@kasufinance/kasu-sdk 2.6.0 → 2.7.1

package/dist/flows/deposit-flow.js

@@ -0,0 +1,436 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { utils } from 'ethers';
+import { asContractType, buildLegacyContractRequestMessage, buildLoanAgreementSignMessage, encodeDepositData, } from '../domain/loan-contract';
+import { decodeRevert } from '../domain/revert-errors';
+import { classifyWalletFailure, isUnpredictableGas, } from '../domain/wallet-errors';
+import { Flow } from './flow';
+/** Generated agreements are valid for five minutes upstream. */
+export const CONTRACT_TTL_MS = 5 * 60 * 1000;
+/** What a run without a spender, from either source, fails with. */
+export const NO_SPENDER_MESSAGE = 'DepositFlow: no ERC-20 spender; build the flow with kasu.flows.deposit() or pass `spender` on the input';
+/** What a malformed auth signature fails the generate step with. */
+export const INVALID_AUTH_SIGNATURE_MESSAGE = 'DepositFlow: the wallet returned a malformed authentication signature; expected 65 bytes of 0x-prefixed hex';
+/** What a malformed acceptance signature fails the confirm step with. */
+export const INVALID_ACCEPTANCE_SIGNATURE_MESSAGE = 'DepositFlow: the wallet returned a malformed acceptance signature; expected 65 bytes of 0x-prefixed hex';
+/**
+ * Is this an EIP-191 personal sign, in the only shape the protocol accepts?
+ *
+ * 65 bytes — `r`, `s`, `v` — 0x-prefixed. Nothing downstream checks it: the
+ * ABI coder takes any even-length hex as `bytes`, so `'0x'` and a 64-byte
+ * string both encode happily into a `depositData` the agreements service then
+ * cannot verify against anything. The check has to happen where the signature
+ * is taken, which is here.
+ */
+function isPersonalSignature(signature) {
+    return utils.isHexString(signature, 65);
+}
+const INITIAL = {
+    phase: 'idle',
+    step: null,
+    stepIndex: 0,
+    stepTotal: 4,
+    approvalRequired: true,
+    contract: null,
+    failure: null,
+};
+/** 1-based badge position, with `approve` dropped when it is out of scope. */
+function stepIndexOf(step, approvalRequired) {
+    const order = approvalRequired
+        ? ['generate', 'confirm', 'approve', 'request']
+        : ['generate', 'confirm', 'request'];
+    return order.indexOf(step) + 1;
+}
+function badgeFor(step, approvalRequired) {
+    return {
+        step,
+        stepIndex: stepIndexOf(step, approvalRequired),
+        stepTotal: approvalRequired ? 4 : 3,
+    };
+}
+/**
+ * The request step's extra outcomes, in the order the evidence supports.
+ *
+ * A revert is read for WHAT reverted before it is read as a shortfall.
+ * `requestDepositWithKyc` reverts for a whole family of declared reasons —
+ * `LendingPoolIsStopped`, `ClearingIsPending`, `UserNotKycd`, `UserBlocked`,
+ * `UserNotInAllowList`, `InvalidTranche`, `BlockExpired` — and every one of
+ * them used to arrive as `insufficient-balance`, which told a fully funded
+ * lender to top up a wallet that was never short while their pool was simply
+ * mid-clearing. So: a decoded protocol error is `reverted` and names itself.
+ *
+ * Only a token balance or allowance failure — or revert data nothing can
+ * decode, on the `UNPREDICTABLE_GAS_LIMIT` ethers raises for a failed gas
+ * estimate — is still `insufficient-balance`, which is the case that reason
+ * was named for and the one where topping up is genuinely the answer.
+ */
+function classifyRequest(err) {
+    const revert = decodeRevert(err);
+    if ((revert === null || revert === void 0 ? void 0 : revert.family) === 'protocol') {
+        return {
+            step: 'request',
+            reason: 'reverted',
+            revertError: revert.name,
+            error: err,
+        };
+    }
+    if (revert !== null || isUnpredictableGas(err)) {
+        return { step: 'request', reason: 'insufficient-balance', error: err };
+    }
+    return classifyWalletFailure('request', err);
+}
+// ---------------------------------------------------------------------------
+// The flow
+// ---------------------------------------------------------------------------
+export class DepositFlow extends Flow {
+    constructor(_ports, opts) {
+        var _a;
+        super(INITIAL);
+        this._ports = _ports;
+        /**
+         * The accept handshake. The run parks on this promise; `acceptContract`,
+         * `declineContract` and `reset` each settle it with an `AcceptOutcome`.
+         * Cleared the moment it settles so a stale resolver from an abandoned run
+         * can never leak into the next one.
+         */
+        this._accept = null;
+        /**
+         * The run token that is between `acceptContract()` and the wallet
+         * settling, or `null`.
+         *
+         * A token rather than a boolean, because the flag has to belong to the RUN
+         * that set it: after `reset()` out of a wallet prompt that never answers,
+         * the abandoned run's `finally` may not arrive for minutes, and a boolean
+         * left standing refuses both Accept and Decline on every run after it.
+         * A stale token simply is not the current generation.
+         */
+        this._acceptingFor = null;
+        this._ttlMs = (_a = opts === null || opts === void 0 ? void 0 : opts.contractTtlMs) !== null && _a !== void 0 ? _a : CONTRACT_TTL_MS;
+        this._defaultSpender = opts === null || opts === void 0 ? void 0 : opts.spender;
+        // Called through the ports object, never captured off it: a consumer
+        // whose clock is a method on its own object keeps its `this`.
+        this._now = () => { var _a, _b; return (_b = (_a = _ports.now) === null || _a === void 0 ? void 0 : _a.call(_ports)) !== null && _b !== void 0 ? _b : Date.now(); };
+    }
+    /**
+     * Sign the agreement and resume the parked run. A no-op when nothing is
+     * parked, so a double tap cannot sign twice.
+     */
+    acceptContract() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const bridge = this._accept;
+            const contract = this._store.state.contract;
+            if (!bridge || !contract || this._isAccepting())
+                return;
+            const token = this._store.generation;
+            this._acceptingFor = token;
+            this._store.patch(Object.assign({ phase: 'accepting-sign' }, badgeFor('confirm', this._store.state.approvalRequired)), token);
+            try {
+                const signature = yield this._ports.signMessage(contract.contractMessage);
+                // Checked HERE, not at the encoder: this is the signature the
+                // agreements service verifies the deposit against, and a wallet
+                // that returned something other than 65 bytes has not signed
+                // anything. Failing the confirm step names the step that produced
+                // it; letting it through would put an unverifiable blob on chain.
+                if (!isPersonalSignature(signature)) {
+                    bridge.settle({
+                        kind: 'failed',
+                        error: new Error(INVALID_ACCEPTANCE_SIGNATURE_MESSAGE),
+                    });
+                    return;
+                }
+                bridge.settle({ kind: 'accepted', signature });
+            }
+            catch (err) {
+                // A WALLET error, and the only one this flow classifies as a
+                // possible cancellation on the confirm step.
+                bridge.settle({ kind: 'failed', error: err });
+            }
+            finally {
+                // Only if this run still holds it: a `reset()` during the prompt
+                // may have started another one, and that one's flag is its own.
+                if (this._acceptingFor === token)
+                    this._acceptingFor = null;
+            }
+        });
+    }
+    /**
+     * Back out of the agreement. The run ends on `declined` — a legitimate
+     * choice, not a failure, and `state.failure` stays null.
+     *
+     * Ignored once `acceptContract()` has opened the wallet: an agreement in
+     * the middle of being signed cannot also be refused. `reset()` is the way
+     * out of a prompt that never answers.
