@cardano-slips/flow 0.0.3 → 0.2.0

package/src/cip30.ts

@@ -0,0 +1,113 @@
+/**
+ * The CIP-30 surface this client calls, declared here because evolution-sdk's
+ * `WalletApi` omits `getChangeAddress`, `getCollateral` and `getNetworkId`
+ * while the object a wallet actually hands back carries all three (ADR-0004).
+ * A typing we assert rather than one the SDK guarantees, so it is proved
+ * against a stubbed provider rather than trusted.
+ */
+
+/** Hex-encoded CBOR: the only form CIP-30 speaks, and the form `verifier` decodes. */
+export type CborHex = string
+
+export type Paginate = { readonly page: number; readonly limit: number }
+
+export type SignedData = { readonly signature: CborHex; readonly key: CborHex }
+
+export interface Cip30Api {
+  readonly getNetworkId: () => Promise<number>
+  readonly getChangeAddress: () => Promise<CborHex>
+  readonly getUsedAddresses: (paginate?: Paginate) => Promise<ReadonlyArray<CborHex>>
+  readonly getUnusedAddresses: () => Promise<ReadonlyArray<CborHex>>
+  readonly getRewardAddresses: () => Promise<ReadonlyArray<CborHex>>
+  readonly getBalance: () => Promise<CborHex>
+  /** `null` where the wallet has nothing to give, per CIP-30. */
+  readonly getUtxos: (amount?: CborHex, paginate?: Paginate) => Promise<ReadonlyArray<CborHex> | null>
+  readonly getCollateral: (params?: { readonly amount: CborHex }) => Promise<ReadonlyArray<CborHex> | null>
+  /** Returns a **witness set**, never a signed transaction — invariant 4 is CIP-30's own shape. */
+  readonly signTx: (tx: CborHex, partialSign?: boolean) => Promise<CborHex>
+  readonly signData: (address: CborHex, payload: CborHex) => Promise<SignedData>
+  readonly submitTx: (tx: CborHex) => Promise<string>
+}
+
+/** What an extension injects at `window.cardano[key]`, before anyone calls `enable()`. */
+export interface Cip30Provider {
+  readonly apiVersion: string
+  readonly name: string
+  readonly icon: string
+  readonly supportedExtensions?: ReadonlyArray<{ readonly cip: number }>
+  readonly enable: (extensions?: ReadonlyArray<{ readonly cip: number }>) => Promise<Cip30Api>
+  readonly isEnabled: () => Promise<boolean>
+}
+
+const isFunction = (value: unknown): boolean => typeof value === "function"
+
+/**
+ * Shape, not name: `window.cardano` is a namespace anything may write to, and a
+ * key that does not answer these four is not a connector whatever it is called.
+ */
+export const isCip30Provider = (value: unknown): value is Cip30Provider => {
+  if (typeof value !== "object" || value === null) return false
+  const candidate = value as Record<string, unknown>
+  return (
+    isFunction(candidate.enable) &&
+    isFunction(candidate.isEnabled) &&
+    typeof candidate.name === "string" &&
+    typeof candidate.apiVersion === "string"
+  )
+}
+
+/** The methods we call. A provider may enable and still not answer them. */
+const apiMethods = ["getNetworkId", "getChangeAddress", "getUsedAddresses", "getUtxos", "signTx", "submitTx"] as const
+
+export const isCip30Api = (value: unknown): value is Cip30Api => {
+  if (typeof value !== "object" || value === null) return false
+  const candidate = value as Record<string, unknown>
+  return apiMethods.every((method) => isFunction(candidate[method]))
+}
+
+/** CIP-30's `APIError`, kept whole: the numeric code is what says a person declined. */
+export type Cip30ApiError = { readonly code: number; readonly info: string }
+
+/** The four `APIError` codes CIP-30 defines. Anything else is passed through as its number. */
+export const apiErrorNames: Readonly<Record<number, string>> = {
+  [-1]: "InvalidRequest",
+  [-2]: "InternalError",
+  [-3]: "Refused",
+  [-4]: "AccountChange"
+}
+
+/** `-3` is the person saying no, which is not a fault and must not be shown as one. */
+export const REFUSED = -3
+
+/**
+ * `TxSignError` and `TxSendError` are `APIError`'s shape on their own
+ * numbering, and the numbering is the footgun: a declined signature is `2`
+ * here, where `2` in `APIError` is an internal error. They never share a call,
+ * so which table applies is decided by the method that rejected.
