@invisible-labs/sdk 0.6.0-devnet.2 → 0.6.0-devnet.4

package/dist/presets.d.ts

@@ -1,43 +1,6 @@
-import { C as CoordinatorEndpoint } from './types.generated-CHGSbmLp.js';
+/** Public coordinator URL conveniences. Policy construction stays internal. */
+declare function invisibleProd(): string;
+declare function invisibleProdAzure(): string;
+declare function invisibleDevnet(): string;
 
-/**
- * `@invisible-labs/sdk/presets` - optional Invisible coordinator endpoint presets.
- *
- * This is the ONLY module permitted to name an `invisible.exchange` host (spec
- * section 6.2). Partners who self-host ignore it entirely and pass their own
- * `CoordinatorEndpoint[]` to `createSession`. The core never imports this module.
- *
- * Production presets embed an approved Azure TDX boot measurement and trust
- * roots. The caller must provide the separately approved coordinator binary
- * hash before a production endpoint can be constructed. Dormant or
- * development targets keep placeholders until approval.
- */
-
-/**
- * Production GCP TDX coordinator endpoint.
- *
- * Currently dormant: GCP is neither the live production nor development TEE
- * path. Kept only for a future explicit GCP relight, or a partner self-hosting
- * on GCP.
- */
-declare function invisibleProdGcp(): CoordinatorEndpoint[];
-/** Production Azure TDX coordinator endpoint. The live prod TEE today. */
-declare function invisibleProdAzure(approvedBinaryHash: string): CoordinatorEndpoint[];
-/**
- * The currently-active Invisible production preset. Integrators that just want
- * "Invisible prod" use this and stay on whichever cloud is live.
- *
- * Switching the prod target between Azure and GCP is this one line:
- * `export const invisibleProd = invisibleProdAzure` -> `invisibleProdGcp`.
- */
-declare const invisibleProd: typeof invisibleProdAzure;
-/** Public Invisible devnet, served by the hardened Azure prod coordinator. */
-declare const invisibleDevnet: typeof invisibleProdAzure;
-/** Dormant GCP development coordinator endpoint. Not the active dev target today. */
-declare function invisibleDevGcp(): CoordinatorEndpoint[];
-/** Azure development coordinator endpoint. The active dev TEE today. */
-declare function invisibleDevAzure(): CoordinatorEndpoint[];
-/** The currently-active Invisible development preset. */
-declare const invisibleDev: typeof invisibleDevAzure;
-
-export { invisibleDev, invisibleDevAzure, invisibleDevGcp, invisibleDevnet, invisibleProd, invisibleProdAzure, invisibleProdGcp };
+export { invisibleDevnet, invisibleProd, invisibleProdAzure };

package/dist/presets.js

@@ -1,70 +1,19 @@
-import { INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 } from './chunk-NCY4FCYU.js';
-import './chunk-OHIM2YWU.js';
+import { AZURE_PROD_COORDINATOR_URL } from './chunk-BRDLLGCZ.js';
+import './chunk-DIA6U2CV.js';
+import './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
-// src/presets/index.ts
-var PLACEHOLDER_PIN = {
-  mrtd: "",
-  intelRootFingerprint: ""
-};
-var BINARY_HASH_HEX = /^[0-9a-f]{64}$/i;
-var AZURE_PROD_RELEASE_PIN = {
-  mrtd: "ff450b138c5ee6734a43dc35afb437abfa24ef743bc9e9484ef4af365fcd89a6c50913248ed7fcb92a7d42b1ba7da984",
-  intelRootFingerprint: INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256,
-  azureMaa: {
-    issuer: "https://sharedweu.weu.attest.azure.net",
-    jwksUrl: "https://sharedweu.weu.attest.azure.net/certs",
-    policyHash: "9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco"
-  }
-};
-function invisibleProdGcp() {
-  return [
-    {
-      wsUrl: "wss://tee.invisible.exchange/ws-noise",
-      expectedHostname: "tee.invisible.exchange",
-      releasePin: { ...PLACEHOLDER_PIN },
-      requiredMode: "prod"
-    }
-  ];
+// src/public-presets.ts
+function invisibleProd() {
+  return AZURE_PROD_COORDINATOR_URL;
 }
-function invisibleProdAzure(approvedBinaryHash) {
-  const binaryHash = typeof approvedBinaryHash === "string" ? approvedBinaryHash.toLowerCase() : "";
-  if (!BINARY_HASH_HEX.test(binaryHash)) {
-    throw new Error("invisibleProdAzure requires an approved 64-character binary SHA-256 hash");
-  }
-  return [
-    {
-      wsUrl: "wss://tee-azure.invisible.exchange/ws-noise",
-      expectedHostname: "tee-azure.invisible.exchange",
-      releasePin: { ...AZURE_PROD_RELEASE_PIN, binaryHash },
-      requiredMode: "prod"
-    }
-  ];
+function invisibleProdAzure() {
+  return AZURE_PROD_COORDINATOR_URL;
 }
-var invisibleProd = invisibleProdAzure;
-var invisibleDevnet = invisibleProdAzure;
-function invisibleDevGcp() {
-  return [
-    {
-      wsUrl: "wss://tee-dev.invisible.exchange/ws-noise",
-      expectedHostname: "tee-dev.invisible.exchange",
-      releasePin: { ...PLACEHOLDER_PIN },
-      requiredMode: "dev"
-    }
-  ];
+function invisibleDevnet() {
+  return AZURE_PROD_COORDINATOR_URL;
 }
-function invisibleDevAzure() {
-  return [
-    {
-      wsUrl: "wss://tee-azure-dev.invisible.exchange/ws-noise",
-      expectedHostname: "tee-azure-dev.invisible.exchange",
-      releasePin: { ...PLACEHOLDER_PIN },
-      requiredMode: "dev"
-    }
-  ];
-}
-var invisibleDev = invisibleDevAzure;
 
