solana-risk-engine 0.4.1 → 0.4.3

package/src/client.js

@@ -1,143 +1,157 @@
-import { PUBLIC_RPC, VIBE_RPC } from "./constants.js";
-import { ScanError, cancelled, isCancel } from "./errors.js";
-import { sleep } from "./util.js";
-
-// Methods PublicNode rejects with 403; if another one shows up it gets added at runtime
-const PN_BLOCKED_DEFAULT = ["getTokenLargestAccounts", "getTokenAccountsByOwner", "getTokenSupply"];
-
-/**
- * Creates the network client every engine function uses.
- *
- * @param {object}   [opts]
- * @param {string}   [opts.rpcUrl]        your own RPC URL (Helius, Triton...). Without it the free
- *                                        PublicNode + Solana Vibe Station combination is used.
- * @param {string}   [opts.heliusApiKey]  Helius key for PnL. If omitted it is taken from rpcUrl when
- *                                        that URL is a Helius one (the key is never sent anywhere else).
- * @param {AbortSignal} [opts.signal]     aborts every pending request with a CANCELLED ScanError
- * @param {Function} [opts.fetch]         fetch implementation (defaults to globalThis.fetch)
- * @param {number}   [opts.retryDelayMs]  first retry delay, doubled each time (default 1200)
- * @param {number}   [opts.vibeIntervalMs] spacing of the free Vibe Station queue (default 1100)
- */
-export function createClient(opts) {
-  opts = opts || {};
-  const fetchImpl = opts.fetch || globalThis.fetch;
-  if (!fetchImpl) throw new Error("no fetch available: pass opts.fetch or use Node 18+");
-  const rpcUrl = (opts.rpcUrl || "").trim() || PUBLIC_RPC;
-  const publicRpc = opts.publicRpc || PUBLIC_RPC;
-  const vibeRpc = opts.vibeRpc || VIBE_RPC;
-  const signal = opts.signal || null;
-  const retryDelay = opts.retryDelayMs === undefined ? 1200 : opts.retryDelayMs;
-  const vibeInterval = opts.vibeIntervalMs === undefined ? 1100 : opts.vibeIntervalMs;
-  const blocked = {};
-  PN_BLOCKED_DEFAULT.forEach(function (m) { blocked[m] = 1; });
-  let vibeNext = 0;
-
-  function checkAbort() {
-    if (signal && signal.aborted) throw cancelled();
-  }
-  function ownRpc() {
-    return rpcUrl !== publicRpc;
-  }
-  function heliusKey() {
-    if (opts.heliusApiKey) return opts.heliusApiKey;
-    // Only use the key if the configured RPC really is Helius: otherwise it is never sent to api.helius.xyz
-    try {
-      const u = new URL(rpcUrl);
-      if (!/(^|\.)helius-rpc\.com$|(^|\.)helius\.xyz$/i.test(u.hostname)) return null;
-      return u.searchParams.get("api-key") || null;
-    } catch (e) { return null; }
-  }
-
-  async function rawFetch(url, init) {
-    checkAbort();
-    try {
-      return await fetchImpl(url, signal ? Object.assign({}, init, { signal: signal }) : init);
-    } catch (e) {
-      if (signal && signal.aborted) throw cancelled();
-      throw e;
-    }
-  }
-
-  // JSON fetch with retries on 429, 5xx and network errors (doubling the wait each time)
-  async function jfetch(url, init, tries) {
-    let wait = retryDelay, last = null;
-    tries = tries || 4;
-    for (let i = 0; i < tries; i++) {
-      checkAbort();
-      try {
-        const r = await rawFetch(url, init);
-        if (r.status === 429 || r.status >= 500) {
-          last = new ScanError("HTTP", "HTTP " + r.status, { status: r.status });
-          await sleep(wait); wait *= 2; continue;
-        }
-        if (!r.ok) throw new ScanError("HTTP", "HTTP " + r.status, { status: r.status });
-        return await r.json();
-      } catch (e) {
-        if (isCancel(e) || (e.code === "HTTP" && e.data.status >= 400 && e.data.status < 500)) throw e;
-        last = e; await sleep(wait); wait *= 2;
