@inversealtruism/cairn-sdk 0.3.2 → 0.4.1

package/dist/board.cjs

@@ -27,7 +27,7 @@ var import_csd_codec = require("@inversealtruism/csd-codec");
 var import_csd_codec2 = require("@inversealtruism/csd-codec");
 
 // src/errors.ts
-var SDK_VERSION = "0.3.2";
+var SDK_VERSION = "0.4.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */

package/dist/board.js

@@ -1,7 +1,7 @@
 import {
   BoardClient
-} from "./chunk-CZWDA3A5.js";
-import "./chunk-FMXNJQWL.js";
+} from "./chunk-DUTVUIQF.js";
+import "./chunk-ERBT4DFD.js";
 export {
   BoardClient
 };

package/dist/chunk-7UOTIAYK.js

@@ -0,0 +1,224 @@
+import {
+  HttpError
+} from "./chunk-ERBT4DFD.js";
+
+// src/registry.ts
+import { fromRecords } from "@inversealtruism/csd-registry";
+
+// src/http.ts
+var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
+var ERR_TEXT_CAP = 8 * 1024;
+async function readCapped(res, maxBytes) {
+  const cl = Number(res.headers.get("content-length"));
+  if (Number.isFinite(cl) && cl > maxBytes) throw new HttpError(res.status, res.url, `response too large (content-length ${cl} > ${maxBytes})`);
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function") {
+    const buf = new Uint8Array(await res.arrayBuffer());
+    if (buf.byteLength > maxBytes) throw new HttpError(res.status, res.url, `response too large (${buf.byteLength} > ${maxBytes})`);
+    return buf;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      total += value.byteLength;
+      if (total > maxBytes) {
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        throw new HttpError(res.status, res.url, `response exceeded ${maxBytes} bytes`);
+      }
+      chunks.push(value);
+    }
+  }
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.byteLength;
+  }
+  return out;
+}
+var Http = class {
+  baseUrl;
+  _fetch;
+  timeoutMs;
+  maxBytes;
+  headers;
+  retries;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    const f = opts.fetch ?? globalThis.fetch;
+    if (!f) throw new Error("No fetch available \u2014 pass `fetch` in the SDK options.");
+    this._fetch = opts.fetch ? opts.fetch : f.bind(globalThis);
+    this.timeoutMs = opts.timeoutMs ?? 15e3;
+    this.maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+    this.headers = opts.headers ?? {};
+    this.retries = Math.min(10, Math.max(0, Math.floor(opts.retries ?? 0)));
+  }
+  /** Build an absolute URL from a path + optional query params. */
+  url(path, query) {
+    const p = path.startsWith("/") ? path : `/${path}`;
+    const u = new URL(this.baseUrl + p);
+    const basePath = new URL(this.baseUrl + "/").pathname;
+    if (basePath !== "/" && !(u.pathname + "/").startsWith(basePath)) {
+      throw new Error(`illegal path '${path}' \u2014 escapes base ${basePath}`);
+    }
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== void 0 && v !== null) u.searchParams.set(k, String(v));
+      }
+    }
+    return u.toString();
+  }
+  async raw(method, path, opts) {
+    const url = this.url(path, opts?.query);
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+    try {
+      const res = await this._fetch(url, {
+        method,
+        signal: ctrl.signal,
+        headers: {
+          ...opts?.body !== void 0 ? { "content-type": "application/json" } : {},
+          ...this.headers,
+          ...opts?.headers ?? {}
+        },
+        body: opts?.body !== void 0 ? JSON.stringify(opts.body) : void 0
+      });
+      return res;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  // A malformed 2xx body must surface as a TYPED HttpError, not a leaked SyntaxError (B10: dApp
+  // code branches on `instanceof CairnError`; a raw parse error escaped that contract).
+  parseJson(res, text, url) {
+    try {
+      return JSON.parse(text);
+    } catch (e) {
+      throw new HttpError(res.status, url, `invalid JSON body: ${text.slice(0, 120)}`);
+    }
+  }
+  async getJson(path, query) {
+    const url = this.url(path, query);
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const res = await this.raw("GET", path, { query });
+        if (!res.ok) {
+          if (!(res.status >= 500 && attempt < this.retries)) throw new HttpError(res.status, url, await safeText(res));