+ */
+export const txSignErrorNames: Readonly<Record<number, string>> = {
+  1: "ProofGeneration",
+  2: "UserDeclined"
+}
+
+/** `2` from `signTx`: the person declined in the wallet. */
+export const USER_DECLINED = 2
+
+export const txSendErrorNames: Readonly<Record<number, string>> = {
+  1: "Refused",
+  2: "Failure"
+}
+
+/** A wallet rejects with a plain `{ code, info }` object, not an `Error`. */
+export const readApiError = (cause: unknown): Cip30ApiError | undefined => {
+  if (typeof cause !== "object" || cause === null) return undefined
+  const candidate = cause as Record<string, unknown>
+  if (typeof candidate.code !== "number") return undefined
+  return { code: candidate.code, info: typeof candidate.info === "string" ? candidate.info : "" }
+}
+
+export const describeApiError = (error: Cip30ApiError): string => {
+  const name = apiErrorNames[error.code]
+  const label = name === undefined ? `code ${error.code}` : name
+  return error.info === "" ? label : `${label}: ${error.info}`
+}

package/src/complete-error.ts

@@ -0,0 +1,83 @@
+/**
+ * Why a Slip did not reach the chain, for the failures that belong to the whole
+ * path rather than to building, signing or submitting alone. `Blocked` is the
+ * one that matters: it is invariant 3 in the error channel, and there is no
+ * field on it that lets anyone past.
+ */
+import { type ClientErrorCode } from "@cardano-slips/core"
+import type { Reason } from "@cardano-slips/verifier"
+import { Data } from "effect"
+
+export type CompletionRefusal =
+  /** The wallet reported no unspent outputs, so there is nothing to build from. */
+  | "NoUtxos"
+  /** What `getUtxos` answered is not something these bytes can be read as. */
+  | "UnreadableUtxos"
+  /** The effects could not be derived from the transaction, or compared with the declaration. */
+  | "CannotJudge"
+  /** The derived effects disagree with what the endpoint declared. Nothing signs after this. */
+  | "Blocked"
+  /** The caller could not put the effects in front of a person, so nothing may be signed. */
+  | "NotShown"
+  /** The funds kept moving, and the transaction has been rebuilt as often as it will be. */
+  | "OutOfAttempts"
+
+/**
+ * Exhaustive by type: adding a refusal above without listing it here fails to
+ * compile, and `test/complete.test.ts` fails if any of them stops being reachable.
+ */
+export const completionRefusals: Readonly<Record<CompletionRefusal, true>> = {
+  NoUtxos: true,
+  UnreadableUtxos: true,
+  CannotJudge: true,
+  Blocked: true,
+  NotShown: true,
+  OutOfAttempts: true
+}
+
+export const slipErrorCodeFor = (refusal: CompletionRefusal): ClientErrorCode | undefined => {
+  switch (refusal) {
+    case "Blocked":
+      return "EFFECTS_MISMATCH"
+    case "NoUtxos":
+      return "INSUFFICIENT_FUNDS"
+    case "CannotJudge":
+      return "CANNOT_BALANCE"
+    case "UnreadableUtxos":
+    case "NotShown":
+    case "OutOfAttempts":
+      return undefined
+  }
+}
+
+/**
+ * `reasons` is what the transaction actually does against what was declared,
+ * for the block to render. There is no way to carry on from one — a mismatch
+ * hard-blocks, with no override, no allowlist and no confirmation.
