice-versa).
+ *
+ * ## Lockstep dependency
+ *
+ * The canonical v2 digest util lives in `@toon-protocol/core`
+ * (`balanceProofHashEvm` → EIP-712) + `@toon-protocol/sdk`
+ * (`verifyAccumulatedClaim` / `buildSettlementTx`). Those packages migrate in
+ * lockstep (connector#324 release order: core/sdk → swap → client). Until a v2
+ * core/sdk is published, this module is the client's own v2 digest so the
+ * receive-side verify (see {@link file://./received-claims.ts}) is already
+ * domain-separated and the golden-vector conformance test
+ * (`evm-claim-digest.test.ts`) pins the exact literals from the spec. When the
+ * v2 core/sdk ships, the recompute here should delegate to it (or be asserted
+ * byte-identical to it) — the golden-vector test stays as the shared fixture.
+ *
+ * The signer leg (`swap` `EvmPaymentChannelSigner.signBalanceProof`) MUST also
+ * move to this same EIP-712 preimage and now REQUIRES `chainId` +
+ * `verifyingContract` inputs it did not take before.
+ */
+
+/** EIP-712 domain `name` for the RollingSwapChannel (spec §2.1). */
+declare const ROLLING_SWAP_DOMAIN_NAME: "RollingSwapChannel";
+/** EIP-712 domain `version` — `"2"` is the domain-separated migration. */
+declare const ROLLING_SWAP_DOMAIN_VERSION: "2";
+/**
+ * `keccak256("ClaimBalanceProof(bytes32 channelId,uint256 cumulativeAmount,uint256 nonce,address recipient)")`.
+ * Pinned from the spec; asserted in `evm-claim-digest.test.ts`.
+ */
+declare const CLAIM_TYPEHASH: "0xa0c8262c1a8615f7674d3af796b14d19672d3634f89c6093502ab35c0afe2d91";
+/**
+ * `keccak256("CooperativeClose(bytes32 channelId,uint256 cumulativeAmount,uint256 nonce)")`.
+ * Pinned from the spec; asserted in `evm-claim-digest.test.ts`.
+ */
+declare const COOP_CLOSE_TYPEHASH: "0xa5753389755fea51cd5016d7b02b508ac03f2e822d9a7ee345ec45b36574ff9f";
+/** The two chain-context inputs v2 adds over v1 (the domain binding). */
+interface EvmClaimDomainContext {
+    /** Settlement chain id (`block.chainid` on-chain). e.g. `8453` for Base. */
+    chainId: number;
+    /** Deployed `RollingSwapChannel` address (`address(this)` / EIP-712 `verifyingContract`). */
+    verifyingContract: string;
+}
+/** Fields of the `ClaimBalanceProof` message (the balance-proof claim leg). */
+interface EvmClaimMessage {
+    /** Channel id, 0x-prefixed 32-byte hex. */
+    channelId: string;
+    /** Cumulative transferred amount (target micro-units). */
+    cumulativeAmount: bigint;
+    /** Monotonic balance-proof nonce. */
+    nonce: bigint;
+    /** Recipient (the claim payout address), 0x-prefixed 20-byte hex. */
+    recipient: string;
+}
+/** Fields of the `CooperativeClose` message (recipient close-ack leg). */
+interface EvmCooperativeCloseMessage {
+    channelId: string;
+    cumulativeAmount: bigint;
+    nonce: bigint;
+}
+/**
+ * The v2 EIP-712 claim digest — `keccak256(0x1901 || domainSeparator ||
+ * hashStruct(ClaimBalanceProof))` — that the on-chain `updateBalance` verifier
+ * (and the swap signer) produce. This is what a received claim's signature must
+ * recover against.
+ */
+declare function evmClaimDigest(ctx: EvmClaimDomainContext, message: EvmClaimMessage): Hex;
+/**
+ * The v2 EIP-712 cooperative-close digest — same domain as the claim, distinct
+ * type hash — that a recipient's close-ack signature must recover against.
