tapimo 0.15.0 → 0.18.0

package/src/internal/Tron.ts

@@ -0,0 +1,289 @@
+import { Base58, Hash, Hex } from 'ox'
+import { createClient as core_createClient, custom, fallback } from 'viem'
+import type { Client as core_Client, FallbackTransport } from 'viem'
+import * as z from 'zod/mini'
+
+/** Converts a checksummed Tron address into its 20-byte ABI address. */
+export function toEvmAddress(address: string): Hex.Hex {
+  if (!/^T[1-9A-HJ-NP-Za-km-z]{33}$/.test(address)) throw new InvalidAddressError()
+  const value = Base58.toHex(address)
+  const payload = Hex.slice(value, 0, 21)
+  if (
+    Hex.size(value) !== 25 ||
+    Hex.slice(payload, 0, 1) !== '0x41' ||
+    Hex.slice(value, 21) !== Hex.slice(Hash.sha256(Hash.sha256(payload)), 0, 4)
+  )
+    throw new InvalidAddressError()
+  return Hex.slice(payload, 1)
+}
+
+/** Encodes a 20-byte ABI address as a checksummed Tron address. */
+export function fromEvmAddress(address: Hex.Hex): string {
+  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) throw new InvalidAddressError()
+  const payload = Hex.concat('0x41', address)
+  return Base58.fromHex(Hex.concat(payload, Hex.slice(Hash.sha256(Hash.sha256(payload)), 0, 4)))
+}
+
+/** Validated native Tron response contracts used by funding providers. */
+export namespace schema {
+  const bytes = z
+    .string()
+    .check(z.regex(/^(?:[0-9a-fA-F]{2})*$/), z.describe('Unprefixed hexadecimal bytes.'))
+  const hash = z
+    .string()
+    .check(z.regex(/^[0-9a-fA-F]{64}$/), z.describe('Unprefixed transaction hash.'))
+  const address = z
+    .string()
+    .check(z.regex(/^41[0-9a-fA-F]{40}$/), z.describe('Network-prefixed Tron address.'))
+  const integer = z
+    .number()
+    .check(
+      z.int(),
+      z.nonnegative(),
+      z.maximum(Number.MAX_SAFE_INTEGER),
+      z.describe('Nonnegative safe integer.'),
+    )
+
+  /** Constant-call response; TVM execution failures remain distinguishable from successful RPC delivery. */
+  export const Call = z
+    .object({
+      constant_result: z.optional(z.array(bytes)),
+      result: z.object({ message: z.optional(z.string()), result: z.boolean() }),
+      transaction: z.optional(
+        z.object({ ret: z.optional(z.array(z.object({ ret: z.optional(z.string()) }))) }),
+      ),
+    })
+    .check(z.describe('Constant contract simulation response.'))
+
+  /** Solidified block metadata. */
+  export const Block = z
+    .object({
+      blockID: hash,
+      block_header: z.object({ raw_data: z.object({ number: integer, timestamp: integer }) }),
+    })
+    .check(z.describe('Solidified Tron block.'))
+
+  /** Solidified transaction receipt with native hexadecimal event fields. */
+  export const Receipt = z
+    .object({
+      blockNumber: integer,
+      blockTimeStamp: integer,
+      id: hash,
+      log: z.optional(
+        z.array(
+          z.object({
+            address: z.string().check(z.regex(/^[0-9a-fA-F]{40}$/)),
+            data: bytes,
+            topics: z.array(hash),
+          }),
+        ),
+      ),
+      receipt: z.object({ result: z.optional(z.string()) }),
+      result: z.optional(z.string()),
+    })
+    .check(z.describe('Solidified Tron execution receipt.'))
+
+  /** Solidified smart-contract transaction and source call evidence. */
+  export const Transaction = z
+    .object({
+      raw_data: z.object({
+        contract: z
+          .array(
+            z.object({
+              parameter: z.object({
+                value: z.object({
+                  call_value: z.optional(integer),
+                  contract_address: address,
+                  data: bytes,
+                  owner_address: address,
+                }),
+              }),
+              type: z.literal('TriggerSmartContract'),
+            }),
+          )
+          .check(z.minLength(1)),
+      }),
+      ret: z.array(z.object({ contractRet: z.string() })).check(z.minLength(1)),
+      txID: hash,
+    })
+    .check(z.describe('Solidified Tron smart-contract transaction.'))
+}
+
+/** Creates a read-only Tron client with bounded endpoint fallback and cancellation. */
+export function createClient(options: createClient.Options): createClient.ReturnType {
+  if (!options.urls.length) throw new RequestError('At least one Tron endpoint is required.')
+  const client = core_createClient({
+    transport: fallback(
+      options.urls.map((url) =>
+        custom(
+          {
+            async request(parameters: { method: string; params?: readonly unknown[] }) {
+              options.signal?.throwIfAborted()
+              if (!/^wallet(?:solidity)?\/[a-z]+$/.test(parameters.method))
+                throw new RequestError('Unsupported Tron method.')
+              const response = await (options.fetch ?? globalThis.fetch)(
+                `${url.replace(/\/$/, '')}/${parameters.method}`,
+                {
+                  body: JSON.stringify(parameters.params?.[0] ?? {}),
+                  headers: { 'content-type': 'application/json' },
+                  method: 'POST',
+                  signal: AbortSignal.any([
+                    AbortSignal.timeout(10_000),
+                    ...(options.signal ? [options.signal] : []),
+                  ]),
+                },
+              )
+              if (!response.ok)
+                throw new RequestError(`Tron endpoint returned HTTP ${response.status}.`)
+              const value: unknown = await response.json()
+              if (!value || typeof value !== 'object' || Array.isArray(value))