+          res.body?.cancel().catch(() => {
+          });
+        } else {
+          return this.parseJson(res, new TextDecoder().decode(await readCapped(res, this.maxBytes)), url);
+        }
+      } catch (e) {
+        if (e instanceof HttpError && e.status < 500) throw e;
+        if (attempt >= this.retries) throw e;
+      }
+      await new Promise((r) => setTimeout(r, Math.floor(Math.random() * Math.min(4e3, 250 * 2 ** attempt))));
+    }
+  }
+  async postJson(path, body, headers) {
+    const url = this.url(path);
+    const res = await this.raw("POST", path, { body, headers });
+    if (!res.ok) throw new HttpError(res.status, url, await safeText(res));
+    return this.parseJson(res, new TextDecoder().decode(await readCapped(res, this.maxBytes)), url);
+  }
+  /** GET raw bytes (for content retrieval). Returns null on 404. */
+  async getBytes(path) {
+    const res = await this.raw("GET", path);
+    if (res.status === 404) return null;
+    if (!res.ok) throw new HttpError(res.status, this.url(path), await safeText(res));
+    return { bytes: await readCapped(res, this.maxBytes), headers: res.headers };
+  }
+};
+async function safeText(res) {
+  try {
+    return new TextDecoder().decode(await readCapped(res, ERR_TEXT_CAP));
+  } catch {
+    return "";
+  }
+}
+
+// src/registry.ts
+import {
+  fromRecords as fromRecords2,
+  verifyPeer,
+  verifyGateway,
+  verifyIdentitySig,
+  DOMAINS,
+  buildPeerRecord,
+  buildGatewayRecord,
+  buildIdentityCommit,
+  buildIdentityReveal,
+  epochOf
+} from "@inversealtruism/csd-registry";
+var RegistryClient = class {
+  http;
+  /** Accepts the SDK's hardened Http directly (the Cairn facade path) or the legacy
+   *  { baseUrl, fetch } options (kept for direct constructors; they now get the same
+   *  hardened transport, built internally). */
+  constructor(src) {
+    this.http = src instanceof Http ? src : new Http({ baseUrl: src.baseUrl, fetch: src.fetch });
+  }
+  /** Discover ranked content/pin gateways (GET /registry/gateways). */
+  gateways() {
+    return this.http.getJson("/registry/gateways");
+  }
+  /** Discover ranked libp2p peers (GET /registry/peers). */
+  peers() {
+    return this.http.getJson("/registry/peers");
+  }
+  /**
+   * Resolve a handle → identity (GET /identity/:handle). Returns null if unresolved.
+   *
+   * ⚠ TRUST (CAIRN-SDK-RESOLVE-VERIFIED-FOOTGUN): the returned `verified` flag is the INDEXER's assertion,
+   * NOT a client-side proof. A hostile/compromised indexer (or a MITM of the read proxy) can return
+   * `verified:true` for a wrong address. Do NOT use this directly as a payee/login target without either (a)
+   * recomputing from raw records via `fromRecords.name(...)`, or (b) cross-checking a second independent
+   * source (the wallet's namespv union cure). Treat `verified` here as a hint, not a guarantee.
+   */
+  resolveName(handle) {
+    return this.getOr404Null(`/identity/${encodeURIComponent(handle)}`);
+  }
+  /** Reverse-resolve an address → identity (GET /address/:addr/identity).
+   *  ⚠ Same indexer-trust caveat as resolveName — `verified` is the indexer's claim, not a client proof. */
+  reverseName(address) {
+    return this.getOr404Null(`/address/${encodeURIComponent(address)}/identity`);
+  }
+  // MF-12: 404 → null (the preserved csd-registry contract for both name resolvers); every other
+  // failure rethrows the typed HttpError/CairnError the hardened Http raises.
+  async getOr404Null(path) {
+    try {
+      return await this.http.getJson(path);
+    } catch (e) {
+      if (e instanceof HttpError && e.status === 404) return null;
+      return Promise.reject(e);
+    }
+  }
+  /** The deterministic, client-side resolvers (recompute from raw ChainRecord[]). */
+  get fromRecords() {
+    return fromRecords;
+  }
+};
+
+export {
+  readCapped,
+  Http,
+  RegistryClient,
+  fromRecords2 as fromRecords,
+  verifyPeer,
+  verifyGateway,
+  verifyIdentitySig,
+  DOMAINS,
+  buildPeerRecord,
+  buildGatewayRecord,
+  buildIdentityCommit,
+  buildIdentityReveal,
+  epochOf
+};

package/dist/{chunk-CZWDA3A5.js → chunk-DUTVUIQF.js}

@@ -1,6 +1,6 @@
 import {
   CairnError
-} from "./chunk-FMXNJQWL.js";
+} from "./chunk-ERBT4DFD.js";
 