+ */
+declare function evmCooperativeCloseDigest(ctx: EvmClaimDomainContext, message: EvmCooperativeCloseMessage): Hex;
+/** A 65-byte `r || s || v` signature, as 0x-hex or raw bytes. */
+type ClaimSignature = Hex | Uint8Array;
+/**
+ * Recover the EVM address that signed a v2 claim digest. Uses the same
+ * `@noble/curves` secp256k1 recovery + keccak address derivation as the sdk's
+ * on-chain-matching `recoverEvmSignerAddress`, over the **v2** EIP-712 digest.
+ * Enforces the same 65-byte `r||s||v`, `v ∈ {27,28}` envelope the on-chain OZ
+ * `ECDSA.recover` accepts (fail-closed on a malformed signature).
+ *
+ * @returns the recovered address (lowercase 0x-hex).
+ * @throws if the signature is not 65 bytes or `v` is not 27/28.
+ */
+declare function recoverEvmClaimSigner(ctx: EvmClaimDomainContext, message: EvmClaimMessage, signature: ClaimSignature): Address;
+/** Result of {@link verifyEvmClaimSignature}. Mirrors the sdk verify shape. */
+type EvmClaimVerifyResult = {
+    valid: true;
+    recovered: Address;
+} | {
+    valid: false;
+    reason: string;
+};
+/**
+ * Verify a received EVM balance-proof claim: recover the v2-digest signer and
+ * check it equals `expectedSigner` (case-insensitive, per EVM address rules).
+ *
+ * Result-shaped — never throws; a malformed signature or a mismatch is a
+ * `{ valid: false, reason }` so the receive ladder can bucket it fail-closed.
+ */
+declare function verifyEvmClaimSignature(params: {
+    ctx: EvmClaimDomainContext;
+    message: EvmClaimMessage;
+    signature: ClaimSignature;
+    expectedSigner: string;
+}): EvmClaimVerifyResult;
+
 /**
  * Per-packet preimage retention (toon-client#360, rolling-swap epic
  * toon-meta#145 — spec `docs/rolling-swap.md` §3 R1 / §3.2 leg-B reveal).
@@ -4175,4 +4338,4 @@ declare function loadKeystore(path: string, password: string): string;
  */
 declare function writeKeystoreFile(path: string, keystore: EncryptedKeystore): void;
 
-export { type BackupPayload, type BalanceProofParams, BtpRuntimeClient, type BtpRuntimeClientConfig, type BuildSwapSettlementsParams, CONDITION_LENGTH, type ChainMetadata, type ChainSigner, ChannelFundingError, ChannelManager, type ClaimMessage, type ClaimResolver, ConnectorError, type DiscoveredIlpPeer, type EVMClaimMessage, type EncryptedKeystore, EvmSigner, type ExecutionConditionPair, FULFILLMENT_MISMATCH_CODE, FULFILLMENT_MISMATCH_MESSAGE, type FaucetChain, type FundWalletOptions, type FundWalletResult, type H402FetchOptions, Http402Client, type Http402ClientConfig, HttpConnectorAdmin, type HttpConnectorAdminConfig, HttpIlpClient, type HttpIlpClientConfig, type HttpIlpClientFactory, HttpRuntimeClient, type HttpRuntimeClientConfig, ILP_CLAIM_HEADER, ILP_CLAIM_WRAPPED_HEADER, ILP_PEER_ID_HEADER, type IlpSendParams, type IlpSendResultWithFulfillment, type IlpTransportChoice, InMemoryPreimageRetentionStore, InMemoryReceivedClaimStore, type IngestAndRevealParams, type IngestAndRevealResult, type IngestReceivedClaimsParams, type IngestReceivedClaimsResult, JsonFileReceivedClaimStore, KeyManager, type KeyManagerConfig, MINA_CHANNEL_STATE, type MinaChannelStateReader, type MinaClaimMessage, type MinaClaimSubmitArgs, type MinaClaimSubmitter, type MinaCoSignInputs, type MinaCoSignedClaim, type MinaDepositReader, type MinaOnChainChannelState, type MinaSettlementContext, MinaSettlementError, type MinaSettlementErrorCode, type MinaSettlementResult, type