+                throw new RequestError('Invalid Tron response.')
+              if ('Error' in value || 'ErrorCode' in value || 'error' in value)
+                throw new RequestError('Tron endpoint rejected the request.')
+              return value
+            },
+          },
+          { retryCount: 0 },
+        ),
+      ),
+      { retryCount: 0 },
+    ),
+  })
+  const actions = {
+    async call(options: call.Options): Promise<Hex.Hex> {
+      toEvmAddress(options.to)
+      if (options.from) toEvmAddress(options.from)
+      if (!/^0x(?:[0-9a-fA-F]{2})+$/.test(options.data))
+        throw new RequestError('Invalid contract calldata.')
+      const value = options.value ?? 0n
+      if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER))
+        throw new RequestError('TRX call value exceeds the supported range.')
+      const result = schema.Call.parse(
+        await client.request({
+          method: 'wallet/triggerconstantcontract',
+          params: [
+            {
+              call_value: Number(value),
+              contract_address: options.to,
+              data: options.data.slice(2),
+              owner_address: options.from ?? options.to,
+              visible: true,
+            },
+          ],
+        } as never),
+      )
+      if (
+        !result.result.result ||
+        result.transaction?.ret?.some(
+          (entry) => entry.ret !== undefined && entry.ret !== 'SUCCESS',
+        ) ||
+        result.constant_result?.length !== 1
+      )
+        throw new RequestError('Tron constant call failed.')
+      return `0x${result.constant_result[0]}`
+    },
+    async getBlock() {
+      return schema.Block.parse(
+        await client.request({ method: 'walletsolidity/getnowblock' } as never),
+      )
+    },
+    async getTransaction(options: getTransaction.Options) {
+      const result = await client.request({
+        method: 'walletsolidity/gettransactionbyid',
+        params: [{ value: internal.hash(options.hash) }],
+      } as never)
+      if (Object.keys(result as object).length === 0) return undefined
+      const transaction = schema.Transaction.parse(result)
+      if (transaction.txID.toLowerCase() !== internal.hash(options.hash))
+        throw new RequestError('Tron transaction hash mismatch.')
+      return transaction
+    },
+    async getTransactionReceipt(options: getTransaction.Options) {
+      const result = await client.request({
+        method: 'walletsolidity/gettransactioninfobyid',
+        params: [{ value: internal.hash(options.hash) }],
+      } as never)
+      if (Object.keys(result as object).length === 0) return undefined
+      const receipt = schema.Receipt.parse(result)
+      if (receipt.id.toLowerCase() !== internal.hash(options.hash))
+        throw new RequestError('Tron receipt hash mismatch.')
+      return receipt
+    },
+  }
+  // viem protects Ethereum action names, so native Tron actions extend a separate namespace.
+  const { tron, ...extended } = client.extend(() => ({ tron: actions }))
+  return { ...extended, ...tron }
+}
+
+export declare namespace createClient {
+  /** Read-only Tron actions backed by a viem fallback client. */
+  type ReturnType = core_Client<FallbackTransport, undefined, undefined> & {
+    /** Simulates an ABI-encoded contract call. */
+    call: (options: call.Options) => Promise<Hex.Hex>
+    /** Reads the latest solidified block. */
+    getBlock: () => Promise<z.output<typeof schema.Block>>
+    /** Reads solidified source transaction evidence. */
+    getTransaction: (
+      options: getTransaction.Options,
+    ) => Promise<z.output<typeof schema.Transaction> | undefined>
+    /** Reads the solidified execution receipt. */
+    getTransactionReceipt: (
+      options: getTransaction.Options,
+    ) => Promise<z.output<typeof schema.Receipt> | undefined>
+  }
+
+  /** Ordered native HTTP endpoints and request cancellation. */
+  type Options = {
+    /** Fetch implementation used for requests. */
+    fetch?: typeof globalThis.fetch | undefined
+    /** Cancellation signal shared by all requests. */
+    signal?: AbortSignal | undefined
+    /** Ordered Tron native HTTP API endpoint URLs. */
+    urls: readonly string[]
+  }
+}
+
+/** Contract-call parameter types. */
+export declare namespace call {
+  /** ABI-encoded constant-call parameters. */
+  type Options = {
+    /** Full ABI-encoded calldata. */
+    data: Hex.Hex
+    /** Optional checksummed caller address. */
+    from?: string | undefined
+    /** Checksummed Tron contract address. */
+    to: string
+    /** TRX value in sun. */
+    value?: bigint | undefined
+  }
+}
+
+/** Transaction lookup parameter types. */
+export declare namespace getTransaction {
+  /** Native Tron transaction identifier. */
+  type Options = {
+    /** Transaction hash, with or without the hexadecimal prefix. */
+    hash: string
+  }
+}
+
+namespace internal {
+  export function hash(value: string) {
+    const hash = value.replace(/^0x/, '').toLowerCase()
+    if (!/^[0-9a-f]{64}$/.test(hash)) throw new RequestError('Invalid Tron transaction hash.')
+    return hash
+  }
+}
+
+/** Invalid Tron address or Base58Check checksum. */
+export class InvalidAddressError extends Error {
+  override name = 'Tron.InvalidAddressError'
+  constructor() {
+    super('Invalid Tron address.')
+  }
+}
+
+/** Native Tron endpoint or contract execution failure. */
+export class RequestError extends Error {
+  override name = 'Tron.RequestError'
+}

