@integraledger/lcp-binding-canton-x402 0.17.0 → 0.18.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @integraledger/lcp-binding-canton-x402
 
+## 0.18.1
+
+### Patch Changes
+
+- @integraledger/lcp-binding-core@0.18.1
+  - @integraledger/lcp-kernel@0.18.1
+
+## 0.18.0
+
+### Patch Changes
+
+- @integraledger/lcp-binding-core@0.18.0
+  - @integraledger/lcp-kernel@0.18.0
+
 ## 0.17.0
 
 ### Patch Changes

package/README.md

@@ -93,7 +93,9 @@ carrier is used. No private key is needed; a party's cooperation is.
 
 **Not forward-indexable.** A participant's update stream is one participant's view, not a chain-global
 index, and the memo is a metadata value rather than an indexed key. `enumerate` scans one party's visible
-transfers and says so.
+transfers and says so — and its `limit` is required, because the scan depth is a bound somebody has to
+choose and this package does not even guess the endpoint PATH it reads from. Left optional it was
+forwarded verbatim, so the deployment's own default governed and a settlement past it came back as `[]`.
 
 **Scoped to x402.** The manifest declares `protocol: "x402"` because the field, its 256-byte ceiling and
 its enforcement are all x402's. A Canton Coin payment settled outside x402 does not get this carrier — and

package/dist/adapter.d.ts

@@ -66,8 +66,18 @@ export interface CantonX402Settlement {
 export interface CantonX402Reader {
     /** One settled transfer by ledger update id, or `null` if the participant has no such update. */
     transferView(updateId: string): Promise<CantonX402TransferView | null>;
-    /** Update ids of transfers visible to `party`, most recent first. A participant view, not an index. */
-    transfersFor(party: string, limit?: number): Promise<string[]>;
+    /**
+     * Update ids of transfers visible to `party`, most recent first. A participant view, not an index.
+     *
+     * ⛔ **`limit` IS REQUIRED, AND THAT IS THIS RAIL'S ANSWER TO THE SCAN QUESTION.** It used to be
+     * optional and forwarded verbatim, so an absent one handed the depth of the scan to whatever the
+     * deployment's endpoint defaults to — and a settlement past that default came back as an empty array,
+     * indistinguishable from "this party has none". This package will not invent the bound either: it does
+     * not even guess the PATH this call goes to ({@link CantonX402ReaderConfig.transfersPath}), so it has no
+     * standing to guess that endpoint's page size. The caller names the depth, and a full result is then
+     * exactly what the caller asked for rather than a truncation nobody chose.
+     */
+    transfersFor(party: string, limit: number): Promise<string[]>;
 }
 /** The Canton x402 rail's surface. `propose` returns an `extra` fragment for the SELLER to merge into its
  *  `PaymentRequirements` — this rail's weld is committed by the seller and echoed by the payer, unlike the
@@ -86,8 +96,10 @@ export interface CantonX402Adapter {
     recover(ref: CantonX402SettlementRef, reader: CantonX402Reader): Promise<Outcome<`0x${string}`>>;
     /** Report the `settled` transition, with the asset the weld is attached to. */
     observe(ref: CantonX402SettlementRef, reader: CantonX402Reader): Promise<Outcome<CantonX402Settlement>>;
-    /** Scan one party's visible transfers for `atrHash` — a participant view, never a global index. */
-    enumerate(atrHash: string, party: string, reader: CantonX402Reader, limit?: number): Promise<CantonX402SettlementRef[]>;
+    /** Scan one party's visible transfers for `atrHash` — a participant view, never a global index.
+     *  `limit` is the scan DEPTH and it is REQUIRED: see {@link CantonX402Reader.transfersFor} for why this
+     *  package will not pick it, and why an absent one used to mean the endpoint picked instead. */
+    enumerate(atrHash: string, party: string, reader: CantonX402Reader, limit: number): Promise<CantonX402SettlementRef[]>;
 }
 /** Config for a live participant reader over a deployment's HTTP ledger surface. */
 export interface CantonX402ReaderConfig {
@@ -118,7 +130,29 @@ export interface CantonX402ReaderConfig {
      * it shipped as `/v1/updates/transfers`.
      */
     transfersPath: string;
+    /**
+     * Per-request deadline in ms; defaults to {@link CANTON_X402_DEFAULT_TIMEOUT_MS}.
+     *
+     * ⛔⛔ **`fetch` HAS NO TIMEOUT OF ITS OWN, AND NOTHING HERE SUPPLIED ONE.** A participant that accepted
+     * the connection and never answered hung `recover`, `observe` and `enumerate` FOREVER — no error, no
+     * refusal, no return. On a surface whose whole contract is to hand back an `Outcome` that is worse than
+     * a failure: a caller can retry a refusal and cannot retry a promise that never settles. It bites hardest
+     * on `enumerate`, which reads every listed update in a loop, so one unanswered transfer stalls the scan
+     * of a party's entire history. The endpoint is a counterparty's own service — this package does not even
+     * guess its PATH, so it certainly cannot assume its liveness.
+     */
+    timeoutMs?: number;
 }
+/**
+ * The default per-request deadline on a participant HTTP call — the same 10s `evidence`'s hardened
+ * resolver uses, because it is the same kind of budget: one round trip to a counterparty's endpoint, not
+ * a long-poll and not a stream.
+ *
+ * Deliberately generous rather than tight. A participant under load legitimately takes seconds to answer,
+ * and a deadline below what the endpoint needs turns its slow honest answers into transport faults — a
+ * different wrong answer, not a fix.
+ */
+export declare const CANTON_X402_DEFAULT_TIMEOUT_MS = 10000;
 /**
  * A live `CantonX402Reader` over a participant's HTTP ledger surface, PURE `fetch` — no Daml SDK.
  *