-export { invisibleDev, invisibleDevAzure, invisibleDevGcp, invisibleDevnet, invisibleProd, invisibleProdAzure, invisibleProdGcp };
+export { invisibleDevnet, invisibleProd, invisibleProdAzure };
 //# sourceMappingURL=presets.js.map
 //# sourceMappingURL=presets.js.map

package/dist/presets.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/presets/index.ts"],"names":[],"mappings":";;;;;AAgBA,IAAM,eAAA,GAAkB;AAAA,EACtB,IAAA,EAAM,EAAA;AAAA,EACN,oBAAA,EAAsB;AACxB,CAAA;AAEA,IAAM,eAAA,GAAkB,iBAAA;AAExB,IAAM,sBAAA,GAAyB;AAAA,EAC7B,IAAA,EAAM,kGAAA;AAAA,EACN,oBAAA,EAAsB,oCAAA;AAAA,EACtB,QAAA,EAAU;AAAA,IACR,MAAA,EAAQ,wCAAA;AAAA,IACR,OAAA,EAAS,8CAAA;AAAA,IACT,UAAA,EAAY;AAAA;AAEhB,CAAA;AASO,SAAS,gBAAA,GAA0C;AACxD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,uCAAA;AAAA,MACP,gBAAA,EAAkB,wBAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,SAAS,mBAAmB,kBAAA,EAAmD;AACpF,EAAA,MAAM,aAAa,OAAO,kBAAA,KAAuB,QAAA,GAAW,kBAAA,CAAmB,aAAY,GAAI,EAAA;AAC/F,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,UAAU,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,6CAAA;AAAA,MACP,gBAAA,EAAkB,8BAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,sBAAA,EAAwB,UAAA,EAAW;AAAA,MACpD,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AASO,IAAM,aAAA,GAAgB;AAGtB,IAAM,eAAA,GAAkB;AAGxB,SAAS,eAAA,GAAyC;AACvD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,2CAAA;AAAA,MACP,gBAAA,EAAkB,4BAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,SAAS,iBAAA,GAA2C;AACzD,EAAA,OAAO;AAAA,IACL;AAAA,MACE,KAAA,EAAO,iDAAA;AAAA,MACP,gBAAA,EAAkB,kCAAA;AAAA,MAClB,UAAA,EAAY,EAAE,GAAG,eAAA,EAAgB;AAAA,MACjC,YAAA,EAAc;AAAA;AAChB,GACF;AACF;AAGO,IAAM,YAAA,GAAe","file":"presets.js","sourcesContent":["/**\n * `@invisible-labs/sdk/presets` - optional Invisible coordinator endpoint presets.\n *\n * This is the ONLY module permitted to name an `invisible.exchange` host (spec\n * section 6.2). Partners who self-host ignore it entirely and pass their own\n * `CoordinatorEndpoint[]` to `createSession`. The core never imports this module.\n *\n * Production presets embed an approved Azure TDX boot measurement and trust\n * roots. The caller must provide the separately approved coordinator binary\n * hash before a production endpoint can be constructed. Dormant or\n * development targets keep placeholders until approval.\n */\n\nimport { INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256 } from \"../attestation/verifier.js\";\nimport type { CoordinatorEndpoint } from \"../schemas/types.generated.js\";\n\nconst PLACEHOLDER_PIN = {\n  mrtd: \"\",\n  intelRootFingerprint: \"\",\n} as const;\n\nconst BINARY_HASH_HEX = /^[0-9a-f]{64}$/i;\n\nconst AZURE_PROD_RELEASE_PIN = {\n  mrtd: \"ff450b138c5ee6734a43dc35afb437abfa24ef743bc9e9484ef4af365fcd89a6c50913248ed7fcb92a7d42b1ba7da984\",\n  intelRootFingerprint: INTEL_SGX_ROOT_CA_FINGERPRINT_SHA256,\n  azureMaa: {\n    issuer: \"https://sharedweu.weu.attest.azure.net\",\n    jwksUrl: \"https://sharedweu.weu.attest.azure.net/certs\",\n    policyHash: \"9NY0VnTQ-IiBriBplVUpFbczcDaEBUwsiFYAzHu_gco\",\n  },\n} as const;\n\n/**\n * Production GCP TDX coordinator endpoint.\n *\n * Currently dormant: GCP is neither the live production nor development TEE\n * path. Kept only for a future explicit GCP relight, or a partner self-hosting\n * on GCP.\n */\nexport function invisibleProdGcp(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"prod\",\n    },\n  ];\n}\n\n/** Production Azure TDX coordinator endpoint. The live prod TEE today. */\nexport function invisibleProdAzure(approvedBinaryHash: string): CoordinatorEndpoint[] {\n  const binaryHash = typeof approvedBinaryHash === \"string\" ? approvedBinaryHash.toLowerCase() : \"\";\n  if (!BINARY_HASH_HEX.test(binaryHash)) {\n    throw new Error(\"invisibleProdAzure requires an approved 64-character binary SHA-256 hash\");\n  }\n  return [\n    {\n      wsUrl: \"wss://tee-azure.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-azure.invisible.exchange\",\n      releasePin: { ...AZURE_PROD_RELEASE_PIN, binaryHash },\n      requiredMode: \"prod\",\n    },\n  ];\n}\n\n/**\n * The currently-active Invisible production preset. Integrators that just want\n * \"Invisible prod\" use this and stay on whichever cloud is live.\n *\n * Switching the prod target between Azure and GCP is this one line:\n * `export const invisibleProd = invisibleProdAzure` -> `invisibleProdGcp`.\n */\nexport const invisibleProd = invisibleProdAzure;\n\n/** Public Invisible devnet, served by the hardened Azure prod coordinator. */\nexport const invisibleDevnet = invisibleProdAzure;\n\n/** Dormant GCP development coordinator endpoint. Not the active dev target today. */\nexport function invisibleDevGcp(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee-dev.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-dev.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"dev\",\n    },\n  ];\n}\n\n/** Azure development coordinator endpoint. The active dev TEE today. */\nexport function invisibleDevAzure(): CoordinatorEndpoint[] {\n  return [\n    {\n      wsUrl: \"wss://tee-azure-dev.invisible.exchange/ws-noise\",\n      expectedHostname: \"tee-azure-dev.invisible.exchange\",\n      releasePin: { ...PLACEHOLDER_PIN },\n      requiredMode: \"dev\",\n    },\n  ];\n}\n\n/** The currently-active Invisible development preset. */\nexport const invisibleDev = invisibleDevAzure;\n"]}
+{"version":3,"sources":["../src/public-presets.ts"],"names":[],"mappings":";;;;;;AAIO,SAAS,aAAA,GAAwB;AACtC,EAAA,OAAO,0BAAA;AACT;AAEO,SAAS,kBAAA,GAA6B;AAC3C,EAAA,OAAO,0BAAA;AACT;AAEO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAO,0BAAA;AACT","file":"presets.js","sourcesContent":["/** Public coordinator URL conveniences. Policy construction stays internal. */\n\nimport { AZURE_PROD_COORDINATOR_URL } from \"./presets/production.js\";\n\nexport function invisibleProd(): string {\n  return AZURE_PROD_COORDINATOR_URL;\n}\n\nexport function invisibleProdAzure(): string {\n  return AZURE_PROD_COORDINATOR_URL;\n}\n\nexport function invisibleDevnet(): string {\n  return AZURE_PROD_COORDINATOR_URL;\n}\n"]}

