Skip to content

feat(payments): validate token movement CHECKs and pin token movement builders (5/5) - #2527

Open
GuiBibeau wants to merge 9 commits into
claude/token-movements-4-adaptersfrom
claude/token-movements-5-display-enforcement
Open

GuiBibeau wants to merge 9 commits into
claude/token-movements-4-adaptersfrom
claude/token-movements-5-display-enforcement

Conversation

@GuiBibeau

@GuiBibeau GuiBibeau commented Oct 23, 2026 •

Copy link
Copy Markdown
Collaborator

5/5 of the ADR 0012 stack, on #2525. Display units are deferred, so this PR only turns enforcement on.

  • 0189 validates the CHECKs 0186–0188 added NOT VALID (SHARE UPDATE EXCLUSIVE). Merge only after 0186–0188 have been in prod past the rollback window.
  • Builder pin: check:value-movement fails a file that imports a transfer, unchecked Transfer, Mosaic or subscriptions builder from its package outside that rule's list (TOKEN_MOVEMENT_BUILDERS). Lists only shrink.
  • ADR 0012: interest-bearing and scaled mints stay refused on every path. The terms and quote routes, display balances and display entry move to one later change (open decision 7).

Verification (local, one branch at a time, on main 0d84d57): typecheck, every check:* script, test:scripts, biome and generated-file drift clean; API 8,234, web 3,698, @sdp/solana 123 tests pass. Surfpool mint matrix 12/12. Seven web tests timed out at 5 s under load and passed on rerun (this PR changes no web files). After the review fixes: the check script's tests reran 19/19; check:value-movement and test:scripts pass.

🤖 Generated with Claude Code

@vercel

vercel Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
sdp-docs Ready Ready Preview Oct 27, 2026 10:00am UTC
sdp-web Ready Ready Preview Oct 27, 2026 10:00am UTC

Request Review

@github-actions

github-actions Bot commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

React Doctor skipped this pull request — it changed no React files.

Reviewed by React Doctor for commit c50b672.

@greptile-apps

greptile-apps Bot commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] The PR appears safe to merge once migrations 0186–0188 have passed their stated production rollback window.

Summary

This PR validates five existing database checks and pins token movement builders to approved files.

  • The value-movement check now pins token builders to approved files.
  • Migration 0189 validates five token-movement database checks.

Reviews (21) · Last reviewed commit: "fix(db): renumber the validation migrati..." · Reviewed by Greptile

Comment thread apps/sdp-api/src/routes/payments/wallet-balances/handlers.ts Outdated
Comment thread apps/sdp-api/src/openapi/schemas/tokens.ts Outdated
Comment thread apps/sdp-web/src/app/dashboard/[projectId]/payments/use-token-amount-entry.ts Outdated
Comment thread apps/sdp-web/src/app/api/dashboard/tokens/[mint]/quote/route.unit.test.ts Outdated
Comment thread apps/sdp-api/src/services/token-movement/balance-display.ts Outdated
Comment thread packages/sdp-types/src/token-movements.ts Outdated
Comment thread apps/sdp-web/src/app/dashboard/[projectId]/payments/token-amount-quote.data.ts Outdated
@GuiBibeau
GuiBibeau force-pushed the claude/token-movements-5-display-enforcement branch from d7f41aa to 8219e80 Compare October 26, 2026 10:26
@GuiBibeau GuiBibeau changed the title feat(api): token terms and quote routes, display amounts, and builder-only enforcement (5/5) feat(payments): validate token movement CHECKs and pin token movement builders (5/5) Oct 26, 2026
Comment thread scripts/check-value-movement.mjs
Comment thread scripts/check-value-movement.mjs Outdated
GuiBibeau and others added 9 commits October 27, 2026 13:57
0187 validates the expectation, mandate and leg CHECKs 0184-0186 added NOT
VALID, under SHARE UPDATE EXCLUSIVE. Deploy it only after 0184-0186 are in
production past their rollback window.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
check:value-movement fails a file that imports a transfer, unchecked
transfer, Mosaic or subscriptions builder from its package outside that
rule's list, and a listed file that no longer does, so the lists only
shrink. A short import rule: it sees named, renamed and namespace imports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…y refused

PR 5 no longer lifts the builder's refusal: balances, the dashboard and a
quote do not show or take display units yet, so every path keeps refusing
interest-bearing and scaled mints. The terms and quote routes, three-unit
balances and display entry move to one later change (open decision 7).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… parser

A string key or destructuring off a namespace import names its builder; any
other use of the namespace counts as every builder.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…der package

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
export { token } hands the namespace out like passing it on, so it counts as
every builder; an alias name and a type-only export count as none.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… by name

A parameter or local that shadows the imported namespace no longer counts as
using every builder, and the namespace's own use still does.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
It moves to 0189, after the migrations it validates (0186 to 0188).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

This branch was successfully deployed

2 active deployments
Preview – sdp-web — c50b672a Deployed Oct 27, 2026 by vercel[bot]
Preview – sdp-docs — c50b672a Deployed Oct 27, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant