Init Solana Contract Whitelist Policy

[spacesailor24]

Description

• Inits new package: policy-sol-contract-whitelist
  • Restricts what Solana programs (contracts) can be called per Solana cluster (devnet, 'testnet', 'mainnet-beta')
• Add policy-sol-contract-whitelist as supported policy to ability-sol-transaction-signer
  • Init new E2E tests for the Policy: packages/apps/ability-sol-transaction-signer/test/e2e/policy-contract-whitelist.spec.ts
• Move two Solana helpers methods used by both ability-sol-transaction-signer and policy-sol-contract-whitelist to the ability-sdk package:
  • packages/libs/ability-sdk/src/lib/abilityHelpers/solana/deserializeTransaction.ts
  • packages/libs/ability-sdk/src/lib/abilityHelpers/solana/verifyBlockhashForClusters.ts

Type of change

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How Has This Been Tested?

Init test file: packages/apps/ability-sol-transaction-signer/test/e2e/policy-contract-whitelist.spec.ts which tests registering the Ability with a Policy where the program ID 11111111111111111111111111111111 is permitted on devnet, but not mainnet-beta. Then the test uses the Ability to sign a transfer transaction (which uses the system program 11111111111111111111111111111111) using both devnet (where it's expected to succeed) and mainnet-beta (where it's expected the Policy will reject Ability executino)

To run the test:

1. git checkout -b feat/policy-sol-contract-whitelist
2. pnpm i && pnpm build
3. cp packages/apps/ability-sol-transaction-signer/.env.example packages/apps/ability-sol-transaction-signer/.env
4. Fill in all ENVs
5. pnpx nx run ability-sol-transaction-signer:test-e2e packages/apps/ability-sol-transaction-signer/test/e2e/generate-key.spec.ts to generate a Wrapped Key for your dev Agent PKP
6. pnpx nx run ability-sol-transaction-signer:test-e2e packages/apps/ability-sol-transaction-signer/test/e2e/policy-contract-whitelist.spec.ts

Checklist:

• I created a release plan (nx release plan) describing my changes and the version bump
• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
vincent-app-dashboard	Ready	Preview, Comment	Dec 15, 2025 5:51pm

[spacesailor24]

Added .nullable due to a quirk of the Ability to Policy param mapping where even if the Policy schema defines a param as optional, it's actually always required if the Ability want to map a param to it

[Copilot]

Pull request overview

This PR introduces a new Solana contract whitelist policy package that restricts which Solana programs can be invoked per cluster, integrates it with the Solana transaction signer ability, and refactors shared Solana helper functions into the ability-sdk package.

• Implements policy-sol-contract-whitelist to validate Solana transactions against whitelisted program IDs per cluster
• Integrates the new policy with ability-sol-transaction-signer with comprehensive E2E tests
• Extracts deserializeTransaction and verifyBlockhashForCluster helper functions to ability-sdk for reuse

Reviewed changes

Copilot reviewed 34 out of 41 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/apps/policy-sol-contract-whitelist/*	New policy package implementation with schema validation, whitelist checking, and bundling configuration
packages/libs/ability-sdk/src/lib/abilityHelpers/solana/*	New shared Solana helpers for transaction deserialization and blockhash verification
packages/apps/ability-sol-transaction-signer/src/lib/vincent-ability.ts	Integration of whitelist policy with transaction signer ability
packages/apps/ability-sol-transaction-signer/test/e2e/policy-contract-whitelist.spec.ts	E2E tests validating policy enforcement on devnet (allowed) and mainnet-beta (denied)
packages/apps/ability-sol-transaction-signer/src/lib/schemas.ts	Updated schema to support nullable rpcUrl
tsconfig.json, nx.json, project.json files	Build configuration updates to include new package

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 34 out of 41 changed files in this pull request and generated 7 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.