package/dist/stats.js

@@ -1,4 +1,4 @@
-import { NotImplementedError } from './chunk-OHIM2YWU.js';
+import { NotImplementedError } from './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
 // src/stats/index.ts

package/dist/storage.js

@@ -1,4 +1,4 @@
-import { StorageError } from './chunk-OHIM2YWU.js';
+import { StorageError } from './chunk-GHBQF3A7.js';
 import './chunk-VR6T6OJS.js';
 
 // src/storage/index.ts

package/dist/{createSession-D3ym-Ira.d.ts → types.generated-DJBTjLpP.d.ts}

@@ -1,7 +1,3 @@
-import { S as Session } from './session-DFuy54C-.js';
-import { T as Transport } from './types-ZhV7TIQY.js';
-import { a as CoordinatorPoolConfig } from './types.generated-CHGSbmLp.js';
-
 /**
  * The closed error taxonomy from docs/sdk-specification.md section 8.3.
  *
@@ -16,7 +12,7 @@ import { a as CoordinatorPoolConfig } from './types.generated-CHGSbmLp.js';
  * The conformance lint allowlists this file for that reason.
  */
 /** Attestation verification failures. Stop; do not retry without a new pin. */
-type AttestationErrorCode = "CERT_CHAIN_INVALID" | "TCB_REJECTED" | "FRESHNESS_NONCE_MISMATCH" | "NOISE_BINDING_MISMATCH" | "DEBUG_BIT_SET" | "MRTD_MISMATCH" | "AZURE_MAA_ISSUER_MISMATCH" | "AZURE_MAA_JWKS_INVALID" | "AZURE_MAA_POLICY_HASH_MISMATCH" | "AZURE_MAA_NOT_COMPLIANT" | "AZURE_MAA_DCAP_MISMATCH" | "AZURE_HCL_KEYS_MISMATCH" | "AZURE_AK_PUB_INVALID" | "AZURE_TPM_AK_QUOTE_INVALID" | "AZURE_TPM_QUALIFYING_DATA_MISMATCH" | "NOT_ATTESTED";
+type AttestationErrorCode = "CERT_CHAIN_INVALID" | "TCB_REJECTED" | "FRESHNESS_NONCE_MISMATCH" | "NOISE_BINDING_MISMATCH" | "DEBUG_BIT_SET" | "MRTD_MISMATCH" | "RUNTIME_PROFILE_MISMATCH" | "AZURE_MAA_ISSUER_MISMATCH" | "AZURE_MAA_JWKS_INVALID" | "AZURE_MAA_POLICY_HASH_MISMATCH" | "AZURE_MAA_NOT_COMPLIANT" | "AZURE_MAA_DCAP_MISMATCH" | "AZURE_HCL_KEYS_MISMATCH" | "AZURE_AK_PUB_INVALID" | "AZURE_TPM_AK_QUOTE_INVALID" | "AZURE_TPM_QUALIFYING_DATA_MISMATCH" | "NOT_ATTESTED";
 /** Transport-level failures. Reconnect through the pool and re-attest. */
 type TransportErrorCode = "WS_HANDSHAKE_FAILED" | "NOISE_HANDSHAKE_FAILED" | "NOISE_FRAME_TOO_LARGE" | "CONNECTION_LOST";
 /** Leader/role routing failures. Failover and re-attest. */
@@ -126,52 +122,40 @@ declare function isInvisibleError(value: unknown): value is InvisibleError;
  */
 declare function normalizeError(error: unknown, fallback?: string): string;
 
-/**
- * `createSession` - the single entrypoint that opens an attested session.
- *
- * It validates the endpoint pool, opens the transport, runs the Noise XX
- * handshake + TDX attestation, and returns an opaque {@link Session} that has
- * already passed attestation (`attested === true`). It resolves only once
- * attestation succeeds; any transport or attestation failure rejects with a
- * typed {@link TransportError} / {@link AttestationError}.
- *
- * A re-attestation timer re-runs verification over the live channel every
- * {@link REATTEST_EVERY_MS}; on failure it marks the session unattested and
- * notifies any registered policy-violation handlers. The transport is
- * injectable for tests.
- */
-
-/** Options for {@link createSession}. */
-interface CreateSessionOptions {
-    /**
-     * The coordinator endpoint pool. Must contain at least one endpoint. No
-     * hostname is provided by default; supply your own or use `@invisible-labs/sdk/presets`.
-     */
-    readonly coordinator: CoordinatorPoolConfig;
-    /**
-     * Storage adapter for recoverable secrets. Typed by `@invisible-labs/sdk/storage`;
-     * accepted here so the session can be threaded into storage-backed flows.
-     */
-    readonly storage?: unknown;
-    /** Wallet adapter used for storage key derivation and signing. */
-    readonly wallet?: unknown;
-    /**
-     * Inject a transport. Defaults to a Noise WebSocket transport over the first
-     * endpoint. Tests pass an in-memory transport (paired with a loopback
-     * coordinator that can complete the handshake + attestation).
-     */
-    readonly transport?: Transport;
-}
-/**
- * Open an attested session against the configured coordinator pool.
- *
- * @throws Error if the pool config is structurally invalid (including an empty
- *   `endpoints` array).
- * @throws TransportError if the connection or Noise handshake fails.
- * @throws AttestationError if attestation verification fails.
- */
-declare function createSession(options: CreateSessionOptions): Promise<Session>;
-/** Close a session created by {@link createSession}. */
-declare function closeSession(session: Session): void;
+type LpPositionView = {
+    readonly id: string;
+    readonly status: "dkg_pending" | "active" | "withdrawing" | "closed";
+    readonly targetShardCount: number;
+    readonly authPublicKey: string;
+    readonly refillPublicKey: string;
+    readonly withdrawalCommitment: string;
+    readonly committedLamports: number;
+    readonly earnedLamports: number;
+    readonly refillThreshold: number;
+    readonly shards: readonly {
+        readonly [key: string]: unknown;
+    }[];
+    readonly createdAt: number;
+};
+type PayoutDestination = {
+    readonly address: string;
+    readonly sharePercent: number;
+    readonly minDelayMs?: number;
+    readonly maxDelayMs?: number;
+    readonly minLamports?: number;
+};
+type PayoutPolicy = {
+    readonly destinations: readonly PayoutDestination[];
+    readonly totalDeadlineMs?: number;
+    readonly batchExclusionId?: string;
+};
+type StorageEnvelope = {
+    readonly namespace: string;
+    readonly key: string;
+    readonly alg: "AES-GCM" | "none";
+    readonly ciphertext: string;
+    readonly iv?: string;
+    readonly createdAtMs: number;
+};
 
