@invisi-labs/sdk 1.1.3 → 1.1.4

package/dist/index.js

@@ -1,29 +1,34 @@
 import {
   DisclosureVerifier,
+  InvisiError,
   Operation,
   TransactionPreparation,
   WalletSession,
-  authorizeOperation,
+  acceptFundingSignature,
+  acceptWalletSignature,
   copyGasBenchmarks,
+  decryptCandidates,
   defineGasBenchmarks,
   deserializeState,
   encodeOperation,
   estimateGasReference,
+  fundingSigningRequest,
   operationPreview,
   positiveAmount,
+  prepareWithErrors,
   proveOperation,
   publicProof,
+  readProtocolLogs,
   requiresAuthorization,
   sameStatement,
   serializeState,
-  signOperationFunding,
   statement,
-  walletBalance
-} from "./chunk-FSQYZO66.js";
+  walletBalance,
+  walletSigningRequest
+} from "./chunk-BE52B32Z.js";
 import {
   EthersAddressResolver,
   EthersChainReader,
-  EthersFundingSigner,
   EthersFundingVerifier
 } from "./chunk-4HMM7ZKY.js";
 
@@ -31,9 +36,7 @@ import {
 import { getAddress } from "ethers";
 
 // src/PreparedTransaction.ts
-import {
-  MissingCapabilityError
-} from "@invisi-labs/core";
+import { MissingCapabilityError } from "@invisi-labs/core";
 import { normalizeFunding } from "@invisi-labs/protocol";
 function check(ok, message) {
   if (!ok) throw new Error(message);
@@ -104,30 +107,77 @@ var PreparedTransaction = class _PreparedTransaction {
       this.#lifecycle.busy = false;
     }
   }
-  async authorize(providerOrOptions = {}, suppliedOptions = {}) {
-    const options = "authorize" in providerOrOptions ? suppliedOptions : providerOrOptions;
-    const provider = "authorize" in providerOrOptions ? providerOrOptions : this.#runtime.authorization();
+  /** Public EIP-712 request; signing transport and key custody belong to the caller. */
+  async exportWalletAuthorization(options = {}) {
+    options.signal?.throwIfAborted();
+    this.current();
+    check(
+      requiresAuthorization(this.#saved.plan),
+      "operation does not require wallet authorization"
+    );
+    check(
+      ["prepared", "authorized"].includes(this.status),
+      "operation is not awaiting wallet authorization"
+    );
+    return walletSigningRequest(this.#saved.plan);
+  }
+  /** Attach an external EOA signature, retaining its witness only at the private proving boundary. */
+  async withWalletSignature(signature, options = {}) {
+    options.signal?.throwIfAborted();
+    this.current();
     check(
       requiresAuthorization(this.#saved.plan),
       "operation does not require wallet authorization"
     );
-    const selectedProvider = provider;
     check(
-      provider.walletIdentity === this.#runtime.scope.walletIdentity,
-      "wallet authorization capability mismatch"
+      ["prepared", "authorized"].includes(this.status),
+      "operation is not awaiting wallet authorization"
     );
+    const authorization = await acceptWalletSignature(this.#saved.plan, signature);
     return this.stage(
       "wallet authorization",
       ["prepared", "authorized"],
+      async () => ({ status: "authorized", authorization }),
+      options.signal
+    );
+  }
+  /** Export only after proving when the funding authorization binds an actual proof hash. */
+  async exportFundingAuthorization(options = {}) {
+    options.signal?.throwIfAborted();
+    this.current();
+    check(
+      this.status === (this.kind === "shield" ? "prepared" : "proved"),
+      "operation is not awaiting funding authorization or proof"
+    );
+    const request = await fundingSigningRequest(this.#saved, this.#runtime);
+    options.signal?.throwIfAborted();
+    this.current();
+    return request;
+  }
+  /** Verify an external signature against this handle's own frozen operation. */
+  async withFundingSignature(signature, options = {}) {
+    options.signal?.throwIfAborted();
+    this.current();
+    check(
+      this.status === (this.kind === "shield" ? "prepared" : "proved"),
+      "operation is not awaiting funding authorization or proof"
+    );
+    const verified = await acceptFundingSignature(this.#saved, signature, this.#runtime);
+    return this.stage(
