@inco/shield-js 0.0.0-bootstrap.0

package/dist/contracts/index.d.ts

@@ -0,0 +1,2 @@
+export { erc20AdapterAbi, incoShieldAbi, iShieldSignatureVerifierAbi, shieldAbiStubAbi, teeSmartAccountAbi, } from './abi.js';
+export { computeErc20AssetId, getAbiFromUnitFunction } from './utils.js';

package/dist/contracts/index.js

@@ -0,0 +1,2 @@
+export { erc20AdapterAbi, incoShieldAbi, iShieldSignatureVerifierAbi, shieldAbiStubAbi, teeSmartAccountAbi, } from './abi.js';
+export { computeErc20AssetId, getAbiFromUnitFunction } from './utils.js';

package/dist/contracts/utils.d.ts

@@ -0,0 +1,25 @@
+import { type Abi, type Hex } from 'viem';
+/**
+ * Compute the shield-internal asset ID for an ERC-20 token.
+ * Matches `Erc20Adapter.getAssetId()` on-chain:
+ * `keccak256(abi.encodePacked(tokenAddress, "Erc20"))`
+ */
+export declare function computeErc20AssetId(tokenAddress: Hex): Hex;
+type AbiFunctionByName<TAbi extends Abi, TName extends string> = Extract<TAbi[number], {
+    type: 'function';
+    name: TName;
+}>;
+/**
+ * Return the sole input parameter of an ABI function that takes exactly one
+ * argument — the "wrap a single struct" convention this codebase uses to
+ * piggyback Solidity types onto the ABI. Pulls the otherwise-arbitrary
+ * `.inputs[0]` lookup out of every call site so `decodeAbiParameters` /
+ * `encodeAbiParameters` invocations read as their domain meaning.
+ *
+ * Throws if the function is absent from the ABI or if it does not take
+ * exactly one input — both indicate the caller picked the wrong helper.
+ */
+export declare function getAbiFromUnitFunction<TAbi extends Abi, TName extends Extract<TAbi[number], {
+    type: 'function';
+}>['name']>(abi: TAbi, name: TName): AbiFunctionByName<TAbi, TName>['inputs'][0];
+export {};

package/dist/contracts/utils.js

@@ -0,0 +1,28 @@
+import { encodePacked, getAddress, keccak256 } from 'viem';
+/**
+ * Compute the shield-internal asset ID for an ERC-20 token.
+ * Matches `Erc20Adapter.getAssetId()` on-chain:
+ * `keccak256(abi.encodePacked(tokenAddress, "Erc20"))`
+ */
+export function computeErc20AssetId(tokenAddress) {
+    return keccak256(encodePacked(['address', 'string'], [getAddress(tokenAddress), 'Erc20']));
+}
+/**
+ * Return the sole input parameter of an ABI function that takes exactly one
+ * argument — the "wrap a single struct" convention this codebase uses to
+ * piggyback Solidity types onto the ABI. Pulls the otherwise-arbitrary
+ * `.inputs[0]` lookup out of every call site so `decodeAbiParameters` /
+ * `encodeAbiParameters` invocations read as their domain meaning.
+ *
+ * Throws if the function is absent from the ABI or if it does not take
+ * exactly one input — both indicate the caller picked the wrong helper.
+ */
+export function getAbiFromUnitFunction(abi, name) {
+    const fn = abi.find((item) => item.type === 'function' && item.name === name);
+    if (!fn)
+        throw new Error(`abi missing function "${name}"`);
+    if (fn.inputs.length !== 1) {
+        throw new Error(`abi function "${name}" expected to take 1 input, got ${fn.inputs.length}`);
+    }
+    return fn.inputs[0];
+}