-export { AttestationError as A, type CreateSessionOptions as C, InvalidDepositAmountError as I, LpLifecycleError as L, NotImplementedError as N, PolicyValidationError as P, RoutingError as R, StorageError as S, TransportError as T, WalletError as W, type AttestationErrorCode as a, CommandError as b, type CommandErrorCode as c, type CommandErrorOptions as d, type CoordinatorWireErrorCode as e, InvisibleError as f, type InvisibleErrorCode as g, type InvisibleErrorOptions as h, type LpLifecycleErrorCode as i, type NotImplementedErrorCode as j, type PolicyValidationErrorCode as k, type RoutingErrorCode as l, type StorageErrorCode as m, type TransportErrorCode as n, type WalletErrorCode as o, closeSession as p, createSession as q, isInvisibleError as r, normalizeError as s };
+export { AttestationError as A, CommandError as C, InvalidDepositAmountError as I, LpLifecycleError as L, NotImplementedError as N, type PayoutPolicy as P, RoutingError as R, type StorageEnvelope as S, TransportError as T, WalletError as W, type AttestationErrorCode as a, type CommandErrorCode as b, type CommandErrorOptions as c, type CoordinatorWireErrorCode as d, InvisibleError as e, type InvisibleErrorCode as f, type InvisibleErrorOptions as g, type LpLifecycleErrorCode as h, type LpPositionView as i, type NotImplementedErrorCode as j, type PayoutDestination as k, PolicyValidationError as l, type PolicyValidationErrorCode as m, type RoutingErrorCode as n, StorageError as o, type StorageErrorCode as p, type TransportErrorCode as q, type WalletErrorCode as r, isInvisibleError as s, normalizeError as t };

package/dist/user.d.ts

@@ -1,8 +1,6 @@
 import { S as Session } from './session-DFuy54C-.js';
-import { a as CoordinatorPoolConfig, P as PayoutPolicy } from './types.generated-CHGSbmLp.js';
-import { C as CreateSessionOptions } from './createSession-D3ym-Ira.js';
-export { I as InvalidDepositAmountError } from './createSession-D3ym-Ira.js';
-import './types-ZhV7TIQY.js';
+import { P as PayoutPolicy } from './types.generated-DJBTjLpP.js';
+export { I as InvalidDepositAmountError } from './types.generated-DJBTjLpP.js';
 
