@inversealtruism/cairn-sdk 0.7.0 → 0.8.1

package/README.md

@@ -39,8 +39,8 @@ cairn.index.streamAll({ onBlock: (e) => console.log("new block", e) });
 
 The SDK follows the exact model MetaMask uses, there is **no allowlist you maintain**:
 
-- **`connect()` / `getAddress()`** grant *address visibility*. The first time a site connects, the user approves once; after that the wallet answers silently (the site shows up under **Settings → Connected sites**, revocable anytime). This is the only "silent" call.
-- **Every signing / fund-moving call:** `send`, `propose`, `attest`, `signIn`, `sealClaim`, `revealClaim`, **always** opens the wallet's clear-signing approval window, **every time**, no matter what. Being "connected" never pre-approves a signature. A connected site cannot move a satoshi without an explicit, fully-disclosed approval click.
+- **`connect()` / `getAddress()`** grant *address visibility*. The first time a site connects, the user approves once; after that the wallet answers silently (the site shows up under **Settings → Connected sites**, revocable anytime). These are the only calls that can return the address without a prompt. `getPermissions()` (read this site's own grant) and `revokePermissions()` (drop it) are silent too; neither signs anything.
+- **Every signing / fund-moving call:** `send`, `propose`, `attest`, `fillOffer`, `sealClaim`, `revealClaim` and `signInWithCsd`, **always** opens the wallet's clear-signing approval window, **every time**, no matter what. Being "connected" never pre-approves a signature. A connected site cannot move a satoshi without an explicit, fully-disclosed approval click. The legacy `signIn()` is deprecated and first-party-only: the wallet refuses it from any other site with `FIRST_PARTY_ONLY` before prompting; use `signInWithCsd()`.
 
 ```ts
 import { connect, UserRejectedError, NotInstalledError } from "@inversealtruism/cairn-sdk";
@@ -58,7 +58,7 @@ try {
 
 **`cairn.index`:** `tipHeight()`, `block()/blockTxids()`, `tx()/txStatus()/txMerkleProof()`, `address()/addressTxs()/addressUtxo()`, `domains()/domainProposals(domain)`, `proposal()/attestations()`, `reputation()`, **`verifyInclusion(txid)`** (trust-minimized), `streamAll()/streamBlocks()/streamDomain()` (SSE), `subscribe()` (WS).
 
-**`cairn.names`:** `resolve(name)` (display-path name to address), `name(name)`/`nameHistory(name)`, `primary(addr)` (reverse lookup)/`namesOf(addr)`, `names()`, `tokens()/token(ticker)`, `offers()`, `bids()`, `state()` (the canonical CairnX state). Reads go through the public `/trade/api/cairnx/*` proxy; for payment-grade name resolution verify through the wallet or a replaying resolver, not a bare read (see `src/names.ts` header).
+**`cairn.names`:** `resolve(name)` (display-path name to address), `name(name)`/`nameHistory(name)`, `primary(addr)` (reverse lookup)/`namesOf(addr)`, `names()`, `tokens()/token(ticker)`, `offers()`/`bids()` (open rows by default; pass `{ status }` for another status, or `{ status: "all" }` for every row), `state()` (the canonical CairnX state). Reads go through the public `/trade/api/cairnx/*` proxy; for payment-grade name resolution verify through the wallet or a replaying resolver, not a bare read (see `src/names.ts` header).
 
 **`cairn.content`:** `prepare(obj)`/`put(obj)` → `{ payloadHash, canonical, bytes }`; `get(hash)` / `getBytes(hash)` (fetch **and verify** `sha256(bytes) === hash`, throws `ContentVerificationError` on tamper); `hash(obj)`.
 
@@ -68,14 +68,13 @@ Subpath imports are available for tree-shaking: `@inversealtruism/cairn-sdk/{con
 
 ## Examples
 
-- **`examples/read-only.mjs`:** runs today against live mainnet, no wallet, no build: `npm run test:live`. Demonstrates chain/indexer reads + verified merkle inclusion + verified content fetch.
-- **`examples/hello-csd/`:** a no-framework browser dApp (connect → read recent proposals → live feed). Build the bundle with `npm run build:example`, then serve the folder from **localhost** (the wallet injects there) with the Cairn Wallet installed.
+- **`examples/read-only.mjs`:** runs against live mainnet with no wallet. It imports the built `dist/`, so run `pnpm build` first, then `pnpm test:live`. Demonstrates chain/indexer reads + verified merkle inclusion + verified content fetch.
+- **`examples/hello-csd/`:** a no-framework browser dApp (connect → read recent proposals → live feed). Build the bundle with `pnpm build:example`, then serve the folder from **localhost** (the wallet injects there) with the Cairn Wallet installed.
 
 ## Trust model & honest limits
 
-- **Content is always verified client-side.** `cairn.content.get()` rejects bytes that don't hash to the requested `payloadHash`, an untrusted gateway can't serve tampered content.
-- **Merkle inclusion is trust-minimized, to the strength of your header source.** `verifyInclusion()` folds the proof and cross-checks its root against a header merkle from `headerMerkleAt`. The default `Cairn` wiring backs that with a light client that PoW-verifies headers forward from a pinned checkpoint, so a match reads `trustLevel: "verified-inclusion"` with `included: true`. A header within 12 blocks of the light client's cached tip is first compared with the header the base serves at that height, so a block orphaned by a reorg stops counting; the hosted base edge-caches rows at or below its tip minus 6, so there this catches reorgs of up to 6 blocks. When no header can be verified (below the checkpoint, header source unreachable, no source configured) the result is `"proof-consistent"` with `included: false` and a `reason`: the indexer alone vouches for it. Gate on `included` or on `trustLevel === "verified-inclusion"`; they agree.
-- **Balances are RPC-trusted.** Headers don't commit to the UTXO set; balance reads trust the node/proxy (same as every light client).