+      "funding authorization",
+      this.kind === "shield" ? ["prepared"] : ["proved"],
       async (saved) => {
-        const authorization = await authorizeOperation(saved.plan, selectedProvider);
-        return { status: "authorized", authorization };
+        saved.plan.funding.signature = verified;
+        if (saved.plan.statement?.target !== "noir-recursive") {
+          saved.call = await this.encode(saved);
+        }
+        return { status: "ready" };
       },
       options.signal
     );
   }
   async prove(backendOrOptions = {}, suppliedOptions = {}) {
-    const options = "prove" in backendOrOptions ? suppliedOptions : backendOrOptions;
+    const options = { ..."prove" in backendOrOptions ? suppliedOptions : backendOrOptions };
     const plan = this.#saved.plan;
     check(plan.kind !== "shield", "shield requires no proof");
     if (requiresAuthorization(plan)) {
@@ -166,37 +216,6 @@ var PreparedTransaction = class _PreparedTransaction {
   encode(saved) {
     return encodeOperation(saved);
   }
-  async authorizeFunding(signerOrOptions = {}, suppliedOptions = {}) {
-    const options = "signTypedData" in signerOrOptions ? suppliedOptions : signerOrOptions;
-    const suppliedSigner = "signTypedData" in signerOrOptions ? signerOrOptions : void 0;
-    const p = this.#saved.plan;
-    check(p.fundingMode === "signature", "operation does not require a funding signature");
-    check(p.kind === "shield" || this.#saved.proof, "proof must precede funding authorization");
-    const signer = suppliedSigner ?? this.#runtime.options.fundingSigner;
-    if (!signer) {
-      throw new MissingCapabilityError("EVM funding signer");
-    }
-    check(
-      signer.address.toLowerCase() === p.funding.payer.toLowerCase(),
-      "funding signer is not the payer"
-    );
-    return this.stage(
-      "funding authorization",
-      p.kind === "shield" ? ["prepared"] : ["proved"],
-      async (saved) => {
-        saved.plan.funding.signature = await signOperationFunding(
-          saved,
-          signer,
-          this.#runtime.options.fundingVerifier
-        );
-        if (saved.plan.statement?.target !== "noir-recursive") {
-          saved.call = await this.encode(saved);
-        }
-        return { status: "ready" };
-      },
-      options.signal
-    );
-  }
   /** Shield caller funding needs no wallet signing or proof; this step only encodes its frozen request. */
   async ready() {
     check(
@@ -285,14 +304,21 @@ function explicitPreparation(options, data, tokenAddress) {
     namespace: "explicit",
     walletIdentity: options.wallet.walletIdentity
   };
-  const { store: _store, coinSelector: _selector, ...capabilities } = options;
+  const {
+    store: _store,
+    coinSelector: _selector,
+    authorization: _authorization,
+    viewing: _viewing,
+    signer: _signer,
+    fundingSigner: _fundingSigner,
+    ...capabilities
+  } = options;
   if (inputs.some((input) => input.note.tokenAddress !== BigInt(getAddress(tokenAddress))))
     throw new Error("explicit note token mismatch");
   const runtime = {
     options: { ...capabilities, protocol: options.protocol.forToken(tokenAddress) },
     reader: options.chainReader,
-    scope,
-    authorization: () => options.authorization ?? options.wallet.exportAuthorization()
+    scope
   };
   return new TransactionPreparation({
     ...runtime,
@@ -305,10 +331,39 @@ function explicitPreparation(options, data, tokenAddress) {
 
 // src/Invisi.ts
 import { ProtocolRpcClient } from "@invisi-labs/rpc";
-import { MissingCapabilityError as MissingCapabilityError2 } from "@invisi-labs/core";
+import { MissingCapabilityError as MissingCapabilityError2, PublicWallet, ReceivingAddress } from "@invisi-labs/core";
+
+// src/AddressRegistry.ts
+import { AddressRegistry as Registry } from "@invisi-labs/protocol";
+var AddressRegistry = class extends Registry {
+  prepareRegistration(options) {
+    return prepareWithErrors("prepareRegistration", async () => {
+      if ("provider" in options) {
+        const { provider, ...preparation } = options;