 /**
  * Acceptance receipts (spec section 8.2).
@@ -73,14 +71,16 @@ type PayoutWindowSyncSnapshot = {
     readonly deadline_ms: number | null;
 };
 type NormalUserContractStatus = "deposit" | "activating" | "active" | "settling" | "completed" | "refunded" | "expired";
-type NormalUserSettlementPhase = "awaiting_deposit" | "activating" | "waiting_for_liquidity" | "matched_scheduled" | "locked_pending_payout" | "submitted" | "confirming" | "completed" | "refund_pending" | "refunded" | "expired";
+type NormalUserSettlementPhase = "awaiting_deposit" | "activating" | "waiting_for_liquidity" | "retry_delayed" | "recovery_required" | "matched_scheduled" | "locked_pending_payout" | "submitted" | "confirming" | "completed" | "refund_pending" | "refunded" | "expired";
 type NormalUserRefundability = "available_now" | "request_pending" | "blocked_by_lock" | "stale" | "unavailable";
+type NormalUserRefundStatus = "queued" | "reserved" | "submitted" | "confirming" | "retrying" | "finalized" | "failed" | "partial" | "canceled";
 type SourceLiquidityUse = "not_materialized" | "available" | "locked_for_payout" | "pending_finality" | "spent" | "released";
 type NormalUserContractSyncSnapshot = {
     readonly contract_id: string;
     readonly status: NormalUserContractStatus;
     readonly settlement_phase: NormalUserSettlementPhase;
     readonly refundability: NormalUserRefundability;
+    readonly refund_status: NormalUserRefundStatus | null;
     readonly source_liquidity_use: SourceLiquidityUse;
     readonly destination_wallet: string | null;
     readonly deposit_amount_lamports: number;
@@ -90,6 +90,7 @@ type NormalUserContractSyncSnapshot = {
     readonly settled_amount_lamports: number;
     readonly protocol_fee_lamports: number;
     readonly network_fee_lost_lamports: readonly number[];
+    readonly recovery_refund_remaining_lamports: number;
     readonly withdrawal_requested_lamports: number;
     readonly withdrawal_landed_lamports: number;
     readonly withdrawal_landed_fee_lamports: number;
@@ -110,11 +111,21 @@ type SyncUserResponsePayload = {
     readonly withdraw_execution?: RefundExecutedPayload;
     readonly actor_sync?: NormalUserActorSyncSnapshot;
 };
-type WithdrawAcceptedPayload = {
-    readonly status: "accepted";
-    readonly amount_lamports: number;
-    readonly destination_address: string;
-    readonly accepted_at_ms: number;
+/**
+ * Actor-scoped sync response plus the coordinator clock used to produce it.
+ * The timestamp is envelope metadata, not part of the wire payload.
+ */
+type SyncUserResponse = SyncUserResponsePayload & {
+    readonly coordinatorTimestampMs: number;
+};
+/**
+ * Acceptance receipt for a normal-user refund, including the coordinator's
+ * authoritative amount claim. The timestamp is absent when the coordinator
+ * reports that the request already executed before the client received it.
+ */
+type RefundAcceptanceReceipt = AcceptanceReceipt & {
+    readonly amountLamports: number;
+    readonly acceptedAtMs?: number;
 };
 type RunSwapParams = {
     amountLamports: number;
@@ -126,9 +137,22 @@ type RunSwapParams = {
     onSyncSecretReady?: (info: {
         secretHex: string;
     }) => void | Promise<void>;
+    resumeSecret?: Uint8Array;
+    onResumeSecretReady?: (info: {
+        secretHex: string;
+    }) => void | Promise<void>;
+    onSwapAllocated?: (info: {
+        swapId: string;
+        syncSecretHex: string;
+        resumeSecretHex: string;
+    }) => void | Promise<void>;
     onRecoveryCodeReady?: (info: {
         codeHex: string;
     }) => void | Promise<void>;
+    onDelegateShareReady?: (info: {
+        swapId: string;
+        delegateShare: Uint8Array;
+    }) => void | Promise<void>;
     delegateShare?: Uint8Array;
     onDepositAddressReady?: (info: {
         swapId: string;
@@ -142,8 +166,6 @@ type RunSwapParams = {
     }) => void | Promise<void>;
     payoutWindowMs?: number;
 };
-/** Parameters for the pre-deposit portion of a normal-user contract flow. */
-type ContractRequestParams = Omit<RunSwapParams, "onDepositConfirmed">;
 /**
  * Details returned once the coordinator has accepted, initialized, and
  * durably delegated a contract, but before the user's deposit is observed.
@@ -163,76 +185,34 @@ type ContractRequestResult = {
     /** The read-only status secret. The caller must persist it if it needs sync. */