MinaSignaturePair, MinaSigner, type MinaSignerOptions, NetworkError, OnChainChannelClient, type OnChainChannelClientConfig, type ParsedFulfillHttp, type ParsedX402Challenge, type PasskeyInfo, type PreimageRetentionStore, type PublishEventResult, type ReceivedClaimEntry, type ReceivedClaimRejection, type ReceivedClaimRejectionCode, type ReceivedClaimStore, type RequestBlobStorageParams, type RequestBlobStorageResult, type RetainedPreimage, type RetryOptions, type RevealDecision, type RevealFn, type RevealResult, type RevealedClaim, type RolledBackClaim, type SelectIlpTransportOptions, type SignedBalanceProof, type SolanaChannelClientOptions, type SolanaClaimMessage, SolanaSigner, type SubmitEvmSettlementParams, type SubmitEvmSettlementResult, type SwapSettlementBuild, type ToonChannelAccept, ToonClient, type ToonClientConfig, ToonClientError, type ToonIdentity, type ToonSigners, type ToonStartResult, ValidationError, type VaultData, type VerifiedReceivedClaim, type WalletBalance, type WalletBalanceSources, type WalletChainBalances, type WalletTokenAmount, applyDefaults, applyNetworkPresets, assertValidCondition, buildBackupEvent, buildBackupFilter, buildMinaCoSignedClaim, buildSettlementInfo, buildStoreWriteEnvelope, buildSwapSettlements, createO1jsMinaClaimSubmitter, decodeEvmSettlementTx, decryptMnemonic, defaultFaucetTimeout, deriveFromNsec, deriveFullIdentity, deriveNostrKeyFromMnemonic, encryptMnemonic, entryToAccumulatedClaim, extractArweaveTxId, fulfillmentMatchesCondition, fundWallet, generateKeystore, generateMnemonic, generateRandomIdentity, getNetworkStatus, hasSettlementMetadata, httpEndpointToBtpUrl, importKeystore, ingestAndReveal, ingestReceivedClaims, isInsufficientGasError, isPrfSupported, isZeroCondition, loadKeystore, mintExecutionCondition, parseBackupPayload, parseEvmChainId, parseFulfillHttp, parseFulfillHttpBytes, parseHttpResponse, parseX402Body, parseX402Challenge, proxyIlpEndpoint, readDiscoveredIlpPeer, readEvmNativeBalance, readEvmTokenBalance, readMinaBalance, readMinaChannelState, readMinaDepositTotal, readSolanaNativeBalance, readSolanaTokenBalance, readWalletBalances, requestBlobStorage, selectIlpTransport, serializeHttpRequest, submitEvmSettlement, submitMinaSettlement, validateConfig, validateMnemonic, withRetry, writeKeystoreFile };
+export { type BackupPayload, type BalanceProofParams, BtpRuntimeClient, type BtpRuntimeClientConfig, type BuildSwapSettlementsParams, CLAIM_TYPEHASH, CONDITION_LENGTH, COOP_CLOSE_TYPEHASH, type ChainMetadata, type ChainSigner, ChannelFundingError, ChannelManager, type ClaimMessage, type ClaimResolver, type ClaimSignature, ConnectorError, type DiscoveredIlpPeer, type EVMClaimMessage, type EncryptedKeystore, type EvmClaimDomainContext, type EvmClaimMessage, type EvmClaimVerifyResult, type EvmCooperativeCloseMessage, EvmSigner, type ExecutionConditionPair, FULFILLMENT_MISMATCH_CODE, FULFILLMENT_MISMATCH_MESSAGE, type FaucetChain, type FundWalletOptions, type FundWalletResult, type H402FetchOptions, Http402Client, type Http402ClientConfig, HttpConnectorAdmin, type HttpConnectorAdminConfig, HttpIlpClient, type HttpIlpClientConfig, type HttpIlpClientFactory, HttpRuntimeClient, type HttpRuntimeClientConfig, ILP_CLAIM_HEADER, ILP_CLAIM_WRAPPED_HEADER, ILP_PEER_ID_HEADER, type IlpSendParams, type IlpSendResultWithFulfillment, type IlpTransportChoice, InMemoryPreimageRetentionStore, InMemoryReceivedClaimStore, type