+     */
+    declineContract() {
+        const bridge = this._accept;
+        if (!bridge || this._isAccepting())
+            return;
+        this._accept = null;
+        bridge.settle({ kind: 'declined' });
+    }
+    /** True only while THIS generation is waiting on the acceptance signature. */
+    _isAccepting() {
+        return (this._acceptingFor !== null &&
+            this._store.isCurrent(this._acceptingFor));
+    }
+    /** `reset()`: unpark the abandoned run and drop its handshake. */
+    _onAbandon() {
+        const bridge = this._accept;
+        this._accept = null;
+        this._acceptingFor = null;
+        bridge === null || bridge === void 0 ? void 0 : bridge.settle({ kind: 'abandoned' });
+    }
+    // -----------------------------------------------------------------------
+    _run(input, token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this._accept = null;
+            this._acceptingFor = null;
+            const ports = this._ports;
+            const owner = input.userAddress.toLowerCase();
+            // 0. The spender, from the input or from the chain config the facade
+            //    built this flow with. Without one there is nothing to read an
+            //    allowance against and nothing to approve — and guessing would
+            //    grant an approval to the wrong contract.
+            const spender = (_a = input.spender) !== null && _a !== void 0 ? _a : this._defaultSpender;
+            if (!spender) {
+                this._fail(token, true, {
+                    step: 'generate',
+                    reason: 'failed',
+                    error: new Error(NO_SPENDER_MESSAGE),
+                });
+                return;
+            }
+            // 1. Allowance pre-check. Decides `approvalRequired` — and therefore
+            //    the badge total — before the lender is shown a single step. Read
+            //    live, never cached: an exact-amount approval is fully consumed by
+            //    the deposit it paid for, so a stale allowance is exactly the value
+            //    that would wrongly skip the approve and revert the deposit.
+            let approvalRequired = true;
+            try {
+                const allowance = yield ports.readAllowance(owner, spender);
+                approvalRequired = allowance.lt(input.amount);
+            }
+            catch (_b) {
+                // A read failure is not a reason to skip an approval. Assume one is
+                // needed: the cost is a redundant approve, the alternative is a
+                // reverted deposit.
+                approvalRequired = true;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            // 2. Generate — sign the auth message.
+            this._store.patch(Object.assign({ approvalRequired, phase: 'generating-sign' }, badgeFor('generate', approvalRequired)), token);
+            const timestamp = this._now();
+            const signedMessage = buildAuthMessage(input, owner, timestamp);
+            let signature;
+            try {
+                signature = yield ports.signMessage(signedMessage);
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, classifyWalletFailure('generate', err));
+                return;
+            }
+            // The same EIP-191 shape as the acceptance, and the same reason to
+            // check it: kasu-backend verifies this one to decide whether to issue
+            // an agreement at all, so a malformed signature is a 4xx that says
+            // nothing about which step produced it. Named here instead.
+            if (!isPersonalSignature(signature)) {
+                this._fail(token, approvalRequired, {
+                    step: 'generate',
+                    reason: 'failed',
+                    error: new Error(INVALID_AUTH_SIGNATURE_MESSAGE),
+                });
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            // 3. Generate — POST the request.
+            this._store.patch(Object.assign({ phase: 'generating-fetch' }, badgeFor('generate', approvalRequired)), token);
+            let contract;
+            try {
+                contract = yield ports.generateContract(Object.assign({ address: owner, signature,
+                    timestamp,
+                    signedMessage, poolId: input.poolId, trancheId: input.trancheId, fixedTermConfigId: input.fixedTermConfigId, depositAmount: input.depositAmount }, displayFieldsOf(input.contractMessage)));
+            }
+            catch (err) {
+                // Never a wallet rejection: this step is an HTTP call, and the
+                // lender's wallet was not involved in it. A backend that happened
+                // to echo the words "user rejected" must not be reported to them as
+                // something they did.
+                this._fail(token, approvalRequired, {
+                    step: 'generate',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            // 4. Park on the agreement until the consumer accepts or declines.
+            const outcome = yield new Promise((resolve) => {
+                this._accept = { settle: resolve };
+                this._store.patch(Object.assign({ phase: 'awaiting-accept', contract }, badgeFor('confirm', approvalRequired)), token);
+            });
+            this._accept = null;
+            // An abandoned run lands here too — `reset()` unparks it. The token
+            // check is what tells the two apart.