     readonly syncSecret: Uint8Array;
     readonly syncSecretHex: string;
+    /** The pre-delegation mutation secret. Persist it only for resume/recovery workflows. */
+    readonly resumeSecret: Uint8Array;
+    readonly resumeSecretHex: string;
     /** Present when the SDK generated the Recovery Code for this request. */
     readonly recoveryCodeHex?: string;
     readonly policySnapshot: SpendingPolicySnapshot;
     readonly delegatePolicySnapshot: SpendingPolicySnapshot;
 };
-type SwapResult = {
-    swapId: string;
-    jointPublicKey: Uint8Array;
-    depositTxSignature: string;
-    depositObservedAtMs: number;
-    delegatedAtMs: number;
-    recoveryCodeHex?: string;
-    policySnapshot: SpendingPolicySnapshot;
-    delegatePolicySnapshot: SpendingPolicySnapshot;
-};
-type RefundIntentResult = {
-    readonly kind: "executed";
-    readonly refund: RefundExecutedPayload;
-} | {
-    readonly kind: "accepted";
-    readonly accepted: WithdrawAcceptedPayload;
-};
-type SessionStatus = "idle" | "connecting" | "running" | "done" | "failed";
-type CoordinatorSessionOptions = {
-    coordinator: CoordinatorPoolConfig;
-    createSession?: (options: CreateSessionOptions) => Promise<Session>;
-};
-type StateChangeListener = (swapState: ClientSwapState, sessionStatus: SessionStatus) => void;
-type LogListener = (msg: string, direction: "in" | "out" | "info") => void;
-type PayoutExecutedListener = (payload: PayoutExecutedPayload, swapId: string) => void;
-type RefundExecutedListener = (payload: RefundExecutedPayload, swapId: string) => void;
-type NormalUserActorSyncListener = (payload: NormalUserActorSyncSnapshot, coordinatorTimestampMs: number) => void;
-type CoordinatorProtocolError = Error & {
-    readonly code: string;
-    readonly failedReqId?: number;
+/** Inputs for resuming an already allocated pre-delegation contract. */
+type ResumePreDelegationParams = {
+    readonly swapId: string;
+    readonly resumeSecret: Uint8Array;
+    readonly syncSecret?: Uint8Array;
+    readonly recoveryCommitment: Uint8Array;
+    /** The policy snapshot persisted when the contract was first allocated. */
+    readonly policySnapshot: SpendingPolicySnapshot;
+    /** Called before DkgRound2 so recovery can persist the generated Alice share. */
+    readonly onDelegateShareReady?: RunSwapParams["onDelegateShareReady"];
+    /** Supply the previously generated Alice share when DKG was already sealed. */
+    readonly delegateShare?: Uint8Array;
 };
-type CoordinatorErrorListener = (err: CoordinatorProtocolError) => void;
-type CoordinatorSessionHandle = {
-    onStateChange(listener: StateChangeListener): () => void;
-    onLog(listener: LogListener): () => void;
-    onPayoutExecuted(listener: PayoutExecutedListener): () => void;
-    onRefundExecuted(listener: RefundExecutedListener): () => void;
-    onNormalUserActorSync(listener: NormalUserActorSyncListener): () => void;
-    onCoordinatorError(listener: CoordinatorErrorListener): () => void;
-    readonly currentSwapState: ClientSwapState;
-    readonly currentSessionStatus: SessionStatus;
-    runSwap(params: RunSwapParams): Promise<SwapResult>;
-    contractRequest(params: ContractRequestParams): Promise<ContractRequestResult>;
-    close(): void;
-    restoreSwapContext(params: {
-        swapId: string;
-        syncSecret?: Uint8Array;
-    }): void;
-    requestSwapStatus(timeoutMs?: number): Promise<SyncUserResponsePayload>;
-    startSwapStatusReconciliation(intervalMs?: number): () => void;
-    requestRefund(params: {
-        swapId?: string;
-        syncSecret?: Uint8Array;
-        recoveryCode: Uint8Array;
-        timeoutMs?: number;
-    }): Promise<RefundExecutedPayload>;
-    requestRefundIntent(params: {
-        swapId?: string;
-        syncSecret?: Uint8Array;
-        recoveryCode: Uint8Array;
-        timeoutMs?: number;
-    }): Promise<RefundIntentResult>;
+type ResumePreDelegationResult = {
+    readonly swapId: string;
+    readonly jointPublicKey?: Uint8Array;
+    readonly depositExpiresAtMs?: number;
+    readonly coordinatorTimestampMs?: number;
+    readonly delegatedAtMs: number;
 };
-declare function createCoordinatorSession(options: CoordinatorSessionOptions): CoordinatorSessionHandle;
-declare function isBenignTransportDrop(err: unknown): boolean;
 
