@invisible-labs/sdk 0.6.0-devnet.1 → 0.6.0-devnet.3

package/README.md

@@ -1,210 +1,178 @@
 # @invisible-labs/sdk
 
-Frontend-integration TypeScript SDK for the Invisible protocol.
+TypeScript SDK for building private SOL transfer integrations with Invisible.
 
-This package is the single programmatic entrypoint for every user and LP
-interaction with an attested Invisible coordinator. It is the contract defined
-in [docs/sdk-specification.md](../../docs/sdk-specification.md). The current
-build exposes both the functional normal-user pre-deposit request and the
-frontend coordinator facade.
+[Documentation](https://docs.invisible.exchange/docs/sdk/) ·
+[Quickstart](https://docs.invisible.exchange/docs/sdk/quickstart/) ·
+[API reference](https://docs.invisible.exchange/docs/sdk/reference/) ·
+[Trust model](https://docs.invisible.exchange/docs/security/)
 
-> Status: **frontend integration SDK**. The attested `/ws-noise` session,
-> normal-user contract request and coordinator session, and LP lifecycle helpers
-> are functional. Target surfaces that are not wired to the live coordinator
-> still throw `NotImplementedError`; no command fakes success.
+> Devnet beta. This release targets Solana devnet. APIs may change before a stable release.
 
-## Entrypoints
-
-| Import                        | Covers                                                |
-| ----------------------------- | ----------------------------------------------------- |
-| `@invisible-labs/sdk`         | `createSession`, attestation and coordinator controls |
-| `@invisible-labs/sdk/user`    | normal-user commands (private transfer)               |
-| `@invisible-labs/sdk/lp`      | liquidity-provider lifecycle                          |
-| `@invisible-labs/sdk/stats`   | actor-safe read projections                           |
-| `@invisible-labs/sdk/events`  | sync subscriptions                                    |
-| `@invisible-labs/sdk/storage` | storage adapters                                      |
-| `@invisible-labs/sdk/presets` | optional Invisible coordinator endpoint presets       |
+This package is the programmatic entrypoint for user and LP interaction with an attested Invisible
+coordinator. The normal-user surface uses one functional sequence over a caller-owned session:
+`createSession`, `contractRequest`, `sync`, `requestRefund`, then `closeSession`.
 
-Each actor entrypoint is independently importable; pulling one in must not drag
-the others into a consumer bundle.
+## Install
 
-See [ARCHITECTURE.md](./ARCHITECTURE.md) for the layered module map (mermaid).
+```bash
+npm install @invisible-labs/sdk@devnet
+```
 
-## Private-transfer amount limits
+## Entrypoints
 
-Use the public user-entry constants for inclusive preflight validation. Values
-are expressed in lamports, matching the `amountLamports` request field.
+| Import                        | Covers                                                 |
+| ----------------------------- | ------------------------------------------------------ |
+| `@invisible-labs/sdk`         | `createSession`, attestation, and coordinator controls |
+| `@invisible-labs/sdk/user`    | normal-user commands: private transfer, sync, refund   |
+| `@invisible-labs/sdk/lp`      | liquidity-provider lifecycle                           |
+| `@invisible-labs/sdk/stats`   | actor-safe read projections                            |
+| `@invisible-labs/sdk/events`  | sync subscriptions                                     |
+| `@invisible-labs/sdk/storage` | storage adapters                                       |
+| `@invisible-labs/sdk/presets` | optional coordinator endpoint presets                  |
 
-```ts
-import { MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS } from "@invisible-labs/sdk/user";
+Each actor entrypoint is independently importable; pulling one in must not drag the others into a
+consumer bundle. See [ARCHITECTURE.md](./ARCHITECTURE.md) for the layered module map.
 
-const isValidEntryAmount = (amountLamports: number) =>
-  amountLamports >= MIN_ENTRY_AMOUNT_LAMPORTS && amountLamports <= MAX_ENTRY_AMOUNT_LAMPORTS;
-```
+## Private transfer
 