-      }
-    }
-    if (last && last.code) throw last;
-    throw new ScanError("NETWORK", (last && last.message) || "no response", { cause: last && last.message });
-  }
-
-  // Fetch that never throws (except on cancel): used for optional extras such as RugCheck,
-  // which must never block the main result if they fail, time out or are down
-  async function softJson(url, timeoutMs) {
-    checkAbort();
-    const ctrl = typeof AbortController !== "undefined" ? new AbortController() : null;
-    let onAbort = null;
-    if (ctrl && signal) { onAbort = function () { ctrl.abort(); }; signal.addEventListener("abort", onAbort); }
-    const to = ctrl ? setTimeout(function () { ctrl.abort(); }, timeoutMs || 8000) : null;
-    try {
-      const r = await fetchImpl(url, ctrl ? { signal: ctrl.signal } : undefined);
-      if (!r.ok) return null;
-      return await r.json();
-    } catch (e) {
-      return null;
-    } finally {
-      if (to) clearTimeout(to);
-      if (onAbort) signal.removeEventListener("abort", onAbort);
-      checkAbort();
-    }
-  }
-
-  async function rpcAt(url, method, params, tries) {
-    const j = await jfetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: method, params: params })
-    }, tries);
-    if (j.error) throw new ScanError("RPC", j.error.message || "RPC error", { rpcCode: j.error.code });
-    return j.result;
-  }
-
-  async function vibeSlot() {
-    const now = Date.now(), at = Math.max(now, vibeNext);
-    vibeNext = at + vibeInterval;
-    if (at > now) await sleep(at - now);
-    checkAbort();
-  }
-
-  async function rpc(method, params) {
-    if (ownRpc()) return rpcAt(rpcUrl, method, params);
-    // PublicNode accepts at most 10 accounts per getMultipleAccounts: split and merge the result
-    if (method === "getMultipleAccounts" && params[0].length > 10) {
-      const parts = [];
-      for (let i = 0; i < params[0].length; i += 10) parts.push(rpc(method, [params[0].slice(i, i + 10)].concat(params.slice(1))));
-      const rs = await Promise.all(parts);
-      return { context: rs[0].context, value: [].concat.apply([], rs.map(function (r) { return r.value; })) };
-    }
-    if (!blocked[method]) {
-      try { return await rpcAt(publicRpc, method, params); }
-      catch (e) {
-        if (isCancel(e) || !(e.code === "HTTP" && (e.data.status === 401 || e.data.status === 403))) throw e;
-        blocked[method] = 1;
-      }
-    }
-    await vibeSlot();
-    return rpcAt(vibeRpc, method, params, 6);   // more retries: its limit sometimes trips even when the queue is respected
-  }
-
-  return { rpc: rpc, jfetch: jfetch, softJson: softJson, ownRpc: ownRpc, heliusKey: heliusKey, checkAbort: checkAbort, rpcUrl: rpcUrl, retryDelayMs: opts.retryDelayMs };
-}
+import { PUBLIC_RPC, VIBE_RPC } from "./constants.js";
+import { ScanError, cancelled, isCancel } from "./errors.js";
+import { sleep } from "./util.js";
+
+// Methods PublicNode rejects with 403; if another one shows up it gets added at runtime
+const PN_BLOCKED_DEFAULT = ["getTokenLargestAccounts", "getTokenAccountsByOwner", "getTokenSupply"];
+
+/**
+ * Creates the network client every engine function uses.
+ *
+ * @param {object}   [opts]
+ * @param {string}   [opts.rpcUrl]        your own RPC URL (Helius, Triton...). Without it the free
+ *                                        PublicNode + Solana Vibe Station combination is used.
+ * @param {string}   [opts.heliusApiKey]  Helius key for PnL. If omitted it is taken from rpcUrl when
+ *                                        that URL is a Helius one (the key is never sent anywhere else).