+Content bytes are always verified client-side; merkle inclusion is verified when a PoW-verified header backs it (`trustLevel: "verified-inclusion"`); balances are RPC-trusted. The full trust model (each `trustLevel`, the checkpoint, reorgs near the tip) is in [`docs/SDK-GUIDE.md`](docs/SDK-GUIDE.md#what-the-sdk-verifies-vs-trusts-read-this).
+
 - **Content comes from the cairn origin.** `cairn.content` reads `/content/<hash>` on the cairn base and verifies every byte against the hash.
 - **The indexer runs behind the cairn proxy.** By default `cairn.index` uses the cairn server's hardened, read-only, rate-limited `/explorer/api` reverse proxy (no separate public indexer needed). **SSE works through that proxy; `subscribe()` (WebSocket) needs a direct indexer endpoint:** set `baseUrls.indexer` to a private/localhost indexer for WS.
 - **The wallet injects on every site** (connect-anywhere shipped in 0.2.4x) behind a per-origin consent gate: a site sees nothing until the user approves the connection, and some request kinds stay first-party-only (the `FIRST_PARTY_ONLY` error code).

package/dist/{chunk-TDXGYP3G.js → chunk-23ATXZKM.js}

@@ -1,7 +1,7 @@
 import {
   CairnError,
   ContentVerificationError
-} from "./chunk-PBKDSDID.js";
+} from "./chunk-X7J6ECNV.js";
 
 // src/content.ts
 import { payloadHash, canonicalJson, verifyContentBytes } from "@inversealtruism/csd-codec";

package/dist/{chunk-4FFLCCL4.js → chunk-F3KJPQXM.js}

@@ -4,7 +4,7 @@ import {
   UnsupportedMethodError,
   mapProviderError,
   mapSubmitResultError
-} from "./chunk-PBKDSDID.js";
+} from "./chunk-X7J6ECNV.js";
 
 // src/connect.ts
 var DEFAULT_PROVIDER_TIMEOUT_MS = 10 * 6e4;

package/dist/{chunk-XOGOSGC6.js → chunk-QWGR5J5D.js}

@@ -1,6 +1,6 @@
 import {
   getWallet
-} from "./chunk-4FFLCCL4.js";
+} from "./chunk-F3KJPQXM.js";
 
 // src/controller.ts
 var DISCONNECTED = Object.freeze({ status: "disconnected", account: null, error: null });

package/dist/{chunk-PBKDSDID.js → chunk-X7J6ECNV.js}

@@ -1,5 +1,5 @@
 // src/errors.ts
-var SDK_VERSION = "0.7.0";
+var SDK_VERSION = "0.8.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */

package/dist/connect.cjs

@@ -30,7 +30,7 @@ __export(connect_exports, {
 module.exports = __toCommonJS(connect_exports);
 
 // src/errors.ts
-var SDK_VERSION = "0.7.0";
+var SDK_VERSION = "0.8.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */

package/dist/connect.js

@@ -5,8 +5,8 @@ import {
   discoverProviders,
   getWallet,
   isInstalled
-} from "./chunk-4FFLCCL4.js";
-import "./chunk-PBKDSDID.js";
+} from "./chunk-F3KJPQXM.js";
+import "./chunk-X7J6ECNV.js";
 export {
   WalletConnection,
   connect,

package/dist/content.cjs

@@ -26,7 +26,7 @@ module.exports = __toCommonJS(content_exports);
 var import_csd_codec = require("@inversealtruism/csd-codec");
 
 // src/errors.ts
-var SDK_VERSION = "0.7.0";
+var SDK_VERSION = "0.8.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */

package/dist/content.js

@@ -1,7 +1,7 @@
 import {
   ContentClient
-} from "./chunk-TDXGYP3G.js";
-import "./chunk-PBKDSDID.js";
+} from "./chunk-23ATXZKM.js";
+import "./chunk-X7J6ECNV.js";
 export {
   ContentClient
 };

package/dist/controller.cjs

@@ -25,7 +25,7 @@ __export(controller_exports, {
 module.exports = __toCommonJS(controller_exports);
 
 // src/errors.ts
-var SDK_VERSION = "0.7.0";
+var SDK_VERSION = "0.8.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */

package/dist/controller.js

@@ -1,8 +1,8 @@
 import {
   CairnController
-} from "./chunk-XOGOSGC6.js";
-import "./chunk-4FFLCCL4.js";
-import "./chunk-PBKDSDID.js";
+} from "./chunk-QWGR5J5D.js";
+import "./chunk-F3KJPQXM.js";
+import "./chunk-X7J6ECNV.js";
 export {
   CairnController
 };

package/dist/index.cjs

@@ -58,7 +58,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/errors.ts
-var SDK_VERSION = "0.7.0";
+var SDK_VERSION = "0.8.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */
@@ -765,7 +765,8 @@ function normalizeHash(hash) {
 // src/names.ts
 var import_cairnx_core = require("@inversealtruism/cairnx-core");
 var nameOk = (n) => typeof n === "string" && import_cairnx_core.NAME_RE.test(n) && !import_cairnx_core.RESERVED_NAMES.has(n);
-var amountOk = (v) => typeof v === "string" && import_cairnx_core.AMOUNT_RE.test(v);
+var amountOk = (v) => (0, import_cairnx_core.parseAmount)(v, { allowZero: true }) !== null;
+var decimalsOk = (d) => Number.isSafeInteger(d) && d >= 0 && d <= import_cairnx_core.MAX_TOKEN_DECIMALS;
 var heightOk = (v) => Number.isSafeInteger(v) && v >= 0;
 function nameHistoryProblem(h, name) {
   if (!h || typeof h !== "object" || Array.isArray(h)) return "not an object";
@@ -782,14 +783,15 @@ function nameHistoryProblem(h, name) {
   }
   return null;
 }
-function tokenProblem(t) {
+function tokenProblem(t, ticker) {
   if (!t || typeof t !== "object") return "not an object";
   const r = t;
   if (typeof r.ticker !== "string" || !import_cairnx_core.TICKER_RE.test(r.ticker)) return "bad ticker";
-  if (!Number.isSafeInteger(r.decimals) || r.decimals < 0) return `bad decimals (${String(r.decimals)})`;