IngestAndRevealParams, type IngestAndRevealResult, type IngestReceivedClaimsParams, type IngestReceivedClaimsResult, JsonFileReceivedClaimStore, KeyManager, type KeyManagerConfig, MINA_CHANNEL_STATE, type MinaChannelStateReader, type MinaClaimMessage, type MinaClaimSubmitArgs, type MinaClaimSubmitter, type MinaCoSignInputs, type MinaCoSignedClaim, type MinaDepositReader, type MinaOnChainChannelState, type MinaSettlementContext, MinaSettlementError, type MinaSettlementErrorCode, type MinaSettlementResult, type MinaSignaturePair, MinaSigner, type MinaSignerOptions, NetworkError, OnChainChannelClient, type OnChainChannelClientConfig, type ParsedFulfillHttp, type ParsedX402Challenge, type PasskeyInfo, type PreimageRetentionStore, type PublishEventResult, ROLLING_SWAP_DOMAIN_NAME, ROLLING_SWAP_DOMAIN_VERSION, type ReceivedClaimEntry, type ReceivedClaimRejection, type ReceivedClaimRejectionCode, type ReceivedClaimStore, type RequestBlobStorageParams, type RequestBlobStorageResult, type RetainedPreimage, type RetryOptions, type RevealDecision, type RevealFn, type RevealResult, type RevealedClaim, type RolledBackClaim, type SelectIlpTransportOptions, type SignedBalanceProof, type SolanaChannelClientOptions, type SolanaClaimMessage, SolanaSigner, type SubmitEvmSettlementParams, type SubmitEvmSettlementResult, type SwapSettlementBuild, type ToonChannelAccept, ToonClient, type ToonClientConfig, ToonClientError, type ToonIdentity, type ToonSigners, type ToonStartResult, ValidationError, type VaultData, type VerifiedReceivedClaim, type WalletBalance, type WalletBalanceSources, type WalletChainBalances, type WalletTokenAmount, applyDefaults, applyNetworkPresets, assertValidCondition, buildBackupEvent, buildBackupFilter, buildMinaCoSignedClaim, buildSettlementInfo, buildStoreWriteEnvelope, buildSwapSettlements, createO1jsMinaClaimSubmitter, decodeEvmSettlementTx, decryptMnemonic, defaultFaucetTimeout, deriveFromNsec, deriveFullIdentity, deriveNostrKeyFromMnemonic, encryptMnemonic, entryToAccumulatedClaim, evmClaimDigest, evmCooperativeCloseDigest, extractArweaveTxId, fulfillmentMatchesCondition, fundWallet, generateKeystore, generateMnemonic, generateRandomIdentity, getNetworkStatus, hasSettlementMetadata, httpEndpointToBtpUrl, importKeystore, ingestAndReveal, ingestReceivedClaims, isInsufficientGasError, isPrfSupported, isZeroCondition, loadKeystore, mintExecutionCondition, parseBackupPayload, parseEvmChainId, parseFulfillHttp, parseFulfillHttpBytes, parseHttpResponse, parseX402Body, parseX402Challenge, proxyIlpEndpoint, readDiscoveredIlpPeer, readEvmNativeBalance, readEvmTokenBalance, readMinaBalance, readMinaChannelState, readMinaDepositTotal, readSolanaNativeBalance, readSolanaTokenBalance, readWalletBalances, recoverEvmClaimSigner, requestBlobStorage, selectIlpTransport, serializeHttpRequest, submitEvmSettlement, submitMinaSettlement, validateConfig, validateMnemonic, verifyEvmClaimSignature, withRetry, writeKeystoreFile };

package/dist/index.js

@@ -1871,6 +1871,17 @@ function deriveChannelPDA(participantA, participantB, tokenMint, programId) {
   const { pda, bump } = findProgramAddress(seeds, program);
   return { pda: base58Encode(pda), bump };
 }
+function deriveAssociatedTokenAccount(owner, tokenMint) {
+  const TOKEN_PROGRAM_ID2 = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+  const ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+  const seeds = [
