@invisible-labs/sdk 0.6.0-devnet.2 → 0.6.0-devnet.3

package/dist/presets.d.ts

@@ -1,4 +1,4 @@
-import { C as CoordinatorEndpoint } from './types.generated-CHGSbmLp.js';
+import { C as CoordinatorEndpoint } from './types.generated-BSEBz4jR.js';
 
 /**
  * `@invisible-labs/sdk/presets` - optional Invisible coordinator endpoint presets.
@@ -21,7 +21,7 @@ import { C as CoordinatorEndpoint } from './types.generated-CHGSbmLp.js';
  * on GCP.
  */
 declare function invisibleProdGcp(): CoordinatorEndpoint[];
-/** Production Azure TDX coordinator endpoint. The live prod TEE today. */
+/** Production Azure TDX coordinator endpoint for the current prod/devnet release. */
 declare function invisibleProdAzure(approvedBinaryHash: string): CoordinatorEndpoint[];
 /**
  * The currently-active Invisible production preset. Integrators that just want
@@ -31,7 +31,7 @@ declare function invisibleProdAzure(approvedBinaryHash: string): CoordinatorEndp
  * `export const invisibleProd = invisibleProdAzure` -> `invisibleProdGcp`.
  */
 declare const invisibleProd: typeof invisibleProdAzure;
-/** Public Invisible devnet, served by the hardened Azure prod coordinator. */
+/** Public Invisible devnet, served by the simplified Azure prod coordinator. */
 declare const invisibleDevnet: typeof invisibleProdAzure;
 /** Dormant GCP development coordinator endpoint. Not the active dev target today. */
 declare function invisibleDevGcp(): CoordinatorEndpoint[];

package/dist/presets.js

@@ -1,7 +1,13 @@
-import { INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 } from './chunk-NCY4FCYU.js';
-import './chunk-OHIM2YWU.js';
+import { INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 } from './chunk-DIA6U2CV.js';
+import './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
+// src/presets/azure-prod-maa.generated.ts
+var AZURE_PROD_MAA_TRUST = {
+  issuer: "https://sharedweu.weu.attest.azure.net",
+  jwksUrl: "https://sharedweu.weu.attest.azure.net/certs",
+  policyHash: "9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco"};
+
 // src/presets/index.ts
 var PLACEHOLDER_PIN = {
   mrtd: "",
@@ -9,12 +15,13 @@ var PLACEHOLDER_PIN = {
 };
 var BINARY_HASH_HEX = /^[0-9a-f]{64}$/i;
 var AZURE_PROD_RELEASE_PIN = {
-  mrtd: "ff450b138c5ee6734a43dc35afb437abfa24ef743bc9e9484ef4af365fcd89a6c50913248ed7fcb92a7d42b1ba7da984",
+  mrtd: "a2e61f1316e9e367e9c1f7a0adc98c48eb13875c399c85d286cee5ea2b05e57f2df9f61d903b0ae7ac5607d843dfffc1",
+  runtimeProfile: "prod-devnet-simplified",
   intelRootFingerprint: INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256,
   azureMaa: {
-    issuer: "https://sharedweu.weu.attest.azure.net",
-    jwksUrl: "https://sharedweu.weu.attest.azure.net/certs",
-    policyHash: "9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco"
+    issuer: AZURE_PROD_MAA_TRUST.issuer,
+    jwksUrl: AZURE_PROD_MAA_TRUST.jwksUrl,
+    policyHash: AZURE_PROD_MAA_TRUST.policyHash
   }
 };
 function invisibleProdGcp() {