package/src/internal/Viem.rpc.test.ts

@@ -0,0 +1,76 @@
+import * as http from 'node:http'
+import type * as net from 'node:net'
+import { getChainId } from 'viem/actions'
+
+import * as Viem from './Viem.js'
+
+describe('createEvmClient', () => {
+  test.each([
+    { auth: 'rpc-key', authorization: 'Bearer rpc-key' },
+    {
+      auth: { 4217: 'wrong-key', 42431: 'user:password' },
+      authorization: 'Basic dXNlcjpwYXNzd29yZA==',
+    },
+  ])(
+    'authenticates the configured endpoint with $authorization',
+    async ({ auth, authorization }) => {
+      const headers: (string | undefined)[] = []
+      const server = http.createServer(async (request, response) => {
+        headers.push(request.headers.authorization)
+        let body = ''
+        for await (const chunk of request) body += chunk
+        response.setHeader('content-type', 'application/json')
+        response.end(JSON.stringify({ id: JSON.parse(body).id, jsonrpc: '2.0', result: '0xa5bf' }))
+      })
+      await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+      try {
+        const url = `http://127.0.0.1:${(server.address() as net.AddressInfo).port}`
+        const client = Viem.createEvmClient({
+          chainId: 42431,
+          fetch,
+          rpc: { auth, url: { 42431: url } },
+          urls: ['http://127.0.0.1:1'],
+        })
+        expect(await getChainId(client)).toBe(42431)
+        expect(headers).toEqual([authorization])
+      } finally {
+        server.closeAllConnections()
+        await new Promise<void>((resolve) => server.close(() => resolve()))
+      }
+    },
+  )
+
+  test('does not forward credentials to redirects or fallback endpoints', async () => {
+    const requests: { authorization: string | undefined; path: string | undefined }[] = []
+    const server = http.createServer(async (request, response) => {
+      requests.push({ authorization: request.headers.authorization, path: request.url })
+      if (request.url === '/primary') {
+        response.writeHead(302, { location: '/redirect' })
+        response.end()
+        return
+      }
+      let body = ''
+      for await (const chunk of request) body += chunk
+      response.setHeader('content-type', 'application/json')
+      response.end(JSON.stringify({ id: JSON.parse(body).id, jsonrpc: '2.0', result: '0xa5bf' }))
+    })
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+    try {
+      const url = `http://127.0.0.1:${(server.address() as net.AddressInfo).port}`
+      const client = Viem.createEvmClient({
+        chainId: 42431,
+        fetch,
+        rpc: { auth: 'rpc-key', url: `${url}/primary` },
+        urls: [`${url}/fallback`],
+      })
+      expect(await getChainId(client)).toBe(42431)
+      expect(requests).toEqual([
+        { authorization: 'Bearer rpc-key', path: '/primary' },
+        { authorization: undefined, path: '/fallback' },
+      ])
+    } finally {
+      server.closeAllConnections()
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    }
+  })
+})