+    padTo32(base58Decode(owner)),
+    padTo32(base58Decode(TOKEN_PROGRAM_ID2)),
+    padTo32(base58Decode(tokenMint))
+  ];
+  const { pda } = findProgramAddress(seeds, padTo32(base58Decode(ASSOCIATED_TOKEN_PROGRAM_ID)));
+  return base58Encode(pda);
+}
 function deriveVaultPDA(channelPDA, programId) {
   const channel = padTo32(base58Decode(channelPDA));
   const program = padTo32(base58Decode(programId));
@@ -2586,14 +2597,17 @@ var OnChainChannelClient = class {
       throw new Error("Solana channel config not set \u2014 cannot deposit.");
     }
     const cfg = this.solanaConfig;
-    const payerTokenAccount = cfg.deposit?.payerTokenAccount;
-    if (!payerTokenAccount) {
-      throw new Error(
-        "Solana deposit requires solanaConfig.deposit.payerTokenAccount (the funded SPL token account)."
-      );
-    }
     const payerSeed = cfg.keypair.slice(0, 32);
     const payerPubkey = base58Encode2(new Uint8Array(ed255192.getPublicKey(payerSeed)));
+    let payerTokenAccount = cfg.deposit?.payerTokenAccount;
+    if (!payerTokenAccount) {
+      if (!cfg.tokenMint) {
+        throw new Error(
+          "Solana deposit requires solanaConfig.deposit.payerTokenAccount or solanaConfig.tokenMint to derive the payer ATA."
+        );
+      }
+      payerTokenAccount = deriveAssociatedTokenAccount(payerPubkey, cfg.tokenMint);
+    }
     const { depositTxSignature } = await depositSolanaChannel({
       rpcUrl: cfg.rpcUrl,
       programId: cfg.programId,
@@ -2799,7 +2813,9 @@ var OnChainChannelClient = class {
     );
     const deposit = cfg.deposit ? {
       amount: BigInt(cfg.deposit.amount),
-      payerTokenAccount: cfg.deposit.payerTokenAccount
+      // Derive the payer ATA (owner + channel mint) when not supplied — it is
+      // deterministic, so the caller need not thread payerTokenAccount through.
+      payerTokenAccount: cfg.deposit.payerTokenAccount || deriveAssociatedTokenAccount(payerPubkey, tokenMint)
     } : void 0;
     const { channelPDA } = await openSolanaChannel({
       rpcUrl: cfg.rpcUrl,
@@ -4677,6 +4693,7 @@ function buildSwapSettlements(params) {
         claims: [entryToAccumulatedClaim(entry)],
         signers: { [entry.chain]: signer },
         recipients: { [entry.chain]: entry.recipient },
+        ...params.verifySignatures !== void 0 ? { verifySignatures: params.verifySignatures } : {},
         ...params.minaSignerClient ? { minaSignerClient: params.minaSignerClient } : {}
       });
       const firstRejected = result.rejected[0];
@@ -4724,7 +4741,9 @@ function decodeEvmSettlementTx(bundle) {
   const chainIdHex = fields[6];
   const chainId = Number.parseInt(chainIdHex === "0x" ? "0x0" : chainIdHex, 16);
   if (typeof to !== "string" || to.length !== 42) {
-    throw new Error(`settlement tx "to" is not a 20-byte address: ${String(to)}`);
+    throw new Error(
+      `settlement tx "to" is not a 20-byte address: ${String(to)}`
+    );
   }
   return { to, data: data === "0x" ? "0x" : data, chainId };
 }
@@ -4741,7 +4760,10 @@ async function submitEvmSettlement(bundle, params) {
     nativeCurrency: { name: "ETH", symbol: "ETH", decimals: 18 },
     rpcUrls: { default: { http: [params.rpcUrl] } }
   });
-  const publicClient = createPublicClient3({ chain, transport: http3(params.rpcUrl) });
+  const publicClient = createPublicClient3({
+    chain,