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAIhF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,kGAAkG;IAClG,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACvE,uGAAuG;IACvG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAChE;AAED;;;6GAG6G;AAC7G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,sGAAsG;IACtG,OAAO,CACL,GAAG,EAAE,uBAAuB,EAC5B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;IACnC,+EAA+E;IAC/E,OAAO,CACL,GAAG,EAAE,uBAAuB,EAC5B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC1C,mGAAmG;IACnG,SAAS,CACP,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,EACxB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACvC;AAED,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,sBAAsB,GAC1B,gBAAgB,CAsDlB;AAED;;;8GAG8G;AAC9G,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,GACxB,iBAAiB,CA4FnB"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAIhF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,kGAAkG;IAClG,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACvE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/D;AAED;;;6GAG6G;AAC7G,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,sGAAsG;IACtG,OAAO,CACL,GAAG,EAAE,uBAAuB,EAC5B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;IACnC,+EAA+E;IAC/E,OAAO,CACL,GAAG,EAAE,uBAAuB,EAC5B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC1C;;oGAEgG;IAChG,SAAS,CACP,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACvC;AAED,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,sBAAsB,GAC1B,gBAAgB,CAuElB;AAyBD;;;8GAG8G;AAC9G,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,GACxB,iBAAiB,CAsHnB"}