package/src/internal/Viem.ts

@@ -73,14 +73,33 @@ export type ZoneHeaders = Record<string, string>
 
 /** Creates a generic EVM client with ordered RPC endpoint fallback. */
 export function createEvmClient(options: createEvmClient.Options): createEvmClient.ReturnType {
+  const resolved =
+    options.rpc && options.chainId !== undefined
+      ? resolveRpc(options.rpc, { chainId: options.chainId as ChainId, principal: null })
+      : undefined
+  const urls = [...new Set([...(resolved?.url ? [resolved.url] : []), ...options.urls])]
   const fallback_transport = fallback(
-    options.urls.map((url) =>
-      http(url, {
+    urls.map((url) => {
+      const authorization =
+        url !== resolved?.url
+          ? undefined
+          : resolved.basicAuth
+            ? `Basic ${btoa(resolved.basicAuth)}`
+            : resolved.bearerAuth
+              ? `Bearer ${resolved.bearerAuth}`
+              : undefined
+      return http(url, {
         fetchFn: options.fetch,
-        ...(options.signal ? { fetchOptions: { signal: options.signal } } : {}),
+        fetchOptions: {
+          ...(options.signal ? { signal: options.signal } : {}),
+          // Credentials belong only to the configured endpoint, never its redirects or catalog fallbacks.
+          ...(authorization
+            ? { headers: { Authorization: authorization }, redirect: 'manual' }
+            : {}),
+        },
         retryCount: 0,
-      }),
-    ),
+      })
+    }),
   )
   const chainId = options.chainId
   const transport: FallbackTransport = (parameters) => {
@@ -98,16 +117,20 @@ export function createEvmClient(options: createEvmClient.Options): createEvmClie
       },
     }
   }
-  return core_createClient({ transport })
+  return core_createClient({ batch: options.batch, transport })
 }
 
 export declare namespace createEvmClient {
   /** Generic EVM RPC client configuration. */
   type Options = {
+    /** Contract read batching configuration. */
+    batch?: core_Client['batch'] | undefined
     /** EIP-155 chain id attached to request failures. */
     chainId?: number | undefined
     /** Fetch implementation used for RPC requests. */
     fetch: typeof globalThis.fetch
+    /** Trusted RPC configuration resolved using the client chain id. */
+    rpc?: getClient.Rpc | undefined
     /** Optional request cancellation signal. */
     signal?: AbortSignal | undefined
     /** Ordered RPC endpoint URLs. */

package/src/internal/rewards/Read.test.ts

@@ -4,6 +4,7 @@ import type { Address } from 'viem'
 import * as TestApp from '../../../test/App.js'
 import * as RewardAccounts from '../../db/tables/rewardAccounts.js'
 import * as RewardCampaigns from '../../db/tables/rewardCampaigns.js'
+import * as RewardEligibilityAssociations from '../../db/tables/rewardEligibilityAssociations.js'
 import * as RewardRuns from '../../db/tables/rewardRuns.js'
 import * as core_EarnVaults from '../../db/tables/earnVaults.js'
 import * as Campaigns from './Campaigns.js'
@@ -31,6 +32,114 @@ const config = {
 } satisfies Campaigns.Config
 