-## Quickstart
+The canonical normal-user flow uses one attested session and the functional SDK commands:
 
 ```ts
-import { createCoordinatorSession } from "@invisible-labs/sdk/user";
+import { closeSession, createSession } from "@invisible-labs/sdk";
+import {
+  contractRequest,
+  recoveryCodeFromHex,
+  requestRefund,
+  sync,
+} from "@invisible-labs/sdk/user";
 
 const coordinator = {
   endpoints: [
     /* CoordinatorEndpoint[] - supply your own, or use @invisible-labs/sdk/presets */
   ],
 };
+const payoutPolicy = {
+  destinations: [{ address: receiverPublicKey, sharePercent: 100 }],
+  totalDeadlineMs: 0,
+};
+
+const session = await createSession({ coordinator });
+try {
+  const contract = await contractRequest(session, {
+    amountLamports: 3_000_000_000,
+    payoutPolicy,
+  });
+  const status = await sync(session, contract.swapId, contract.syncSecret);
+  console.log(status.state, status.coordinatorTimestampMs);
+
+  if (status.actor_sync?.snapshot.refundability === "available_now") {
+    const receipt = await requestRefund(session, {
+      recoveryCode: recoveryCodeFromHex(contract.recoveryCodeHex!),
+    });
+    console.log(receipt.requestId, receipt.amountLamports);
+  }
+} finally {
+  closeSession(session);
+}
+```
+
+`contractRequest` resolves after durable delegation and before the deposit is observed. Its result
+contains `swapId`, `depositAddress`, `depositExpiresAtMs`, `syncSecret`, and the generated Recovery
+Code. Persist the sync secret and Recovery Code before asking the user to deposit. Send exactly
+`amountLamports` to the deposit address. The `sync` response contains actor-scoped lifecycle truth
+and the coordinator response timestamp; it does not expose an internal payout due timestamp. A
+refund receipt also carries the coordinator-authoritative accepted amount; use that value for
+pending refund accounting and use `sync` for final landing, cancellation, and fee-loss outcomes.
+
+## Private-transfer amount limits
 
-const user = createCoordinatorSession({ coordinator });
+Use the public user-entry constants for inclusive preflight validation. Values are expressed in
+lamports, matching the `amountLamports` request field. The current V0 bounds are `1.5 SOL`
+(`1_500_000_000` lamports) minimum and `100 SOL` (`100_000_000_000` lamports) maximum.
+The SDK rejects non-safe integers and values outside these bounds before sending a coordinator
+request.
 
-await user.runSwap({ amountLamports: 3_000_000_000, payoutSpec });
+```ts
+import { MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS } from "@invisible-labs/sdk/user";
+
+const isValidEntryAmount = (amountLamports: number) =>
+  Number.isSafeInteger(amountLamports) &&
+  amountLamports >= MIN_ENTRY_AMOUNT_LAMPORTS &&
+  amountLamports <= MAX_ENTRY_AMOUNT_LAMPORTS;
 ```
 
-The quickstart above is the full normal-user transfer path. For a bot or server
-integration that owns the deposit step, use `contractRequest` from
-`@invisible-labs/sdk/user`. It resolves after durable delegation and returns
-`swapId`, `depositAddress`, `depositExpiresAtMs`, `syncSecret`, and the generated
-Recovery Code before waiting for a deposit. Set `payoutPolicy.totalDeadlineMs`
-to `0` for instant payout, or to `3_600_000`, `86_400_000`, or `604_800_000`
-milliseconds for the supported 1-hour, 24-hour, or 7-day scheduled windows.
-
-## What is real vs NO-OP today
-
-Real and usable now:
-
-- `createSession` opens a live WebSocket, runs Noise XX, verifies TDX
-  attestation, and returns an attested `Session`.
-- `createCoordinatorSession` in `@invisible-labs/sdk/user` drives the normal-user
-  contract, sync, refund-withdrawal, and event flow used by the web app.
-- The functional `contractRequest`, `requestRefund`, and `sync` exports in
-  `@invisible-labs/sdk/user` send the same normal-user protocol commands on a
-  caller-owned attested session.
-- `createLpLifecycleClient` and the LP free functions in `@invisible-labs/sdk/lp`
-  drive position open/recover, DKG, funding, refill, withdrawal, confirmation,
-  and listing. Lower-level LP coordinator and DKG helpers remain available.
-- Input validation: `PayoutPolicy` and LP plan checks throw `PolicyValidationError`;
-  LP client-side lifecycle states throw `LpLifecycleError`.
-- The closed `InvisibleError` taxonomy and `normalizeError`.
-- `coordinator.endpoints`, `attestation.current` / `policy` (read-only).
-- `stats.derivedRefundableLamports` (pure local computation).
-- `inMemoryStorage`, `browserStorage`, `extensionStorage`; the `presets`
-  endpoint helpers.
-- `presets.invisibleDevnet(approvedBinaryHash)` targets the public devnet through
-  the hardened Azure coordinator in prod mode with the release MRTD, Intel root,
-  MAA, and exact coordinator binary hash pins. The approved 64-hex binary hash
-  is required at preset construction; no unapproved default is embedded.
-
-Deferred (throws `NotImplementedError` until each target surface is finalized):
-
-- Spec-level user free functions other than the live `contractRequest`,
-  `requestRefund`, and `sync` functions, actor-safe stats, and `events`
-  subscriptions when they are not the frontend-facing coordinator helpers
-  listed above.
-- Server-HKDF storage. The current web app keeps its local recovery material in
-  its persisted app store; SDK consumers can choose their own storage controls.
-
-Before public npm distribution, the remaining deferred functions will either be
-wired to the coordinator helpers or removed from the published surface.
+## Live and deferred surfaces
+
+Live today:
+
+- `createSession` opens a live WebSocket, runs Noise XX, verifies TDX attestation, and returns an
+  attested `Session`.
+- `contractRequest`, `sync`, and `requestRefund` are the only normal-user command path over a
+  caller-owned attested session. `closeSession` ends the flow.
+- LP lifecycle helpers drive position open/recover, DKG, funding, refill, withdrawal, confirmation,
+  and listing.
+- Input validation throws typed `PolicyValidationError`; the closed `InvisibleError` taxonomy and
+  `normalizeError` are available to callers.
+
+Other target surfaces throw `NotImplementedError` until each is finalized. No command fakes success.
 