package/dist/presets.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/presets/index.ts"],"names":[],"mappings":";;;;;AAgBA,IAAM,eAAA,GAAkB;AAAA,EACtB,IAAA,EAAM,EAAA;AAAA,EACN,oBAAA,EAAsB;AACxB,CAAA;AAEA,IAAM,eAAA,GAAkB,iBAAA;AAExB,IAAM,sBAAA,GAAyB;AAAA,EAC7B,IAAA,EAAM,kGAAA;AAAA,EACN,oBAAA,EAAsB,oCAAA;AAAA,EACtB,QAAA,EAAU;AAAA,IACR,MAAA,EAAQ,wCAAA;AAAA,IACR,OAAA,EAAS,8CAAA;AAAA,IACT,UAAA,EAAY;AAAA;AAEhB,CAAA;AASO,SAAS,gBAAA,GAA0C;AACxD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,uCAAA;AAAA,MACP,gBAAA,EAAkB,wBAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,SAAS,mBAAmB,kBAAA,EAAmD;AACpF,EAAA,MAAM,aAAa,OAAO,kBAAA,KAAuB,QAAA,GAAW,kBAAA,CAAmB,aAAY,GAAI,EAAA;AAC/F,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,6CAAA;AAAA,MACP,gBAAA,EAAkB,8BAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,sBAAA,EAAwB,UAAA,EAAW;AAAA,MACpD,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AASO,IAAM,aAAA,GAAgB;AAGtB,IAAM,eAAA,GAAkB;AAGxB,SAAS,eAAA,GAAyC;AACvD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,2CAAA;AAAA,MACP,gBAAA,EAAkB,4BAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,SAAS,iBAAA,GAA2C;AACzD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,iDAAA;AAAA,MACP,gBAAA,EAAkB,kCAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,IAAM,YAAA,GAAe","file":"presets.js","sourcesContent":["/**\n * `@invisible-labs/sdk/presets` - optional Invisible coordinator endpoint presets.\n *\n * This is the ONLY module permitted to name an `invisible.exchange` host (spec\n * section 6.2). Partners who self-host ignore it entirely and pass their own\n * `CoordinatorEndpoint[]` to `createSession`. The core never imports this module.\n *\n * Production presets embed an approved Azure TDX boot measurement and trust\n * roots. The caller must provide the separately approved coordinator binary\n * hash before a production endpoint can be constructed. Dormant or\n * development targets keep placeholders until approval.\n */\n\nimport { INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 } from \"../attestation/verifier.js\";\nimport type { CoordinatorEndpoint } from \"../schemas/types.generated.js\";\n\nconst PLACEHOLDER_PIN = {\n  mrtd: \"\",\n  intelRootFingerprint: \"\",\n} as const;\n\nconst BINARY_HASH_HEX = /^[0-9a-f]{64}$/i;\n\nconst AZURE_PROD_RELEASE_PIN = {\n  mrtd: \"ff450b138c5ee6734a43dc35afb437abfa24ef743bc9e9484ef4af365fcd89a6c50913248ed7fcb92a7d42b1ba7da984\",\n  intelRootFingerprint: INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256,\n  azureMaa: {\n    issuer: \"https://sharedweu.weu.attest.azure.net\",\n    jwksUrl: \"https://sharedweu.weu.attest.azure.net/certs\",\n    policyHash: \"9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco\",\n  },\n} as const;\n\n/**\n * Production GCP TDX coordinator endpoint.\n *\n * Currently dormant: GCP is neither the live production nor development TEE\n * path. Kept only for a future explicit GCP relight, or a partner self-hosting\n * on GCP.\n */\nexport function invisibleProdGcp(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"prod\",\n    },\n  ];\n}\n\n/** Production Azure TDX coordinator endpoint. The live prod TEE today. */\nexport function invisibleProdAzure(approvedBinaryHash: string): CoordinatorEndpoint[] {\n  const binaryHash = typeof approvedBinaryHash === \"string\" ? approvedBinaryHash.toLowerCase() : \"\";\n  if (!BINARY_HASH_HEX.test(binaryHash)) {\n    throw new Error(\"invisibleProdAzure requires an approved 64-character binary SHA-256 hash\");\n  }\n  return [\n    {\n      wsUrl: \"wss://tee-azure.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-azure.invisible.exchange\",\n      releasePin: { ...AZURE_PROD_RELEASE_PIN, binaryHash },\n      requiredMode: \"prod\",\n    },\n  ];\n}\n\n/**\n * The currently-active Invisible production preset. Integrators that just want\n * \"Invisible prod\" use this and stay on whichever cloud is live.\n *\n * Switching the prod target between Azure and GCP is this one line:\n * `export const invisibleProd = invisibleProdAzure` -> `invisibleProdGcp`.\n */\nexport const invisibleProd = invisibleProdAzure;\n\n/** Public Invisible devnet, served by the hardened Azure prod coordinator. */\nexport const invisibleDevnet = invisibleProdAzure;\n\n/** Dormant GCP development coordinator endpoint. Not the active dev target today. */\nexport function invisibleDevGcp(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee-dev.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-dev.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"dev\",\n    },\n  ];\n}\n\n/** Azure development coordinator endpoint. The active dev TEE today. */\nexport function invisibleDevAzure(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee-azure-dev.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-azure-dev.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"dev\",\n    },\n  ];\n}\n\n/** The currently-active Invisible development preset. */\nexport const invisibleDev = invisibleDevAzure;\n"]}