package/dist/adapter.js

@@ -1,5 +1,15 @@
 import { atrHashEquals, isAtrHash } from "@integraledger/lcp-kernel";
 import { readTransferMemoAtrHash, x402MemoRequirement } from "./memo.js";
+/**
+ * The default per-request deadline on a participant HTTP call — the same 10s `evidence`'s hardened
+ * resolver uses, because it is the same kind of budget: one round trip to a counterparty's endpoint, not
+ * a long-poll and not a stream.
+ *
+ * Deliberately generous rather than tight. A participant under load legitimately takes seconds to answer,
+ * and a deadline below what the endpoint needs turns its slow honest answers into transport faults — a
+ * different wrong answer, not a fix.
+ */
+export const CANTON_X402_DEFAULT_TIMEOUT_MS = 10_000;
 /**
  * A live `CantonX402Reader` over a participant's HTTP ledger surface, PURE `fetch` — no Daml SDK.
  *
@@ -24,6 +34,7 @@ export function makeCantonX402Reader(cfg) {
         throw new Error("makeCantonX402Reader: transferPath is empty — this package does not guess your participant's update endpoint");
     if (cfg.transfersPath.length === 0)
         throw new Error("makeCantonX402Reader: transfersPath is empty — this package does not guess your participant's update endpoint");
+    const timeoutMs = cfg.timeoutMs ?? CANTON_X402_DEFAULT_TIMEOUT_MS;
     async function ledgerCall(path, body) {
         const res = await fetch(`${cfg.jsonLedgerUrl}${path}`, {
             method: "POST",
@@ -32,6 +43,10 @@ export function makeCantonX402Reader(cfg) {
                 authorization: `Bearer ${cfg.bearerJwt}`,
             },
             body: JSON.stringify(body),
+            // Without this the call never comes back on a participant that accepts and does not answer — see
+            // CantonX402ReaderConfig.timeoutMs. `AbortSignal.timeout` rejects with a `TimeoutError`, a throw out
+            // of the reader port and therefore a LOUD failure, as every other transport fault here is.
+            signal: AbortSignal.timeout(timeoutMs),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => "");
@@ -50,13 +65,44 @@ export function makeCantonX402Reader(cfg) {
             return result ?? null;
         },
         async transfersFor(party, limit) {
-            return ledgerCall(cfg.transfersPath, {
+            const result = await ledgerCall(cfg.transfersPath, {
                 party,
-                ...(limit !== undefined ? { limit } : {}),
+                limit,
             });
+            // ⛔⛔ **A `result: null` PASSED THE ENVELOPE CHECK AND CAME BACK AS AN ARRAY.** `ledgerCall` refuses
+            // an ABSENT `result` and `null` is present, so this returned `null` under a declared `string[]` and
+            // `enumerate`'s `for…of` threw `TypeError: updateIds is not iterable` — an exception out of a
+            // refuse-don't-throw surface, raised by the shape of a counterparty's response. The array is the
+            // check rather than not-null, and so is the ELEMENT type: a list carrying a `null` id would be
+            // POSTed straight back as `{ updateId: null }` and read as a transfer that is merely absent.
+            if (!Array.isArray(result) || result.some((id) => typeof id !== "string"))
+                throw new Error(`Daml ${cfg.transfersPath} returned a result that is not an array of update ids — this endpoint is not answering the transfer-listing shape this reader was pointed at`);
+            return result;
         },
     };
 }
+/**
+ * The asset fields a transfer view must actually carry, named — empty when the view is complete.
+ *
+ * Non-empty STRINGS, not merely present values: `receiver: ""` names no party and `amount: ""` is no
+ * quantity, and a reader that fills its required fields with blanks has answered the type checker rather
+ * than the question. `instrumentId` is checked through both of its own halves for the same reason — a
+ * `{ admin: "", id: "" }` identifies no instrument.
+ */
+function missingAssetFields(view) {
+    const text = (v) => typeof v === "string" && v.length > 0;
+    const out = [];
+    if (!text(view.receiver))
+        out.push("receiver");
+    if (!text(view.amount))
+        out.push("amount");
+    if (view.instrumentId === null ||
+        typeof view.instrumentId !== "object" ||
+        !text(view.instrumentId.admin) ||
+        !text(view.instrumentId.id))
+        out.push("instrumentId");
+    return out;
+}
 /** Construct the Canton x402 adapter. **The manifest is injected, not baked in** — pass this package's own
  *  `CANTON_X402_MANIFEST`; a manifest whose `rail` is not `"canton:x402"` throws, because an adapter over
  *  another rail's manifest would publish that rail's claims as its own. Nothing has to be deployed first:
@@ -88,6 +134,26 @@ export function createCantonX402Adapter(manifest) {
                 code: "canton/no-lcp-memo",
                 detail: `the transfer at updateId ${ref.updateId} carries no well-formed atrHash under x402.memo`,
             };
+        // ⛔⛔ **THE MEMO WAS CHECKED AND THE ASSET WAS NOT, UNDER TYPES THAT SAID BOTH WERE THERE.**
+        // `CantonX402TransferView` declares `receiver`, `amount` and `instrumentId` as REQUIRED, but the view
+        // comes off a counterparty's HTTP endpoint through `JSON.parse` — a shape no type checks at runtime —
+        // so a reader that omitted them handed back `undefined` and this function copied it into a
+        // `CantonX402Settlement` whose own types promise strings. The result is a settled verdict carrying
+        // `receiver: undefined`, which a consumer then compares against the merchant it expected and finds
+        // unequal, or renders, or writes into a record.
+        //
+        // ⭐ And it is what makes `assetBinding: "carried"` in this manifest a TRUE claim rather than a hopeful
+        // one. That axis says a consumer can reach the asset the weld is attached to. Two lines above, an
+        // absent memo refuses loudly by name; the asset fields are the other half of the same promise and were
+        // not checked at all. One shape of missing evidence was a refusal and the other was a success.
+        const missing = missingAssetFields(view);
+        if (missing.length > 0)
+            return {
+                refused: true,
+                haltClass: "verification-failure",
+                code: "canton/incomplete-transfer-view",
+                detail: `the transfer at updateId ${ref.updateId} carries a well-formed atrHash but no ${missing.join(", ")} — this manifest declares assetBinding "carried", so a settlement whose asset cannot be read is not one this rail can report`,
+            };
         return {
             ok: true,
             value: {
@@ -118,6 +184,10 @@ export function createCantonX402Adapter(manifest) {
             // it would produce is indistinguishable from "this party has no settlements".
             if (!isAtrHash(atrHash))
                 throw new Error(`enumerate: atrHash must be a 0x-prefixed 32-byte value, got "${atrHash}"`);
+            // The same reasoning as the atrHash above, applied to the bound: a scan of zero (or of half a
+            // transfer) returns [], which is the answer that cannot be told apart from "no settlements".
+            if (!Number.isInteger(limit) || limit < 1)
+                throw new Error(`enumerate: limit must be a positive integer — it is the scan DEPTH and this package will not choose it, got ${limit}`);
             const updateIds = await reader.transfersFor(party, limit);
             const out = [];
             for (const updateId of updateIds) {