-  if (!amountOk(r.supply)) return "supply is not a base-unit integer string";
-  if (!amountOk(r.minted)) return "minted is not a base-unit integer string";
-  if (r.mintLimit !== void 0 && !amountOk(r.mintLimit)) return "mintLimit is not a base-unit integer string";
+  if (ticker !== void 0 && r.ticker !== ticker) return `ticker is ${JSON.stringify(r.ticker)}, expected ${JSON.stringify(ticker)}`;
+  if (!decimalsOk(r.decimals)) return `bad decimals (${String(r.decimals)}), not an integer in the consensus range`;
+  if (!amountOk(r.supply)) return "supply is not a base-unit integer string within MAX_AMOUNT";
+  if (!amountOk(r.minted)) return "minted is not a base-unit integer string within MAX_AMOUNT";
+  if (r.mintLimit !== void 0 && !amountOk(r.mintLimit)) return "mintLimit is not a base-unit integer string within MAX_AMOUNT";
   return null;
 }
 var NamesClient = class {
@@ -800,11 +802,17 @@ var NamesClient = class {
   malformed(path, what) {
     return new HttpError(200, this.http.url(path), `malformed response: ${what}`);
   }
-  async list(path) {
-    const body = await this.http.getJson(path);
+  async list(path, query) {
+    const body = await this.http.getJson(path, query);
     if (!Array.isArray(body)) throw this.malformed(path, "expected an array");
     return body;
   }
+  /** Rows of a market list with one status, or every row for "all". */
+  async byStatus(path, status) {
+    if (status === "all") return this.list(path);
+    const rows = await this.list(path, { status });
+    return rows.filter((r) => r?.status === status);
+  }
   /** Resolve a .csd name for DISPLAY (server-trusted; see the module trust note). null = unknown/invalid name. */
   async resolve(name) {
     if (!nameOk(name)) return null;
@@ -875,7 +883,8 @@ var NamesClient = class {
     });
     return rows;
   }
-  /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body. */
+  /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body or a
+   *  record for another ticker. */
   async token(ticker) {
     if (typeof ticker !== "string" || !import_cairnx_core.TICKER_RE.test(ticker)) return null;
     const path = `/trade/api/cairnx/token/${ticker}`;
@@ -886,17 +895,19 @@ var NamesClient = class {
       if (e?.status === 404) return null;
       throw e;
     }
-    const p = tokenProblem(t);
+    const p = tokenProblem(t, ticker);
     if (p) throw this.malformed(path, p);
     return t;
   }
-  /** Open offers (the market's display list). */
-  offers() {
-    return this.list(`/trade/api/cairnx/offers`);
+  /** Offers with one status, open ones by default (the market's display list). `{ status: "all" }` returns every
+   *  offer the server holds, filled, cancelled and expired ones included. */
+  offers(opts = {}) {
+    return this.byStatus(`/trade/api/cairnx/offers`, opts.status ?? "open");
   }
-  /** Open bids. */
-  bids() {
-    return this.list(`/trade/api/cairnx/bids`);
+  /** Bids with one status, open ones by default. `{ status: "all" }` returns every bid the server holds, done,
+   *  cancelled and expired ones included. */
+  bids(opts = {}) {
+    return this.byStatus(`/trade/api/cairnx/bids`, opts.status ?? "open");
   }
   /** The full canonical CairnX state (large; prefer the scoped reads above). */
   state() {
@@ -1161,6 +1172,7 @@ async function connect(opts = {}) {
 // src/fillverify.ts
 var import_csd_client3 = require("@inversealtruism/csd-client");
 var import_csd_codec4 = require("@inversealtruism/csd-codec");
+var import_csd_crypto3 = require("@inversealtruism/csd-crypto");
 var import_cairnx_core2 = require("@inversealtruism/cairnx-core");
 var ADDR = /^0x[0-9a-f]{40}$/;
 var BELOW_BASE = /^tx below the synced base \((\d+)\)/;
@@ -1201,9 +1213,7 @@ async function provenAuthor(client, provenTx) {
     return null;
   }
   if (String((0, import_csd_codec4.txid)(src)).toLowerCase() !== String(in0.prevTxid).toLowerCase()) return null;
-  const out = src.outputs?.[Number(in0.vout)];
-  const spk = out?.scriptPubkey ? String(out.scriptPubkey).toLowerCase() : null;
-  return spk && ADDR.test(spk) ? spk : null;
+  return (0, import_csd_crypto3.authorOf)(provenTx, src.outputs?.[Number(in0.vout)]?.scriptPubkey);
 }
 async function preverifyOffer(opts) {
   const id = String(opts.offerId).toLowerCase();
@@ -1231,8 +1241,6 @@ async function preverifyOffer(opts) {
   if (String(provenId).toLowerCase() !== id) return { ok: false, trust: "unverified", reason: "the merkle-proven tx doesn't match the offer id" };
   const app = incl.tx.app;
   if (!app || app.type !== "Propose") return { ok: false, trust: "unverified", reason: "the offer tx is not a Propose" };
-  if (String(app.domain) !== import_cairnx_core2.DOMAIN)
-    return { ok: false, trust: "unverified", reason: `the offer tx is not a ${import_cairnx_core2.DOMAIN} Propose (wrong settlement domain)` };
   let rec;
   try {
     rec = (0, import_cairnx_core2.parseRecord)(app.uri, incl.appPayloadHash);
@@ -1245,14 +1253,12 @@ async function preverifyOffer(opts) {