 ## Recovery material and storage
 
-The SDK does not yet persist recovery material automatically from
-`createSession`. Consumers that need restart or tab-close recovery must keep the
-relevant values themselves, using SDK storage helpers or their own storage layer:
+The SDK does not persist recovery material automatically. Consumers that need restart or tab-close
+recovery must store the relevant values themselves:
+
+| Material                | Needed for                                      | Guidance                                                |
+| ----------------------- | ----------------------------------------------- | ------------------------------------------------------- |
+| `swapId` + `syncSecret` | Re-sync a private-transfer status view          | Persist before asking the user to deposit.              |
+| User Recovery Code      | Request an origin-bound private-transfer refund | Treat it like a seed phrase and persist it immediately. |
+| LP Position Code        | Recover and operate an LP position              | Keep it out of logs and treat it like a seed phrase.    |
 
-| Material                | Needed for                                       | Current guidance                                                                                                                                                    |
-| ----------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `swapId` + `syncSecret` | Re-sync a private-transfer status view.          | `contractRequest` returns both values and supports `onSyncSecretReady({ secretHex })`; store them before asking the user to deposit.                                |
-| User Recovery Code      | Request an origin-bound private-transfer refund. | Persist `onRecoveryCodeReady({ codeHex })` immediately, or pass caller-managed recovery material. Products with stricter local-storage requirements can encrypt it. |
-| LP Position Code        | Recover and operate an LP position.              | Treat like a seed phrase. The SDK keeps derived LP auth only in memory.                                                                                             |
+The web app persists private-transfer recovery material locally so users can resume flows. SDK
+consumers can choose `browserStorage`, `extensionStorage`, or their own encrypted storage layer.
 
-The Invisible web app currently persists private-transfer `refundCode` and
-`syncSecret` locally so users can resume flows. That is the current product
-tradeoff. Integrators can use `browserStorage` or `extensionStorage` as local
-byte stores, or they can pre-encrypt/wrap values before storing them if their
-product requires that.
+LP DKG requests are bounded. If a browser worker stops responding, the SDK terminates the local
+workers and attempts the signed position-scoped DKG abort command within a bounded cleanup window
+before returning the original failure. LP recovery sends the same cleanup command for an
+incomplete position, so a reload does not wait for the coordinator's session expiry.
 