+ * @param {AbortSignal} [opts.signal]     aborts every pending request with a CANCELLED ScanError
+ * @param {Function} [opts.fetch]         fetch implementation (defaults to globalThis.fetch)
+ * @param {number}   [opts.retryDelayMs]  first retry delay, doubled each time (default 1200)
+ * @param {number}   [opts.vibeIntervalMs] spacing of the free Vibe Station queue (default 1100)
+ */
+export function createClient(opts) {
+  opts = opts || {};
+  const fetchImpl = opts.fetch || globalThis.fetch;
+  if (!fetchImpl) throw new Error("no fetch available: pass opts.fetch or use Node 18+");
+  const rpcUrl = (opts.rpcUrl || "").trim() || PUBLIC_RPC;
+  const publicRpc = opts.publicRpc || PUBLIC_RPC;
+  const vibeRpc = opts.vibeRpc || VIBE_RPC;
+  const signal = opts.signal || null;
+  const retryDelay = opts.retryDelayMs === undefined ? 1200 : opts.retryDelayMs;
+  const vibeInterval = opts.vibeIntervalMs === undefined ? 1100 : opts.vibeIntervalMs;
+  const blocked = {};
+  PN_BLOCKED_DEFAULT.forEach(function (m) { blocked[m] = 1; });
+  let vibeNext = 0;
+
+  function checkAbort() {
+    if (signal && signal.aborted) throw cancelled();
+  }
+  function ownRpc() {
+    return rpcUrl !== publicRpc;
+  }
+  function heliusKey() {
+    if (opts.heliusApiKey) return opts.heliusApiKey;
+    // Only use the key if the configured RPC really is Helius: otherwise it is never sent to api.helius.xyz
+    try {
+      const u = new URL(rpcUrl);
+      if (!/(^|\.)helius-rpc\.com$|(^|\.)helius\.xyz$/i.test(u.hostname)) return null;
+      return u.searchParams.get("api-key") || null;
+    } catch (e) { return null; }
+  }
+
+  async function rawFetch(url, init) {
+    checkAbort();
+    try {
+      return await fetchImpl(url, signal ? Object.assign({}, init, { signal: signal }) : init);
+    } catch (e) {
+      if (signal && signal.aborted) throw cancelled();
+      throw e;
+    }
+  }
+
+  // JSON fetch with retries on 429, 5xx and network errors (doubling the wait each time)
+  async function jfetch(url, init, tries) {
+    let wait = retryDelay, last = null;
+    tries = tries || 4;
+    for (let i = 0; i < tries; i++) {
+      checkAbort();
+      try {
+        const r = await rawFetch(url, init);
+        if (r.status === 429 || r.status >= 500) {
+          last = new ScanError("HTTP", "HTTP " + r.status, { status: r.status });
+          await sleep(wait); wait *= 2; continue;
+        }
+        if (!r.ok) throw new ScanError("HTTP", "HTTP " + r.status, { status: r.status });
+        return await r.json();
+      } catch (e) {
+        if (isCancel(e) || (e.code === "HTTP" && e.data.status >= 400 && e.data.status < 500)) throw e;
+        last = e; await sleep(wait); wait *= 2;
+      }
+    }
+    if (last && last.code) throw last;
+    throw new ScanError("NETWORK", (last && last.message) || "no response", { cause: last && last.message });
+  }
+
+  // Fetch that never throws (except on cancel): used for optional extras such as RugCheck,
+  // which must never block the main result if they fail, time out or are down
+  async function softJson(url, timeoutMs) {
+    checkAbort();
+    const ctrl = typeof AbortController !== "undefined" ? new AbortController() : null;
+    let onAbort = null;
+    if (ctrl && signal) { onAbort = function () { ctrl.abort(); }; signal.addEventListener("abort", onAbort); }