+{"version":3,"sources":["../src/presets/azure-prod-maa.generated.ts","../src/presets/index.ts"],"names":[],"mappings":";;;;;AACO,IAAM,oBAAA,GAAuB;AAAA,EAClC,MAAA,EAAQ,wCAAA;AAAA,EACR,OAAA,EAAS,8CAAA;AAAA,EACT,UAAA,EAAY,6CAEd,CAAA;;;ACWA,IAAM,eAAA,GAAkB;AAAA,EACtB,IAAA,EAAM,EAAA;AAAA,EACN,oBAAA,EAAsB;AACxB,CAAA;AAEA,IAAM,eAAA,GAAkB,iBAAA;AAExB,IAAM,sBAAA,GAAyB;AAAA,EAC7B,IAAA,EAAM,kGAAA;AAAA,EACN,cAAA,EAAgB,wBAAA;AAAA,EAChB,oBAAA,EAAsB,oCAAA;AAAA,EACtB,QAAA,EAAU;AAAA,IACR,QAAQ,oBAAA,CAAqB,MAAA;AAAA,IAC7B,SAAS,oBAAA,CAAqB,OAAA;AAAA,IAC9B,YAAY,oBAAA,CAAqB;AAAA;AAErC,CAAA;AASO,SAAS,gBAAA,GAA0C;AACxD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,uCAAA;AAAA,MACP,gBAAA,EAAkB,wBAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,SAAS,mBAAmB,kBAAA,EAAmD;AACpF,EAAA,MAAM,aAAa,OAAO,kBAAA,KAAuB,QAAA,GAAW,kBAAA,CAAmB,aAAY,GAAI,EAAA;AAC/F,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,6CAAA;AAAA,MACP,gBAAA,EAAkB,8BAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,sBAAA,EAAwB,UAAA,EAAW;AAAA,MACpD,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AASO,IAAM,aAAA,GAAgB;AAGtB,IAAM,eAAA,GAAkB;AAGxB,SAAS,eAAA,GAAyC;AACvD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,2CAAA;AAAA,MACP,gBAAA,EAAkB,4BAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,SAAS,iBAAA,GAA2C;AACzD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,iDAAA;AAAA,MACP,gBAAA,EAAkB,kCAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,IAAM,YAAA,GAAe","file":"presets.js","sourcesContent":["// Generated by npm run release:trust-policy:generate-sdk. Do not edit.\nexport const AZURE_PROD_MAA_TRUST = {\n  issuer: \"https://sharedweu.weu.attest.azure.net\",\n  jwksUrl: \"https://sharedweu.weu.attest.azure.net/certs\",\n  policyHash: \"9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco\",\n  trustSetVersion: \"azure-prod-maa-v1\",\n} as const;\n","/**\n * `@invisible-labs/sdk/presets` - optional Invisible coordinator endpoint presets.\n *\n * This is the ONLY module permitted to name an `invisible.exchange` host (spec\n * section 6.2). Partners who self-host ignore it entirely and pass their own\n * `CoordinatorEndpoint[]` to `createSession`. The core never imports this module.\n *\n * Production presets embed an approved Azure TDX boot measurement and trust\n * roots. The caller must provide the separately approved coordinator binary\n * hash before a production endpoint can be constructed. Dormant or\n * development targets keep placeholders until approval.\n */\n\nimport { INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 } from \"../attestation/verifier.js\";\nimport type { CoordinatorEndpoint } from \"../schemas/types.generated.js\";\nimport { AZURE_PROD_MAA_TRUST } from \"./azure-prod-maa.generated.js\";\n\nconst PLACEHOLDER_PIN = {\n  mrtd: \"\",\n  intelRootFingerprint: \"\",\n} as const;\n\nconst BINARY_HASH_HEX = /^[0-9a-f]{64}$/i;\n\nconst AZURE_PROD_RELEASE_PIN = {\n  mrtd: \"a2e61f1316e9e367e9c1f7a0adc98c48eb13875c399c85d286cee5ea2b05e57f2df9f61d903b0ae7ac5607d843dfffc1\",\n  runtimeProfile: \"prod-devnet-simplified\",\n  intelRootFingerprint: INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256,\n  azureMaa: {\n    issuer: AZURE_PROD_MAA_TRUST.issuer,\n    jwksUrl: AZURE_PROD_MAA_TRUST.jwksUrl,\n    policyHash: AZURE_PROD_MAA_TRUST.policyHash,\n  },\n} as const;\n\n/**\n * Production GCP TDX coordinator endpoint.\n *\n * Currently dormant: GCP is neither the live production nor development TEE\n * path. Kept only for a future explicit GCP relight, or a partner self-hosting\n * on GCP.\n */\nexport function invisibleProdGcp(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"prod\",\n    },\n  ];\n}\n\n/** Production Azure TDX coordinator endpoint for the current prod/devnet release. */\nexport function invisibleProdAzure(approvedBinaryHash: string): CoordinatorEndpoint[] {\n  const binaryHash = typeof approvedBinaryHash === \"string\" ? approvedBinaryHash.toLowerCase() : \"\";\n  if (!BINARY_HASH_HEX.test(binaryHash)) {\n    throw new Error(\"invisibleProdAzure requires an approved 64-character binary SHA-256 hash\");\n  }\n  return [\n    {\n      wsUrl: \"wss://tee-azure.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-azure.invisible.exchange\",\n      releasePin: { ...AZURE_PROD_RELEASE_PIN, binaryHash },\n      requiredMode: \"prod\",\n    },\n  ];\n}\n\n/**\n * The currently-active Invisible production preset. Integrators that just want\n * \"Invisible prod\" use this and stay on whichever cloud is live.\n *\n * Switching the prod target between Azure and GCP is this one line:\n * `export const invisibleProd = invisibleProdAzure` -> `invisibleProdGcp`.\n */\nexport const invisibleProd = invisibleProdAzure;\n\n/** Public Invisible devnet, served by the simplified Azure prod coordinator. */\nexport const invisibleDevnet = invisibleProdAzure;\n\n/** Dormant GCP development coordinator endpoint. Not the active dev target today. */\nexport function invisibleDevGcp(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee-dev.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-dev.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"dev\",\n    },\n  ];\n}\n\n/** Azure development coordinator endpoint. The active dev TEE today. */\nexport function invisibleDevAzure(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee-azure-dev.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-azure-dev.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"dev\",\n    },\n  ];\n}\n\n/** The currently-active Invisible development preset. */\nexport const invisibleDev = invisibleDevAzure;\n"]}