 describe('Earn rewards reads', () => {
+  test.each([
+    { balance: '30000000', baseNet: '0.02', name: 'fresh deposit', qualifiedShares: undefined },
+    { balance: '30000000', baseNet: '0.02', name: 'zero qualification', qualifiedShares: '0' },
+    { balance: '0', baseNet: '0.02', name: 'zero balance', qualifiedShares: undefined },
+    { balance: '30000000', baseNet: '0.08', name: 'base above target', qualifiedShares: undefined },
+  ])(
+    'exposes the registered boost target for $name without increasing net APY',
+    async (options) => {
+      vi.useFakeTimers({ now: (config.boostRewards.startTimestamp + 1) * 1_000, toFake: ['Date'] })
+      try {
+        const db = TestApp.database()
+        await seedCampaign(db)
+        await RewardEligibilityAssociations.upsert(db, {
+          chainId: 4217,
+          vaultAddress,
+          walletAddress: recipient,
+        })
+        if (options.qualifiedShares !== undefined)
+          await seedAccount(db, { qualifiedShares: options.qualifiedShares })
+        const apy = await Read.positionApy({
+          assetDecimals: 6,
+          baseNet: options.baseNet,
+          chainId: 4217,
+          db,
+          excludedAddresses: [],
+          recipient,
+          shareBalance: options.balance,
+          value: options.balance,
+          vaultAddress,
+        })
+        expect(apy?.breakdown[0]).toMatchInlineSnapshot(`
+          {
+            "assetAmount": {
+              "baseUnits": "0",
+              "decimals": 6,
+              "formatted": "0",
+            },
+            "net": "0.0700",
+            "type": "boost",
+          }
+        `)
+        expect(apy?.breakdown).toHaveLength(2)
+        expect(apy?.breakdown[1]).toMatchObject({
+          assetAmount: { baseUnits: options.balance },
+          net: options.baseNet,
+          type: 'base',
+        })
+        expect(apy?.net).toBe(options.baseNet)
+      } finally {
+        vi.useRealTimers()
+      }
+    },
+  )
+
+  test.each([
+    { enabled: true, excluded: false, name: 'unregistered wallet', offset: 1, registered: false },
+    { enabled: false, excluded: false, name: 'disabled campaign', offset: 1, registered: true },
+    { enabled: true, excluded: false, name: 'future campaign', offset: -1, registered: true },
+    { enabled: true, excluded: false, name: 'ended campaign', offset: 600, registered: true },
+    { enabled: true, excluded: true, name: 'excluded wallet', offset: 1, registered: true },
+  ])('omits a zero-amount boost for $name', async (options) => {
+    vi.useFakeTimers({
+      now: (config.boostRewards.startTimestamp + options.offset) * 1_000,
+      toFake: ['Date'],
+    })
+    try {
+      const db = TestApp.database()
+      await seedCampaign(db, {
+        config: { boostRewards: { ...config.boostRewards, enabled: options.enabled } },
+      })
+      if (options.registered)
+        await RewardEligibilityAssociations.upsert(db, {
+          chainId: 4217,
+          vaultAddress,
+          walletAddress: recipient,
+        })
+      const apy = await Read.positionApy({
+        assetDecimals: 6,
+        baseNet: '0.02',
+        chainId: 4217,
+        db,
+        excludedAddresses: options.excluded ? [recipient] : [],
+        recipient,
+        shareBalance: '30000000',
+        value: '30000000',
+        vaultAddress,
+      })
+      expect(apy).toMatchInlineSnapshot(`
+        {
+          "breakdown": [
+            {
+              "assetAmount": {
+                "baseUnits": "30000000",
+                "decimals": 6,
+                "formatted": "30",
+              },
+              "net": "0.02",
+              "type": "base",
+            },
+          ],
+          "net": "0.02",
+        }
+      `)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   test('calculates wallet APY below, at, and above the qualified cap', async () => {
     vi.useFakeTimers({ now: (config.boostRewards.startTimestamp + 1) * 1_000, toFake: ['Date'] })
     try {

package/src/internal/rewards/Read.ts

@@ -4,6 +4,7 @@ import { Value as core_Value } from 'ox'
 import * as Db from '../../db/Db.js'
 import * as RewardAccounts from '../../db/tables/rewardAccounts.js'
 import * as RewardCampaigns from '../../db/tables/rewardCampaigns.js'
+import * as RewardEligibilityAssociations from '../../db/tables/rewardEligibilityAssociations.js'
 import * as RewardRuns from '../../db/tables/rewardRuns.js'
 import * as Campaigns from './Campaigns.js'
 import type * as Viem from '../Viem.js'
@@ -64,7 +65,7 @@ export type Recipient = {
 