+    const to = ctrl ? setTimeout(function () { ctrl.abort(); }, timeoutMs || 8000) : null;
+    try {
+      const r = await fetchImpl(url, ctrl ? { signal: ctrl.signal } : undefined);
+      if (!r.ok) return null;
+      return await r.json();
+    } catch (e) {
+      return null;
+    } finally {
+      if (to) clearTimeout(to);
+      if (onAbort) signal.removeEventListener("abort", onAbort);
+      checkAbort();
+    }
+  }
+
+  async function rpcAt(url, method, params, tries) {
+    const j = await jfetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: method, params: params })
+    }, tries);
+    if (j.error) throw new ScanError("RPC", j.error.message || "RPC error", { rpcCode: j.error.code });
+    return j.result;
+  }
+
+  async function vibeSlot() {
+    const now = Date.now(), at = Math.max(now, vibeNext);
+    vibeNext = at + vibeInterval;
+    if (at > now) await sleep(at - now);
+    checkAbort();
+  }
+
+  async function rpc(method, params) {
+    if (ownRpc()) return rpcAt(rpcUrl, method, params);
+    // PublicNode accepts at most 10 accounts per getMultipleAccounts: split and merge the result
+    if (method === "getMultipleAccounts" && params[0].length > 10) {
+      const parts = [];
+      for (let i = 0; i < params[0].length; i += 10) parts.push(rpc(method, [params[0].slice(i, i + 10)].concat(params.slice(1))));
+      const rs = await Promise.all(parts);
+      return { context: rs[0].context, value: [].concat.apply([], rs.map(function (r) { return r.value; })) };
+    }
+    if (!blocked[method]) {
+      try {
+        const res = await rpcAt(publicRpc, method, params);
+        // PublicNode only keeps a few days of history: a list that ends before filling the page, or a
+        // transaction it cannot find, may just be old. Vibe Station keeps it all, so it gets the last word
+        if (method === "getSignaturesForAddress" && Array.isArray(res) && res.length < ((params[1] && params[1].limit) || 1000)) {
+          await vibeSlot();
+          const full = await rpcAt(vibeRpc, method, params, 6).catch(function (e) { if (isCancel(e)) throw e; return null; });
+          return Array.isArray(full) && full.length > res.length ? full : res;
+        }
+        if (method === "getTransaction" && res === null) {
+          await vibeSlot();
+          return await rpcAt(vibeRpc, method, params, 6).catch(function (e) { if (isCancel(e)) throw e; return null; });
+        }
+        return res;
+      }
+      catch (e) {
+        if (isCancel(e) || !(e.code === "HTTP" && (e.data.status === 401 || e.data.status === 403))) throw e;
+        blocked[method] = 1;
+      }
+    }
+    await vibeSlot();
+    return rpcAt(vibeRpc, method, params, 6);   // more retries: its limit sometimes trips even when the queue is respected
+  }
+
+  return { rpc: rpc, jfetch: jfetch, softJson: softJson, ownRpc: ownRpc, heliusKey: heliusKey, checkAbort: checkAbort, rpcUrl: rpcUrl, retryDelayMs: opts.retryDelayMs };
+}

package/src/constants.js

@@ -1,62 +1,78 @@
-// api.mainnet-beta.solana.com answers 403 to anything coming from a browser. PublicNode serves almost
-// everything (accounts, signatures, transactions) quickly, but blocks token-by-owner and largest-holder
-// queries. Those go to Solana Vibe Station, which accepts them without a key but only at ~1 per second,
-// so they go through a queue (see client.js). With your own RPC URL everything goes to that URL.
