refactor(deps): drop @solana/spl-token and @bonfida/spl-name-service

[amilz]

Description

Kit-migration task 0.2: removes the @solana/spl-token 0.1.8 dependency.

• Program-address constants (TOKEN_PROGRAM_ID, ASSOCIATED_TOKEN_PROGRAM_ID, NATIVE_MINT) come from @solana-program/token instead.
• MintLayout / AccountLayout decodes become getMintDecoder() / getTokenDecoder().
• Also drops @bonfida/spl-name-service — see below for why that got pulled in.

Net client JS: 8644 KB → 8244 KB (clean builds, measured against the base branch).

Why the second dependency

Removing the direct @solana/spl-token pin let @bonfida/spl-name-service's peer range re-resolve 0.1.8 → 0.4.14, pulling in spl-token-group and spl-token-metadata. That reaches a client chunk through the @entities/domain barrel — a 200 KB regression on a PR whose whole point was removing a dependency. A scoped pnpm override does not bind a peer dep (verified).

Explorer used exactly three things from that SDK: a SHA-256 name hash, a 3-seed PDA, and a 96-byte header decode. Those are now ~40 lines in app/entities/domain/lib/sns-name-service.ts on kit codecs and @noble/hashes (both already bundled), which also removes ethers — which Bonfida pulled in solely for its SHA-256 — and bn.js.

Rationale and rejected alternatives: openspec/changes/vendor-sns-name-derivation/.

Type of change

• Other: dependency removal / refactor (no user-facing behavior change)

Testing

Full local pipeline green: format:ci, lint, openspec:validate, build, test:ci.

SNS derivation was equivalence-tested against @bonfida/spl-name-service 0.1.30 across 6 name vectors (including a unicode and an empty label), plus registry decoding of an account with trailing data. The resulting addresses are locked as literal vectors in app/entities/domain/lib/__tests__/sns-name-service.spec.ts, so the derivation cannot drift once the SDK is gone.

Pre-existing on the base branch and unchanged by this PR: 7 test files / 46 failures, all localStorage-dependent — verified by running the same files on base. They fail because the dev machine runs Node v26 while the repo requires ^22.

Related Issues

Closes DEV-882. Part of the DEV-881 kit-migration epic.

Stacked on #1199. That PR is on a fork branch, so GitHub cannot use it as a base here — the first two commits belong to #1199 and will drop out of this diff once it merges. Review only refactor(deps): drop @solana/spl-token and @bonfida/spl-name-service.

Checklist

• My code follows the project's style guidelines
• I have added tests that prove my fix/feature works
• All checks pass locally (pnpm test, pnpm lint, pnpm typecheck)
• I have updated documentation as needed
• I have run build:info script to update build information
• CI/CD checks pass on the PR
• Screenshots included — no UI changes
• For security-related features, I have included links to related information

Additional Notes

Two things reviewers may want to weigh in on:

1. build-token-balances.ts gains a try/catch. The kit token decoder validates the account-state enum where buffer-layout did not, so a Token-2022 multisig that passes the size and discriminator filters would otherwise throw and take down the entire simulation result rather than dropping one row.
2. borsh is deliberately not removed, even though this PR deletes our last direct borsh import. @onsol/tldparser needs the 0.x deserializeUnchecked, and our direct pin is what holds its transitive resolution there — dropping it silently re-resolves tldparser to borsh 2.0.0 and breaks ANS domain resolution. That pin should come out together with tldparser.

[vercel]

@amilz is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Greptile Summary

The PR removes the legacy SPL Token and Bonfida SNS dependencies while preserving token constants, account decoding, and .sol domain behavior through kit-native replacements.

• Replaces legacy token program constants and layouts with @solana-program/token addresses and decoders.
• Vendors the small SNS hashing, PDA derivation, and registry-owner decoding surface with compatibility vectors.
• Removes the obsolete direct dependencies and updates the lockfile.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
app/features/instruction-simulation/lib/build-token-balances.ts	Migrates token-account decoding to the kit decoder and safely drops malformed accounts whose validated state cannot be decoded.
app/features/instruction-simulation/lib/get-mint-decimals.ts	Migrates mint decoding to the kit decoder; the previously reported exception concern is invalid because the fixed-width mint decoder is total for accepted-size inputs.
app/entities/domain/lib/sns-name-service.ts	Reimplements the required SNS hash, PDA, and registry-header primitives with matching seed order and fixed-width layout.
app/entities/domain/api/resolve-domain.ts	Routes .sol resolution through the vendored SNS implementation while preserving base58 address and owner results.
package.json	Removes the two obsolete direct dependencies after their used APIs were migrated.
pnpm-lock.yaml	Updates dependency resolution for the removed legacy SDKs without an established build or runtime regression.

_{Reviews (3): Last reviewed commit: "docs(openspec): correct the rejected-alt..." | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
explorer	Ready	Preview	Aug 17, 2026 8:57pm