-Server integrations can keep raw recovery material in their own database/vault,
-or derive material from a master secret with domain-separated HKDF. For
-pre-acceptance material such as `syncSecret`, use a stable context available
-before the coordinator receives `sync_commitment`; `swapId` is only available
-after acceptance.
+## Security model
+
+The SDK establishes an encrypted Noise XX channel and verifies TDX attestation before sensitive
+protocol material is sent. Verification failures stop the session. Integrators remain responsible
+for loading coordinator measurements from an approved release source, protecting Recovery Codes and
+sync secrets, persisting recovery material before deposit, using fresh payout destinations, and
+handling reconnects through `sync` instead of blindly repeating commands.
+
+Invisible is trust-minimized, not trustless. Attestation verifies an approved coordinator build; it
+does not prove that the code is bug-free. Privacy can be weakened by low pool depth, timing, amount
+correlation, destination reuse, and off-chain metadata.
+
+## Devnet limitations
+
+- Solana devnet and SOL only.
+- No settlement SLA.
+- Current normal-user transfers support one payout destination.
+- Availability and privacy strength depend on current pool conditions.
+- Some documented target APIs are not yet available in the devnet beta.
+
+Use only APIs marked as live in the [current reference](https://docs.invisible.exchange/docs/sdk/reference/).
 
 ## Not in this SDK
 
-Protocol-fee (admin) payout is deliberately **out of scope** for the SDK. It
-lives in a separate, fully isolated, non-public admin frontend. See
-[ADR-0120](../../docs/adr/0120-protocol-fee-payout-lives-in-isolated-admin-frontend.md).
-
-## Packaging and publishing
-
-The package is bundled with [tsup](./tsup.config.ts) into a **self-contained
-artifact** so it can be installed by an external consumer that has none of this
-monorepo's workspace links:
-
-- The three workspace-internal packages (`@invisible/shared`, `protocol`,
-  `frost`) are `file:` deps that npm does not rewrite on publish. They are
-  **inlined** into `dist` (`noExternal`) and live in `devDependencies`, so the
-  published runtime `dependencies` contain zero `file:` specifiers.
-- The **FROST wasm** is inlined into the bundle. The SDK uses a swappable wasm
-  loader: from source the web app and vitest use
-  [`frostWasm.dev.ts`](./src/frost/frostWasm.dev.ts) (Vite-friendly asset URL /
-  Node `file:` read), while tsup swaps in
-  [`frostWasm.bundled.ts`](./src/frost/frostWasm.bundled.ts) (esbuild `binary`
-  loader -> inlined bytes) for the published artifact, so there is no runtime
-  asset path or `import.meta.url` resolution to break in a consumer's bundler.
-- Only published third-party packages (`ajv`, `@peculiar/x509`, `@stablelib/*`)
-  stay external and are declared in `dependencies`.
+Protocol-fee admin payout is out of scope for the SDK. It lives behind a separate admin surface.
+
+## Packaging
+
+The package is bundled with tsup into a self-contained artifact. Workspace-internal packages and the
+FROST WASM are inlined into the published bundle, while published third-party packages remain
+external dependencies.
 
 ```bash
-npm run prepare:frost   # build or restore frost/pkg for SDK source/bundling
-npm run build           # tsup: bundled dist + .d.ts
-npm run verify:exports  # assert exports, bundled dist, and FROST wasm init
-npm run smoke:prod-attestation -- --host tee-azure.invisible.exchange --mrtd <96-hex> --binary-hash <64-hex-approved> --azure-maa-issuer <https-url> --azure-maa-jwks-url <https-url> --azure-maa-policy-hash <base64url>
-npm run smoke:publish   # publish -> install -> typecheck -> import on Verdaccio
-npm run publish:public:noop # credential-free public manifest validation
-VERSION=<version> NPM_DIST_TAG=devnet npm run publish:public -- --confirm @invisible-labs/sdk@<version>
+npm run build
+npm run verify:exports
 ```
 