package/dist/errors.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Lightweight tagged-error helper compatible with effect's `Data.TaggedError`
+ * shape (`_tag` discriminator + `Error` subclass) without taking `effect` as
+ * a runtime dependency.
+ *
+ * Usage mirrors `Data.TaggedError` so consumers using effect can catch these
+ * with `Effect.catchTag` (which keys on the `_tag` field) and consumers
+ * without effect can use plain `try`/`catch` with `instanceof` or `_tag`
+ * discrimination.
+ *
+ *   class MyError extends TaggedError('MyError')<{ readonly foo: string }> {}
+ *
+ *   throw new MyError({ foo: 'bar', message: 'optional human message' });
+ *
+ *   try { ... } catch (err) {
+ *     if (err instanceof MyError) { ... }
+ *     // or: if (err && typeof err === 'object' && err._tag === 'MyError')
+ *   }
+ *
+ * The optional `message` field (if provided in the args object) populates
+ * `Error.prototype.message`; otherwise the tag is used as the message.
+ */
+type TaggedErrorConstructor<Tag extends string> = new <Fields extends Record<string, unknown>>(fields: Fields) => Error & {
+    readonly _tag: Tag;
+} & Readonly<Fields>;
+export declare function TaggedError<Tag extends string>(tag: Tag): TaggedErrorConstructor<Tag>;
+declare const ShieldError_base: TaggedErrorConstructor<"ShieldError">;
+/**
+ * Generic application-level error from the shield covalidator. Prefer a
+ * specific tagged error where the failure mode is well-defined; reach for
+ * `ShieldError` only as a last resort.
+ */
+export declare class ShieldError extends ShieldError_base<{
+    readonly message: string;
+}> {
+}
+declare const CovalidatorError_base: TaggedErrorConstructor<"CovalidatorError">;
+/**
+ * The covalidator returned a payload whose decrypted error message is set;
+ * the inner `errorMessage` carries server-side detail.
+ */
+export declare class CovalidatorError extends CovalidatorError_base<{
+    readonly message: string;
+}> {
+}
+declare const MissingWalletAccount_base: TaggedErrorConstructor<"MissingWalletAccount">;
+/** A required wallet account was missing from the WalletClient. */
+export declare class MissingWalletAccount extends MissingWalletAccount_base<{
+    readonly message: string;
+}> {
+}
+declare const MalformedProto_base: TaggedErrorConstructor<"MalformedProto">;
+/** A required field was missing from a decoded protobuf message. */
+export declare class MalformedProto extends MalformedProto_base<{
+    readonly message: string;
+    readonly field: string;
+}> {
+}
+declare const UnknownProtoTag_base: TaggedErrorConstructor<"UnknownProtoTag">;
+/** A protobuf oneof or tag was unrecognized. */
+export declare class UnknownProtoTag extends UnknownProtoTag_base<{
+    readonly message: string;
+    readonly tag: string;
+}> {
+}
+declare const InvalidContractReturnType_base: TaggedErrorConstructor<"InvalidContractReturnType">;
+/** A contract read or simulation returned a value of the wrong runtime type. */
+export declare class InvalidContractReturnType extends InvalidContractReturnType_base<{
+    readonly message: string;
+    readonly functionName: string;
+    readonly expectedType: string;
+}> {
+}
+declare const BundlerGasEstimateIncomplete_base: TaggedErrorConstructor<"BundlerGasEstimateIncomplete">;
+/** Bundler returned an incomplete gas estimate — paymaster sub-limits absent. */
+export declare class BundlerGasEstimateIncomplete extends BundlerGasEstimateIncomplete_base<{
+    readonly message: string;
+    readonly missingFields: readonly string[];
+}> {
+}
+declare const TransactionReverted_base: TaggedErrorConstructor<"TransactionReverted">;
+/** A transaction was sent but reverted on chain. */
+export declare class TransactionReverted extends TransactionReverted_base<{
+    readonly message: string;
+    readonly operation: string;
+}> {
+}
+declare const InvalidTransactionReceipt_base: TaggedErrorConstructor<"InvalidTransactionReceipt">;
+/** A transaction receipt lacked an expected field (block number, log, topic, ...). */
+export declare class InvalidTransactionReceipt extends InvalidTransactionReceipt_base<{
+    readonly message: string;
+}> {
+}
+declare const MissingEventLog_base: TaggedErrorConstructor<"MissingEventLog">;
+/** An expected event log was missing from a transaction receipt. */
+export declare class MissingEventLog extends MissingEventLog_base<{
+    readonly message: string;
+    readonly eventName: string;
+}> {
+}
+declare const MalformedEventLog_base: TaggedErrorConstructor<"MalformedEventLog">;
+/** An event log was present but its shape (topics, data) was unexpected. */
+export declare class MalformedEventLog extends MalformedEventLog_base<{
+    readonly message: string;
+    readonly eventName: string;
+}> {
+}
+declare const EncryptionError_base: TaggedErrorConstructor<"EncryptionError">;
+/** Encryption / decryption / key-handling failed in a recoverable way. */
+export declare class EncryptionError extends EncryptionError_base<{
+    readonly message: string;
+}> {
+}
+declare const HpkeKeyPairDerivationFailure_base: TaggedErrorConstructor<"HpkeKeyPairDerivationFailure">;
+/**
+ * Failure deriving an HPKE keypair from input keying material. The
+ * `message` carries any underlying `@hpke/hybridkem-x-wing` exception text
+ * folded in at construction (their error classes are not exported as
+ * public API, so we can't preserve them as a typed `cause`).
+ */
+export declare class HpkeKeyPairDerivationFailure extends HpkeKeyPairDerivationFailure_base<{
+    readonly message: string;
+}> {
+}
+export {};