   const seller = await provenAuthor(opts.client, provenTx);
   if (!seller) return { ok: false, trust: "verified", transient: true, blockHeight, reason: "couldn't prove the offer's on-chain author yet; the chain view may be catching up, try again" };
   const offerRec = rec;
+  const ee = app.expires_epoch;
+  const refusal = (0, import_cairnx_core2.provenOfferRefusal)(offerRec, { domain: String(app.domain), height: blockHeight, expiresEpoch: typeof ee === "bigint" ? ee : Number(ee), seller });
+  if (refusal) return { ok: false, trust: "verified", blockHeight, reason: `CairnX rejects this offer (${refusal}) - a fill would move CSD for nothing` };
   const w = rec.want ?? {};
   const payto = w.payto && ADDR.test(String(w.payto).toLowerCase()) ? String(w.payto).toLowerCase() : seller;
   const terms = (0, import_cairnx_core2.provenOfferTerms)(offerRec, blockHeight);
-  if (payto === import_cairnx_core2.TREASURY_ADDR)
-    return { ok: false, trust: "verified", blockHeight, reason: "the offer's payment recipient is the protocol treasury - the chain rejects it, and a fill would move CSD for nothing" };
-  const provenExpiresEpoch = Number(app.expires_epoch);
-  if (!Number.isSafeInteger(provenExpiresEpoch) || (0, import_cairnx_core2.epochOf)(blockHeight) > provenExpiresEpoch)
-    return { ok: false, trust: "verified", blockHeight, reason: "the offer was already expired when it was mined - the chain rejects it, and a fill would move CSD for nothing" };
   let outputPlan;
   let sumsMismatch;
   let planReason;
@@ -1310,9 +1316,7 @@ async function preverifyOffer(opts) {
     if (String(so.seller).toLowerCase() !== seller)
       return { ok: false, trust: "verified", reason: "the served seller doesn't match the offer's on-chain author (a lying resolver may be redirecting your payment)", ...base };
     if ((0, import_cairnx_core2.bindOfferTerms)(opts.servedOffer, terms, { give: true, wantType: true }))
-      return { ok: false, trust: "verified", reason: "the served terms don't match the offer's on-chain record (fee, rebate, partial sizing, the give, or the want type - a lying resolver could mis-size or re-route the fill, redirecting or burning your payment)", ...base };
-    if ((0, import_cairnx_core2.isTokenWant)(offerRec.want) && (String(so?.want?.ticker) !== String(offerRec.want.ticker) || String(so?.want?.amount) !== String(offerRec.want.amount)))
-      return { ok: false, trust: "verified", reason: "the served want ticker/amount don't match the offer's on-chain record (a lying resolver could bait-and-switch the token price)", ...base };
+      return { ok: false, trust: "verified", reason: "the served terms don't match the offer's on-chain record (fee, rebate, partial sizing, the give, or the want's type or token price - a lying resolver could mis-size, re-price or re-route the fill, redirecting or burning your payment)", ...base };
   }
   if (sumsMismatch) return { ok: false, trust: "verified", reason: sumsMismatch, ...base };
   return { ok: true, trust: "verified", ...base };

package/dist/index.d.cts

@@ -5,7 +5,7 @@ import { IndexerClient } from './indexer.cjs';
 export { InclusionResult, IndexEvent, MerkleProof, StreamHandle, StreamHandlers, TrustLevel } from './indexer.cjs';
 import { ContentClient } from './content.cjs';
 export { ContentClientOptions, PreparedContent } from './content.cjs';
-import { NameState, MintedProvenOfferTerms } from '@inversealtruism/cairnx-core';
+import { NameState, OfferStatus, BidStatus, MintedProvenOfferTerms } from '@inversealtruism/cairnx-core';
 export { FillEndorsement, FillOutputPlan, FillPreview, FillSafety, MintedProvenOfferTerms, ProvenOfferTerms, bindOfferTerms, feeBpsAt, fillEndorsement, fillIsSafe, fillOutputPlan, previewFill, requiredFillOutputs } from '@inversealtruism/cairnx-core';
 import { WalletConnection, DetectOptions } from './connect.cjs';
 export { AttestParams, CairnProvider, ConnectResult, FillParams, ProposeParams, ProviderDetail, ProviderInfo, SealClaimParams, SendParams, SignInResult, SiwcParams, SiwcResult, TxResult, WalletCapabilities, WalletPermission, connect, detectProvider, discoverProviders, getWallet, isInstalled } from './connect.cjs';
@@ -16,7 +16,7 @@ import '@inversealtruism/csd-tx';
 import '@inversealtruism/csd-codec';
 import '@inversealtruism/csd-crypto';
 
-/** `/cairnx/resolve/:name` — the display-path name→address resolution. */
+/** `/cairnx/resolve/:name`: the display-path name→address resolution. */
 interface NameResolution {
     ok: boolean;
     name: string;
@@ -28,7 +28,7 @@ interface NameResolution {
     owner?: string;
     tipHeight?: number;
 }
-/** `/cairnx/name/:name` — full name detail (lease, lock, resting offer, recapture window). */
+/** `/cairnx/name/:name`: full name detail (lease, lock, resting offer, recapture window). */
 interface NameDetail {
     name: string;
     owner: string;
@@ -101,6 +101,8 @@ declare class NamesClient {
     constructor(http: Http);
     private malformed;
     private list;
+    /** Rows of a market list with one status, or every row for "all". */
+    private byStatus;