 // src/board.ts
 import { payloadHash } from "@inversealtruism/csd-codec";

package/dist/{chunk-FMXNJQWL.js → chunk-ERBT4DFD.js}

@@ -1,5 +1,5 @@
 // src/errors.ts
-var SDK_VERSION = "0.3.2";
+var SDK_VERSION = "0.4.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */
@@ -91,7 +91,7 @@ var SubmitInFlightError = class extends CairnError {
     this.txid = txid;
   }
 };
-var NATIVE_CODES = /* @__PURE__ */ new Set(["ACCOUNT_CHANGED", "FIRST_PARTY_ONLY", "RATE_LIMITED", "APPROVAL_CLOSED", "FORBIDDEN", "INTERNAL"]);
+var NATIVE_CODES = /* @__PURE__ */ new Set(["FIRST_PARTY_ONLY", "RATE_LIMITED", "FORBIDDEN", "INTERNAL"]);
 var NESTED_TRANSIENT = /* @__PURE__ */ new Set(["VERIFY_UNAVAILABLE", "OFFER_UNKNOWN"]);
 var NESTED_TERMINAL = /* @__PURE__ */ new Set([
   "FILL_UNSAFE",

package/dist/{chunk-JKC5K253.js → chunk-OCEHXK6A.js}

@@ -1,6 +1,6 @@
 import {
   ContentVerificationError
-} from "./chunk-FMXNJQWL.js";
+} from "./chunk-ERBT4DFD.js";
 
 // src/content.ts
 import { payloadHash, canonicalJson, verifyContentBytes } from "@inversealtruism/csd-codec";

package/dist/{chunk-BN3PFJDY.js → chunk-PIPN6FSA.js}

@@ -1,11 +1,13 @@
 import {
+  CairnError,
   NotInstalledError,
   UnsupportedMethodError,
   mapProviderError,
   mapSubmitResultError
-} from "./chunk-FMXNJQWL.js";
+} from "./chunk-ERBT4DFD.js";
 