 /** Effective APY combining live position amounts with the latest delivered reward qualification. */
 export type PositionApy = {
-  /** Position amounts grouped by the annual rate they receive. */
+  /** Position amounts by annual rate, including an eligible boost target with zero qualified amount. */
   breakdown: readonly {
     /** Position amount in vault asset units. */
     assetAmount: {
@@ -77,7 +78,7 @@ export type PositionApy = {
     }
     /** Annual rate applied to this amount, as a decimal ratio. */
     net: string
-    /** Whether this amount receives the base or qualified boost rate. */
+    /** Base rate or eligible boost target; zero boost amount does not imply earned rewards. */
     type: 'base' | 'boost'
   }[]
   /** Balance-weighted annual rate for the wallet's position, as a decimal ratio. */
@@ -238,9 +239,16 @@ export async function positionApy(options: positionApy.Options): Promise<Positio
   if (amounts === undefined || amounts.shareBalance < 0n || amounts.value < 0n) return null
 
   const db = Db.get(options.db)
-  const [account, campaign] = await Promise.all([
+  // Registration is a keyed lookup, so it loads with the other rows rather
+  // than as a dependent round trip once qualification proves absent.
+  const [account, campaign, eligible] = await Promise.all([
     RewardAccounts.get(db, options),
     RewardCampaigns.get(db, options),
+    RewardEligibilityAssociations.get(db, {
+      chainId: options.chainId,
+      vaultAddress: getAddress(options.vaultAddress),
+      walletAddress: getAddress(options.recipient),
+    }),
   ])
   // Stored qualification applies only while the campaign is active and the recipient is eligible.
   const now = Math.floor(Date.now() / 1_000)
@@ -282,7 +290,8 @@ export async function positionApy(options: positionApy.Options): Promise<Positio
   const baseAmount = value - boostAmount
   const breakdown: PositionApy['breakdown'][number][] = []
   const assetDecimals = campaign?.assetDecimals ?? options.assetDecimals
-  if (boostAmount > 0n && boostRate !== undefined && boostNet !== undefined)
+  // Registration exposes the target before qualification arrives, without changing the weighted position rate.
+  if ((boostAmount > 0n || eligible) && boostRate !== undefined && boostNet !== undefined)
     breakdown.push({
       assetAmount: {
         baseUnits: boostAmount.toString(),

package/src/internal/routes/Action.test.ts

@@ -1,3 +1,6 @@
+import { AbiFunction } from 'ox'
+
+import * as Tron from '../Tron.js'
 import * as Action from './Action.js'
 
 const sourceToken = '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
@@ -225,3 +228,70 @@ describe('validateEvmCalls', () => {
       ).toThrow(Action.InvalidActionError)
   })
 })
+
+describe('validateTronCalls', () => {
+  const token = 'TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t'
+  const executor = 'TJRabPrwbZy45sbavfcjinPJC18kjpRTv8'
+  const approve = AbiFunction.from('function approve(address spender, uint256 amount)')
+  const calls = [
+    {
+      data: AbiFunction.encodeData(approve, [Tron.toEvmAddress(executor), 1_000_000n]),
+      to: token,
+      value: '0x0',
+    },
+    { data: '0x12345678', to: executor, value: '0x64' },
+  ]
+
+  test('accepts bounded approvals and exact SUN fees', () => {
+    expect(() =>
+      Action.validateTronCalls({
+        action: { calls, type: 'tron:calls' },
+        nativeValues: [{ to: executor, value: '0x64' }],
+        sourceAmount: '1000000',
+        sourceTokenAddress: token,
+      }),
+    ).not.toThrow()
+  })
+
+  test('rejects native fees outside provider allowances', () => {
+    expect(() =>
+      Action.validateTronCalls({
+        action: { calls, type: 'tron:calls' },
+        nativeValues: [{ to: executor, value: '0x65' }],
+        sourceAmount: '1000000',
+        sourceTokenAddress: token,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Routes.Action.InvalidActionError: Native value must match a validated provider fee.]`,
+    )
+  })
+
+  test('rejects approvals above the source amount', () => {
+    expect(() =>
+      Action.validateTronCalls({
+        action: { calls, type: 'tron:calls' },
+        nativeValues: [{ to: executor, value: '0x64' }],
+        sourceAmount: '999999',
+        sourceTokenAddress: token,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Routes.Action.InvalidActionError: Approval must stay bounded to the route amount.]`,
+    )
+  })
+
+  test('rejects a malformed Base58 checksum', () => {
+    expect(() =>
+      Action.validateTronCalls({
+        action: {
+          calls: [{ ...calls[0]!, to: `${token.slice(0, -1)}u` }, calls[1]!],
+          type: 'tron:calls',
+        },
+        nativeValues: [{ to: executor, value: '0x64' }],
+        sourceAmount: '1000000',
+        sourceTokenAddress: token,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Routes.Action.InvalidActionError: Malformed Tron calls or allowances.]`,
+    )
+  })
+})