     /** Resolve a .csd name for DISPLAY (server-trusted; see the module trust note). null = unknown/invalid name. */
     resolve(name: string): Promise<NameResolution | null>;
     /** Full detail for one name (lease, lock, resting offer, recapture). null = not registered/invalid. */
@@ -116,12 +118,19 @@ declare class NamesClient {
     names(): Promise<unknown[]>;
     /** All deployed tokens. Throws a typed HttpError if any row has a malformed ticker, decimals or amount. */
     tokens(): Promise<TokenInfo[]>;
-    /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body. */
+    /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body or a
+     *  record for another ticker. */
     token(ticker: string): Promise<TokenInfo | null>;
-    /** Open offers (the market's display list). */
-    offers(): Promise<unknown[]>;
-    /** Open bids. */
-    bids(): Promise<unknown[]>;
+    /** Offers with one status, open ones by default (the market's display list). `{ status: "all" }` returns every
+     *  offer the server holds, filled, cancelled and expired ones included. */
+    offers(opts?: {
+        status?: OfferStatus | "all";
+    }): Promise<unknown[]>;
+    /** Bids with one status, open ones by default. `{ status: "all" }` returns every bid the server holds, done,
+     *  cancelled and expired ones included. */
+    bids(opts?: {
+        status?: BidStatus | "all";
+    }): Promise<unknown[]>;
     /** The full canonical CairnX state (large; prefer the scoped reads above). */
     state(): Promise<unknown>;
 }
@@ -189,7 +198,7 @@ declare function preverifyOffer(opts: {
 
 /** Stable machine-readable error codes (branch on these, not the message text). */
 type CairnErrorCode = "NOT_INSTALLED" | "USER_REJECTED" | "WALLET_LOCKED" | "UNSUPPORTED_METHOD" | "HTTP_ERROR" | "CONTENT_VERIFICATION" | "CONTENT_NOT_JSON" | "ACCOUNT_CHANGED" | "FIRST_PARTY_ONLY" | "RATE_LIMITED" | "APPROVAL_CLOSED" | "FORBIDDEN" | "INTERNAL" | "GHOST_INPUTS_SKIPPED" | "VERIFY_UNAVAILABLE" | "VERIFY_TAMPER" | "INSUFFICIENT" | "TOO_MANY_INPUTS" | "FEE_TOO_LOW" | "FEE_CAP" | "BAD_FEE" | "ZERO_ADDR_REFUSED" | "BAD_OUTPUTS" | "NO_OUTPUTS" | "BAD_REQUEST" | "OFFER_UNKNOWN" | "FILL_UNSAFE" | "FILL_WRONG_TARGET" | "SOURCE_DIVERGENCE" | "SUBMIT_REJECTED" | "SUBMIT_MAYBE_INFLIGHT" | "SUBMIT_DUPLICATE" | "NOTHING_TO_CONSOLIDATE" | "OFFER_SOURCE_CONFLICT" | "FILL_LEGACY_SUNSET" | "VERIFY_HORIZON" | "VERIFY_UNREPRESENTABLE" | "WALLET_UNAVAILABLE" | "REVIEW_REQUIRED" | "UNKNOWN";
-declare const SDK_VERSION = "0.7.0";
+declare const SDK_VERSION = "0.8.1";
 interface CairnErrorOptions {
     code?: CairnErrorCode;
     docsPath?: string;
@@ -209,7 +218,7 @@ declare class CairnError extends Error {
     /** Relative docs path (under the SDK docs base), if any. */
     readonly docsPath?: string;
     /** The cairn-sdk version that produced this error. */
-    readonly version = "0.7.0";
+    readonly version = "0.8.1";
     /**
      * Whether a dApp may safely AUTO-retry this failure. `false` for fund-safety refusals and user-intent
      * declines (the default); `true` only for provably transient infra faults where nothing was signed.

package/dist/index.d.ts

@@ -5,7 +5,7 @@ import { IndexerClient } from './indexer.js';
 export { InclusionResult, IndexEvent, MerkleProof, StreamHandle, StreamHandlers, TrustLevel } from './indexer.js';
 import { ContentClient } from './content.js';
 export { ContentClientOptions, PreparedContent } from './content.js';
-import { NameState, MintedProvenOfferTerms } from '@inversealtruism/cairnx-core';
+import { NameState, OfferStatus, BidStatus, MintedProvenOfferTerms } from '@inversealtruism/cairnx-core';
 export { FillEndorsement, FillOutputPlan, FillPreview, FillSafety, MintedProvenOfferTerms, ProvenOfferTerms, bindOfferTerms, feeBpsAt, fillEndorsement, fillIsSafe, fillOutputPlan, previewFill, requiredFillOutputs } from '@inversealtruism/cairnx-core';
 import { WalletConnection, DetectOptions } from './connect.js';
 export { AttestParams, CairnProvider, ConnectResult, FillParams, ProposeParams, ProviderDetail, ProviderInfo, SealClaimParams, SendParams, SignInResult, SiwcParams, SiwcResult, TxResult, WalletCapabilities, WalletPermission, connect, detectProvider, discoverProviders, getWallet, isInstalled } from './connect.js';
@@ -16,7 +16,7 @@ import '@inversealtruism/csd-tx';
 import '@inversealtruism/csd-codec';
 import '@inversealtruism/csd-crypto';
 
-/** `/cairnx/resolve/:name` — the display-path name→address resolution. */
+/** `/cairnx/resolve/:name`: the display-path name→address resolution. */
 interface NameResolution {
     ok: boolean;
     name: string;
@@ -28,7 +28,7 @@ interface NameResolution {
     owner?: string;
     tipHeight?: number;
 }
-/** `/cairnx/name/:name` — full name detail (lease, lock, resting offer, recapture window). */
+/** `/cairnx/name/:name`: full name detail (lease, lock, resting offer, recapture window). */
 interface NameDetail {
     name: string;
     owner: string;
@@ -101,6 +101,8 @@ declare class NamesClient {