package/dist/stats.js

@@ -1,4 +1,4 @@
-import { NotImplementedError } from './chunk-OHIM2YWU.js';
+import { NotImplementedError } from './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
 // src/stats/index.ts

package/dist/storage.js

@@ -1,4 +1,4 @@
-import { StorageError } from './chunk-OHIM2YWU.js';
+import { StorageError } from './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
 // src/storage/index.ts

package/dist/{types.generated-CHGSbmLp.d.ts → types.generated-BSEBz4jR.d.ts}

@@ -10,6 +10,7 @@ type CoordinatorEndpoint = {
 type CoordinatorReleasePin = {
     readonly mrtd: string;
     readonly binaryHash?: string;
+    readonly runtimeProfile?: "prod-hardened" | "prod-devnet-simplified";
     readonly intelRootFingerprint?: string;
     readonly allowMissingDcapCollateral?: boolean;
     readonly azureMaa?: AzureMaaPin;

package/dist/user.d.ts

@@ -1,8 +1,6 @@
 import { S as Session } from './session-DFuy54C-.js';
-import { a as CoordinatorPoolConfig, P as PayoutPolicy } from './types.generated-CHGSbmLp.js';
-import { C as CreateSessionOptions } from './createSession-D3ym-Ira.js';
-export { I as InvalidDepositAmountError } from './createSession-D3ym-Ira.js';
-import './types-ZhV7TIQY.js';
+import { P as PayoutPolicy } from './types.generated-BSEBz4jR.js';
+export { I as InvalidDepositAmountError } from './errors-N2touVm4.js';
 
 /**
  * Acceptance receipts (spec section 8.2).
@@ -21,15 +19,6 @@ interface AcceptanceReceipt {
 }
 
