CONF-1944: Run the one-attempt Solana Pay path and recovery loop

[pedronfigueiredo]

Summary

Implements the Core-owned Solana source path for MetaMask Pay on top of CONF-1943's transaction-owned CAIP source metadata:

• keeps TransactionMeta.metamaskPay as the single durable owner; TransactionPayController state remains transient
• creates a phase-aware Solana execution checkpoint only after Relay returns an executable quote
• derives and validates the Solana source chain from persisted CAIP-10/CAIP-19 metadata
• consumes Relay /quote/v2 SOL/SPL instruction and lookup-table responses with structural validation
• derives destination chain, currency, recipient, minimum output, trade type, and atomic Perps/Predict destination calls from the parent transaction and Pay data
• exposes a typed platform preflight boundary for prepared transaction data, fees, rent, reserves, balances, and affordability
• checkpoints attempting before exactly one client-owned signAndSendTransaction call
• distinguishes submitted, user-rejected, guaranteed-not-submitted, and ambiguous/unknown source outcomes
• returns externallyHandled from the publish hook so TransactionController suppresses EVM RPC fallback and EVM receipt polling for the hashless parent
• scans persisted TransactionController records for status-only restart recovery without signing, broadcasting, or notifying
• exposes notifyRelayOfSolanaTransaction solely for Relay indexing notification of an existing signature
• keeps the Money Account operation as one separately checkpointed sponsored destination follow-up, not a source retry
• drives terminal parent lifecycle only for submitted transactions marked isExternalPublish

There is no source resubmission operation. The four separate operations are:

1. one source sign-and-broadcast attempt;
2. optional Relay indexing notification for the resulting signature;
3. repeatable source/Relay status observation;
4. one required Money Account destination follow-up, when applicable.

Relay endpoint rationale and authority

Existing EVM Relay traffic remains on /quote. Relay deprecates that endpoint, but this PR does not change the established EVM contract. Solana uses the supported /quote/v2 endpoint exercised by the verified integration fixtures.

Relay's public OpenAPI documents the generic /quote/v2 request, including destination txs, but does not fully document the observed Solana instruction/LUT response. Core treats that response as an integration-specific observed contract and validates its structure before crossing the client preparation boundary. This does not claim that legacy /quote is technically incapable of Solana.

Commit stack

• 3cfae69505 — add the one-attempt Solana Pay flow
• 33b2264e27 — harden the client and external-publication boundary
• 161d8614fa — embed atomic Solana product calls
• c6b0cc879f — preserve the immutable Solana source amount
• 099cef50c3 — adapt to transaction-owned, phase-aware execution state from the updated parent

Validation

• full @metamask/transaction-pay-controller test suite: 100% statements/lines/functions and 99.5% branches
• full @metamask/transaction-controller test suite
• focused TransactionController publication/composer/pending-tracker/batch suites: 379 tests passed
• yarn build
• yarn lint:eslint
• targeted ESLint for changed files
• yarn lint:misc
• yarn changelog:validate
• TransactionController and TransactionPayController messenger action-type checks
• staged and unstaged diff checks

Non-failing Watchman recrawl/worker-shutdown warnings were observed during Jest runs.

Solana Pay ticket and PR index

• CONF-1943 — Persist the Solana Pay intent model in TransactionPayController

  • MetaMask/core — #10272 — CONF-1943: Persist chain-agnostic Solana Pay intents
    • Branched from main

• CONF-1944 — Run the one-attempt Solana source path and recovery loop in Core

  • MetaMask/core — #10273 — CONF-1944: Run the one-attempt Solana Pay path and recovery loop
    • Branched from MetaMask/core#10272

• CONF-1945 — Ship the Solana Pay source picker and confirmation flow in Extension

  • MetaMask/metamask-extension — #46396 — CONF-1945: Ship the Solana Pay flow in Extension
    • Branched from main

• CONF-1946 — Ship the Solana Pay source picker and confirmation flow in Mobile

  • MetaMask/metamask-mobile — #36361 — CONF-1946: Ship the Solana Pay flow in Mobile
    • Branched from main

• CONF-1947 — Wire rollout flags, analytics, and support diagnostics for Solana Pay

  • MetaMask/core — #10274 — CONF-1947: Add Solana Pay rollout diagnostics in Core
    • Branched from MetaMask/core#10273
  • MetaMask/metamask-extension — #46397 — CONF-1947: Add Solana Pay rollout diagnostics in Extension
    • Branched from MetaMask/metamask-extension#46396
  • MetaMask/metamask-mobile — #36362 — CONF-1947: Add Solana Pay rollout diagnostics in Mobile
    • Branched from MetaMask/metamask-mobile#36361