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA8GzE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAA2B;IAE3B,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,+FAA+F;IAC/F,2EAA2E;IAC3E,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IAEJ,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,IAAa;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,GAAG,CAAC,SAAS,EAAE;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,YAAY,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,qBAAqB,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAChB,QAAgB;YAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,GAAG,CAAC,YAAY,EAChB,EAAE,QAAQ,EAAE,CACb,CAAC;YACF,OAAO,MAAM,IAAI,IAAI,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,KAAc;YAC9C,OAAO,UAAU,CAAW,GAAG,CAAC,aAAa,EAAE;gBAC7C,KAAK;gBACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;8GAG8G;AAC9G,MAAM,UAAU,uBAAuB,CACrC,QAAyB;IAEzB,oGAAoG;IACpG,oGAAoG;IACpG,0FAA0F;IAC1F,yGAAyG;IACzG,gGAAgG;IAChG,uFAAuF;IACvF,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QACjC,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,IAAI,wBAAwB,CACjF,CAAC;IAEJ,6EAA6E;IAC7E,KAAK,UAAU,cAAc,CAC3B,GAA4B,EAC5B,MAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,+CAA+C,GAAG,CAAC,QAAQ,EAAE;aACtE,CAAC;QACJ,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,IAAI;YAClB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,4BAA4B,GAAG,CAAC,QAAQ,iDAAiD;aAClG,CAAC;QACJ,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,OAAO;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QAER,OAAO,CAAC,OAAe;YACrB,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,OAAO,CACX,GAA4B,EAC5B,MAAwB;YAExB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,SAAS,IAAI,UAAU;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,CACL,GAA4B,EAC5B,MAAwB;YAExB,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,SAAS,CACb,OAAe,EACf,KAAa,EACb,MAAwB,EACxB,KAAc;YAEd,iGAAiG;YACjG,8EAA8E;YAC9E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,GAAG,CAC3E,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,GAAG,GAA8B,EAAE,CAAC;YAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxE,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;oBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAsIzE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAA2B;IAE3B,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,+FAA+F;IAC/F,2EAA2E;IAC3E,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;IACJ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IAEJ,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,8BAA8B,CAAC;IAElE,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,IAAa;QACtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,GAAG,CAAC,SAAS,EAAE;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,iGAAiG;YACjG,qGAAqG;YACrG,2FAA2F;YAC3F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,YAAY,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAC/B,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,qBAAqB,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAChB,QAAgB;YAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,GAAG,CAAC,YAAY,EAChB,EAAE,QAAQ,EAAE,CACb,CAAC;YACF,OAAO,MAAM,IAAI,IAAI,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,KAAa;YAC7C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAU,GAAG,CAAC,aAAa,EAAE;gBAC1D,KAAK;gBACL,KAAK;aACN,CAAC,CAAC;YACH,oGAAoG;YACpG,oGAAoG;YACpG,8FAA8F;YAC9F,iGAAiG;YACjG,+FAA+F;YAC/F,6FAA6F;YAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;gBACvE,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,aAAa,8IAA8I,CACxK,CAAC;YACJ,OAAO,MAAkB,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,IAA4B;IACtD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,IACE,IAAI,CAAC,YAAY,KAAK,IAAI;QAC1B,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QACrC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAE3B,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;8GAG8G;AAC9G,MAAM,UAAU,uBAAuB,CACrC,QAAyB;IAEzB,oGAAoG;IACpG,oGAAoG;IACpG,0FAA0F;IAC1F,yGAAyG;IACzG,gGAAgG;IAChG,uFAAuF;IACvF,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;QACjC,