 /**
  * Payout policy validation (spec sections 4.3.1 and 10.1).
@@ -269,13 +249,12 @@ declare function recoveryCodeFromUserInput(input: string): Uint8Array;
 /**
  * `@invisible-labs/sdk/user` - normal-user (private transfer) commands (spec 4.3).
  *
- * The functional user API and the frontend `createCoordinatorSession` facade
- * share the same coordinator lifecycle implementation. Importing this module
- * must not pull in `/lp`, `/stats`, or `/events`.
+ * The normal-user API is functional and operates on the caller-owned attested
+ * Session. Importing this module must not pull in `/lp`, `/stats`, or `/events`.
  */
 
 /** Inclusive minimum private-transfer entry amount in lamports. */
-declare const MIN_ENTRY_AMOUNT_LAMPORTS = 400000000;
+declare const MIN_ENTRY_AMOUNT_LAMPORTS = 1500000000;
 /** Inclusive maximum private-transfer entry amount in lamports. */
 declare const MAX_ENTRY_AMOUNT_LAMPORTS = 100000000000;
 /** Arguments to start a new private-transfer pool entry. */
@@ -287,6 +266,8 @@ interface ContractRequestArgs {
      * to observe at the fundable deposit address and hold in the joint wallet.
      * It is the custody-side amount before protocol and network-fee accounting,
      * not the net amount a payout destination receives.
+     * The value must be a safe integer between {@link MIN_ENTRY_AMOUNT_LAMPORTS}
+     * and {@link MAX_ENTRY_AMOUNT_LAMPORTS}, inclusive.
      */
     readonly amountLamports: number;
     /**
@@ -301,23 +282,35 @@ interface ContractRequestArgs {
      * `SUPPORTED_TOTAL_DEADLINE_MS`.
      */
     readonly payoutPolicy: PayoutPolicy;
-    /**
-     * Retained for API compatibility. The current wire contract always commits a
-     * sync secret because status reads are keyed by that commitment.
-     */
-    readonly sync?: boolean;
     /** Optional caller-owned status secret, copied before it reaches the wire. */
     readonly syncSecret?: Uint8Array;
     /** Called before ContractRequest so the caller can persist the status secret. */
     readonly onSyncSecretReady?: (info: {
         secretHex: string;
     }) => void | Promise<void>;
+    /** Optional precomputed pre-delegation mutation secret, copied before it reaches the wire. */
+    readonly resumeSecret?: Uint8Array;
+    /** Called before ContractRequest so the caller can persist the resume secret. */
+    readonly onResumeSecretReady?: (info: {
+        secretHex: string;
+    }) => void | Promise<void>;
+    /** Called after allocation so the caller can persist both secrets with the swap id. */
+    readonly onSwapAllocated?: (info: {
+        swapId: string;
+        syncSecretHex: string;
+        resumeSecretHex: string;
+    }) => void | Promise<void>;
     /** Optional precomputed Recovery Code commitment for caller-managed recovery. */
     readonly recoveryCommitment?: Uint8Array;
     /** Called before DelegateShare so the caller can persist the generated code. */
     readonly onRecoveryCodeReady?: (info: {
         codeHex: string;
     }) => void | Promise<void>;
+    /** Called before DkgRound2 so the caller can persist the generated Alice share. */
+    readonly onDelegateShareReady?: (info: {
+        swapId: string;
+        delegateShare: Uint8Array;
+    }) => void | Promise<void>;
 }
 /**
  * Start a new pool entry through the current normal-user coordinator flow.
@@ -333,45 +326,34 @@ interface ContractRequestArgs {
  *   session cannot complete the DKG/delegation boundary.
  */
 declare function contractRequest(session: Session, args: ContractRequestArgs): Promise<ContractRequestResult>;
+/** Resume pre-delegation DKG or delegation on a caller-owned Session. */
+declare function resumePreDelegation(session: Session, args: ResumePreDelegationParams): Promise<ResumePreDelegationResult>;
 /** Read the actor-scoped lifecycle projection for a normal-user contract. */
-declare function sync(session: Session, contractId: string, syncSecret: Uint8Array, timeoutMs?: number): Promise<SyncUserResponsePayload>;
+declare function sync(session: Session, contractId: string, syncSecret: Uint8Array, timeoutMs?: number): Promise<SyncUserResponse>;
 /** Arguments to refund a pool entry with the Recovery Code preimage. */
 interface RequestRefundArgs {
+    /** Optional contract correlation required when multiple contracts share one Session. */
+    readonly swapId?: string;
+    /** Optional status secret used to restore the correlated contract context. */
+    readonly syncSecret?: Uint8Array;
     /** The 32-byte Recovery Code preimage. */
     readonly recoveryCode: Uint8Array;
 }
 /**
- * Submit a normal-user `withdraw_request` with only the Recovery Code preimage
- * (`{ recovery_code }`). The coordinator queues a durable origin-bound
- * withdrawal intent and terminal outcome is recovered through sync/status
- * reads. No caller-supplied destination is accepted.
+ * Submit a normal-user `withdraw_request` with the Recovery Code preimage
+ * (`{ recovery_code }`). Pass `swapId` and `syncSecret` when multiple contracts
+ * share one Session so the request is correlated to the intended contract.
+ * The coordinator queues a durable origin-bound withdrawal intent and terminal
+ * outcome is recovered through sync/status reads. No caller-supplied destination
+ * is accepted.
  *
- * @returns An acceptance receipt keyed by the resolved V0 `swapId`. The
+ * @returns An acceptance receipt keyed by the resolved V0 `swapId`, including
+ *   the coordinator-authoritative amount accepted for withdrawal. The
  *   coordinator's durable execution result is read later through `sync`.
  * @throws AttestationError if the session is not attested.
  * @throws PolicyValidationError if `recoveryCode` is not exactly 32 bytes.
  * @throws CommandError if the coordinator rejects the withdrawal request.
  */
-declare function requestRefund(session: Session, args: RequestRefundArgs): Promise<AcceptanceReceipt>;
-/**
- * Read the fundable deposit address for a request once the sealed contract
- * exposes it (`sync`).
- *
- * @throws NotImplementedError - read execution is deferred.
- */
-declare function getDepositAddress(_session: Session, _requestId: string, _syncSecret: Uint8Array): Promise<string>;
-/**
- * Subscribe to live sync messages for a request.
- *
- * @throws NotImplementedError - subscriptions are deferred.
- */
-declare function subscribe(_session: Session, _requestId: string, _syncSecret: Uint8Array, _handler: (event: unknown) => void): never;
-/**
- * Recover open requests after a tab close or restart by replaying the storage
- * adapter and re-subscribing.
- *
- * @throws NotImplementedError - replay is deferred.
- */
-declare function replayFromStorage(_session: Session, _storage: unknown): Promise<void>;
+declare function requestRefund(session: Session, args: RequestRefundArgs): Promise<RefundAcceptanceReceipt>;
 