 type ClientSwapState = "new" | "awaiting_dkg" | "awaiting_deposit" | "awaiting_delegation" | "awaiting_delegate_ack" | "awaiting_delegate_ack_after_deposit" | "ready_for_settlement" | "settling" | "completed" | "refunded" | "failed";
-type PayoutSpec = {
-    readonly mode: "instant";
-    readonly destination_address: string;
-} | {
-    readonly mode: "scheduled";
-    readonly num_fragments: number;
-    readonly window_seconds: number;
-    readonly destination_addresses: readonly string[];
-};
 type SpendingPolicySnapshot = {
     readonly asset: "SOL";
     readonly entry_amount_lamports: number;
@@ -110,40 +99,22 @@ type SyncUserResponsePayload = {
     readonly withdraw_execution?: RefundExecutedPayload;
     readonly actor_sync?: NormalUserActorSyncSnapshot;
 };
-type WithdrawAcceptedPayload = {
-    readonly status: "accepted";
-    readonly amount_lamports: number;
-    readonly destination_address: string;
-    readonly accepted_at_ms: number;
+/**
+ * Actor-scoped sync response plus the coordinator clock used to produce it.
+ * The timestamp is envelope metadata, not part of the wire payload.
+ */
+type SyncUserResponse = SyncUserResponsePayload & {
+    readonly coordinatorTimestampMs: number;
 };
-type RunSwapParams = {
-    amountLamports: number;
-    payoutSpec: PayoutSpec;
-    payoutDeadlineMs?: number;
-    onPolicySnapshot?: (policy: SpendingPolicySnapshot) => void;
-    recoveryCommitment?: Uint8Array;
-    syncSecret?: Uint8Array;
-    onSyncSecretReady?: (info: {
-        secretHex: string;
-    }) => void | Promise<void>;
-    onRecoveryCodeReady?: (info: {
-        codeHex: string;
-    }) => void | Promise<void>;
-    delegateShare?: Uint8Array;
-    onDepositAddressReady?: (info: {
-        swapId: string;
-        jointPublicKey: Uint8Array;
-        amountLamports: number;
-        depositExpiresAtMs: number;
-        coordinatorTimestampMs: number;
-    }) => void | Promise<void>;
-    onDepositConfirmed?: (info: {
-        originAddress: string | undefined;
-    }) => void | Promise<void>;
-    payoutWindowMs?: number;
+/**
+ * Acceptance receipt for a normal-user refund, including the coordinator's
+ * authoritative amount claim. The timestamp is absent when the coordinator
+ * reports that the request already executed before the client received it.
+ */
+type RefundAcceptanceReceipt = AcceptanceReceipt & {
+    readonly amountLamports: number;
+    readonly acceptedAtMs?: number;
 };
-/** Parameters for the pre-deposit portion of a normal-user contract flow. */
-type ContractRequestParams = Omit<RunSwapParams, "onDepositConfirmed">;
 /**
  * Details returned once the coordinator has accepted, initialized, and
  * durably delegated a contract, but before the user's deposit is observed.
@@ -168,71 +139,6 @@ type ContractRequestResult = {
     readonly policySnapshot: SpendingPolicySnapshot;
     readonly delegatePolicySnapshot: SpendingPolicySnapshot;
 };
-type SwapResult = {
-    swapId: string;
-    jointPublicKey: Uint8Array;
-    depositTxSignature: string;
-    depositObservedAtMs: number;
-    delegatedAtMs: number;
-    recoveryCodeHex?: string;
-    policySnapshot: SpendingPolicySnapshot;
-    delegatePolicySnapshot: SpendingPolicySnapshot;
-};
-type RefundIntentResult = {
-    readonly kind: "executed";
-    readonly refund: RefundExecutedPayload;
-} | {
-    readonly kind: "accepted";
-    readonly accepted: WithdrawAcceptedPayload;
-};
-type SessionStatus = "idle" | "connecting" | "running" | "done" | "failed";
-type CoordinatorSessionOptions = {
-    coordinator: CoordinatorPoolConfig;
-    createSession?: (options: CreateSessionOptions) => Promise<Session>;
-};
-type StateChangeListener = (swapState: ClientSwapState, sessionStatus: SessionStatus) => void;
-type LogListener = (msg: string, direction: "in" | "out" | "info") => void;
-type PayoutExecutedListener = (payload: PayoutExecutedPayload, swapId: string) => void;
-type RefundExecutedListener = (payload: RefundExecutedPayload, swapId: string) => void;
-type NormalUserActorSyncListener = (payload: NormalUserActorSyncSnapshot, coordinatorTimestampMs: number) => void;
-type CoordinatorProtocolError = Error & {
-    readonly code: string;
-    readonly failedReqId?: number;
-};
-type CoordinatorErrorListener = (err: CoordinatorProtocolError) => void;
-type CoordinatorSessionHandle = {
-    onStateChange(listener: StateChangeListener): () => void;
-    onLog(listener: LogListener): () => void;
-    onPayoutExecuted(listener: PayoutExecutedListener): () => void;
-    onRefundExecuted(listener: RefundExecutedListener): () => void;
-    onNormalUserActorSync(listener: NormalUserActorSyncListener): () => void;
-    onCoordinatorError(listener: CoordinatorErrorListener): () => void;
-    readonly currentSwapState: ClientSwapState;
-    readonly currentSessionStatus: SessionStatus;
-    runSwap(params: RunSwapParams): Promise<SwapResult>;
-    contractRequest(params: ContractRequestParams): Promise<ContractRequestResult>;
-    close(): void;
-    restoreSwapContext(params: {
-        swapId: string;
-        syncSecret?: Uint8Array;
-    }): void;
-    requestSwapStatus(timeoutMs?: number): Promise<SyncUserResponsePayload>;
-    startSwapStatusReconciliation(intervalMs?: number): () => void;
-    requestRefund(params: {
-        swapId?: string;
-        syncSecret?: Uint8Array;
-        recoveryCode: Uint8Array;
-        timeoutMs?: number;
-    }): Promise<RefundExecutedPayload>;
-    requestRefundIntent(params: {
-        swapId?: string;
-        syncSecret?: Uint8Array;
-        recoveryCode: Uint8Array;
-        timeoutMs?: number;
-    }): Promise<RefundIntentResult>;
-};
-declare function createCoordinatorSession(options: CoordinatorSessionOptions): CoordinatorSessionHandle;
-declare function isBenignTransportDrop(err: unknown): boolean;
 
 /**
  * Payout policy validation (spec sections 4.3.1 and 10.1).
@@ -269,13 +175,12 @@ declare function recoveryCodeFromUserInput(input: string): Uint8Array;
 /**
  * `@invisible-labs/sdk/user` - normal-user (private transfer) commands (spec 4.3).
  *
- * The functional user API and the frontend `createCoordinatorSession` facade
- * share the same coordinator lifecycle implementation. Importing this module
- * must not pull in `/lp`, `/stats`, or `/events`.
+ * The normal-user API is functional and operates on the caller-owned attested
+ * Session. Importing this module must not pull in `/lp`, `/stats`, or `/events`.
  */
 