     constructor(http: Http);
     private malformed;
     private list;
+    /** Rows of a market list with one status, or every row for "all". */
+    private byStatus;
     /** Resolve a .csd name for DISPLAY (server-trusted; see the module trust note). null = unknown/invalid name. */
     resolve(name: string): Promise<NameResolution | null>;
     /** Full detail for one name (lease, lock, resting offer, recapture). null = not registered/invalid. */
@@ -116,12 +118,19 @@ declare class NamesClient {
     names(): Promise<unknown[]>;
     /** All deployed tokens. Throws a typed HttpError if any row has a malformed ticker, decimals or amount. */
     tokens(): Promise<TokenInfo[]>;
-    /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body. */
+    /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body or a
+     *  record for another ticker. */
     token(ticker: string): Promise<TokenInfo | null>;
-    /** Open offers (the market's display list). */
-    offers(): Promise<unknown[]>;
-    /** Open bids. */
-    bids(): Promise<unknown[]>;
+    /** Offers with one status, open ones by default (the market's display list). `{ status: "all" }` returns every
+     *  offer the server holds, filled, cancelled and expired ones included. */
+    offers(opts?: {
+        status?: OfferStatus | "all";
+    }): Promise<unknown[]>;
+    /** Bids with one status, open ones by default. `{ status: "all" }` returns every bid the server holds, done,
+     *  cancelled and expired ones included. */
+    bids(opts?: {
+        status?: BidStatus | "all";
+    }): Promise<unknown[]>;
     /** The full canonical CairnX state (large; prefer the scoped reads above). */
     state(): Promise<unknown>;
 }
@@ -189,7 +198,7 @@ declare function preverifyOffer(opts: {
 
 /** Stable machine-readable error codes (branch on these, not the message text). */
 type CairnErrorCode = "NOT_INSTALLED" | "USER_REJECTED" | "WALLET_LOCKED" | "UNSUPPORTED_METHOD" | "HTTP_ERROR" | "CONTENT_VERIFICATION" | "CONTENT_NOT_JSON" | "ACCOUNT_CHANGED" | "FIRST_PARTY_ONLY" | "RATE_LIMITED" | "APPROVAL_CLOSED" | "FORBIDDEN" | "INTERNAL" | "GHOST_INPUTS_SKIPPED" | "VERIFY_UNAVAILABLE" | "VERIFY_TAMPER" | "INSUFFICIENT" | "TOO_MANY_INPUTS" | "FEE_TOO_LOW" | "FEE_CAP" | "BAD_FEE" | "ZERO_ADDR_REFUSED" | "BAD_OUTPUTS" | "NO_OUTPUTS" | "BAD_REQUEST" | "OFFER_UNKNOWN" | "FILL_UNSAFE" | "FILL_WRONG_TARGET" | "SOURCE_DIVERGENCE" | "SUBMIT_REJECTED" | "SUBMIT_MAYBE_INFLIGHT" | "SUBMIT_DUPLICATE" | "NOTHING_TO_CONSOLIDATE" | "OFFER_SOURCE_CONFLICT" | "FILL_LEGACY_SUNSET" | "VERIFY_HORIZON" | "VERIFY_UNREPRESENTABLE" | "WALLET_UNAVAILABLE" | "REVIEW_REQUIRED" | "UNKNOWN";
-declare const SDK_VERSION = "0.7.0";
+declare const SDK_VERSION = "0.8.1";
 interface CairnErrorOptions {
     code?: CairnErrorCode;
     docsPath?: string;
@@ -209,7 +218,7 @@ declare class CairnError extends Error {
     /** Relative docs path (under the SDK docs base), if any. */
     readonly docsPath?: string;
     /** The cairn-sdk version that produced this error. */
-    readonly version = "0.7.0";
+    readonly version = "0.8.1";
     /**
      * Whether a dApp may safely AUTO-retry this failure. `false` for fund-safety refusals and user-intent
      * declines (the default); `true` only for provably transient infra faults where nothing was signed.

package/dist/index.js

@@ -4,13 +4,13 @@ import {
 } from "./chunk-C452UODV.js";
 import {
   ContentClient
-} from "./chunk-TDXGYP3G.js";
+} from "./chunk-23ATXZKM.js";
 import {
   IndexerClient
 } from "./chunk-CI7YODPP.js";
 import {
   CairnController
-} from "./chunk-XOGOSGC6.js";
+} from "./chunk-QWGR5J5D.js";
 import {
   WalletConnection,
   connect,
@@ -18,7 +18,7 @@ import {
   discoverProviders,
   getWallet,
   isInstalled
-} from "./chunk-4FFLCCL4.js";
+} from "./chunk-F3KJPQXM.js";
 import {
   CairnError,
   ContentVerificationError,
@@ -32,7 +32,7 @@ import {
   errorCode,
   mapProviderError,
   mapSubmitResultError
-} from "./chunk-PBKDSDID.js";
+} from "./chunk-X7J6ECNV.js";
 
 // src/http.ts
 var DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
@@ -203,9 +203,10 @@ function errText(body) {
 }
 
 // src/names.ts
-import { NAME_RE, RESERVED_NAMES, TICKER_RE, AMOUNT_RE, HASH_RE } from "@inversealtruism/cairnx-core";
+import { NAME_RE, RESERVED_NAMES, TICKER_RE, HASH_RE, MAX_TOKEN_DECIMALS, parseAmount } from "@inversealtruism/cairnx-core";
 var nameOk = (n) => typeof n === "string" && NAME_RE.test(n) && !RESERVED_NAMES.has(n);
-var amountOk = (v) => typeof v === "string" && AMOUNT_RE.test(v);
+var amountOk = (v) => parseAmount(v, { allowZero: true }) !== null;
+var decimalsOk = (d) => Number.isSafeInteger(d) && d >= 0 && d <= MAX_TOKEN_DECIMALS;
 var heightOk = (v) => Number.isSafeInteger(v) && v >= 0;
 function nameHistoryProblem(h, name) {
   if (!h || typeof h !== "object" || Array.isArray(h)) return "not an object";
@@ -222,14 +223,15 @@ function nameHistoryProblem(h, name) {
   }
   return null;
 }
-function tokenProblem(t) {
+function tokenProblem(t, ticker) {