package/dist/errors.js

@@ -0,0 +1,91 @@
+/**
+ * Lightweight tagged-error helper compatible with effect's `Data.TaggedError`
+ * shape (`_tag` discriminator + `Error` subclass) without taking `effect` as
+ * a runtime dependency.
+ *
+ * Usage mirrors `Data.TaggedError` so consumers using effect can catch these
+ * with `Effect.catchTag` (which keys on the `_tag` field) and consumers
+ * without effect can use plain `try`/`catch` with `instanceof` or `_tag`
+ * discrimination.
+ *
+ *   class MyError extends TaggedError('MyError')<{ readonly foo: string }> {}
+ *
+ *   throw new MyError({ foo: 'bar', message: 'optional human message' });
+ *
+ *   try { ... } catch (err) {
+ *     if (err instanceof MyError) { ... }
+ *     // or: if (err && typeof err === 'object' && err._tag === 'MyError')
+ *   }
+ *
+ * The optional `message` field (if provided in the args object) populates
+ * `Error.prototype.message`; otherwise the tag is used as the message.
+ */
+export function TaggedError(tag) {
+    class TaggedErrorImpl extends Error {
+        _tag = tag;
+        constructor(fields) {
+            const message = typeof fields.message === 'string' ? fields.message : tag;
+            super(message);
+            this.name = tag;
+            Object.assign(this, fields);
+        }
+    }
+    // The runtime class accepts any record; the cast exposes the phantom-typed
+    // generic constructor that mirrors Data.TaggedError's API.
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    return TaggedErrorImpl;
+}
+/**
+ * Generic application-level error from the shield covalidator. Prefer a
+ * specific tagged error where the failure mode is well-defined; reach for
+ * `ShieldError` only as a last resort.
+ */
+export class ShieldError extends TaggedError('ShieldError') {
+}
+// ---------------------------------------------------------------------------
+// SDK-wide tagged errors
+// ---------------------------------------------------------------------------
+/**
+ * The covalidator returned a payload whose decrypted error message is set;
+ * the inner `errorMessage` carries server-side detail.
+ */
+export class CovalidatorError extends TaggedError('CovalidatorError') {
+}
+/** A required wallet account was missing from the WalletClient. */
+export class MissingWalletAccount extends TaggedError('MissingWalletAccount') {
+}
+/** A required field was missing from a decoded protobuf message. */
+export class MalformedProto extends TaggedError('MalformedProto') {
+}
+/** A protobuf oneof or tag was unrecognized. */
+export class UnknownProtoTag extends TaggedError('UnknownProtoTag') {
+}
+/** A contract read or simulation returned a value of the wrong runtime type. */
+export class InvalidContractReturnType extends TaggedError('InvalidContractReturnType') {
+}
+/** Bundler returned an incomplete gas estimate — paymaster sub-limits absent. */
+export class BundlerGasEstimateIncomplete extends TaggedError('BundlerGasEstimateIncomplete') {
+}
+/** A transaction was sent but reverted on chain. */
+export class TransactionReverted extends TaggedError('TransactionReverted') {
+}
+/** A transaction receipt lacked an expected field (block number, log, topic, ...). */
+export class InvalidTransactionReceipt extends TaggedError('InvalidTransactionReceipt') {
+}
+/** An expected event log was missing from a transaction receipt. */
+export class MissingEventLog extends TaggedError('MissingEventLog') {
+}
+/** An event log was present but its shape (topics, data) was unexpected. */
+export class MalformedEventLog extends TaggedError('MalformedEventLog') {
+}
+/** Encryption / decryption / key-handling failed in a recoverable way. */
+export class EncryptionError extends TaggedError('EncryptionError') {
+}
+/**
+ * Failure deriving an HPKE keypair from input keying material. The
+ * `message` carries any underlying `@hpke/hybridkem-x-wing` exception text
+ * folded in at construction (their error classes are not exported as
+ * public API, so we can't preserve them as a typed `cause`).
+ */
+export class HpkeKeyPairDerivationFailure extends TaggedError('HpkeKeyPairDerivationFailure') {
+}