 /** Inclusive minimum private-transfer entry amount in lamports. */
-declare const MIN_ENTRY_AMOUNT_LAMPORTS = 400000000;
+declare const MIN_ENTRY_AMOUNT_LAMPORTS = 1500000000;
 /** Inclusive maximum private-transfer entry amount in lamports. */
 declare const MAX_ENTRY_AMOUNT_LAMPORTS = 100000000000;
 /** Arguments to start a new private-transfer pool entry. */
@@ -287,6 +192,8 @@ interface ContractRequestArgs {
      * to observe at the fundable deposit address and hold in the joint wallet.
      * It is the custody-side amount before protocol and network-fee accounting,
      * not the net amount a payout destination receives.
+     * The value must be a safe integer between {@link MIN_ENTRY_AMOUNT_LAMPORTS}
+     * and {@link MAX_ENTRY_AMOUNT_LAMPORTS}, inclusive.
      */
     readonly amountLamports: number;
     /**
@@ -301,11 +208,6 @@ interface ContractRequestArgs {
      * `SUPPORTED_TOTAL_DEADLINE_MS`.
      */
     readonly payoutPolicy: PayoutPolicy;
-    /**
-     * Retained for API compatibility. The current wire contract always commits a
-     * sync secret because status reads are keyed by that commitment.
-     */
-    readonly sync?: boolean;
     /** Optional caller-owned status secret, copied before it reaches the wire. */
     readonly syncSecret?: Uint8Array;
     /** Called before ContractRequest so the caller can persist the status secret. */
@@ -334,7 +236,7 @@ interface ContractRequestArgs {
  */
 declare function contractRequest(session: Session, args: ContractRequestArgs): Promise<ContractRequestResult>;
 /** Read the actor-scoped lifecycle projection for a normal-user contract. */
-declare function sync(session: Session, contractId: string, syncSecret: Uint8Array, timeoutMs?: number): Promise<SyncUserResponsePayload>;
+declare function sync(session: Session, contractId: string, syncSecret: Uint8Array, timeoutMs?: number): Promise<SyncUserResponse>;
 /** Arguments to refund a pool entry with the Recovery Code preimage. */
 interface RequestRefundArgs {
     /** The 32-byte Recovery Code preimage. */
@@ -346,32 +248,13 @@ interface RequestRefundArgs {
  * withdrawal intent and terminal outcome is recovered through sync/status
  * reads. No caller-supplied destination is accepted.
  *
- * @returns An acceptance receipt keyed by the resolved V0 `swapId`. The
+ * @returns An acceptance receipt keyed by the resolved V0 `swapId`, including
+ *   the coordinator-authoritative amount accepted for withdrawal. The
  *   coordinator's durable execution result is read later through `sync`.
  * @throws AttestationError if the session is not attested.
  * @throws PolicyValidationError if `recoveryCode` is not exactly 32 bytes.
  * @throws CommandError if the coordinator rejects the withdrawal request.
  */
-declare function requestRefund(session: Session, args: RequestRefundArgs): Promise<AcceptanceReceipt>;
-/**
- * Read the fundable deposit address for a request once the sealed contract
- * exposes it (`sync`).
- *
- * @throws NotImplementedError - read execution is deferred.
- */
-declare function getDepositAddress(_session: Session, _requestId: string, _syncSecret: Uint8Array): Promise<string>;
-/**
- * Subscribe to live sync messages for a request.
- *
- * @throws NotImplementedError - subscriptions are deferred.
- */
-declare function subscribe(_session: Session, _requestId: string, _syncSecret: Uint8Array, _handler: (event: unknown) => void): never;
-/**
- * Recover open requests after a tab close or restart by replaying the storage
- * adapter and re-subscribing.
- *
- * @throws NotImplementedError - replay is deferred.
- */
-declare function replayFromStorage(_session: Session, _storage: unknown): Promise<void>;
+declare function requestRefund(session: Session, args: RequestRefundArgs): Promise<RefundAcceptanceReceipt>;
 
-export { type ClientSwapState, type ContractRequestArgs, type ContractRequestParams, type ContractRequestResult, type CoordinatorProtocolError, type CoordinatorSessionHandle, type CoordinatorSessionOptions, INSTANT_PAYOUT_WINDOW_MS, MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS, type NormalUserActorSyncSnapshot, type NormalUserRefundability, type NormalUserSettlementPhase, PAYOUT_WINDOW_MILLISECONDS_PER_SECOND, type PayoutExecutedPayload, type PayoutSpec, RECOVERY_CODE_BYTE_LENGTH, type RefundExecutedPayload, type RefundIntentResult, type RequestRefundArgs, type RunSwapParams, SUPPORTED_TOTAL_DEADLINE_MS, type SessionStatus, type SourceLiquidityUse, type SpendingPolicySnapshot, type SwapResult, type SyncUserResponsePayload, type WithdrawExecutedPayload, commitmentFromCode, contractRequest, createCoordinatorSession, generateRecoveryCode, getDepositAddress, isBenignTransportDrop, recoveryCodeFromHex, recoveryCodeFromUserInput, recoveryCodeToHex, replayFromStorage, requestRefund, subscribe, sync };
+export { type ContractRequestArgs, type ContractRequestResult, INSTANT_PAYOUT_WINDOW_MS, MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS, type NormalUserActorSyncSnapshot, type NormalUserRefundability, type NormalUserSettlementPhase, PAYOUT_WINDOW_MILLISECONDS_PER_SECOND, type PayoutExecutedPayload, RECOVERY_CODE_BYTE_LENGTH, type RefundAcceptanceReceipt, type RefundExecutedPayload, type RequestRefundArgs, SUPPORTED_TOTAL_DEADLINE_MS, type SourceLiquidityUse, type SpendingPolicySnapshot, type SyncUserResponse, type SyncUserResponsePayload, type WithdrawExecutedPayload, commitmentFromCode, contractRequest, generateRecoveryCode, recoveryCodeFromHex, recoveryCodeFromUserInput, recoveryCodeToHex, requestRefund, sync };