   if (!t || typeof t !== "object") return "not an object";
   const r = t;
   if (typeof r.ticker !== "string" || !TICKER_RE.test(r.ticker)) return "bad ticker";
-  if (!Number.isSafeInteger(r.decimals) || r.decimals < 0) return `bad decimals (${String(r.decimals)})`;
-  if (!amountOk(r.supply)) return "supply is not a base-unit integer string";
-  if (!amountOk(r.minted)) return "minted is not a base-unit integer string";
-  if (r.mintLimit !== void 0 && !amountOk(r.mintLimit)) return "mintLimit is not a base-unit integer string";
+  if (ticker !== void 0 && r.ticker !== ticker) return `ticker is ${JSON.stringify(r.ticker)}, expected ${JSON.stringify(ticker)}`;
+  if (!decimalsOk(r.decimals)) return `bad decimals (${String(r.decimals)}), not an integer in the consensus range`;
+  if (!amountOk(r.supply)) return "supply is not a base-unit integer string within MAX_AMOUNT";
+  if (!amountOk(r.minted)) return "minted is not a base-unit integer string within MAX_AMOUNT";
+  if (r.mintLimit !== void 0 && !amountOk(r.mintLimit)) return "mintLimit is not a base-unit integer string within MAX_AMOUNT";
   return null;
 }
 var NamesClient = class {
@@ -240,11 +242,17 @@ var NamesClient = class {
   malformed(path, what) {
     return new HttpError(200, this.http.url(path), `malformed response: ${what}`);
   }
-  async list(path) {
-    const body = await this.http.getJson(path);
+  async list(path, query) {
+    const body = await this.http.getJson(path, query);
     if (!Array.isArray(body)) throw this.malformed(path, "expected an array");
     return body;
   }
+  /** Rows of a market list with one status, or every row for "all". */
+  async byStatus(path, status) {
+    if (status === "all") return this.list(path);
+    const rows = await this.list(path, { status });
+    return rows.filter((r) => r?.status === status);
+  }
   /** Resolve a .csd name for DISPLAY (server-trusted; see the module trust note). null = unknown/invalid name. */
   async resolve(name) {
     if (!nameOk(name)) return null;
@@ -315,7 +323,8 @@ var NamesClient = class {
     });
     return rows;
   }
-  /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body. */
+  /** One token by ticker. null = unknown/invalid ticker. Throws a typed HttpError on a malformed body or a
+   *  record for another ticker. */
   async token(ticker) {
     if (typeof ticker !== "string" || !TICKER_RE.test(ticker)) return null;
     const path = `/trade/api/cairnx/token/${ticker}`;
@@ -326,17 +335,19 @@ var NamesClient = class {
       if (e?.status === 404) return null;
       throw e;
     }
-    const p = tokenProblem(t);
+    const p = tokenProblem(t, ticker);
     if (p) throw this.malformed(path, p);
     return t;
   }
-  /** Open offers (the market's display list). */
-  offers() {
-    return this.list(`/trade/api/cairnx/offers`);
+  /** Offers with one status, open ones by default (the market's display list). `{ status: "all" }` returns every
+   *  offer the server holds, filled, cancelled and expired ones included. */
+  offers(opts = {}) {
+    return this.byStatus(`/trade/api/cairnx/offers`, opts.status ?? "open");
   }
-  /** Open bids. */
-  bids() {
-    return this.list(`/trade/api/cairnx/bids`);
+  /** Bids with one status, open ones by default. `{ status: "all" }` returns every bid the server holds, done,
+   *  cancelled and expired ones included. */
+  bids(opts = {}) {
+    return this.byStatus(`/trade/api/cairnx/bids`, opts.status ?? "open");
   }
   /** The full canonical CairnX state (large; prefer the scoped reads above). */
   state() {
@@ -347,20 +358,19 @@ var NamesClient = class {
 // src/fillverify.ts
 import { rpcTxToTx } from "@inversealtruism/csd-client";
 import { txid, payloadHash } from "@inversealtruism/csd-codec";
+import { authorOf } from "@inversealtruism/csd-crypto";
 import {
-  DOMAIN,
   parseRecord,
   feeBpsAt,
   bindOfferTerms,
   provenOfferTerms,
+  provenOfferRefusal,
   fillOutputPlan,
   isTokenWant,
   fillEndorsement,
   fillIsSafe,
   requiredFillOutputs,
-  previewFill,
-  TREASURY_ADDR,
-  epochOf
+  previewFill
 } from "@inversealtruism/cairnx-core";
 var ADDR = /^0x[0-9a-f]{40}$/;
 var BELOW_BASE = /^tx below the synced base \((\d+)\)/;
@@ -401,9 +411,7 @@ async function provenAuthor(client, provenTx) {
     return null;
   }
   if (String(txid(src)).toLowerCase() !== String(in0.prevTxid).toLowerCase()) return null;
-  const out = src.outputs?.[Number(in0.vout)];
-  const spk = out?.scriptPubkey ? String(out.scriptPubkey).toLowerCase() : null;
-  return spk && ADDR.test(spk) ? spk : null;
+  return authorOf(provenTx, src.outputs?.[Number(in0.vout)]?.scriptPubkey);
 }
 async function preverifyOffer(opts) {
   const id = String(opts.offerId).toLowerCase();
@@ -431,8 +439,6 @@ async function preverifyOffer(opts) {
   if (String(provenId).toLowerCase() !== id) return { ok: false, trust: "unverified", reason: "the merkle-proven tx doesn't match the offer id" };
   const app = incl.tx.app;
   if (!app || app.type !== "Propose") return { ok: false, trust: "unverified", reason: "the offer tx is not a Propose" };