+ */
+export class CompletionError extends Data.TaggedError("CompletionError")<{
+  readonly refusal: CompletionRefusal
+  readonly detail: string
+  readonly reasons?: ReadonlyArray<Reason>
+  readonly cause?: unknown
+}> {
+  override get message(): string {
+    return this.detail
+  }
+
+  get code(): ClientErrorCode | undefined {
+    return slipErrorCodeFor(this.refusal)
+  }
+}
+
+export const refuse = (
+  refusal: CompletionRefusal,
+  detail: string,
+  extra: { readonly reasons?: ReadonlyArray<Reason>; readonly cause?: unknown } = {}
+): CompletionError =>
+  new CompletionError({
+    refusal,
+    detail,
+    ...(extra.reasons === undefined ? {} : { reasons: extra.reasons }),
+    ...(extra.cause === undefined ? {} : { cause: extra.cause })
+  })

package/src/complete.ts

@@ -0,0 +1,198 @@
+/**
+ * The whole path: build against what the wallet holds, judge it with the
+ * verifier's own engine, sign, submit. When the funds move underneath, every
+ * one of those happens again — a rebuilt transaction is a different transaction,
+ * and asking for a signature on it without deriving its effects first would put
+ * a person's name on something nobody read.
+ */
+import type { Intent, Network } from "@cardano-slips/core"
+import { compare, decodeTransaction, deriveEffects, type Effects } from "@cardano-slips/verifier"
+import { Effect, Either } from "effect"
+
+import { balanceIntent, type BalancingParameters } from "./balance.js"
+import type { BalanceError } from "./balance-error.js"
+import type { Cip30Api } from "./cip30.js"
+import { type CompletionError, refuse } from "./complete-error.js"
+import { asResolvedInputs } from "./resolve.js"
+import { signTransaction, submitTransaction } from "./sign.js"
+import type { SigningError } from "./sign-error.js"
+import { readWalletUtxos } from "./utxo.js"
+import { transactionIdOf } from "./witness.js"
+
+/** Enough rebuilds to outlast an unlucky moment, few enough that nobody is asked forever. */
+const defaultAttempts = 3
+
+export type Attempt = {
+  /** Counting from one, so a rendered "attempt 2 of 3" reads as a person would say it. */
+  readonly number: number
+  readonly transactionId: string
+  /** What this transaction does, derived from its own bytes. */
+  readonly effects: Effects
+}
+
+export type CompletionRequest = {
+  readonly api: Cip30Api
+  /** What the endpoint declared, and what the transaction is judged against. */
+  readonly intent: Intent
+  readonly network: Network
+  readonly changeAddress: string
+  /**
+   * Every address the wallet calls its own, its reward account included. An
+   * address missing from here is read as a stranger's, which turns the wallet's
+   * own change into an undeclared payment and blocks the Slip.
+   */
+  readonly userAddresses: ReadonlyArray<Uint8Array>
+  readonly parameters: BalancingParameters
+  readonly rewardBalance?: bigint
+  /** Read once per attempt: a rebuilt transaction gets its own validity window. */
+  readonly now?: () => number
+  /** How many times the transaction may be built. Beyond this the funds are moving faster than we can follow. */
+  readonly attempts?: number
+  /** Called once per attempt, after the effects are derived and before the wallet is asked to sign. */
+  readonly onAttempt?: (attempt: Attempt) => void
+}
+
+export type Receipt = {
+  readonly transactionId: string
+  readonly effects: Effects
+  /** How many transactions it took, which is how many times the funds moved plus one. */
+  readonly attempts: number
+}
+
+type Failure = BalanceError | CompletionError | SigningError
+
+const fromHex = (hex: string): Uint8Array =>
+  Uint8Array.from({ length: hex.length / 2 }, (_, index) => Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16))
+
+const walletUtxos = (api: Cip30Api) =>
+  Effect.gen(function* () {
+    const answered = yield* Effect.tryPromise({
+      try: () => api.getUtxos(),
+      catch: (cause) => refuse("UnreadableUtxos", "The wallet could not say what it holds.", { cause })
+    })
+
+    // `null` is CIP-30's own answer for a wallet with nothing to give.
+    const hexes = answered ?? []
+    const read = readWalletUtxos(hexes)
+    if (Either.isLeft(read)) {
+      return yield* Effect.fail(
+        refuse("UnreadableUtxos", `The wallet's unspent outputs could not be read: ${read.left}`)
+      )
+    }
+    if (read.right.length === 0) {
+      return yield* Effect.fail(refuse("NoUtxos", "This wallet holds nothing to pay with."))