package/dist/user.js

@@ -1,12 +1,12 @@
-import { scheduledPayoutWindowSeconds } from './chunk-LBC7ALYO.js';
-import { createSession, createExponentialBackoff, validatePayoutPolicyShape, formatAjvErrors } from './chunk-7DSVN3MV.js';
-import { PRODUCT_MAX_ENTRY_LAMPORTS, PRODUCT_MIN_ENTRY_LAMPORTS } from './chunk-TQNNTV5F.js';
-import { solanaAddressFromPublicKeyBytes, publicKey, assertAttested } from './chunk-SZAYO2L5.js';
-import { CoordinatorMessageType, onEnvelope, closeProtocolRuntime, EnvelopeKind, requestEnvelope } from './chunk-XUWBGET5.js';
-import { getSessionState } from './chunk-JRMKCE3S.js';
-import './chunk-NCY4FCYU.js';
-import { TransportError, CommandError, InvalidDepositAmountError, normalizeError, PolicyValidationError, NotImplementedError, RoutingError, AttestationError } from './chunk-OHIM2YWU.js';
-export { InvalidDepositAmountError } from './chunk-OHIM2YWU.js';
+import { scheduledPayoutWindowSeconds } from './chunk-NKRVQXRP.js';
+import { validatePayoutPolicyShape, formatAjvErrors, createSession, createExponentialBackoff } from './chunk-BWCGNTN5.js';
+import { PRODUCT_MAX_ENTRY_LAMPORTS, PRODUCT_MIN_ENTRY_LAMPORTS } from './chunk-4X5OCCQW.js';
+import { assertAttested, publicKey, solanaAddressFromPublicKeyBytes } from './chunk-NHEHCUS5.js';
+import { requestEnvelope, CoordinatorMessageType, onEnvelope, closeProtocolRuntime, EnvelopeKind } from './chunk-QQSI3ZD7.js';
+import { getSessionState } from './chunk-V5HXJRBW.js';
+import './chunk-DIA6U2CV.js';
+import { PolicyValidationError, CommandError, TransportError, InvalidDepositAmountError, normalizeError, RoutingError, AttestationError } from './chunk-GHBQF3A7.js';
+export { InvalidDepositAmountError } from './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
 // src/validation/payoutPolicy.ts
@@ -171,7 +171,7 @@ function recoveryCodeFromUserInput(input) {
 var protocolPromise = null;
 var frostRuntimePromise = null;
 function loadProtocol() {
-  protocolPromise ??= import('./coordinator-7Y45MCCZ.js');
+  protocolPromise ??= import('./coordinator-VVJ33WF2.js');
   return protocolPromise;
 }
 function loadFrostRuntime() {
@@ -185,6 +185,7 @@ var BENIGN_TRANSPORT_DROP = /* @__PURE__ */ Symbol("benignTransportDrop");
 var ALICE_ID = 1;
 var COORDINATOR_ID = 2;
 var SYNC_SECRET_BYTE_LENGTH = 32;
+var SYNC_CONTRACT_ID_MISMATCH_MESSAGE = "sync response contract id does not match requested contract";
 var ACTIVE_CONTRACT_REQUEST_MESSAGE = "coordinator session already has an active contract";
 var DEFAULT_SWAP_STATUS_RECONCILE_INTERVAL_MS = 5e3;
 var MAX_SWAP_STATUS_RETRY_DELAY_MS = 3e4;
@@ -198,9 +199,6 @@ var CURRENT_SCHEDULED_PAYOUT_WINDOW_SECONDS = new Set(scheduledPayoutWindowSecon
 var CURRENT_SCHEDULED_PAYOUT_WINDOW_MESSAGE = `scheduled payout_spec.window_seconds must be one of [${scheduledPayoutWindowSeconds().join(", ")}]`;
 var TERMINAL_SWAP_STATES = /* @__PURE__ */ new Set(["completed", "refunded", "failed"]);
 var activeFunctionalContractRequests = /* @__PURE__ */ new WeakSet();
-function createCoordinatorSession(options) {
-  return new UserCoordinatorSession(options);
-}
 function isBenignTransportDrop(err) {
   return typeof err === "object" && err !== null && err[BENIGN_TRANSPORT_DROP] === true;
 }
@@ -1016,7 +1014,7 @@ async function requestRefundOnSession(session, params) {
     false
   );
   try {
-    await client.requestRefundIntent(params);
+    const result = await client.requestRefundIntent(params);
     const requestId = client.currentSwapId;
     if (!requestId) {
       throw new CommandError(
@@ -1024,7 +1022,19 @@ async function requestRefundOnSession(session, params) {
         "refund response did not include the resolved contract id"
       );
     }
-    return { accepted: true, requestId };