+        return super.prepareRegistration({
+          ...preparation,
+          reader: new EthersChainReader(provider)
+        });
+      }
+      return super.prepareRegistration(options);
+    });
+  }
+};
+
+// src/Invisi.ts
 var Invisi = class {
   #options;
   constructor(options = {}) {
+    if ("ciphertextCodecs" in options || "envelopeVersion" in options) {
+      throw new Error(
+        "SDK envelope versions are fixed; encode application payload bytes externally"
+      );
+    }
+    if ("signer" in options || "fundingSigner" in options) {
+      throw new Error(
+        "Invisi does not accept signer defaults; export a signing request and attach the external signature"
+      );
+    }
     this.#options = {
       ...options,
       ...options.gasBenchmarks ? { gasBenchmarks: copyGasBenchmarks(options.gasBenchmarks) } : {}
@@ -319,7 +374,15 @@ var Invisi = class {
     return new WalletSession(await this.resolve(options));
   }
   async resolve(options) {
-    const allowed = ["wallet", "protocol", "namespace", "viewing", "authorization"];
+    const allowed = [
+      "wallet",
+      "protocol",
+      "namespace",
+      "viewing",
+      "authorization",
+      "signer",
+      "fundingSigner"
+    ];
     for (const key of Object.keys(options)) {
       if (!allowed.includes(key))
         throw new Error(
@@ -328,7 +391,10 @@ var Invisi = class {
     }
     const selected = { ...options };
     const combined = { ...this.#options, ...selected };
-    const { provider, signer, ...runtime } = combined;
+    const { provider, addressLookup = "protocol-rpc", ...runtime } = combined;
+    if (addressLookup !== void 0 && addressLookup !== "chain" && addressLookup !== "protocol-rpc") {
+      throw new Error("Invalid recipient address lookup source");
+    }
     const reader = combined.chainReader ?? (provider ? new EthersChainReader(provider) : void 0);
     if (!reader) throw new MissingCapabilityError2("chain reader");
     if (provider && (await provider.getNetwork()).chainId !== selected.protocol.context.chainId)
@@ -337,88 +403,138 @@ var Invisi = class {
     if (runtime.protocolRpc instanceof ProtocolRpcClient) {
       runtime.protocolRpc = runtime.protocolRpc.withReader(reader);
     }
-    if (signer) {
-      if (!provider) throw new MissingCapabilityError2("provider for signer");
-      if (!signer.provider) throw new Error("signer must be connected to a provider");
-      if ((await signer.provider.getNetwork()).chainId !== selected.protocol.context.chainId)
-        throw new Error("signer-provider deployment chain mismatch");
-    }
     const registry = selected.protocol.deployment.registry;
-    const fundingSigner = combined.fundingSigner ?? (signer ? await EthersFundingSigner.create(signer, selected.protocol.context.chainId) : void 0);
     const fundingVerifier = combined.fundingVerifier ?? (provider ? new EthersFundingVerifier(provider, selected.protocol.context.chainId) : void 0);
-    const addressResolver = combined.addressResolver ?? (provider && registry ? new EthersAddressResolver(
-      provider,
-      {
-        chainId: selected.protocol.context.chainId,
-        registryAddress: registry.address
-      },
-      registry.runtimeCodeHash
-    ).lookup : void 0);
+    let addressResolver = combined.addressResolver;
+    if (!addressResolver && registry) {
+      if (addressLookup === "protocol-rpc") {
+        const rpc = runtime.protocolRpc;
+        addressResolver = async (identity) => {
+          if (!(rpc instanceof ProtocolRpcClient)) {
+            throw new MissingCapabilityError2("Protocol RPC recipient discovery");
+          }
+          const discovered = await rpc.getDeployment(selected.protocol.context.chainId);
+          const expected = selected.protocol.deployment;
+          if (discovered.protocol.address !== expected.protocol.address || discovered.protocol.runtimeCodeHash !== expected.protocol.runtimeCodeHash || discovered.protocol.fromBlock !== expected.protocol.fromBlock || discovered.registry?.address !== registry.address || discovered.registry.runtimeCodeHash !== registry.runtimeCodeHash || discovered.registry.fromBlock !== registry.fromBlock)