package/dist/generated/inco/shield/v2/conductor_connect.d.ts

@@ -0,0 +1,137 @@
+import { EncryptedEnvelope, EncryptedResponse } from "./types_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+/**
+ * ConductorService provides the conductor's API, accessible to clients.
+ *
+ * The most important method is Draft() - see below.
+ *
+ * @generated from service inco.shield.v2.ConductorService
+ */
+export declare const ConductorService: {
+    readonly typeName: "inco.shield.v2.ConductorService";
+    readonly methods: {
+        /**
+         * Draft creates a Cheque for the given intent.
+         * The conductor receives an encrypted intent from the user, assigns it
+         * a trace index, and forwards it to the enclave via SendTrace.
+         * The returned cheque is correlated to the waiting user request via the trace index.
+         *
+         * Envelope payload: DraftRequest.
+         * Response payload: Cheque, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.Draft
+         */
+        readonly draft: {
+            readonly name: "Draft";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * GetBalance returns the balance for an account and asset.
+         * Envelope payload: GetBalanceRequest.
+         * Response payload: GetBalanceResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetBalance
+         */
+        readonly getBalance: {
+            readonly name: "GetBalance";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * RequestPermissionAttestation redeems an owner-signed PermissionIntent
+         * and returns a TEE-signed PermissionAttestation.
+         * Envelope payload: RequestPermissionAttestationRequest.
+         * Response payload: RequestPermissionAttestationResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.RequestPermissionAttestation
+         */
+        readonly requestPermissionAttestation: {
+            readonly name: "RequestPermissionAttestation";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * RequestDepositAttestation generates a TEE attestation signature for the
+         * on-chain `deposit()` call. Mitigates TOB-INCOEH-1 front-running.
+         * Envelope payload: RequestDepositAttestationRequest.
+         * Response payload: RequestDepositAttestationResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.RequestDepositAttestation
+         */
+        readonly requestDepositAttestation: {
+            readonly name: "RequestDepositAttestation";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * GetPermissionsByOwner returns all permissions granted by an owner.
+         * Envelope payload: GetPermissionsByOwnerRequest.
+         * Response payload: GetPermissionsResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetPermissionsByOwner
+         */
+        readonly getPermissionsByOwner: {
+            readonly name: "GetPermissionsByOwner";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * GetPermissionsBySpender returns all permissions granted to a spender.
+         * Envelope payload: GetPermissionsBySpenderRequest.
+         * Response payload: GetPermissionsResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetPermissionsBySpender
+         */
+        readonly getPermissionsBySpender: {
+            readonly name: "GetPermissionsBySpender";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * GetPermissionDetails returns detailed information about a specific permission.
+         * Envelope payload: GetPermissionDetailsRequest.
+         * Response payload: GetPermissionDetailsResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetPermissionDetails
+         */
+        readonly getPermissionDetails: {
+            readonly name: "GetPermissionDetails";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * GetSpendable returns a single clamped spend ceiling for a delegated permission.
+         * Envelope payload: GetSpendableRequest.
+         * Response payload: GetSpendableResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetSpendable
+         */
+        readonly getSpendable: {
+            readonly name: "GetSpendable";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+        /**
+         * GetOwnerGeneration returns the current generation for an owner (from observed on-chain events).
+         * Envelope payload: GetOwnerGenerationRequest.
+         * Response payload: GetOwnerGenerationResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetOwnerGeneration
+         */
+        readonly getOwnerGeneration: {
+            readonly name: "GetOwnerGeneration";
+            readonly I: typeof EncryptedEnvelope;
+            readonly O: typeof EncryptedResponse;
+            readonly kind: MethodKind.Unary;
+        };
+    };
+};