-The SDK `build` and `prepack` scripts run `prepare:frost` first, so direct
-package builds, `smoke:publish`, and `publish:private` are hermetic from a clean
-checkout. In GitHub CI, the first SDK preparation uses the clean FROST WASM
-build path, then later SDK build/pack guards in the same job reuse that prepared
-artifact. From the repository root, `npm run test:sdk` uses the same SDK
-preparer before typecheck, tests, conformance, bundle, export check, and pack
-dry-run. The export check also rejects unresolved workspace imports, rejects the
-source-only FROST wasm loader path in built `dist`, and instantiates the bundled
-FROST wasm once through `dkgRound1`.
-`smoke:prod-attestation` also builds first, then verifies a live production
-coordinator with `createSession`, `requiredMode=prod`, the supplied MRTD and
-approved binary hash pins, Azure MAA pins, and mandatory DCAP collateral.
-
-### Publish flow (Verdaccio -> GitHub Packages -> npmjs)
-
-The package manifest is public-publishable, but public npmjs publication remains
-manual. Private GitHub Packages publishing still stages a versioned copy under
-`@invisible-labs/sdk`. The progression, each step gated on the previous one
-passing:
-
-1. **Local (Verdaccio).** `npm run smoke:publish` boots a throwaway local
-   registry, stages a publishable copy (private flag flipped, unique test
-   version), publishes it, then installs, typechecks, and imports it from a
-   clean consumer project. Zero external footprint. Use this to confirm the
-   tarball works.
-2. **Private remote (GitHub Packages).** Intermediate validation against a real
-   remote without going public. The executable path is `publish:private`, which
-   stages the workspace package as `@invisible-labs/sdk` because GitHub Packages
-   requires the package scope to match the `Invisible-Labs` org. Authenticate
-   with a PAT or `GITHUB_TOKEN` with `write:packages`, then run:
-   ```bash
-   NODE_AUTH_TOKEN=<token> VERSION=0.0.1 npm run publish:private
-   ```
-   The release workflow runs this path automatically for SDK-relevant changes
-   and publishes `<package version>-dev.<run_number>.<run_attempt>` with the
-   private `dev` dist-tag.
-   Consumers install the private `dev` dist-tag and import `@invisible-labs/sdk`
-   directly, with no npm alias; see [`PUBLISHING.md`](./PUBLISHING.md).
-3. **Public validation no-op.** Production promotion runs `publish:public:noop`
-   with the exact `packages/sdk` version. This verifies the public-publishable
-   manifest without npmjs credentials or publication.
-4. **Public (npmjs).** After the release commit is on `main`, an authorized npm
-   publisher runs the manual npmjs publish flow in [`PUBLISHING.md`](./PUBLISHING.md).
-   CI does not publish to npmjs.
+The prod-attestation smoke normally rebuilds the SDK. Its `--prebuilt-sdk`
+option is reserved for an integrity-bound runtime that already contains the
+exact built `dist`; ordinary operator runs must omit it.

package/dist/{chunk-TQNNTV5F.js → chunk-4X5OCCQW.js}

@@ -6,12 +6,12 @@ var LP_DEFAULT_TARGET_SHARDS = 200;
 var LP_MAX_TARGET_SHARDS = 300;
 var LP_DEFAULT_REFILL_BATCH_SIZE = 50;
 var LP_MAX_REFILL_BATCH_SIZE = 50;
-var PRODUCT_MIN_ENTRY_LAMPORTS = 4e8;
+var PRODUCT_MIN_ENTRY_LAMPORTS = 15e8;
 var PRODUCT_MAX_ENTRY_LAMPORTS = 1e11;
 function isValidLpPositionId(lpPositionId) {
   return lpPositionId.length >= LP_POSITION_ID_MIN_LENGTH && lpPositionId.length <= LP_POSITION_ID_MAX_LENGTH && LP_POSITION_ID_PATTERN.test(lpPositionId);
 }
 
 export { LP_DEFAULT_REFILL_BATCH_SIZE, LP_DEFAULT_TARGET_SHARDS, LP_MAX_REFILL_BATCH_SIZE, LP_MAX_TARGET_SHARDS, PRODUCT_MAX_ENTRY_LAMPORTS, PRODUCT_MIN_ENTRY_LAMPORTS, isValidLpPositionId };
-//# sourceMappingURL=chunk-TQNNTV5F.js.map
-//# sourceMappingURL=chunk-TQNNTV5F.js.map
+//# sourceMappingURL=chunk-4X5OCCQW.js.map
+//# sourceMappingURL=chunk-4X5OCCQW.js.map