+            if (!this._store.isCurrent(token))
+                return;
+            if (outcome.kind === 'declined') {
+                this._store.patch(Object.assign({ phase: 'declined' }, badgeFor('confirm', approvalRequired)), token);
+                return;
+            }
+            if (outcome.kind !== 'accepted') {
+                if (outcome.kind === 'failed') {
+                    this._fail(token, approvalRequired, classifyWalletFailure('confirm', outcome.error));
+                }
+                return;
+            }
+            // 5. TTL guard. Checked here because this is where the idling happens:
+            //    the lender has just spent as long as they wanted reading. An
+            //    expired agreement is refused rather than broadcast — the on-chain
+            //    call would revert, after a wallet prompt and a gas estimate, with
+            //    nothing on screen explaining why.
+            if (this._now() > contract.timestamp + this._ttlMs) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'contract-expired',
+                });
+                return;
+            }
+            // The acceptance signature is already known to be 65 bytes, but the
+            // encoder also reads `timestamp`, `contractVersion` and
+            // `contractType` off a response the SDK did not produce. `start()`
+            // promises it does not reject, so anything that throws in here becomes
+            // a failure the consumer can render rather than an unhandled rejection
+            // in an application that was told it never had to catch one.
+            let depositData;
+            try {
+                depositData = encodeDepositData({
+                    signature: outcome.signature,
+                    timestamp: contract.timestamp,
+                    contractVersion: contract.contractVersion,
+                    contractType: asContractType(contract.contractType),
+                });
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            // 6. Approve — the EXACT amount, never `MaxUint256`. House rule: an
+            //    unlimited allowance outlives the deposit it was granted for, and a
+            //    later exploit of the spender would drain a wallet that has long
+            //    since stopped lending.
+            if (approvalRequired) {
+                this._store.patch(Object.assign({ phase: 'approve' }, badgeFor('approve', approvalRequired)), token);
+                try {
+                    const tx = yield ports.approve(spender, input.amount);
+                    yield tx.wait();
+                }
+                catch (err) {
+                    this._fail(token, approvalRequired, classifyWalletFailure('approve', err));
+                    return;
+                }
+                if (!this._store.isCurrent(token))
+                    return;
+            }
+            // 7. Request — KYC signature, then the deposit and its receipt.
+            this._store.patch(Object.assign({ phase: 'request-sign' }, badgeFor('request', approvalRequired)), token);
+            // The two KYC ports reach the consumer's own backend, so they fail the
+            // way the generate step does: `failed`, with the error kept. Running
+            // them through the rejection classifier would let a backend wording —
+            // "Declined", "request rejected" — end a run as "you cancelled in your
+            // wallet", with the real error discarded and nothing to report.
+            let kyc;
+            try {
+                const kycParams = yield ports.buildKycParams(owner);
+                kyc = yield ports.getKycSignature(kycParams);
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, {
+                    step: 'request',
+                    reason: 'failed',
+                    error: err,
+                });
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            try {
+                const tx = yield ports.deposit({
+                    poolId: input.poolId,
+                    trancheId: input.trancheId,
+                    amount: input.amount,
+                    kycSignature: {
+                        blockExpiration: kyc.blockExpiration,
+                        signature: kyc.signature,
+                    },
+                    depositData,
+                    fixedTermConfigId: input.fixedTermConfigId,
+                });
+                this._store.patch(Object.assign({ phase: 'request-confirm' }, badgeFor('request', approvalRequired)), token);
+                yield tx.wait();
+            }
+            catch (err) {
+                this._fail(token, approvalRequired, classifyRequest(err));
+                return;
+            }
+            if (!this._store.isCurrent(token))
+                return;
+            this._store.patch(Object.assign({ phase: 'success' }, badgeFor('request', approvalRequired)), token);
+        });
+    }
+    _fail(token, approvalRequired, failure) {
+        this._store.patch(Object.assign({ phase: 'error', failure }, badgeFor(failure.step, approvalRequired)), token);
+    }
+}
+// ---------------------------------------------------------------------------
+// Message building
+// ---------------------------------------------------------------------------
+/**
+ * The auth message, in whichever format the consumer asked for. Both builders
+ * are the byte-exact protocol strings from `domain/loan-contract` — the string
+ * signed here and the body posted from `_run` state the SAME timestamp and the
+ * SAME lowercased address, because kasu-backend rebuilds one from the other.