-  if (String(app.domain) !== DOMAIN)
-    return { ok: false, trust: "unverified", reason: `the offer tx is not a ${DOMAIN} Propose (wrong settlement domain)` };
   let rec;
   try {
     rec = parseRecord(app.uri, incl.appPayloadHash);
@@ -445,14 +451,12 @@ async function preverifyOffer(opts) {
   const seller = await provenAuthor(opts.client, provenTx);
   if (!seller) return { ok: false, trust: "verified", transient: true, blockHeight, reason: "couldn't prove the offer's on-chain author yet; the chain view may be catching up, try again" };
   const offerRec = rec;
+  const ee = app.expires_epoch;
+  const refusal = provenOfferRefusal(offerRec, { domain: String(app.domain), height: blockHeight, expiresEpoch: typeof ee === "bigint" ? ee : Number(ee), seller });
+  if (refusal) return { ok: false, trust: "verified", blockHeight, reason: `CairnX rejects this offer (${refusal}) - a fill would move CSD for nothing` };
   const w = rec.want ?? {};
   const payto = w.payto && ADDR.test(String(w.payto).toLowerCase()) ? String(w.payto).toLowerCase() : seller;
   const terms = provenOfferTerms(offerRec, blockHeight);
-  if (payto === TREASURY_ADDR)
-    return { ok: false, trust: "verified", blockHeight, reason: "the offer's payment recipient is the protocol treasury - the chain rejects it, and a fill would move CSD for nothing" };
-  const provenExpiresEpoch = Number(app.expires_epoch);
-  if (!Number.isSafeInteger(provenExpiresEpoch) || epochOf(blockHeight) > provenExpiresEpoch)
-    return { ok: false, trust: "verified", blockHeight, reason: "the offer was already expired when it was mined - the chain rejects it, and a fill would move CSD for nothing" };
   let outputPlan;
   let sumsMismatch;
   let planReason;
@@ -510,9 +514,7 @@ async function preverifyOffer(opts) {
     if (String(so.seller).toLowerCase() !== seller)
       return { ok: false, trust: "verified", reason: "the served seller doesn't match the offer's on-chain author (a lying resolver may be redirecting your payment)", ...base };
     if (bindOfferTerms(opts.servedOffer, terms, { give: true, wantType: true }))
-      return { ok: false, trust: "verified", reason: "the served terms don't match the offer's on-chain record (fee, rebate, partial sizing, the give, or the want type - a lying resolver could mis-size or re-route the fill, redirecting or burning your payment)", ...base };
-    if (isTokenWant(offerRec.want) && (String(so?.want?.ticker) !== String(offerRec.want.ticker) || String(so?.want?.amount) !== String(offerRec.want.amount)))
-      return { ok: false, trust: "verified", reason: "the served want ticker/amount don't match the offer's on-chain record (a lying resolver could bait-and-switch the token price)", ...base };
+      return { ok: false, trust: "verified", reason: "the served terms don't match the offer's on-chain record (fee, rebate, partial sizing, the give, or the want's type or token price - a lying resolver could mis-size, re-price or re-route the fill, redirecting or burning your payment)", ...base };
   }
   if (sumsMismatch) return { ok: false, trust: "verified", reason: sumsMismatch, ...base };
   return { ok: true, trust: "verified", ...base };

package/dist/react.cjs

@@ -26,7 +26,7 @@ __export(react_exports, {
 module.exports = __toCommonJS(react_exports);
 
 // src/errors.ts
-var SDK_VERSION = "0.7.0";
+var SDK_VERSION = "0.8.1";
 var DOCS_BASE = "https://cairn-substrate.com/docs/sdk";
 var CairnError = class extends Error {
   /** Stable machine code for programmatic branching. */

package/dist/react.js

@@ -1,8 +1,8 @@
 import {
   CairnController
-} from "./chunk-XOGOSGC6.js";
-import "./chunk-4FFLCCL4.js";
-import "./chunk-PBKDSDID.js";
+} from "./chunk-QWGR5J5D.js";
+import "./chunk-F3KJPQXM.js";
+import "./chunk-X7J6ECNV.js";
 
 // src/react.ts
 function createCairnHooks(React, controllerOrOpts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inversealtruism/cairn-sdk",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "The Compute Substrate dApp kit: one cohesive toolkit to connect the Cairn Wallet, read the chain, the indexer and .csd names, verify self-certifying content, and resolve .csd names. Composes the published csd-* primitives.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -49,16 +49,16 @@
     "README.md"
   ],
   "dependencies": {
-    "@inversealtruism/cairnx-core": "0.2.0",
-    "@inversealtruism/csd-client": "0.1.18",
+    "@inversealtruism/cairnx-core": "0.2.3",
+    "@inversealtruism/csd-client": "0.1.20",
     "@inversealtruism/csd-codec": "0.1.18",
-    "@inversealtruism/csd-crypto": "0.1.18",
-    "@inversealtruism/csd-light": "0.1.23",
-    "@inversealtruism/csd-tx": "0.1.21"
+    "@inversealtruism/csd-crypto": "0.1.20",
+    "@inversealtruism/csd-light": "0.1.26",
+    "@inversealtruism/csd-tx": "0.1.23"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.15",
-    "@inversealtruism/csd-siwc": "0.1.19",
+    "@inversealtruism/csd-siwc": "0.1.21",
     "@types/node": "22.19.20",
     "esbuild": "0.28.2",
     "playwright-core": "1.60.0",