package/dist/generated/inco/shield/v2/conductor_connect.js

@@ -0,0 +1,141 @@
+// @generated by protoc-gen-connect-es v1.7.0 with parameter "target=ts,import_extension=.js"
+// @generated from file inco/shield/v2/conductor.proto (package inco.shield.v2, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+import { EncryptedEnvelope, EncryptedResponse } from "./types_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+/**
+ * ConductorService provides the conductor's API, accessible to clients.
+ *
+ * The most important method is Draft() - see below.
+ *
+ * @generated from service inco.shield.v2.ConductorService
+ */
+export const ConductorService = {
+    typeName: "inco.shield.v2.ConductorService",
+    methods: {
+        /**
+         * Draft creates a Cheque for the given intent.
+         * The conductor receives an encrypted intent from the user, assigns it
+         * a trace index, and forwards it to the enclave via SendTrace.
+         * The returned cheque is correlated to the waiting user request via the trace index.
+         *
+         * Envelope payload: DraftRequest.
+         * Response payload: Cheque, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.Draft
+         */
+        draft: {
+            name: "Draft",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * GetBalance returns the balance for an account and asset.
+         * Envelope payload: GetBalanceRequest.
+         * Response payload: GetBalanceResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetBalance
+         */
+        getBalance: {
+            name: "GetBalance",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * RequestPermissionAttestation redeems an owner-signed PermissionIntent
+         * and returns a TEE-signed PermissionAttestation.
+         * Envelope payload: RequestPermissionAttestationRequest.
+         * Response payload: RequestPermissionAttestationResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.RequestPermissionAttestation
+         */
+        requestPermissionAttestation: {
+            name: "RequestPermissionAttestation",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * RequestDepositAttestation generates a TEE attestation signature for the
+         * on-chain `deposit()` call. Mitigates TOB-INCOEH-1 front-running.
+         * Envelope payload: RequestDepositAttestationRequest.
+         * Response payload: RequestDepositAttestationResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.RequestDepositAttestation
+         */
+        requestDepositAttestation: {
+            name: "RequestDepositAttestation",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * GetPermissionsByOwner returns all permissions granted by an owner.
+         * Envelope payload: GetPermissionsByOwnerRequest.
+         * Response payload: GetPermissionsResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetPermissionsByOwner
+         */
+        getPermissionsByOwner: {
+            name: "GetPermissionsByOwner",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * GetPermissionsBySpender returns all permissions granted to a spender.
+         * Envelope payload: GetPermissionsBySpenderRequest.
+         * Response payload: GetPermissionsResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetPermissionsBySpender
+         */
+        getPermissionsBySpender: {
+            name: "GetPermissionsBySpender",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * GetPermissionDetails returns detailed information about a specific permission.
+         * Envelope payload: GetPermissionDetailsRequest.
+         * Response payload: GetPermissionDetailsResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetPermissionDetails
+         */
+        getPermissionDetails: {
+            name: "GetPermissionDetails",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * GetSpendable returns a single clamped spend ceiling for a delegated permission.
+         * Envelope payload: GetSpendableRequest.
+         * Response payload: GetSpendableResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetSpendable
+         */
+        getSpendable: {
+            name: "GetSpendable",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+        /**
+         * GetOwnerGeneration returns the current generation for an owner (from observed on-chain events).
+         * Envelope payload: GetOwnerGenerationRequest.
+         * Response payload: GetOwnerGenerationResponse, AEAD-encrypted with response_key.
+         *
+         * @generated from rpc inco.shield.v2.ConductorService.GetOwnerGeneration
+         */
+        getOwnerGeneration: {
+            name: "GetOwnerGeneration",
+            I: EncryptedEnvelope,
+            O: EncryptedResponse,
+            kind: MethodKind.Unary,
+        },
+    }
+};