+ */
+function buildAuthMessage(input, owner, timestamp) {
+    if (input.contractMessage.format === 'legacy') {
+        return buildLegacyContractRequestMessage(owner, timestamp);
+    }
+    const { strategyName, region, optionName, amountLabel } = input.contractMessage;
+    return buildLoanAgreementSignMessage({
+        strategyName,
+        region,
+        optionName,
+        amountLabel,
+        timestamp,
+    });
+}
+/**
+ * The four display fields, present only on the new format. The backend picks
+ * its verification path on their presence: all four → the human-readable
+ * format, any missing → the legacy string.
+ */
+function displayFieldsOf(message) {
+    if (message.format === 'legacy')
+        return {};
+    return {
+        strategyName: message.strategyName,
+        region: message.region,
+        optionName: message.optionName,
+        amountLabel: message.amountLabel,
+    };
+}
+//# sourceMappingURL=deposit-flow.js.map

package/dist/flows/deposit-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deposit-flow.js","sourceRoot":"","sources":["../../src/flows/deposit-flow.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAa,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE1C,OAAO,EACH,cAAc,EACd,iCAAiC,EACjC,6BAA6B,EAC7B,iBAAiB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EACH,qBAAqB,EACrB,kBAAkB,GACrB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAuT9B,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAC3B,yGAAyG,CAAC;AAE9G,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GACvC,6GAA6G,CAAC;AAElH,yEAAyE;AACzE,MAAM,CAAC,MAAM,oCAAoC,GAC7C,yGAAyG,CAAC;AAE9G;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,SAAkB;IAC3C,OAAO,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,GAAiB;IAC1B,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,IAAI;IACV,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,CAAC;IACZ,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;CAChB,CAAC;AAuBF,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAiB,EAAE,gBAAyB;IAC7D,MAAM,KAAK,GAAkB,gBAAgB;QACzC,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QAC/C,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CACb,IAAiB,EACjB,gBAAyB;IAEzB,OAAO;QACH,IAAI;QACJ,SAAS,EAAE,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC9C,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACtC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CAAC,GAAY;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,MAAK,UAAU,EAAE,CAAC;QAChC,OAAO;YACH,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,KAAK,EAAE,GAAG;SACb,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,OAAO,WAAY,SAAQ,IAAoC;IAyBjE,YACqB,MAAoB,EACrC,IAAyB;;QAEzB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHE,WAAM,GAAN,MAAM,CAAc;QArBzC;;;;;WAKG;QACK,YAAO,GAAwD,IAAI,CAAC;QAE5E;;;;;;;;;WASG;QACK,kBAAa,GAAkB,IAAI,CAAC;QAOxC,IAAI,CAAC,MAAM,GAAG,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,aAAa,mCAAI,eAAe,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,CAAC;QACrC,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,CAAC,IAAI,GAAG,GAAW,EAAE,eAAC,OAAA,MAAA,MAAA,MAAM,CAAC,GAAG,sDAAI,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAA,EAAA,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACG,cAAc;;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE;gBAAE,OAAO;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,iBAET,KAAK,EAAE,gBAAgB,IACpB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAE9D,KAAK,CACR,CAAC;YACF,IAAI,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAC3C,QAAQ,CAAC,eAAe,CAC3B,CAAC;gBACF,8DAA8D;gBAC9D,gEAAgE;gBAChE,6DAA6D;gBAC7D,kEAAkE;gBAClE,kEAAkE;gBAClE,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,MAAM,CAAC,MAAM,CAAC;wBACV,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,IAAI,KAAK,CAAC,oCAAoC,CAAC;qBACzD,CAAC,CAAC;oBACH,OAAO;gBACX,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,6DAA6D;gBAC7D,6CAA6C;gBAC7C,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAClD,CAAC;oBAAS,CAAC;gBACP,iEAAiE;gBACjE,gEAAgE;gBAChE,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK;oBAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAChE,CAAC;QACL,CAAC;KAAA;IAED;;;;;;;OAOG;IACH,eAAe;