 // src/connect.ts
+var DEFAULT_PROVIDER_TIMEOUT_MS = 10 * 6e4;
 function discoverProviders(opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 1e3;
   return new Promise((resolve) => {
@@ -85,8 +87,27 @@ function unwrapWrite(reply) {
 var WalletConnection = class {
   provider;
   _addr = null;
-  constructor(provider) {
+  /** B7c: per-call provider timeout (ms). GENEROUS by default so it never rejects an in-flight human
+   *  approval; 0 disables it. Every provider call (writes especially) races against it. */
+  _timeoutMs;
+  constructor(provider, opts = {}) {
     this.provider = provider;
+    this._timeoutMs = opts.timeoutMs ?? DEFAULT_PROVIDER_TIMEOUT_MS;
+  }
+  // B7c: race a provider call against the per-call timeout. On timeout, throw a fail-closed CairnError
+  // (retryable:false: a write may already have reached the wallet, so never invite a blind auto-retry). The
+  // genuine wallet resolves quickly once the user acts; this only fires on a truly hung/absent response.
+  call(op, label) {
+    const ms = this._timeoutMs;
+    const invoke = () => new Promise((resolve) => {
+      resolve(op());
+    });
+    if (!Number.isFinite(ms) || ms <= 0) return invoke();
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new CairnError(`the wallet did not respond to ${label} within ${ms}ms`, { retryable: false })), ms);
+    });
+    return Promise.race([invoke(), timeout]).finally(() => clearTimeout(timer));
   }
   /** The wallet's version string (e.g. "0.2.x"). */
   get version() {
@@ -98,13 +119,13 @@ var WalletConnection = class {
   }
   /** Request connection. First time per origin prompts the user; afterwards may be silent. */
   async connect() {
-    const { addr } = unwrap(await this.provider.connect());
+    const { addr } = unwrap(await this.call(() => this.provider.connect(), "connect"));
     this._addr = addr;
     return addr;
   }
   /** Get the connected address (does not force a new connection prompt if already consented). */
   async getAddress() {
-    const { addr } = unwrap(await this.provider.getAddress());
+    const { addr } = unwrap(await this.call(() => this.provider.getAddress(), "getAddress"));
     this._addr = addr;
     return addr;
   }
@@ -117,7 +138,7 @@ var WalletConnection = class {
     if (typeof this.provider.signIn !== "function") {
       return Promise.reject(new UnsupportedMethodError("this wallet does not expose signIn()"));
     }
-    return Promise.resolve(this.provider.signIn()).then(unwrap);
+    return this.call(() => this.provider.signIn(), "signIn").then(unwrap);
   }
   /**
    * Audience-bound "Sign in with CSD" (SIWC) — the secure, replay-resistant third-party login.
@@ -133,7 +154,7 @@ var WalletConnection = class {
     if (typeof this.provider.signInWithCsd !== "function") {
       return Promise.reject(new UnsupportedMethodError("this wallet predates Sign-in-with-CSD \u2014 ask the user to update the Cairn Wallet"));
     }
-    return Promise.resolve(this.provider.signInWithCsd(params)).then(unwrap);
+    return this.call(() => this.provider.signInWithCsd(params), "signInWithCsd").then(unwrap);
   }
   /** True if this wallet supports audience-bound SIWC (safe to call `signInWithCsd`). */
   get supportsSiwc() {
@@ -143,7 +164,7 @@ var WalletConnection = class {
   async getCapabilities() {
     if (typeof this.provider.getCapabilities !== "function") return null;
     try {
-      return await this.provider.getCapabilities();
+      return await this.call(() => this.provider.getCapabilities(), "getCapabilities");
     } catch {
       return null;
     }
@@ -159,24 +180,40 @@ var WalletConnection = class {
     if (typeof this.provider.fillOffer !== "function") {
       return Promise.reject(new UnsupportedMethodError("this wallet predates fillOffer() \u2014 ask the user to update the Cairn Wallet"));
     }
-    return Promise.resolve(this.provider.fillOffer(params)).then(unwrapWrite);
+    this.adviseFillSpvCapability();
+    return this.call(() => this.provider.fillOffer(params), "fillOffer").then(unwrapWrite);
+  }
+  // P75-5 MF-10: ONE capability advisory per connection. The wallet's on-device fill-SPV (0.2.60+) is the
+  // payment-grade fill boundary; when the provider SELF-REPORTS an older version, warn the integrator once
+  // and STILL RELAY. WARN, NEVER BLOCK: a hard version gate would decline honest fills (version strings are
+  // spoofable and unparseable forks exist), and the wallet itself is the enforcement point. Reads only the
+  // sync `provider.version`; never an awaited getCapabilities() round-trip on the fill hot path. An
+  // unparseable version never warns (no false alarms).
+  _fillSpvAdvised = false;
+  adviseFillSpvCapability() {
+    if (this._fillSpvAdvised) return;
+    this._fillSpvAdvised = true;
+    const m = /^(\d+)\.(\d+)\.(\d+)/.exec(String(this.provider?.version ?? ""));
+    if (!m) return;
+    const below = Number(m[1]) === 0 && (Number(m[2]) < 2 || Number(m[2]) === 2 && Number(m[3]) < 60);
+    if (below) console.warn(`[cairn-sdk] this Cairn Wallet (v${m[0]}) predates the on-device fill-SPV boundary (cairn-wallet 0.2.60+). The fill proceeds; suggest a wallet update for payment-grade offer verification.`);
   }
   /** This origin's current permission grant (EIP-2255-style). Silent; [] if none / unsupported. */
   async getPermissions() {
     if (typeof this.provider.getPermissions !== "function") return [];
-    return unwrap(await this.provider.getPermissions());
+    return unwrap(await this.call(() => this.provider.getPermissions(), "getPermissions"));
   }
   /** Explicitly request permission to see the address (prompts, like connect). */
   requestPermissions() {
     if (typeof this.provider.requestPermissions !== "function") {
       return Promise.reject(new UnsupportedMethodError("this wallet predates requestPermissions \u2014 use connect()"));
     }
-    return Promise.resolve(this.provider.requestPermissions()).then(unwrap);
+    return this.call(() => this.provider.requestPermissions(), "requestPermissions").then(unwrap);
   }
   /** Revoke THIS origin's own access (silent). Returns { revoked }. Safe no-op on older wallets. */
   async revokePermissions() {
     if (typeof this.provider.revokePermissions !== "function") return { revoked: false };
-    return unwrap(await this.provider.revokePermissions());
+    return unwrap(await this.call(() => this.provider.revokePermissions(), "revokePermissions"));
   }
   /**
    * Subscribe to provider events. `accountsChanged` fires with `[]` when this site loses access
@@ -192,26 +229,26 @@ var WalletConnection = class {
   }
   /** Send CSD (always prompts with clear-signing; wallet picks inputs + returns change to itself). */
   send(params) {
-    return Promise.resolve(this.provider.send(params)).then(unwrapWrite);
+    return this.call(() => this.provider.send(params), "send").then(unwrapWrite);
   }
   /** Low-level Propose (always prompts). Prefer `cairn.board.propose()` which computes the hash/uri/expiry. */
   propose(params) {
-    return Promise.resolve(this.provider.propose(params)).then(unwrapWrite);
+    return this.call(() => this.provider.propose(params), "propose").then(unwrapWrite);
   }
   /** Attest/support a proposal (always prompts). */
   attest(params) {
-    return Promise.resolve(this.provider.attest(params)).then(unwrapWrite);
+    return this.call(() => this.provider.attest(params), "attest").then(unwrapWrite);
   }
   /** Seal a commit-reveal claim (always prompts; salt stays inside the wallet). */
   sealClaim(params) {
-    return Promise.resolve(this.provider.sealClaim(params)).then(unwrapWrite);
+    return this.call(() => this.provider.sealClaim(params), "sealClaim").then(unwrapWrite);
   }
   /** Reveal a previously sealed claim by its sealing txid (always prompts). */
   revealClaim(txid) {
     if (typeof txid !== "string" || !txid) {
       return Promise.reject(new UnsupportedMethodError("revealClaim requires the sealing txid"));
     }
-    return Promise.resolve(this.provider.revealClaim(txid)).then(unwrapWrite);
+    return this.call(() => this.provider.revealClaim(txid), "revealClaim").then(unwrapWrite);
   }
 };
 async function getWallet(opts = {}) {