package/dist/generated/inco/shield/v2/deposit_pb.d.ts

@@ -0,0 +1,103 @@
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+import { Address } from "./types_pb.js";
+/**
+ * RequestDepositAttestationRequest is the envelope payload for RequestDepositAttestation.
+ *
+ * @generated from message inco.shield.v2.RequestDepositAttestationRequest
+ */
+export declare class RequestDepositAttestationRequest extends Message<RequestDepositAttestationRequest> {
+    /**
+     * Plaintext recipient address — TEE encrypts this to produce on-chain to_ciphertext.
+     *
+     * @generated from field: inco.shield.v2.Address recipient = 1;
+     */
+    recipient?: Address;
+    /**
+     * The asset adapter address (20 bytes, encoded as an Address).
+     *
+     * @generated from field: inco.shield.v2.Address asset_adapter = 2;
+     */
+    assetAdapter?: Address;
+    /**
+     * Asset identification data (e.g. abi.encode(tokenAddress)).
+     *
+     * @generated from field: bytes asset_identification_args = 3;
+     */
+    assetIdentificationArgs: Uint8Array<ArrayBuffer>;
+    /**
+     * Optional memo.
+     *
+     * @generated from field: bytes memo = 4;
+     */
+    memo: Uint8Array<ArrayBuffer>;
+    /**
+     * Optional escape hatch data.
+     *
+     * @generated from field: bytes escape_hatch = 5;
+     */
+    escapeHatch: Uint8Array<ArrayBuffer>;
+    /**
+     * Symmetric key for AEAD-encrypting the response.
+     *
+     * @generated from field: bytes response_key = 6;
+     */
+    responseKey: Uint8Array<ArrayBuffer>;
+    /**
+     * Depositor's EIP-712 signature over the DepositAttestationRequest digest
+     * (covers depositor, recipient, asset_adapter, asset_identification_args,
+     * memo, escape_hatch).
+     *
+     * @generated from field: bytes eip712_signature = 7;
+     */
+    eip712Signature: Uint8Array<ArrayBuffer>;
+    /**
+     * Depositor address (must match eip712_signature signer).
+     *
+     * @generated from field: inco.shield.v2.Address depositor = 9;
+     */
+    depositor?: Address;
+    constructor(data?: PartialMessage<RequestDepositAttestationRequest>);
+    static readonly runtime: typeof proto3;
+    static readonly typeName = "inco.shield.v2.RequestDepositAttestationRequest";
+    static readonly fields: FieldList;
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): RequestDepositAttestationRequest;
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): RequestDepositAttestationRequest;
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): RequestDepositAttestationRequest;
+    static equals(a: RequestDepositAttestationRequest | PlainMessage<RequestDepositAttestationRequest> | undefined, b: RequestDepositAttestationRequest | PlainMessage<RequestDepositAttestationRequest> | undefined): boolean;
+}
+/**
+ * RequestDepositAttestationResponse returns the TEE-generated ciphertext and attestation signature.
+ * Serialized into an EncryptedResponse (AEAD-encrypted with the caller's response_key).
+ *
+ * @generated from message inco.shield.v2.RequestDepositAttestationResponse
+ */
+export declare class RequestDepositAttestationResponse extends Message<RequestDepositAttestationResponse> {
+    /**
+     * TEE signature over the DepositAttestation EIP-712 digest.
+     *
+     * @generated from field: bytes tee_signature = 1;
+     */
+    teeSignature: Uint8Array<ArrayBuffer>;
+    /**
+     * Error message if the request failed.
+     *
+     * @generated from field: string error_message = 2;
+     */
+    errorMessage: string;
+    /**
+     * TEE-generated AEAD-encrypted recipient address (the on-chain `Deposit.toCiphertext`),
+     * sealed under the quorum-shared enclave key with a fresh random nonce.
+     *
+     * @generated from field: bytes to_ciphertext = 3;
+     */
+    toCiphertext: Uint8Array<ArrayBuffer>;
+    constructor(data?: PartialMessage<RequestDepositAttestationResponse>);
+    static readonly runtime: typeof proto3;
+    static readonly typeName = "inco.shield.v2.RequestDepositAttestationResponse";
+    static readonly fields: FieldList;
+    static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): RequestDepositAttestationResponse;
+    static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): RequestDepositAttestationResponse;
+    static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): RequestDepositAttestationResponse;
+    static equals(a: RequestDepositAttestationResponse | PlainMessage<RequestDepositAttestationResponse> | undefined, b: RequestDepositAttestationResponse | PlainMessage<RequestDepositAttestationResponse> | undefined): boolean;
+}