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,8EAA8E;IACtE,YAAY;QAChB,OAAO,CACH,IAAI,CAAC,aAAa,KAAK,IAAI;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAC5C,CAAC;IACN,CAAC;IAED,kEAAkE;IAC/C,UAAU;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAE1D,IAAI,CAChB,KAAuB,EACvB,KAAa;;;YAEb,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAE9C,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,8CAA8C;YAC9C,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,OAAO,mCAAI,IAAI,CAAC,eAAe,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;oBACpB,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,IAAI,KAAK,CAAC,kBAAkB,CAAC;iBACvC,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,iEAAiE;YACjE,IAAI,gBAAgB,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC5D,gBAAgB,GAAG,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;YAAC,WAAM,CAAC;gBACL,oEAAoE;gBACpE,gEAAgE;gBAChE,oBAAoB;gBACpB,gBAAgB,GAAG,IAAI,CAAC;YAC5B,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO;YAE1C,uCAAuC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,iBAET,gBAAgB,EAChB,KAAK,EAAE,iBAAiB,IACrB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAE7C,KAAK,CACR,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAChE,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACD,SAAS,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,KAAK,CACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,CACzC,CAAC;gBACF,OAAO;YACX,CAAC;YACD,mEAAmE;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE;oBAChC,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,CAAC;iBACnD,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO;YAE1C,kCAAkC;YAClC,IAAI,CAAC,MAAM,CAAC,KAAK,iBAET,KAAK,EAAE,kBAAkB,IACtB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAE7C,KAAK,CACR,CAAC;YACF,IAAI,QAAkC,CAAC;YACvC,IAAI,CAAC;gBACD,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,iBACnC,OAAO,EAAE,KAAK,EACd,SAAS;oBACT,SAAS;oBACT,aAAa,EACb,MAAM,EAAE,KAAK,CAAC,MAAM,EACpB,SAAS,EAAE,KAAK,CAAC,SAAS,EAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAC1C,aAAa,EAAE,KAAK,CAAC,aAAa,IAC/B,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,EAC3C,CAAC;YACP,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,+DAA+D;gBAC/D,kEAAkE;gBAClE,oEAAoE;gBACpE,sBAAsB;gBACtB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE;oBAChC,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG;iBACb,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO;YAE1C,mEAAmE;YACnE,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;gBACzD,IAAI,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,iBAET,KAAK,EAAE,iBAAiB,EACxB,QAAQ,IACL,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAE5C,KAAK,CACR,CAAC;YACN,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,oEAAoE;YACpE,qCAAqC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,iBACX,KAAK,EAAE,UAAU,IAAK,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAC7D,KAAK,CACR,CAAC;gBACF,OAAO;YACX,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC,KAAK,CACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAClD,CAAC;gBACN,CAAC;gBACD,OAAO;YACX,CAAC;YAED,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,uCAAuC;YACvC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE;oBAChC,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,kBAAkB;iBAC7B,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,oEAAoE;YACpE,wDAAwD;YACxD,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,6DAA6D;YAC7D,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACD,WAAW,GAAG,iBAAiB,CAAC;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC;iBACtD,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE;oBAChC,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG;iBACb,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YAED,oEAAoE;YACpE,wEAAwE;YACxE,qEAAqE;YACrE,4BAA4B;YAC5B,IAAI,gBAAgB,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,iBACX,KAAK,EAAE,SAAS,IAAK,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAC5D,KAAK,CACR,CAAC;gBACF,IAAI,CAAC;oBACD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBACtD,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,IAAI,CAAC,KAAK,CACN,KAAK,EACL,gBAAgB,EAChB,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CACxC,CAAC;oBACF,