+    if (result.kind === "accepted") {
+      return {
+        accepted: true,
+        requestId,
+        amountLamports: result.accepted.amount_lamports,
+        acceptedAtMs: result.accepted.accepted_at_ms
+      };
+    }
+    return {
+      accepted: true,
+      requestId,
+      amountLamports: result.refund.amount_lamports
+    };
   } finally {
     client.releaseWithoutClosing();
   }
@@ -1043,9 +1053,20 @@ async function requestUserSync(session, swapId, syncSecret, timeoutMs) {
       actor: "user",
       sync_secret: new Uint8Array(syncSecret)
     },
-    { swapId, timeoutMs }
+    { swapId, timeoutMs, rejectMatchingOutOfBandErrors: true }
   );
-  return (await loadProtocol()).asSyncUserResponsePayload(env);
+  const payload = (await loadProtocol()).asSyncUserResponsePayload(env);
+  assertSyncResponseContractId(env, payload, swapId);
+  return {
+    ...payload,
+    coordinatorTimestampMs: env.timestamp_ms
+  };
+}
+function assertSyncResponseContractId(envelope, payload, requestedSwapId) {
+  const actorSyncContractId = payload.actor_sync?.snapshot.contract_id;
+  if (envelope.swap_id !== requestedSwapId || actorSyncContractId !== void 0 && actorSyncContractId !== requestedSwapId) {
+    throw new CommandError("REJECTED_STATE", SYNC_CONTRACT_ID_MISMATCH_MESSAGE);
+  }
 }
 async function ensureFrostWasm() {
   await (await loadFrostRuntime()).ensureFrostWasm();
@@ -1150,10 +1171,10 @@ async function contractRequest(session, args) {
   assertCurrentUserContractPolicy(payoutPolicy);
   assertAttested(session);
   const destination = payoutPolicy.destinations[0];
-  const payoutSpec = payoutSpecFromPolicy(payoutPolicy, destination.address);
+  const wirePayoutSpec = wirePayoutSpecFromPolicy(payoutPolicy, destination.address);
   return contractRequestOnSession(session, {
     amountLamports: args.amountLamports,
-    payoutSpec,
+    payoutSpec: wirePayoutSpec,
     ...args.syncSecret !== void 0 && { syncSecret: args.syncSecret },
     ...args.recoveryCommitment !== void 0 && {
       recoveryCommitment: args.recoveryCommitment
@@ -1188,7 +1209,7 @@ function assertCurrentUserContractPolicy(policy) {
     }
   }
 }
-function payoutSpecFromPolicy(policy, destinationAddress) {
+function wirePayoutSpecFromPolicy(policy, destinationAddress) {
   const totalDeadlineMs = policy.totalDeadlineMs;
   if (totalDeadlineMs === void 0 || totalDeadlineMs === INSTANT_PAYOUT_WINDOW_MS) {
     return {
@@ -1210,16 +1231,7 @@ async function requestRefund(session, args) {
     recoveryCode: new Uint8Array(args.recoveryCode)
   });
 }
-async function getDepositAddress(_session, _requestId, _syncSecret) {
-  throw new NotImplementedError("user.getDepositAddress");
-}
-function subscribe(_session, _requestId, _syncSecret, _handler) {
-  throw new NotImplementedError("user.subscribe");
-}
-async function replayFromStorage(_session, _storage) {
-  throw new NotImplementedError("user.replayFromStorage");
-}
 
-export { INSTANT_PAYOUT_WINDOW_MS, MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS, PAYOUT_WINDOW_MILLISECONDS_PER_SECOND, RECOVERY_CODE_BYTE_LENGTH, SUPPORTED_TOTAL_DEADLINE_MS, commitmentFromCode, contractRequest, createCoordinatorSession, generateRecoveryCode, getDepositAddress, isBenignTransportDrop, recoveryCodeFromHex, recoveryCodeFromUserInput, recoveryCodeToHex, replayFromStorage, requestRefund, subscribe, sync };
+export { INSTANT_PAYOUT_WINDOW_MS, MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS, PAYOUT_WINDOW_MILLISECONDS_PER_SECOND, RECOVERY_CODE_BYTE_LENGTH, SUPPORTED_TOTAL_DEADLINE_MS, commitmentFromCode, contractRequest, generateRecoveryCode, recoveryCodeFromHex, recoveryCodeFromUserInput, recoveryCodeToHex, requestRefund, sync };
 //# sourceMappingURL=user.js.map
 //# sourceMappingURL=user.js.map