@cardano-slips/flow 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Emmanuel Mutisya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,41 @@
+# @cardano-slips/flow
+
+The client side. It resolves a Slip link, renders it, connects a wallet, balances the transaction against the person's own UTxOs, derives what that transaction actually does, and refuses to ask for a signature when the answer disagrees with what the endpoint declared.
+
+```
+pnpm add @cardano-slips/flow react
+```
+
+## What it does
+
+| Step | What happens |
+| --- | --- |
+| resolve | the shared link through `slips.json`, then `GET` for the Slip's metadata |
+| render | the card, the parameter form generated from what the endpoint declared, and the wallet selector |
+| build | `POST` for the publisher's side of the transaction |
+| balance | locally, against the wallet's own UTxOs — the endpoint never sees them |
+| derive | what the built transaction does, from its bytes |
+| compare | against the intent, and block on any disagreement |
+| sign | `signTx` → assemble the witness set into the body → `submitTx` |
+
+`useSlip`, `useWallet` and `useEffects` are the composable surface for anyone who wants the machinery without our components.
+
+## It refuses; it does not decide
+
+The comparison is `verifier`'s, and it is a pure function so the attack examples run the same code path a real signature does. This package is the consequence of a verdict: a mismatch renders as a block with no control to press. There is no override to configure — not a setting, not an allowlist, not a confirmation. See [Blocking](../../spec/CIP-XXXX/README.md#blocking).
+
+## It does not own the page
+
+These components are meant to be dropped into someone else's page. No fixed positioning, no assumption about the document, and styles that survive an inherited font stack. `tokens.css` holds the design tokens as CSS custom properties and is the only place a colour is defined.
+
+React is a **peer** dependency: your copy is the one that renders, and a second copy in the tree is the oldest breakage in the ecosystem.
+
+## Entry point
+
+One export, the package root. Deep imports into `dist/` are not a supported surface, so moving a file is never a breaking change:
+
+```ts
+import { ... } from "@cardano-slips/flow"
+```
+
+MIT licensed. Issues and contribution guide: [cardano-slips](https://github.com/emmanuel-musau/cardano-slips).

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The public entry point of `@cardano-slips/flow`.
+ *
+ * Everything a consumer may import is re-exported from here, and the package
+ * `exports` map exposes this module and nothing else — a deep import into
+ * `dist/` is not a supported surface, so moving a file is never a breaking
+ * change. The package lands one issue at a time: wallet discovery and enable,
+ * local balancing, the effects panel and the mismatch block, the parameter
+ * form, and rebuild-and-retry (docs/ARCHITECTURE.md).
+ *
+ * This is the half that runs in a browser next to a wallet, and two things
+ * about it do not change as the rest arrives.
+ *
+ * **It refuses; it does not decide.** The comparison between what a
+ * transaction does and what the endpoint declared is `verifier`'s, and it is a
+ * pure function so that the attack examples exercise the same code a real
+ * signature runs through. What lives here is the consequence: a mismatch
+ * renders as a block with no control to press, and there is no override path
+ * to write — not a setting, not an allowlist, not a confirmation.
+ *
+ * **It does not own the page it is dropped into.** These components go into
+ * third-party pages: no fixed positioning, no assumption about the document,
+ * and styles that survive an inherited font stack. Design tokens live in
+ * `tokens.css` as custom properties and are the only source of a colour.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAA"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@cardano-slips/flow",
+  "version": "0.0.0",
+  "description": "The client side of Cardano Slips: CIP-30 orchestration, local balancing, and the React components that render a Slip and block a signature when its effects disagree",
+  "keywords": [
+    "cardano",
+    "cardano-slips",
+    "cip-30",
+    "react",
+    "wallet"
+  ],
+  "homepage": "https://github.com/emmanuel-musau/cardano-slips/tree/main/packages/flow#readme",
+  "bugs": "https://github.com/emmanuel-musau/cardano-slips/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/emmanuel-musau/cardano-slips.git",
+    "directory": "packages/flow"
+  },
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "peerDependencies": {
+    "react": "^19.0.0"
+  },
+  "dependencies": {
+    "@cardano-slips/core": "^0.0.2",
+    "@cardano-slips/verifier": "^0.0.1"
+  },
+  "devDependencies": {
+    "@testing-library/react": "^16.3.2",
+    "@types/react": "^19.2.18",
+    "happy-dom": "^20.11.6",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "typescript": "^6.0.3"
+  },
+  "scripts": {
+    "build": "tsc -b tsconfig.build.json",
+    "typecheck": "tsc -b tsconfig.src.json && tsc -p tsconfig.test.json",
+    "test": "vitest run",
+    "lint": "eslint .",
+    "clean": "rm -rf dist build coverage .tsbuildinfo .turbo"
+  }
+}

package/src/index.ts

@@ -0,0 +1,26 @@
+/**
+ * The public entry point of `@cardano-slips/flow`.
+ *
+ * Everything a consumer may import is re-exported from here, and the package
+ * `exports` map exposes this module and nothing else — a deep import into
+ * `dist/` is not a supported surface, so moving a file is never a breaking
+ * change. The package lands one issue at a time: wallet discovery and enable,
+ * local balancing, the effects panel and the mismatch block, the parameter
+ * form, and rebuild-and-retry (docs/ARCHITECTURE.md).
+ *
+ * This is the half that runs in a browser next to a wallet, and two things
+ * about it do not change as the rest arrives.
+ *
+ * **It refuses; it does not decide.** The comparison between what a
+ * transaction does and what the endpoint declared is `verifier`'s, and it is a
+ * pure function so that the attack examples exercise the same code a real
+ * signature runs through. What lives here is the consequence: a mismatch
+ * renders as a block with no control to press, and there is no override path
+ * to write — not a setting, not an allowlist, not a confirmation.
+ *
+ * **It does not own the page it is dropped into.** These components go into
+ * third-party pages: no fixed positioning, no assumption about the document,
+ * and styles that survive an inherited font stack. Design tokens live in
+ * `tokens.css` as custom properties and are the only source of a colour.
+ */
+export {}