package/dist/{chunk-TQNNTV5F.js.map → chunk-4X5OCCQW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../shared/src/index.ts"],"names":[],"mappings":";AAgBO,IAAM,yBAAA,GAA4B,CAAA;AAClC,IAAM,yBAAA,GAA4B,EAAA;AAClC,IAAM,sBAAA,GAAyB,kBAAA;AAC/B,IAAM,wBAAA,GAA2B;AACjC,IAAM,oBAAA,GAAuB;AAC7B,IAAM,4BAAA,GAA+B;AACrC,IAAM,wBAAA,GAA2B;AAKjC,IAAM,0BAAA,GAA6B;AACnC,IAAM,0BAAA,GAA6B;AAGnC,SAAS,oBAAoB,YAAA,EAA+B;AACjE,EAAA,OACE,YAAA,CAAa,UAAU,yBAAA,IACvB,YAAA,CAAa,UAAU,yBAAA,IACvB,sBAAA,CAAuB,KAAK,YAAY,CAAA;AAE5C","file":"chunk-TQNNTV5F.js","sourcesContent":["/**\n * Shared workspace entrypoint.\n *\n * Keep exports here pure and reusable across workspaces. Do not put React,\n * DOM-only, libp2p runtime state, or feature-specific glue in this package.\n */\nexport function sleep(ms: number): Promise<void> {\n  if (ms <= 0) {\n    return Promise.resolve();\n  }\n\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\nexport const LP_POSITION_ID_MIN_LENGTH = 3;\nexport const LP_POSITION_ID_MAX_LENGTH = 96;\nexport const LP_POSITION_ID_PATTERN = /^[A-Za-z0-9_-]+$/;\nexport const LP_DEFAULT_TARGET_SHARDS = 200;\nexport const LP_MAX_TARGET_SHARDS = 300;\nexport const LP_DEFAULT_REFILL_BATCH_SIZE = 50;\nexport const LP_MAX_REFILL_BATCH_SIZE = 50;\n\n// Temporary TypeScript mirrors of the Rust TEE entry limits, plus the distinct\n// mainnet UI default. Keep them guarded by `npm run product-limits:check` until\n// cross-language generated product constants exist.\nexport const PRODUCT_MIN_ENTRY_LAMPORTS = 400_000_000;\nexport const PRODUCT_MAX_ENTRY_LAMPORTS = 100_000_000_000;\nexport const PRODUCT_DEFAULT_MAINNET_ENTRY_LAMPORTS = 3_000_000_000;\n\nexport function isValidLpPositionId(lpPositionId: string): boolean {\n  return (\n    lpPositionId.length >= LP_POSITION_ID_MIN_LENGTH &&\n    lpPositionId.length <= LP_POSITION_ID_MAX_LENGTH &&\n    LP_POSITION_ID_PATTERN.test(lpPositionId)\n  );\n}\n"]}
+{"version":3,"sources":["../../shared/src/index.ts"],"names":[],"mappings":";AAgBO,IAAM,yBAAA,GAA4B,CAAA;AAClC,IAAM,yBAAA,GAA4B,EAAA;AAClC,IAAM,sBAAA,GAAyB,kBAAA;AAC/B,IAAM,wBAAA,GAA2B;AACjC,IAAM,oBAAA,GAAuB;AAC7B,IAAM,4BAAA,GAA+B;AACrC,IAAM,wBAAA,GAA2B;AAKjC,IAAM,0BAAA,GAA6B;AACnC,IAAM,0BAAA,GAA6B;AAGnC,SAAS,oBAAoB,YAAA,EAA+B;AACjE,EAAA,OACE,YAAA,CAAa,UAAU,yBAAA,IACvB,YAAA,CAAa,UAAU,yBAAA,IACvB,sBAAA,CAAuB,KAAK,YAAY,CAAA;AAE5C","file":"chunk-4X5OCCQW.js","sourcesContent":["/**\n * Shared workspace entrypoint.\n *\n * Keep exports here pure and reusable across workspaces. Do not put React,\n * DOM-only, libp2p runtime state, or feature-specific glue in this package.\n */\nexport function sleep(ms: number): Promise<void> {\n  if (ms <= 0) {\n    return Promise.resolve();\n  }\n\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\nexport const LP_POSITION_ID_MIN_LENGTH = 3;\nexport const LP_POSITION_ID_MAX_LENGTH = 96;\nexport const LP_POSITION_ID_PATTERN = /^[A-Za-z0-9_-]+$/;\nexport const LP_DEFAULT_TARGET_SHARDS = 200;\nexport const LP_MAX_TARGET_SHARDS = 300;\nexport const LP_DEFAULT_REFILL_BATCH_SIZE = 50;\nexport const LP_MAX_REFILL_BATCH_SIZE = 50;\n\n// Temporary TypeScript mirrors of the Rust TEE entry limits, plus the distinct\n// mainnet UI default. Keep them guarded by `npm run product-limits:check` until\n// cross-language generated product constants exist.\nexport const PRODUCT_MIN_ENTRY_LAMPORTS = 1_500_000_000;\nexport const PRODUCT_MAX_ENTRY_LAMPORTS = 100_000_000_000;\nexport const PRODUCT_DEFAULT_MAINNET_ENTRY_LAMPORTS = 1_500_000_000;\n\nexport function isValidLpPositionId(lpPositionId: string): boolean {\n  return (\n    lpPositionId.length >= LP_POSITION_ID_MIN_LENGTH &&\n    lpPositionId.length <= LP_POSITION_ID_MAX_LENGTH &&\n    LP_POSITION_ID_PATTERN.test(lpPositionId)\n  );\n}\n"]}