+    }
+    return read.right
+  })
+
+/**
+ * One transaction, from the wallet's outputs to a verdict. The judging happens
+ * here rather than at the caller so that no path reaches `signTransaction`
+ * without having passed it.
+ */
+const buildAndJudge = (request: CompletionRequest, number: number) =>
+  Effect.gen(function* () {
+    const utxos = yield* walletUtxos(request.api)
+    const now = (request.now ?? Date.now)()
+
+    const built = yield* balanceIntent({
+      intent: request.intent,
+      network: request.network,
+      changeAddress: request.changeAddress,
+      utxos,
+      parameters: request.parameters,
+      ...(request.rewardBalance === undefined ? {} : { rewardBalance: request.rewardBalance }),
+      now
+    })
+
+    const transaction = decodeTransaction(fromHex(built.cbor))
+    if (Either.isLeft(transaction)) {
+      return yield* Effect.fail(
+        refuse("CannotJudge", `This transaction could not be read back: ${transaction.left.message}`)
+      )
+    }
+
+    const effects = deriveEffects({
+      transaction: transaction.right,
+      userAddresses: request.userAddresses,
+      resolvedInputs: asResolvedInputs(utxos),
+      protocolParameters: request.parameters
+    })
+    if (Either.isLeft(effects)) {
+      return yield* Effect.fail(
+        refuse("CannotJudge", `What this transaction does could not be worked out: ${effects.left.message}`)
+      )
+    }
+
+    const verdict = compare({
+      effects: effects.right,
+      declared: request.intent,
+      changeAddress: request.changeAddress,
+      now: BigInt(now),
+      protocolParameters: request.parameters
+    })
+    if (Either.isLeft(verdict)) {
+      return yield* Effect.fail(
+        refuse(
+          "CannotJudge",
+          `This transaction could not be checked against what was declared: ${verdict.left.message}`
+        )
+      )
+    }
+
+    if (verdict.right._tag === "mismatch") {
+      return yield* Effect.fail(
+        refuse("Blocked", "This transaction does not do what the Slip said it would, so it will not be signed.", {
+          reasons: verdict.right.reasons
+        })
+      )
+    }
+
+    const transactionId = yield* transactionIdOf(built.cbor)
+    const attempt: Attempt = { number, transactionId, effects: effects.right }
+
+    // The caller is what puts these effects in front of a person. If that
+    // throws, the person has not seen them, so this fails closed rather than
+    // carrying on to a signature — and as a refusal rather than a stack trace.
+    yield* Effect.try({
+      try: () => request.onAttempt?.(attempt),
+      catch: (cause) => refuse("NotShown", "This transaction could not be shown, so it will not be signed.", { cause })
+    })
+
+    return { cbor: built.cbor, attempt }
+  })
+
+/**
+ * Completes the Slip, or says why not. A submission that failed because an
+ * input was spent is the one failure worth repeating: everything else either
+ * cannot be helped by a rebuild or is a person having said no.
+ */
+export const completeIntent = (request: CompletionRequest): Effect.Effect<Receipt, Failure> =>
+  Effect.gen(function* () {
+    const allowed = Math.max(1, request.attempts ?? defaultAttempts)
+
+    for (let number = 1; number <= allowed; number += 1) {
+      const { attempt, cbor } = yield* buildAndJudge(request, number)
+
+      const signed = yield* signTransaction({
+        api: request.api,
+        transaction: cbor,
+        transactionId: attempt.transactionId
+      })
+
+      const submitted = yield* Effect.either(submitTransaction(request.api, signed))
+      if (Either.isRight(submitted)) {
+        return { transactionId: submitted.right, effects: attempt.effects, attempts: number }
+      }
+      if (submitted.left.refusal !== "InputsSpent") {
+        return yield* Effect.fail(submitted.left)
+      }
+    }
+
+    return yield* Effect.fail(
+      refuse(
+        "OutOfAttempts",
+        `The wallet's funds moved every time this was built, ${allowed} times over. Try again in a moment.`
+      )
+    )
+  })

package/src/connect.ts

@@ -0,0 +1,136 @@
+/**
+ * `enable()` and the three answers a connection is not usable without: the API
+ * object, the network, and the change address. Everything downstream of here —
+ * UTxOs, balancing, signing — goes through evolution-sdk with this API object
+ * (ADR-0004).