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,OAAO;YAC9C,CAAC;YAED,gEAAgE;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,iBACX,KAAK,EAAE,cAAc,IAAK,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,GACjE,KAAK,CACR,CAAC;YAEF,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,GAAiB,CAAC;YACtB,IAAI,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CACxC,KAAsB,CACzB,CAAC;gBACF,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE;oBAChC,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG;iBACb,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO;YAE1C,IAAI,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;oBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,YAAY,EAAE;wBACV,eAAe,EAAE,GAAG,CAAC,eAAe;wBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;qBAC3B;oBACD,WAAW;oBACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;iBAC7C,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,iBAET,KAAK,EAAE,iBAAiB,IACrB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAE5C,KAAK,CACR,CAAC;gBACF,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO;YAE1C,IAAI,CAAC,MAAM,CAAC,KAAK,iBACX,KAAK,EAAE,SAAS,IAAK,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAC5D,KAAK,CACR,CAAC;QACN,CAAC;KAAA;IAEO,KAAK,CACT,KAAa,EACb,gBAAyB,EACzB,OAAuB;QAEvB,IAAI,CAAC,MAAM,CAAC,KAAK,iBAET,KAAK,EAAE,OAAO,EACd,OAAO,IACJ,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,GAE/C,KAAK,CACR,CAAC;IACN,CAAC;CACJ;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,gBAAgB,CACrB,KAAuB,EACvB,KAAa,EACb,SAAiB;IAEjB,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,iCAAiC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GACnD,KAAK,CAAC,eAAe,CAAC;IAC1B,OAAO,6BAA6B,CAAC;QACjC,YAAY;QACZ,MAAM;QACN,UAAU;QACV,WAAW;QACX,SAAS;KACZ,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACpB,OAA+B;IAK/B,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO;QACH,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;KACnC,CAAC;AACN,CAAC"}

package/dist/flows/flow.d.ts

@@ -0,0 +1,72 @@
+import { FlowStore } from './observable';
+/**
+ * The run lifecycle both flows share: one run at a time, every transition
+ * published, and a `reset()` that is safe to call in the middle of one.
+ *
+ * `DepositFlow` and `WithdrawFlow` each carried their own copy of this — the
+ * re-entrancy guard, the `try/finally` around the run, `state`, `isRunning`,
+ * `subscribe`, `reset`. Two copies of a guard is two places for a guard to be
+ * wrong, on the money path, which is the same reason the pipelines themselves
+ * moved out of the applications.
+ *
+ * ## The guard and the run token are separate, and both matter
+ *
+ * `_runToken` is the re-entrancy guard: claimed synchronously, before the
+ * first `await`, so a double tap cannot launch two pipelines. The store's
+ * `generation` is the abandonment mechanism: an in-flight run holds the value
+ * it claimed, and every `patch` and `isCurrent` checkpoint it makes after
+ * `reset()` is dropped.
+ *
+ * `reset()` releases the guard IMMEDIATELY rather than waiting for the
+ * abandoned run to notice. It has to: a run parked on a wallet prompt that
+ * never answers is a promise that may never settle, and a consumer that has
+ * left that screen must be able to start a new run in the same tick. The
+ * abandoned run's `finally` therefore releases the guard only if it still
+ * holds it — by then a NEW run may own it, and clearing it there would let a
+ * third run start alongside the second.
+ */
+export declare abstract class Flow<S, I> {
+    protected readonly _store: FlowStore<S>;
+    /**
+     * The token of the run currently holding the guard, or `null` when none
+     * does. Not a boolean: releasing the guard has to be attributable to the
+     * run that claimed it.
+     */
+    private _runToken;
+    protected constructor(initial: S);
+    /** The current state. Every transition is also published to `subscribe`. */
+    get state(): S;
+    /** True while a run is in flight, including while parked. */
+    get isRunning(): boolean;
+    /**
+     * Observe every transition. Returns the unsubscribe function.
+     *
+     * The listener is not called on subscribe; read `state` for the value it
+     * starts from.