+            throw new Error("Recipient registry deployment pins mismatch");
+          const registration = await rpc.getReceivingAddress(identity);
+          return registration ? ReceivingAddress.parse(registration.receivingAddress).getReceivingKeys() : null;
+        };
+      } else if (provider) {
+        addressResolver = new EthersAddressResolver(
+          provider,
+          {
+            chainId: selected.protocol.context.chainId,
+            registryAddress: registry.address
+          },
+          registry.runtimeCodeHash
+        ).lookup;
+      }
+    }
     return {
       ...runtime,
       chainReader: reader,
-      ...signer ? { signer } : {},
-      ...fundingSigner ? { fundingSigner } : {},
       ...fundingVerifier ? { fundingVerifier } : {},
       ...addressResolver ? { addressResolver } : {},
       protocol: selected.protocol
     };
   }
+  /** Discover the selected chain's registry and prepare an independent signing request. */
+  async prepareRegistration(options) {
+    return prepareWithErrors("prepareRegistration", async () => {
+      for (const key of Object.keys(options)) {
+        if (!["wallet", "update", "deadline"].includes(key)) {
+          throw new Error(`Unknown registration option: ${key}`);
+        }
+      }
+      this.assertPublicIdentity(options);
+      const selected = { ...options };
+      const { provider, protocolRpc } = this.#options;
+      if (!provider) throw new MissingCapabilityError2("ethers provider");
+      if (!(protocolRpc instanceof ProtocolRpcClient)) {
+        throw new MissingCapabilityError2("Protocol RPC deployment discovery");
+      }
+      const chainId = (await provider.getNetwork()).chainId;
+      const deployment = await protocolRpc.getDeployment(chainId);
+      if (!deployment.registry) {
+        throw new MissingCapabilityError2("receiving-key registry deployment");
+      }
+      const registry = new AddressRegistry(
+        { chainId, registryAddress: deployment.registry.address },
+        { expectedRuntimeCodeHash: deployment.registry.runtimeCodeHash }
+      );
+      return registry.prepareRegistration({ ...selected, provider });
+    });
+  }
+  assertPublicIdentity(options) {
+    const { wallet } = options;
+    if (!(wallet instanceof PublicWallet) || ["getViewer", "getDetector", "exportAuthorization"].some((key) => key in wallet)) {
+      throw new Error(
+        "Independent preparation requires a PublicWallet without private capabilities"
+      );
+    }
+    for (const key of ["authorization", "signer", "fundingSigner", "viewing"]) {
+      if (key in options)
+        throw new Error(`Independent preparation does not accept capability: ${key}`);
+    }
+  }
+  resolveExplicit(options) {
+    this.assertPublicIdentity(options);
+    return this.resolve({ wallet: options.wallet, protocol: options.protocol });
+  }
   async prepareTransfer(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareTransfer(request);
-  }
-  async prepareWithdraw(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareWithdraw(request);
-  }
-  async prepareSweep(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareSweep(request);
+    return prepareWithErrors("prepareTransfer", async () => {
+      const { wallet, protocol, ...input } = options;
+      const request = structuredClone(input);
+      const runtime = await this.resolveExplicit(options);
+      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
+      return preparation.prepareTransfer(request);
+    });
   }
   async prepareShield(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, {}, request.tokenAddress);
-    return preparation.prepareShield(request);
+    return prepareWithErrors("prepareShield", async () => {
+      const { wallet, protocol, ...input } = options;
+      const request = structuredClone(input);
+      const runtime = await this.resolveExplicit(options);
+      const preparation = explicitPreparation(runtime, {}, request.tokenAddress);