+    transport: http3(params.rpcUrl)
+  });
   const [nonce, gasPrice, gas] = await Promise.all([
     publicClient.getTransactionCount({
       address: params.account.address,
@@ -6463,6 +6485,116 @@ function fromJson(entry) {
 import {
   verifyAccumulatedClaim
 } from "@toon-protocol/sdk";
+
+// src/swap/evm-claim-digest.ts
+import {
+  hashTypedData
+} from "viem";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
+import { hexToBytes, bytesToHex as bytesToHex2 } from "@noble/hashes/utils.js";
+var ROLLING_SWAP_DOMAIN_NAME = "RollingSwapChannel";
+var ROLLING_SWAP_DOMAIN_VERSION = "2";
+var CLAIM_TYPEHASH = "0xa0c8262c1a8615f7674d3af796b14d19672d3634f89c6093502ab35c0afe2d91";
+var COOP_CLOSE_TYPEHASH = "0xa5753389755fea51cd5016d7b02b508ac03f2e822d9a7ee345ec45b36574ff9f";
+var CLAIM_TYPES = {
+  ClaimBalanceProof: [
+    { name: "channelId", type: "bytes32" },
+    { name: "cumulativeAmount", type: "uint256" },
+    { name: "nonce", type: "uint256" },
+    { name: "recipient", type: "address" }
+  ]
+};
+var COOP_CLOSE_TYPES = {
+  CooperativeClose: [
+    { name: "channelId", type: "bytes32" },
+    { name: "cumulativeAmount", type: "uint256" },
+    { name: "nonce", type: "uint256" }
+  ]
+};
+function normalizeAddress(addr) {
+  return addr.toLowerCase();
+}
+function domainOf(ctx) {
+  return {
+    name: ROLLING_SWAP_DOMAIN_NAME,
+    version: ROLLING_SWAP_DOMAIN_VERSION,
+    chainId: ctx.chainId,
+    verifyingContract: normalizeAddress(ctx.verifyingContract)
+  };
+}
+function evmClaimDigest(ctx, message) {
+  return hashTypedData({
+    domain: domainOf(ctx),
+    types: CLAIM_TYPES,
+    primaryType: "ClaimBalanceProof",
+    message: {
+      channelId: message.channelId,
+      cumulativeAmount: message.cumulativeAmount,
+      nonce: message.nonce,
+      recipient: normalizeAddress(message.recipient)
+    }
+  });
+}
+function evmCooperativeCloseDigest(ctx, message) {
+  return hashTypedData({
+    domain: domainOf(ctx),
+    types: COOP_CLOSE_TYPES,
+    primaryType: "CooperativeClose",
+    message: {
+      channelId: message.channelId,
+      cumulativeAmount: message.cumulativeAmount,
+      nonce: message.nonce
+    }
+  });
+}
+var SIG_BYTES = 65;
+function signatureToBytes(sig) {
+  if (typeof sig !== "string") return sig;
+  const hex = sig.startsWith("0x") ? sig.slice(2) : sig;
+  return hexToBytes(hex);
+}
+function recoverEvmClaimSigner(ctx, message, signature) {
+  const bytes = signatureToBytes(signature);
+  if (bytes.length !== SIG_BYTES) {
+    throw new Error(
+      `EVM signature must be 65 bytes (r||s||v), got ${bytes.length}`
+    );
+  }
+  const v = bytes[64];
+  if (v !== 27 && v !== 28) {
+    throw new Error(`EVM signature v must be 27 or 28, got ${v}`);
+  }
+  const digest = evmClaimDigest(ctx, message).slice(2);
+  const recovered = secp256k1.Signature.fromBytes(bytes.slice(0, 64), "compact").addRecoveryBit(v - 27).recoverPublicKey(hexToBytes(digest));
+  const uncompressed = recovered.toBytes(false);
+  const addrHash = keccak_256(uncompressed.slice(1));
+  return `0x${bytesToHex2(addrHash.slice(-20))}`;
+}
+function verifyEvmClaimSignature(params) {
+  let recovered;
+  try {
+    recovered = recoverEvmClaimSigner(
+      params.ctx,
+      params.message,
+      params.signature
+    );
+  } catch (err) {
+    return {
+      valid: false,