-export { type ClientSwapState, type ContractRequestArgs, type ContractRequestParams, type ContractRequestResult, type CoordinatorProtocolError, type CoordinatorSessionHandle, type CoordinatorSessionOptions, INSTANT_PAYOUT_WINDOW_MS, MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS, type NormalUserActorSyncSnapshot, type NormalUserRefundability, type NormalUserSettlementPhase, PAYOUT_WINDOW_MILLISECONDS_PER_SECOND, type PayoutExecutedPayload, type PayoutSpec, RECOVERY_CODE_BYTE_LENGTH, type RefundExecutedPayload, type RefundIntentResult, type RequestRefundArgs, type RunSwapParams, SUPPORTED_TOTAL_DEADLINE_MS, type SessionStatus, type SourceLiquidityUse, type SpendingPolicySnapshot, type SwapResult, type SyncUserResponsePayload, type WithdrawExecutedPayload, commitmentFromCode, contractRequest, createCoordinatorSession, generateRecoveryCode, getDepositAddress, isBenignTransportDrop, recoveryCodeFromHex, recoveryCodeFromUserInput, recoveryCodeToHex, replayFromStorage, requestRefund, subscribe, sync };
+export { type ContractRequestArgs, type ContractRequestResult, INSTANT_PAYOUT_WINDOW_MS, MAX_ENTRY_AMOUNT_LAMPORTS, MIN_ENTRY_AMOUNT_LAMPORTS, type NormalUserActorSyncSnapshot, type NormalUserRefundability, type NormalUserSettlementPhase, PAYOUT_WINDOW_MILLISECONDS_PER_SECOND, type PayoutExecutedPayload, RECOVERY_CODE_BYTE_LENGTH, type RefundAcceptanceReceipt, type RefundExecutedPayload, type RequestRefundArgs, type ResumePreDelegationParams, type ResumePreDelegationResult, SUPPORTED_TOTAL_DEADLINE_MS, type SourceLiquidityUse, type SpendingPolicySnapshot, type SyncUserResponse, type SyncUserResponsePayload, type WithdrawExecutedPayload, commitmentFromCode, contractRequest, generateRecoveryCode, recoveryCodeFromHex, recoveryCodeFromUserInput, recoveryCodeToHex, requestRefund, resumePreDelegation, sync };