+ */
+import { type Network } from "@cardano-slips/core"
+import { Effect } from "effect"
+
+import { type NetworkId, readWalletAddress } from "./address.js"
+import { type Cip30Api, describeApiError, isCip30Api, readApiError, REFUSED } from "./cip30.js"
+import { type DiscoveredWallet, findWallet, injectedUnder } from "./discovery.js"
+import { refuse, type WalletConnectError } from "./wallet-error.js"
+
+export type ConnectOptions = {
+  /** The network the Slip declares. The wallet is held to it, not asked for it. */
+  readonly network: Network
+  /** Where `cardano` lives. Defaults to the global object, so a test never needs one. */
+  readonly host?: unknown
+  /** CIP extensions to ask for. A wallet may grant fewer, and none of ours are required. */
+  readonly extensions?: ReadonlyArray<{ readonly cip: number }>
+}
+
+export type ConnectedWallet = {
+  readonly wallet: DiscoveredWallet
+  readonly api: Cip30Api
+  /** The Slip's network, now known to be the wallet's as well. */
+  readonly network: Network
+  readonly networkId: NetworkId
+  /** Bech32, ready for a `BuildRequest`. */
+  readonly changeAddress: string
+}
+
+/**
+ * A CIP-19 address separates mainnet from testnet and no further, so this is
+ * every network id there is — preprod and preview are one value here. Telling
+ * them apart is exactly why a Slip states its network by name (`core/types.ts`).
+ */
+export const networkIdFor = (network: Network): NetworkId => (network === "mainnet" ? 1 : 0)
+
+const networkNames: Readonly<Record<NetworkId, string>> = { 0: "a test network", 1: "mainnet" }
+
+const call = <A>(key: string, method: string, run: () => Promise<A>): Effect.Effect<A, WalletConnectError> =>
+  Effect.tryPromise({
+    try: run,
+    catch: (cause) => {
+      const cip30 = readApiError(cause)
+      return refuse(
+        "Unreadable",
+        key,
+        `${method} failed: ${cip30 === undefined ? String(cause) : describeApiError(cip30)}`,
+        cip30
+      )
+    }
+  })
+
+/**
+ * Connects, or says why not. The network check happens here rather than in a
+ * component because it decides whether there is a connection at all: a wallet
+ * on another chain cannot sign this Slip's transaction, and letting the flow
+ * continue only moves the failure to where it costs a person more.
+ */
+export const connectWallet = (
+  key: string,
+  options: ConnectOptions
+): Effect.Effect<ConnectedWallet, WalletConnectError> =>
+  Effect.gen(function* () {
+    const host = options.host ?? globalThis
+    const wallet = findWallet(key, host)
+    if (wallet === undefined) {
+      return yield* Effect.fail(
+        injectedUnder(key, host) === undefined
+          ? refuse("NotInjected", key, "no wallet is installed under this name")
+          : refuse("NotCip30", key, "what is installed under this name does not implement CIP-30")
+      )
+    }
+
+    const api = yield* Effect.tryPromise({
+      try: () => wallet.provider.enable(options.extensions),
+      catch: (cause) => {
+        const cip30 = readApiError(cause)
+        if (cip30?.code === REFUSED) {
+          return refuse("Refused", key, "the connection was declined in the wallet", cip30)
+        }
+        const detail = cip30 === undefined ? String(cause) : describeApiError(cip30)
+        return refuse("EnableFailed", key, `the wallet could not be connected: ${detail}`, cip30)
+      }
+    })
+
+    // `enable()` is typed to return the API and is under no obligation to.