+      return preparation.prepareShield(request);
+    });
   }
   async prepareCreateCredit(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareCreateCredit(request);
+    return prepareWithErrors("prepareCreateCredit", async () => {
+      const { wallet, protocol, ...input } = options;
+      const request = structuredClone(input);
+      const runtime = await this.resolveExplicit(options);
+      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
+      return preparation.prepareCreateCredit(request);
+    });
   }
   async prepareDrawCredit(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareDrawCredit(request);
+    return prepareWithErrors("prepareDrawCredit", async () => {
+      const { wallet, protocol, ...input } = options;
+      const request = structuredClone(input);
+      const runtime = await this.resolveExplicit(options);
+      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
+      return preparation.prepareDrawCredit(request);
+    });
   }
   async prepareTopUpCredit(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareTopUpCredit(request);
+    return prepareWithErrors("prepareTopUpCredit", async () => {
+      const { wallet, protocol, ...input } = options;
+      const request = structuredClone(input);
+      const runtime = await this.resolveExplicit(options);
+      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
+      return preparation.prepareTopUpCredit(request);
+    });
   }
   async prepareCancelCredit(options) {
-    const { wallet, protocol, ...input } = options;
-    const request = structuredClone(input);
-    const runtime = await this.resolve({ wallet, protocol });
-    const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-    return preparation.prepareCancelCredit(request);
+    return prepareWithErrors("prepareCancelCredit", async () => {
+      const { wallet, protocol, ...input } = options;
+      const request = structuredClone(input);
+      const runtime = await this.resolveExplicit(options);
+      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
+      return preparation.prepareCancelCredit(request);
+    });
   }
   toJSON() {
     return { invisi: true };
@@ -430,7 +546,11 @@ var Invisi = class {
 
 // src/index.ts
 import {
+  fundsV1,
+  creditV1,
+  decodeDeliveryHeader,
   Wallet,
+  PublicWallet as PublicWallet2,
   ViewingCapability,
   Detector,
   NullifierCapability,
@@ -439,7 +559,9 @@ import {
   Disclosure,
   encodeMemo,
   decodeMemoText,
-  MAX_MEMO_BYTES
+  MAX_MEMO_BYTES,
+  computeCreditNullifier,
+  creditPeriods
 } from "@invisi-labs/core";
 import { Protocol, RegistrationOperation } from "@invisi-labs/protocol";
 import { ProtocolRpcError } from "@invisi-labs/rpc";
@@ -452,21 +574,6 @@ var ProtocolRpcClient2 = class extends RpcClient {
   }
 };
 
-// src/AddressRegistry.ts
-import { AddressRegistry as Registry } from "@invisi-labs/protocol";
-var AddressRegistry = class extends Registry {
-  prepareRegistration(options) {
-    if ("provider" in options) {
-      const { provider, ...preparation } = options;
-      return super.prepareRegistration({
-        ...preparation,
-        reader: new EthersChainReader(provider)
-      });
-    }
-    return super.prepareRegistration(options);
-  }
-};
-
 // src/integrations/encrypted-codec.ts
 var EncryptedWalletCodec = class _EncryptedWalletCodec {
   #key;
@@ -557,6 +664,7 @@ export {
   DisclosureVerifier,
   EncryptedWalletCodec,
   Invisi,
+  InvisiError,
   MAX_MEMO_BYTES,
   MissingCapabilityError3 as MissingCapabilityError,
   NullifierCapability,
@@ -565,14 +673,22 @@ export {
   Protocol,
   ProtocolRpcClient2 as ProtocolRpcClient,
   ProtocolRpcError,
+  PublicWallet2 as PublicWallet,
   RegistrationOperation,
   ViewingCapability,
   Wallet,
   WalletAuthorization,
   WalletSession,
+  computeCreditNullifier,
+  creditPeriods,
+  creditV1,
+  decodeDeliveryHeader,
   decodeMemoText,
+  decryptCandidates,
   defineGasBenchmarks,
   encodeMemo,
+  fundsV1,
+  readProtocolLogs,
   walletBalance
 };
 //# sourceMappingURL=index.js.map