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,CAAC,IAAI,wBAAwB,CACjF,CAAC;IAEJ,6EAA6E;IAC7E,KAAK,UAAU,cAAc,CAC3B,GAA4B,EAC5B,MAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,IAAI,KAAK,IAAI;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,+CAA+C,GAAG,CAAC,QAAQ,EAAE;aACtE,CAAC;QACJ,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,IAAI;YAClB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,4BAA4B,GAAG,CAAC,QAAQ,iDAAiD;aAClG,CAAC;QACJ,4FAA4F;QAC5F,sGAAsG;QACtG,sGAAsG;QACtG,2FAA2F;QAC3F,mGAAmG;QACnG,mGAAmG;QACnG,gDAAgD;QAChD,EAAE;QACF,uGAAuG;QACvG,kGAAkG;QAClG,uGAAuG;QACvG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,iCAAiC;gBACvC,MAAM,EAAE,4BAA4B,GAAG,CAAC,QAAQ,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8HAA8H;aAC1O,CAAC;QACJ,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,OAAO;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QAER,OAAO,CAAC,OAAe;YACrB,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,OAAO,CACX,GAA4B,EAC5B,MAAwB;YAExB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,SAAS,IAAI,UAAU;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,CAAC;QAED,OAAO,CACL,GAA4B,EAC5B,MAAwB;YAExB,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,SAAS,CACb,OAAe,EACf,KAAa,EACb,MAAwB,EACxB,KAAa;YAEb,iGAAiG;YACjG,8EAA8E;YAC9E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,GAAG,CAC3E,CAAC;YACJ,8FAA8F;YAC9F,6FAA6F;YAC7F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,+GAA+G,KAAK,EAAE,CACvH,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,GAAG,GAA8B,EAAE,CAAC;YAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxE,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;oBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { type CantonX402Adapter, type CantonX402Reader, type CantonX402ReaderConfig, type CantonX402Settlement, type CantonX402SettlementRef, type CantonX402TransferView, createCantonX402Adapter, makeCantonX402Reader, } from "./adapter.js";
-export { CANTON_X402_MEMO_KEY, CANTON_X402_MEMO_MAX_BYTES, type CantonX402Network, type CantonX402NetworkConfig, getCantonX402Config, } from "./constants.js";
+export { CANTON_X402_DEFAULT_TIMEOUT_MS, type CantonX402Adapter, type CantonX402Reader, type CantonX402ReaderConfig, type CantonX402Settlement, type CantonX402SettlementRef, type CantonX402TransferView, createCantonX402Adapter, makeCantonX402Reader, } from "./adapter.js";
+export { CANTON_X402_COLLECTION_PATH, CANTON_X402_MEMO_KEY, CANTON_X402_MEMO_MAX_BYTES, type CantonX402Network, type CantonX402NetworkConfig, getCantonX402Config, } from "./constants.js";
 export { CANTON_X402_MANIFEST } from "./manifest.js";
 export { decodeTransferMemo, encodeTransferMemo, readTransferMemoAtrHash, x402MemoRequirement, } from "./memo.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
-export { createCantonX402Adapter, makeCantonX402Reader, } from "./adapter.js";
-export { CANTON_X402_MEMO_KEY, CANTON_X402_MEMO_MAX_BYTES, getCantonX402Config, } from "./constants.js";
+export { CANTON_X402_DEFAULT_TIMEOUT_MS, createCantonX402Adapter, makeCantonX402Reader, } from "./adapter.js";
+export { CANTON_X402_COLLECTION_PATH, CANTON_X402_MEMO_KEY, CANTON_X402_MEMO_MAX_BYTES, getCantonX402Config, } from "./constants.js";
 export { CANTON_X402_MANIFEST } from "./manifest.js";
 export { decodeTransferMemo, encodeTransferMemo, readTransferMemoAtrHash, x402MemoRequirement, } from "./memo.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAG1B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAO9B,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAG1B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-binding-canton-x402",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Welds an ATR hash into a Canton Coin settlement over x402's exact scheme.",
   "keywords": [
     "lcp",
@@ -43,8 +43,8 @@
   },
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-canton-x402#readme",
   "dependencies": {
-    "@integraledger/lcp-binding-core": "0.17.0",
-    "@integraledger/lcp-kernel": "0.17.0"
+    "@integraledger/lcp-binding-core": "0.18.1",
+    "@integraledger/lcp-kernel": "0.18.1"
   },
   "devDependencies": {
     "@types/node": "24.13.3",