+      reason: `SIGNATURE_INVALID: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (recovered.toLowerCase() !== params.expectedSigner.toLowerCase()) {
+    return {
+      valid: false,
+      reason: `SIGNER_MISMATCH: recovered ${recovered}, expected ${params.expectedSigner}`
+    };
+  }
+  return { valid: true, recovered };
+}
+
+// src/swap/received-claims.ts
 function hasSettlementMetadata(claim) {
   return claim.channelId !== void 0 && claim.nonce !== void 0 && claim.cumulativeAmount !== void 0 && claim.recipient !== void 0 && claim.swapSignerAddress !== void 0;
 }
@@ -6517,11 +6649,49 @@ function ingestReceivedClaims(params) {
       continue;
     }
     const expectedSigner = params.expectedSignerAddress ?? claim.swapSignerAddress;
-    const sig = verifyAccumulatedClaim(
-      claim,
-      { address: expectedSigner },
-      params.minaSignerClient
-    );
+    let sig;
+    if (chain.startsWith("evm")) {
+      const chainId = parseEvmChainId2(chain);
+      const verifyingContract = params.tokenNetworks?.[chain];
+      if (chainId === void 0 || !verifyingContract) {
+        reject(
+          claim,
+          "MISSING_CHAIN_CONFIG",
+          `EVM v2 balance-proof verification for ${chain} needs a numeric chain id in the chain key AND tokenNetworks["${chain}"] (the RollingSwapChannel / verifyingContract) to reconstruct the EIP-712 domain; supply it from the connector/swap session context.`
+        );
+        continue;
+      }
+      let msgNonce;
+      let msgCumulative;
+      try {
+        msgNonce = BigInt(claim.nonce);
+        msgCumulative = BigInt(claim.cumulativeAmount);
+      } catch {
+        reject(
+          claim,
+          "MALFORMED_METADATA",
+          `nonce "${claim.nonce}" / cumulativeAmount "${claim.cumulativeAmount}" are not decimal integers`
+        );
+        continue;
+      }
+      sig = verifyEvmClaimSignature({
+        ctx: { chainId, verifyingContract },
+        message: {
+          channelId: claim.channelId,
+          cumulativeAmount: msgCumulative,
+          nonce: msgNonce,
+          recipient: claim.recipient
+        },
+        signature: claim.claimBytes,
+        expectedSigner
+      });
+    } else {
+      sig = verifyAccumulatedClaim(
+        claim,
+        { address: expectedSigner },
+        params.minaSignerClient
+      );
+    }
     if (!sig.valid) {
       reject(claim, signatureRejectionCode(sig.reason), sig.reason);
       continue;
@@ -6889,14 +7059,14 @@ function fromBase642(b64) {
   }
   return bytes;
 }
-function hexToBytes(hex) {
+function hexToBytes2(hex) {
   const bytes = new Uint8Array(hex.length / 2);
   for (let i = 0; i < hex.length; i += 2) {
     bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
   }
   return bytes;
 }
-function bytesToHex2(bytes) {
+function bytesToHex3(bytes) {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 
@@ -7228,7 +7398,7 @@ var KeyManager = class {
     const mnemonic = generateMnemonic();
     const identity = await deriveFullIdentity(mnemonic);
     const prfSalt = crypto.getRandomValues(new Uint8Array(32));
-    const userIdBytes = hexToBytes(identity.nostr.pubkey);
+    const userIdBytes = hexToBytes2(identity.nostr.pubkey);
     const registration = await registerPasskey({
       rpId: this.config.rpId,
       rpName: this.config.rpName,
@@ -7270,7 +7440,7 @@ var KeyManager = class {
         "Passkey did not return a userHandle. Cannot determine Nostr pubkey for recovery."
