From 6c6eab8956135fdcabfe3c3552627eb57978c95d Mon Sep 17 00:00:00 2001
From: emrekayat <237104270+emrekayat@users.noreply.github.com>
Date: Tue, 8 Sep 2026 20:02:45 +0300
Subject: [PATCH] fix(sdk): validate positive numeric round IDs (#256)

---
 packages/sdk/src/ids.test.ts | 15 +++++++++++++++
 packages/sdk/src/ids.ts      |  9 ++++++---
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/packages/sdk/src/ids.test.ts b/packages/sdk/src/ids.test.ts
index fa9a4ff3..a302edc7 100644
--- a/packages/sdk/src/ids.test.ts
+++ b/packages/sdk/src/ids.test.ts
@@ -36,3 +36,18 @@ describe("normalizeSorobanContractId", () => {
     assert.throws(() => normalizeSorobanContractId("C123"), /contractId/);
   });
 });
+
+describe("normalizeRoundId numeric boundaries", () => {
+  for (const value of [0, -0, -1, 1.5, NaN, Infinity, -Infinity, Number.MAX_SAFE_INTEGER + 1, 0n, -1n]) {
+    it(`rejects ${String(value)} (${typeof value})`, () => {
+      assert.throws(() => normalizeRoundId(value), /roundId must be a positive/);
+    });
+  }
+  it("preserves safe numbers and arbitrary-precision positive bigint/string IDs", () => {
+    assert.equal(normalizeRoundId(1), 1n);
+    assert.equal(normalizeRoundId(Number.MAX_SAFE_INTEGER), BigInt(Number.MAX_SAFE_INTEGER));
+    const large = 2n ** 100n;
+    assert.equal(normalizeRoundId(large), large);
+    assert.equal(normalizeRoundId(large.toString()), large);
+  });
+});
diff --git a/packages/sdk/src/ids.ts b/packages/sdk/src/ids.ts
index 493868b3..4e2430ec 100644
--- a/packages/sdk/src/ids.ts
+++ b/packages/sdk/src/ids.ts
@@ -7,11 +7,14 @@ function toTrimmedString(value: string | undefined): string | undefined {
 }
 
 export function normalizeRoundId(value: string | number | bigint): bigint {
-  if (typeof value === "bigint") return value;
+  if (typeof value === "bigint") {
+    if (value < 1n) throw new Error("roundId must be a positive integer");
+    return value;
+  }
 
   if (typeof value === "number") {
-    if (!Number.isInteger(value)) {
-      throw new Error(`roundId must be an integer, got ${JSON.stringify(value)}`);
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw new Error(`roundId must be a positive safe integer, got ${JSON.stringify(value)}`);
     }
     return BigInt(value);
   }