package/src/adapter.ts

@@ -66,8 +66,18 @@ export interface CantonX402Settlement {
 export interface CantonX402Reader {
   /** One settled transfer by ledger update id, or `null` if the participant has no such update. */
   transferView(updateId: string): Promise<CantonX402TransferView | null>;
-  /** Update ids of transfers visible to `party`, most recent first. A participant view, not an index. */
-  transfersFor(party: string, limit?: number): Promise<string[]>;
+  /**
+   * Update ids of transfers visible to `party`, most recent first. A participant view, not an index.
+   *
+   * ⛔ **`limit` IS REQUIRED, AND THAT IS THIS RAIL'S ANSWER TO THE SCAN QUESTION.** It used to be
+   * optional and forwarded verbatim, so an absent one handed the depth of the scan to whatever the
+   * deployment's endpoint defaults to — and a settlement past that default came back as an empty array,
+   * indistinguishable from "this party has none". This package will not invent the bound either: it does
+   * not even guess the PATH this call goes to ({@link CantonX402ReaderConfig.transfersPath}), so it has no
+   * standing to guess that endpoint's page size. The caller names the depth, and a full result is then
+   * exactly what the caller asked for rather than a truncation nobody chose.
+   */
+  transfersFor(party: string, limit: number): Promise<string[]>;
 }
 
 /** The Canton x402 rail's surface. `propose` returns an `extra` fragment for the SELLER to merge into its
@@ -91,12 +101,14 @@ export interface CantonX402Adapter {
     ref: CantonX402SettlementRef,
     reader: CantonX402Reader,
   ): Promise<Outcome<CantonX402Settlement>>;
-  /** Scan one party's visible transfers for `atrHash` — a participant view, never a global index. */
+  /** Scan one party's visible transfers for `atrHash` — a participant view, never a global index.
+   *  `limit` is the scan DEPTH and it is REQUIRED: see {@link CantonX402Reader.transfersFor} for why this
+   *  package will not pick it, and why an absent one used to mean the endpoint picked instead. */
   enumerate(
     atrHash: string,
     party: string,
     reader: CantonX402Reader,
-    limit?: number,
+    limit: number,
   ): Promise<CantonX402SettlementRef[]>;
 }
 
@@ -129,8 +141,31 @@ export interface CantonX402ReaderConfig {
    * it shipped as `/v1/updates/transfers`.
    */
   transfersPath: string;
+  /**
+   * Per-request deadline in ms; defaults to {@link CANTON_X402_DEFAULT_TIMEOUT_MS}.
+   *
+   * ⛔⛔ **`fetch` HAS NO TIMEOUT OF ITS OWN, AND NOTHING HERE SUPPLIED ONE.** A participant that accepted
+   * the connection and never answered hung `recover`, `observe` and `enumerate` FOREVER — no error, no
+   * refusal, no return. On a surface whose whole contract is to hand back an `Outcome` that is worse than
+   * a failure: a caller can retry a refusal and cannot retry a promise that never settles. It bites hardest
+   * on `enumerate`, which reads every listed update in a loop, so one unanswered transfer stalls the scan
+   * of a party's entire history. The endpoint is a counterparty's own service — this package does not even
+   * guess its PATH, so it certainly cannot assume its liveness.
+   */
+  timeoutMs?: number;
 }
 