package/dist/{chunk-7DSVN3MV.js → chunk-BWCGNTN5.js}

@@ -1,6 +1,6 @@
-import { failSessionClosed, createSessionHandle, getSessionState, closeSessionState } from './chunk-JRMKCE3S.js';
-import { verifyAttestation, assertAttestResponse } from './chunk-NCY4FCYU.js';
-import { TransportError, AttestationError } from './chunk-OHIM2YWU.js';
+import { failSessionClosed, createSessionHandle, getSessionState, closeSessionState } from './chunk-V5HXJRBW.js';
+import { verifyAttestation, assertAttestResponse } from './chunk-DIA6U2CV.js';
+import { TransportError, AttestationError } from './chunk-GHBQF3A7.js';
 import { generateKeyPair, sharedKey } from '@stablelib/x25519';
 import { ChaCha20Poly1305 } from '@stablelib/chacha20poly1305';
 import { hash, SHA256 } from '@stablelib/sha256';
@@ -398,6 +398,7 @@ function toAttestationPolicy(endpoint) {
     // ignore the MRTD pin inside the verifier.
     expectedMrtd: pin.mrtd,
     ...pin.binaryHash ? { expectedBinaryHash: pin.binaryHash } : {},
+    ...pin.runtimeProfile ? { expectedRuntimeProfile: pin.runtimeProfile } : {},
     allowMissingDcapCollateral: pin.allowMissingDcapCollateral === true,
     allowLocalAttestation
   };
@@ -694,6 +695,7 @@ async function establishAttestedChannel(params) {
     mrtd: channel.attestation.mrtd,
     mode: channel.attestation.mode,
     binaryHash: channel.attestation.binaryHash,
+    runtimeProfile: channel.attestation.runtimeProfile,
     pubkeyHex: channel.attestation.pubkeyHex,
     localAttestation: channel.attestation.localAttestation,
     rtmr0: channel.attestation.rtmr0,
@@ -723,6 +725,7 @@ function performAttestation(_transport, handshake) {
     mrtd: channel.attestation.mrtd,
     mode: channel.attestation.mode,
     binaryHash: channel.attestation.binaryHash,
+    runtimeProfile: channel.attestation.runtimeProfile,
     pubkeyHex: channel.attestation.pubkeyHex,
     localAttestation: channel.attestation.localAttestation,
     rtmr0: channel.attestation.rtmr0,
@@ -872,6 +875,10 @@ var coordinatorPoolConfig_schema_default = {
           pattern: "^[0-9a-fA-F]{64}$",
           description: "Optional SHA-256 hash of the approved coordinator binary; required for production Azure attestation."
         },
+        runtimeProfile: {
+          enum: ["prod-hardened", "prod-devnet-simplified"],
+          description: "Optional compile-time coordinator runtime profile; production simplified deployments must pin it."
+        },
         intelRootFingerprint: {
           type: "string",
           description: "Hex SHA-256 of the Intel root cert."
@@ -1023,6 +1030,7 @@ async function reattest(state, endpoint, timeoutMs = DEFAULT_REATTEST_TIMEOUT_MS
     mrtd: metadata.mrtd,
     mode: metadata.mode,
     binaryHash: metadata.binaryHash,
+    runtimeProfile: metadata.runtimeProfile,
     pubkeyHex: metadata.pubkeyHex,
     localAttestation: metadata.localAttestation,
     rtmr0: metadata.rtmr0,
@@ -1141,5 +1149,5 @@ async function runReattest(state, endpoint) {
 }
 
 export { closeSession, createExponentialBackoff, createSession, createStateController, formatAjvErrors, noiseWebSocketTransport, performAttestation, performNoiseHandshake, reattestSerialized, validatePayoutPolicyShape };
-//# sourceMappingURL=chunk-7DSVN3MV.js.map
-//# sourceMappingURL=chunk-7DSVN3MV.js.map
+//# sourceMappingURL=chunk-BWCGNTN5.js.map
+//# sourceMappingURL=chunk-BWCGNTN5.js.map