       );
     }
-    const pubkey = bytesToHex2(discovery.userHandle);
+    const pubkey = bytesToHex3(discovery.userHandle);
     const vault = await fetchBackupFromRelays(pubkey, this.config.relayUrls);
     if (!vault) {
       throw new Error(
@@ -7308,7 +7478,7 @@ var KeyManager = class {
     }
     const identity = await deriveFullIdentity(mnemonic);
     const prfSalt = crypto.getRandomValues(new Uint8Array(32));
-    const userIdBytes = hexToBytes(identity.nostr.pubkey);
+    const userIdBytes = hexToBytes2(identity.nostr.pubkey);
     const registration = await registerPasskey({
       rpId: this.config.rpId,
       rpName: this.config.rpName,
@@ -7339,7 +7509,7 @@ var KeyManager = class {
     const identity = deriveFromNsec(secretKey);
     if (isPrfSupported()) {
       const prfSalt = crypto.getRandomValues(new Uint8Array(32));
-      const userIdBytes = hexToBytes(identity.nostr.pubkey);
+      const userIdBytes = hexToBytes2(identity.nostr.pubkey);
       try {
         const registration = await registerPasskey({
           rpId: this.config.rpId,
@@ -7350,7 +7520,7 @@ var KeyManager = class {
         });
         const kek = await deriveKek(registration.prfOutput);
         const credIdHash = await hashCredentialId(registration.credentialId);
-        const hexKey = bytesToHex2(secretKey);
+        const hexKey = bytesToHex3(secretKey);
         this.vault = await createVault(hexKey, kek, credIdHash, prfSalt);
         this.activeCredentialIdHash = credIdHash;
         await this.saveToLocalStorage();
@@ -7369,7 +7539,7 @@ var KeyManager = class {
       throw new Error("No active identity \u2014 call create() or recover() first");
     }
     const prfSalt = crypto.getRandomValues(new Uint8Array(32));
-    const userIdBytes = hexToBytes(this.identity.nostr.pubkey);
+    const userIdBytes = hexToBytes2(this.identity.nostr.pubkey);
     const registration = await registerPasskey({
       rpId: this.config.rpId,
       rpName: this.config.rpName,
@@ -7799,7 +7969,9 @@ function writeKeystoreFile(path, keystore) {
 }
 export {
   BtpRuntimeClient,
+  CLAIM_TYPEHASH,
   CONDITION_LENGTH,
+  COOP_CLOSE_TYPEHASH,
   ChannelFundingError,
   ChannelManager,
   ConnectorError,
@@ -7826,6 +7998,8 @@ export {
   MinaSigner,
   NetworkError,
   OnChainChannelClient,
+  ROLLING_SWAP_DOMAIN_NAME,
+  ROLLING_SWAP_DOMAIN_VERSION,
   RendererPinStore,
   SolanaSigner,
   ToonClient,
@@ -7856,6 +8030,8 @@ export {
   deterministicGenerator,
   encryptMnemonic2 as encryptMnemonic,
   entryToAccumulatedClaim,
+  evmClaimDigest,
+  evmCooperativeCloseDigest,
   extractArweaveTxId,
   extractUiResource,
   fulfillmentMatchesCondition,
@@ -7896,6 +8072,7 @@ export {
   readSolanaNativeBalance,
   readSolanaTokenBalance,
   readWalletBalances,
+  recoverEvmClaimSigner,
   renderDeterministicHtml,
   renderDispatch,
   requestBlobStorage,
@@ -7909,6 +8086,7 @@ export {
   submitMinaSettlement,
   validateConfig,
   validateMnemonic,
+  verifyEvmClaimSignature,
   verifyRendererTrust,
   withRetry,
   writeKeystoreFile