+/**
+ * The default per-request deadline on a participant HTTP call — the same 10s `evidence`'s hardened
+ * resolver uses, because it is the same kind of budget: one round trip to a counterparty's endpoint, not
+ * a long-poll and not a stream.
+ *
+ * Deliberately generous rather than tight. A participant under load legitimately takes seconds to answer,
+ * and a deadline below what the endpoint needs turns its slow honest answers into transport faults — a
+ * different wrong answer, not a fix.
+ */
+export const CANTON_X402_DEFAULT_TIMEOUT_MS = 10_000;
+
 /**
  * A live `CantonX402Reader` over a participant's HTTP ledger surface, PURE `fetch` — no Daml SDK.
  *
@@ -162,6 +197,8 @@ export function makeCantonX402Reader(
       "makeCantonX402Reader: transfersPath is empty — this package does not guess your participant's update endpoint",
     );
 
+  const timeoutMs = cfg.timeoutMs ?? CANTON_X402_DEFAULT_TIMEOUT_MS;
+
   async function ledgerCall<T>(path: string, body: unknown): Promise<T> {
     const res = await fetch(`${cfg.jsonLedgerUrl}${path}`, {
       method: "POST",
@@ -170,6 +207,10 @@ export function makeCantonX402Reader(
         authorization: `Bearer ${cfg.bearerJwt}`,
       },
       body: JSON.stringify(body),
+      // Without this the call never comes back on a participant that accepts and does not answer — see
+      // CantonX402ReaderConfig.timeoutMs. `AbortSignal.timeout` rejects with a `TimeoutError`, a throw out
+      // of the reader port and therefore a LOUD failure, as every other transport fault here is.
+      signal: AbortSignal.timeout(timeoutMs),
     });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
@@ -193,15 +234,49 @@ export function makeCantonX402Reader(
       );
       return result ?? null;
     },
-    async transfersFor(party: string, limit?: number): Promise<string[]> {
-      return ledgerCall<string[]>(cfg.transfersPath, {
+    async transfersFor(party: string, limit: number): Promise<string[]> {
+      const result = await ledgerCall<unknown>(cfg.transfersPath, {
         party,
-        ...(limit !== undefined ? { limit } : {}),
+        limit,
       });
+      // ⛔⛔ **A `result: null` PASSED THE ENVELOPE CHECK AND CAME BACK AS AN ARRAY.** `ledgerCall` refuses
+      // an ABSENT `result` and `null` is present, so this returned `null` under a declared `string[]` and
+      // `enumerate`'s `for…of` threw `TypeError: updateIds is not iterable` — an exception out of a
+      // refuse-don't-throw surface, raised by the shape of a counterparty's response. The array is the
+      // check rather than not-null, and so is the ELEMENT type: a list carrying a `null` id would be
+      // POSTed straight back as `{ updateId: null }` and read as a transfer that is merely absent.
+      if (!Array.isArray(result) || result.some((id) => typeof id !== "string"))
+        throw new Error(
+          `Daml ${cfg.transfersPath} returned a result that is not an array of update ids — this endpoint is not answering the transfer-listing shape this reader was pointed at`,
+        );
+      return result as string[];
     },
   };
 }
 