+    if (!isCip30Api(api)) {
+      return yield* Effect.fail(refuse("NotCip30", key, "the wallet connected without returning a CIP-30 API"))
+    }
+
+    const reported = yield* call(key, "getNetworkId", () => api.getNetworkId())
+    if (reported !== 0 && reported !== 1) {
+      return yield* Effect.fail(refuse("Unreadable", key, `getNetworkId answered ${String(reported)}`))
+    }
+    const networkId: NetworkId = reported === 1 ? 1 : 0
+
+    const hex = yield* call(key, "getChangeAddress", () => api.getChangeAddress())
+    const address = yield* readWalletAddress(hex).pipe(
+      Effect.mapError((detail) => refuse("Unreadable", key, `getChangeAddress answered ${detail}`))
+    )
+
+    // Two answers about one wallet. A wallet that gives both cannot be taken at
+    // either word, and the disagreement is not the person's to resolve.
+    if (address.networkId !== networkId) {
+      return yield* Effect.fail(
+        refuse(
+          "Unreadable",
+          key,
+          `the wallet reports ${networkNames[networkId]} and its change address is on ${networkNames[address.networkId]}`
+        )
+      )
+    }
+
+    const expected = networkIdFor(options.network)
+    if (networkId !== expected) {
+      return yield* Effect.fail(
+        refuse(
+          "WrongNetwork",
+          key,
+          `this Slip is on ${options.network} and the wallet is on ${networkNames[networkId]}`
+        )
+      )
+    }
+
+    return {
+      wallet,
+      api,
+      network: options.network,
+      networkId,
+      changeAddress: address.bech32
+    }
+  })

package/src/discovery.ts

@@ -0,0 +1,92 @@
+/**
+ * What is injected at `window.cardano`, read on demand. Nothing here touches a
+ * browser global at module scope: this SDK is imported by server-rendered pages
+ * we do not control, and a module that reads `window` while loading breaks them
+ * before any of it runs (ADR-0004).
+ */
+import { type Cip30Provider, isCip30Provider } from "./cip30.js"
+import { knownWallet } from "./registry.js"
+
+export type DiscoveredWallet = {
+  /** The `window.cardano` key. What `connectWallet` is asked for. */
+  readonly key: string
+  readonly name: string
+  readonly icon: string | undefined
+  readonly apiVersion: string
+  /** CIP numbers the provider says it supports, before `enable()` negotiates any of them. */
+  readonly extensions: ReadonlyArray<number>
+  /** Present only for a wallet in the registry. */
+  readonly install: string | undefined
+  readonly provider: Cip30Provider
+}
+
+/** Anything with a `cardano` namespace: a `Window`, or a stand-in in a test. */
+export type WalletHost = { readonly cardano?: unknown }
+
+const namespaceOf = (host: unknown): Record<string, unknown> | undefined => {
+  if (typeof host !== "object" || host === null) return undefined
+  const cardano = (host as Record<string, unknown>).cardano
+  if (typeof cardano !== "object" || cardano === null) return undefined
+  return cardano as Record<string, unknown>
+}
+
+const extensionsOf = (provider: Cip30Provider): ReadonlyArray<number> =>
+  (provider.supportedExtensions ?? [])
+    .filter((extension) => typeof extension?.cip === "number")
+    .map((extension) => extension.cip)
+
+const describe = (key: string, provider: Cip30Provider): DiscoveredWallet => {
+  const known = knownWallet(key)
+  return {
+    key,
+    // The registry wins over the injected name so one extension reads the same
+    // way in every list; an unknown wallet still gets to name itself.
+    name: known?.name ?? (provider.name === "" ? key : provider.name),
+    icon: typeof provider.icon === "string" && provider.icon !== "" ? provider.icon : undefined,
+    apiVersion: provider.apiVersion,
+    extensions: extensionsOf(provider),
+    install: known?.install,
+    provider
+  }
+}
+
+/**
+ * Every CIP-30 provider in the namespace, by display name. Returns an empty
+ * list where there is no namespace at all — a page with no wallet and a page
+ * rendered on a server are the same case to a caller, and neither is an error.
