CI rehearsal only (do not merge)

[michael-moffett]

Fork CI only. Do not merge.

[greptile-apps]

Confidence Score: 2/5

[High risk] Adds test-only cheatcode for mint configuration.

The PR should not be merged until the SDK authority type, concurrent update handling, and existing-account initialization behavior are addressed.

Findings

1.  SDK cannot clear authority ▶
2.  Concurrent mint updates overwrite changes ▶
3.  Uninitialized mint accounts are rejected ▶

Summary

Adds surfnet_setMint to create or update SPL Token and Token-2022 mints, including a confidential-transfer extension, with Rust tests and Node SDK bindings.

• The generated SDK type omits a supported authority-clearing value.
• Concurrent mint updates can lose changes, and an existing uninitialized mint account cannot be set up through this method.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A["surfnet_setMint"] --> B["Look up mint or generate default"]
  B --> C["Validate owner and apply fields"]
  C --> D["Preserve or add extensions"]
  D --> E["Top up rent and write account"]

Loading

_{Reviews (1) · Last reviewed commit: "feat(core): surfnet_setMint cheatcode wi..."}

[greptile-apps]

SDK cannot clear authority

The Rust API accepts null for confidential.authority to clear an existing authority, but this generated type permits only string. A TypeScript caller cannot make that supported request without bypassing the type checker.

[greptile-apps]

Concurrent mint updates overwrite changes

If two surfnet_setMint calls read the same mint before either writes, each builds a complete account from its earlier read. The later write can erase the other call’s update, even when the calls change different fields, because the write lock does not cover the read.

[greptile-apps]

Uninitialized mint accounts are rejected

If an account is already allocated to a token program but is not initialized as a mint, the missing-account factory does not run. MintAccount::unpack then fails, so surfnet_setMint cannot configure that account, although it can create a mint at an absent address.