-export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
-export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
-export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
-export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
-export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
-export const HELIUS_API = "https://api.helius.xyz/v0/addresses/";
-export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/market_chart?vs_currency=usd&days=365";
-
-export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-export const TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
-export const SYSTEM_PROGRAM = "11111111111111111111111111111111";
-export const PUMP_PROGRAM = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P";
-// dexId of a token still on Pump.fun's bonding curve: DexScreener says "pumpfun", GeckoTerminal "pump-fun"
-export const PUMP_CURVE_DEXES = ["pumpfun", "pump-fun"];
-
-export const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
-export const USDT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
-export const WSOL = "So11111111111111111111111111111111111111112";
-
-export const KNOWN = {
-  [WSOL]: "SOL (wrapped)",
-  [USDC]: "USDC",
-  [USDT]: "USDT"
-};
-
-// Symbols that scams usually copy, with their official address (checked on DexScreener)
-export const FAMOUS = {
-  USDC, USDT, SOL: WSOL, WSOL,
-  JUP: "JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN", BONK: "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
-  WIF: "EKpQGSJtjMFqKZ9KQanSqYXRcF8fBopzLHYxdM65zcjm", PYTH: "HZ1JovNiVvGrGNiiYvEozEVgZ58xaU3RKwX8eACQBCt3",
-  JTO: "jtojtomepa8beP8AuQc6eXt5FriJwfFMwQx2v2f9mCL", RAY: "4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R",
-  PYUSD: "2b1kV6DkPAnxd5ixfnxCpjxmKwqjjaYmCZfHsFu24GXo", MSOL: "mSoLzYCxHdYgdzU16g5QSh3i5K3z3KZK7ytfqcJm7So",
-  JITOSOL: "J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn", TRUMP: "6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN",
-  PUMP: "pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn", JLP: "27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4",
-  POPCAT: "7GCihgDB8fe6KNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr", HNT: "hntyVP6YFm1Hg25TN9WGLqM12b8TQmcknKrdu1oxWux",
-  RENDER: "rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof", ORCA: "orcaEKTdK7LKz57vaAYr9QeNsVEPfiu6QeMU1kektZE",
-  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7",
-  // Bitcoin and Ether only exist on Solana bridged: a Pump.fun token called "BTC" is never the real one
-  BTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh", WBTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh",
-  ETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs", WETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs"
-};
-
-// Token-2022 extensions that add risk, with the points they add to the no-market spam score
-export const EXT_POINTS = {
-  permanentDelegate: 25,
-  transferHook: 15,
-  transferFeeConfig: 10,
-  nonTransferable: 10,
-  defaultAccountState: 10
-};
-
-// Risk levels, from worst to best (also the default sort order of results)
-export const LEVELS = ["HIGH", "MEDIUM", "LOW", "SPAM", "NO_DATA", "NO_MARKET"];
-export const TYPES = ["STABLE", "TOKENIZED", "BRIDGED", "CREATOR", "OPEN"];
-export const LIGHTS = ["control", "concentration", "market", "dependency"];
-export const RANKS = { ok: 0, na: 0, warn: 1, bad: 2 };
-
-export const ADDRESS_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+// api.mainnet-beta.solana.com answers 403 to anything coming from a browser. PublicNode serves almost
+// everything (accounts, signatures, transactions) quickly, but blocks token-by-owner and largest-holder
+// queries. Those go to Solana Vibe Station, which accepts them without a key but only at ~1 per second,
+// so they go through a queue (see client.js). With your own RPC URL everything goes to that URL.
+export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
+export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
+export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
+export const DEX_SEARCH = "https://api.dexscreener.com/latest/dex/search?q=";
+export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
+export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
+export const HELIUS_API = "https://api.helius.xyz/v0/addresses/";
+export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/market_chart?vs_currency=usd&days=365";
+
+export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+export const TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
+export const SYSTEM_PROGRAM = "11111111111111111111111111111111";
+export const PUMP_PROGRAM = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P";
+// dexId of a token still on Pump.fun's bonding curve: DexScreener says "pumpfun", GeckoTerminal "pump-fun"
+export const PUMP_CURVE_DEXES = ["pumpfun", "pump-fun"];
+
+export const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+export const USDT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
+export const WSOL = "So11111111111111111111111111111111111111112";
+
+export const KNOWN = {
+  [WSOL]: "SOL (wrapped)",
+  [USDC]: "USDC",
+  [USDT]: "USDT"
+};
+
+// Symbols that scams usually copy, with their official address (checked on DexScreener)
+export const FAMOUS = {
+  USDC, USDT, SOL: WSOL, WSOL,
+  JUP: "JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN", BONK: "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
+  WIF: "EKpQGSJtjMFqKZ9KQanSqYXRcF8fBopzLHYxdM65zcjm", PYTH: "HZ1JovNiVvGrGNiiYvEozEVgZ58xaU3RKwX8eACQBCt3",
+  JTO: "jtojtomepa8beP8AuQc6eXt5FriJwfFMwQx2v2f9mCL", RAY: "4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R",
+  PYUSD: "2b1kV6DkPAnxd5ixfnxCpjxmKwqjjaYmCZfHsFu24GXo", MSOL: "mSoLzYCxHdYgdzU16g5QSh3i5K3z3KZK7ytfqcJm7So",
+  JITOSOL: "J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn", TRUMP: "6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN",
+  PUMP: "pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn", JLP: "27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4",
+  POPCAT: "7GCihgDB8fe6KNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr", HNT: "hntyVP6YFm1Hg25TN9WGLqM12b8TQmcknKrdu1oxWux",
+  RENDER: "rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof", ORCA: "orcaEKTdK7LKz57vaAYr9QeNsVEPfiu6QeMU1kektZE",
+  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7",
+  // Bitcoin and Ether only exist on Solana bridged: a Pump.fun token called "BTC" is never the real one
+  BTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh", WBTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh",
+  ETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs", WETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs"
+};
+
+// Real companies with no token of their own on Solana: a memecoin called "Spotify" is not Spotify. Their
+// genuine tokenized shares come from an issuer (xStocks, Backpack...) and are typed TOKENIZED, so they
+// are never matched. Names only, lower case: stock tickers clash with real crypto symbols (META, COIN...)
+export const BRANDS = {
+  spotify: "Spotify", shopify: "Shopify", tesla: "Tesla", apple: "Apple", nvidia: "Nvidia", amazon: "Amazon",
+  google: "Google", alphabet: "Alphabet", microsoft: "Microsoft", facebook: "Facebook", instagram: "Instagram",
+  whatsapp: "WhatsApp", netflix: "Netflix", coinbase: "Coinbase", robinhood: "Robinhood", gamestop: "GameStop",
+  microstrategy: "MicroStrategy", paypal: "PayPal", visa: "Visa", mastercard: "Mastercard", nike: "Nike",
+  disney: "Disney", starbucks: "Starbucks", mcdonalds: "McDonald's", walmart: "Walmart", uber: "Uber",
+  airbnb: "Airbnb", tiktok: "TikTok", youtube: "YouTube", openai: "OpenAI", chatgpt: "ChatGPT", blackrock: "BlackRock",
+  jpmorgan: "JPMorgan", samsung: "Samsung", sony: "Sony", nintendo: "Nintendo", playstation: "PlayStation",
+  ferrari: "Ferrari", lamborghini: "Lamborghini", "red bull": "Red Bull", "coca cola": "Coca-Cola", pepsi: "Pepsi",
+  adidas: "Adidas", gucci: "Gucci", louis_vuitton: "Louis Vuitton", rolex: "Rolex", spacex: "SpaceX", neuralink: "Neuralink"
+};
+
+// Token-2022 extensions that add risk, with the points they add to the no-market spam score
+export const EXT_POINTS = {
+  permanentDelegate: 25,
+  transferHook: 15,
+  transferFeeConfig: 10,
+  nonTransferable: 10,
+  defaultAccountState: 10
+};
+
+// Risk levels, from worst to best (also the default sort order of results)
+export const LEVELS = ["HIGH", "MEDIUM", "LOW", "SPAM", "NO_DATA", "NO_MARKET"];
+export const TYPES = ["STABLE", "TOKENIZED", "BRIDGED", "CREATOR", "OPEN"];
+export const LIGHTS = ["control", "concentration", "market", "dependency"];
+export const RANKS = { ok: 0, na: 0, warn: 1, bad: 2 };
+
+export const ADDRESS_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;