+/**
+ * The asset fields a transfer view must actually carry, named — empty when the view is complete.
+ *
+ * Non-empty STRINGS, not merely present values: `receiver: ""` names no party and `amount: ""` is no
+ * quantity, and a reader that fills its required fields with blanks has answered the type checker rather
+ * than the question. `instrumentId` is checked through both of its own halves for the same reason — a
+ * `{ admin: "", id: "" }` identifies no instrument.
+ */
+function missingAssetFields(view: CantonX402TransferView): string[] {
+  const text = (v: unknown): boolean => typeof v === "string" && v.length > 0;
+  const out: string[] = [];
+  if (!text(view.receiver)) out.push("receiver");
+  if (!text(view.amount)) out.push("amount");
+  if (
+    view.instrumentId === null ||
+    typeof view.instrumentId !== "object" ||
+    !text(view.instrumentId.admin) ||
+    !text(view.instrumentId.id)
+  )
+    out.push("instrumentId");
+  return out;
+}
+
 /** Construct the Canton x402 adapter. **The manifest is injected, not baked in** — pass this package's own
  *  `CANTON_X402_MANIFEST`; a manifest whose `rail` is not `"canton:x402"` throws, because an adapter over
  *  another rail's manifest would publish that rail's claims as its own. Nothing has to be deployed first:
@@ -241,6 +316,26 @@ export function createCantonX402Adapter(
         code: "canton/no-lcp-memo",
         detail: `the transfer at updateId ${ref.updateId} carries no well-formed atrHash under x402.memo`,
       };
+    // ⛔⛔ **THE MEMO WAS CHECKED AND THE ASSET WAS NOT, UNDER TYPES THAT SAID BOTH WERE THERE.**
+    // `CantonX402TransferView` declares `receiver`, `amount` and `instrumentId` as REQUIRED, but the view
+    // comes off a counterparty's HTTP endpoint through `JSON.parse` — a shape no type checks at runtime —
+    // so a reader that omitted them handed back `undefined` and this function copied it into a
+    // `CantonX402Settlement` whose own types promise strings. The result is a settled verdict carrying
+    // `receiver: undefined`, which a consumer then compares against the merchant it expected and finds
+    // unequal, or renders, or writes into a record.
+    //
+    // ⭐ And it is what makes `assetBinding: "carried"` in this manifest a TRUE claim rather than a hopeful
+    // one. That axis says a consumer can reach the asset the weld is attached to. Two lines above, an
+    // absent memo refuses loudly by name; the asset fields are the other half of the same promise and were
+    // not checked at all. One shape of missing evidence was a refusal and the other was a success.
+    const missing = missingAssetFields(view);
+    if (missing.length > 0)
+      return {
+        refused: true,
+        haltClass: "verification-failure",
+        code: "canton/incomplete-transfer-view",
+        detail: `the transfer at updateId ${ref.updateId} carries a well-formed atrHash but no ${missing.join(", ")} — this manifest declares assetBinding "carried", so a settlement whose asset cannot be read is not one this rail can report`,
+      };
     return {
       ok: true,
       value: {
@@ -281,7 +376,7 @@ export function createCantonX402Adapter(
       atrHash: string,
       party: string,
       reader: CantonX402Reader,
-      limit?: number,
+      limit: number,
     ): Promise<CantonX402SettlementRef[]> {
       // Fail-fast, like propose: a malformed atrHash can never match a decoded memo, and the silent []
       // it would produce is indistinguishable from "this party has no settlements".
@@ -289,6 +384,12 @@ export function createCantonX402Adapter(
         throw new Error(
           `enumerate: atrHash must be a 0x-prefixed 32-byte value, got "${atrHash}"`,
         );
+      // The same reasoning as the atrHash above, applied to the bound: a scan of zero (or of half a
+      // transfer) returns [], which is the answer that cannot be told apart from "no settlements".
+      if (!Number.isInteger(limit) || limit < 1)
+        throw new Error(
+          `enumerate: limit must be a positive integer — it is the scan DEPTH and this package will not choose it, got ${limit}`,
+        );
       const updateIds = await reader.transfersFor(party, limit);
       const out: CantonX402SettlementRef[] = [];
       for (const updateId of updateIds) {

package/src/index.ts

@@ -1,4 +1,5 @@
 export {
+  CANTON_X402_DEFAULT_TIMEOUT_MS,
   type CantonX402Adapter,
   type CantonX402Reader,
   type CantonX402ReaderConfig,
@@ -9,6 +10,7 @@ export {
   makeCantonX402Reader,
 } from "./adapter.js";
 export {
+  CANTON_X402_COLLECTION_PATH,
   CANTON_X402_MEMO_KEY,
   CANTON_X402_MEMO_MAX_BYTES,
   type CantonX402Network,