package/dist/{chunk-AGU6K5EZ.js → chunk-QATE6AIP.js}

@@ -1,12 +1,15 @@
 import {
   getWallet
-} from "./chunk-BN3PFJDY.js";
+} from "./chunk-PIPN6FSA.js";
 
 // src/controller.ts
 var DISCONNECTED = Object.freeze({ status: "disconnected", account: null, error: null });
 var CairnController = class {
   state = DISCONNECTED;
   conn = null;
+  // MF-15: connect/disconnect generation token. disconnect() bumps it; a connect() whose await straddled
+  // the bump must never commit "connected" over the torn-down session (a zombie null-connection session).
+  epoch = 0;
   listeners = /* @__PURE__ */ new Set();
   getWalletFn;
   detectOpts;
@@ -59,34 +62,43 @@ var CairnController = class {
   }
   /** Detect + connect (prompts the user the first time per origin). Resolves the connected address. */
   connect = async () => {
+    const epoch = this.epoch;
     this.setState({ status: "connecting", error: null });
     try {
-      if (!this.conn) {
-        this.conn = await this.getWalletFn(this.detectOpts);
-        this.conn.on("accountsChanged", this.onAccounts);
-        this.conn.on("disconnect", this.onDisconnect);
+      let conn = this.conn;
+      if (!conn) {
+        conn = await this.getWalletFn(this.detectOpts);
+        if (epoch !== this.epoch) throw new Error("connection was torn down while connecting - call connect() again");
+        conn.on("accountsChanged", this.onAccounts);
+        conn.on("disconnect", this.onDisconnect);
+        this.conn = conn;
       }
-      const addr = await this.conn.connect();
+      const addr = await conn.connect();
+      if (epoch !== this.epoch) throw new Error("connection was torn down while awaiting approval - call connect() again");
       this.setState({ status: "connected", account: addr, error: null });
       return addr;
     } catch (e) {
-      this.setState({ status: "disconnected", account: null, error: e?.message ?? String(e) });
+      if (epoch === this.epoch) this.setState({ status: "disconnected", account: null, error: e?.message ?? String(e) });
       throw e;
     }
   };
-  /** Forget the connection locally AND revoke this origin's wallet-side permission (best-effort). */
+  /** Forget the connection locally AND revoke this origin's wallet-side permission (best-effort).
+   *  Local teardown is IMMEDIATE and unconditional; the wallet-side revoke happens after, so a hung
+   *  provider can never hold a torn-down session in "connected". */
   disconnect = async () => {
-    try {
-      await this.conn?.revokePermissions();
-    } catch {
-    }
+    this.epoch++;
+    const conn = this.conn;
     this.detach();
     this.conn = null;
     this.setState({ status: "disconnected", account: null, error: null });
+    try {
+      await conn?.revokePermissions();
+    } catch {
+    }
   };
   /** Audience-bound sign-in (must connect() first). Returns the signed artifact to verify server-side. */
   signInWithCsd = (params) => {
-    if (!this.conn) return Promise.reject(new Error("call connect() before signInWithCsd()"));
+    if (!this.conn || this.state.status !== "connected") return Promise.reject(new Error("call connect() before signInWithCsd()"));
     return this.conn.signInWithCsd(params);
   };
 };