+ */
+export const discoverWallets = (host: unknown = globalThis): ReadonlyArray<DiscoveredWallet> => {
+  const namespace = namespaceOf(host)
+  if (namespace === undefined) return []
+
+  const found = new Map<string, DiscoveredWallet>()
+  for (const key of Object.keys(namespace)) {
+    const provider = namespace[key]
+    if (isCip30Provider(provider)) found.set(key, describe(key, provider))
+  }
+
+  // An extension injecting two keys is one wallet: listing it twice asks the
+  // person to choose between a wallet and itself.
+  for (const key of [...found.keys()]) {
+    const alias = knownWallet(key)?.aliasOf
+    if (alias !== undefined && found.has(alias)) found.delete(key)
+  }
+
+  return [...found.values()].sort(
+    (left, right) => left.name.localeCompare(right.name) || left.key.localeCompare(right.key)
+  )
+}
+
+/**
+ * Whatever sits under the key, connector or not. Lets a caller separate a
+ * wallet that is not installed from one that is and does not speak CIP-30.
+ */
+export const injectedUnder = (key: string, host: unknown = globalThis): unknown => namespaceOf(host)?.[key]
+
+/** The provider under one key, or `undefined` where nothing usable is there. */
+export const findWallet = (key: string, host: unknown = globalThis): DiscoveredWallet | undefined => {
+  const namespace = namespaceOf(host)
+  if (namespace === undefined) return undefined
+  const provider = namespace[key]
+  return isCip30Provider(provider) ? describe(key, provider) : undefined
+}

package/src/index.ts

@@ -1,11 +1,41 @@
 /**
  * The public entry point of `@cardano-slips/flow`. The `exports` map exposes
  * this module and nothing else, so moving a file is never a breaking change.
- *
- * Two properties hold as the rest of the package arrives. It refuses but does
- * not decide — the comparison is `verifier`'s, and a mismatch renders as a
- * block with no override path to write. And it does not own the page it is
- * dropped into: no fixed positioning, no assumptions about the document, and
- * colours only from the custom properties in `tokens.css`.
  */
-export {}
+export type { NetworkId, WalletAddress } from "./address.js"
+export { readWalletAddress } from "./address.js"
+export type { BalancedTransaction, BalanceInputs, BalancingParameters } from "./balance.js"
+export { balanceIntent } from "./balance.js"
+export type { BalanceRefusal } from "./balance-error.js"
+export { BalanceError, balanceRefusals, slipErrorCodeFor as balanceErrorCodeFor } from "./balance-error.js"
+export type { CborHex, Cip30Api, Cip30ApiError, Cip30Provider, Paginate, SignedData } from "./cip30.js"
+export {
+  apiErrorNames,
+  describeApiError,
+  isCip30Api,
+  isCip30Provider,
+  readApiError,
+  REFUSED,
+  txSendErrorNames,
+  txSignErrorNames,
+  USER_DECLINED
+} from "./cip30.js"
+export type { Attempt, CompletionRequest, Receipt } from "./complete.js"
+export { completeIntent } from "./complete.js"
+export type { CompletionRefusal } from "./complete-error.js"
+export { CompletionError, completionRefusals, slipErrorCodeFor as completionErrorCodeFor } from "./complete-error.js"
+export type { ConnectedWallet, ConnectOptions } from "./connect.js"
+export { connectWallet, networkIdFor } from "./connect.js"
+export type { DiscoveredWallet, WalletHost } from "./discovery.js"
+export { discoverWallets, findWallet, injectedUnder } from "./discovery.js"
+export type { KnownWallet } from "./registry.js"
+export { knownWallet, knownWallets } from "./registry.js"
+export { asResolvedInput, asResolvedInputs } from "./resolve.js"
+export type { SignedTransaction, SignRequest } from "./sign.js"
+export { signTransaction, submitTransaction } from "./sign.js"
+export type { SignRefusal } from "./sign-error.js"
+export { signRefusals, SigningError, slipErrorCodeFor as signErrorCodeFor } from "./sign-error.js"
+export { readWalletUtxos } from "./utxo.js"
+export type { ConnectRefusal } from "./wallet-error.js"
+export { connectRefusals, slipErrorCodeFor, WalletConnectError } from "./wallet-error.js"
+export { assembleWitnesses, requireSameBody, transactionIdOf } from "./witness.js"