+     */
+    subscribe(listener: (state: S) => void): () => void;
+    /**
+     * Run the pipeline. Resolves when it reaches a terminal phase — it does
+     * not reject, because every outcome a consumer can act on is in `state`.
+     *
+     * A second call while one is in flight is a no-op: one submission per
+     * intent, however many times the button is pressed.
+     */
+    start(input: I): Promise<void>;
+    /**
+     * Back to `idle`, abandoning any run in flight: its remaining transitions
+     * are dropped, whatever it is parked on is unparked, and the guard is
+     * released at once so `start()` is accepted in the SAME tick. Subscribers
+     * are kept — the consumer watching the last run is the one watching the
+     * next.
+     */
+    reset(): void;
+    /**
+     * Hook for a flow that parks: unpark it. Called by `reset()` after the
+     * generation has been bumped, so anything the abandoned run does with the
+     * result is dropped.
+     */
+    protected _onAbandon(): void;
+    /** The pipeline itself. `token` is this run's; check it after every await. */
+    protected abstract _run(input: I, token: number): Promise<void>;
+}

package/dist/flows/flow.js

@@ -0,0 +1,110 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { FlowStore } from './observable';
+/**
+ * The run lifecycle both flows share: one run at a time, every transition
+ * published, and a `reset()` that is safe to call in the middle of one.
+ *
+ * `DepositFlow` and `WithdrawFlow` each carried their own copy of this — the
+ * re-entrancy guard, the `try/finally` around the run, `state`, `isRunning`,
+ * `subscribe`, `reset`. Two copies of a guard is two places for a guard to be
+ * wrong, on the money path, which is the same reason the pipelines themselves
+ * moved out of the applications.
+ *
+ * ## The guard and the run token are separate, and both matter
+ *
+ * `_runToken` is the re-entrancy guard: claimed synchronously, before the
+ * first `await`, so a double tap cannot launch two pipelines. The store's
+ * `generation` is the abandonment mechanism: an in-flight run holds the value
+ * it claimed, and every `patch` and `isCurrent` checkpoint it makes after
+ * `reset()` is dropped.
+ *
+ * `reset()` releases the guard IMMEDIATELY rather than waiting for the
+ * abandoned run to notice. It has to: a run parked on a wallet prompt that
+ * never answers is a promise that may never settle, and a consumer that has
+ * left that screen must be able to start a new run in the same tick. The
+ * abandoned run's `finally` therefore releases the guard only if it still
+ * holds it — by then a NEW run may own it, and clearing it there would let a
+ * third run start alongside the second.
+ */
+export class Flow {
+    constructor(initial) {
+        /**
+         * The token of the run currently holding the guard, or `null` when none
+         * does. Not a boolean: releasing the guard has to be attributable to the
+         * run that claimed it.
+         */
+        this._runToken = null;
+        this._store = new FlowStore(initial);
+    }
+    /** The current state. Every transition is also published to `subscribe`. */
+    get state() {
+        return this._store.state;
+    }
+    /** True while a run is in flight, including while parked. */
+    get isRunning() {
+        return this._runToken !== null;
+    }
+    /**
+     * Observe every transition. Returns the unsubscribe function.
+     *
+     * The listener is not called on subscribe; read `state` for the value it
+     * starts from.
+     */
+    subscribe(listener) {
+        return this._store.subscribe(listener);
+    }
+    /**
+     * Run the pipeline. Resolves when it reaches a terminal phase — it does
+     * not reject, because every outcome a consumer can act on is in `state`.
+     *
+     * A second call while one is in flight is a no-op: one submission per
+     * intent, however many times the button is pressed.
+     */
+    start(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this._runToken !== null)
+                return;
+            this._store.reset();
+            const token = this._store.beginRun();
+            this._runToken = token;
+            try {
+                yield this._run(input, token);
+            }
+            finally {
+                if (this._runToken === token)
+                    this._runToken = null;
+            }
+        });
+    }
+    /**
+     * Back to `idle`, abandoning any run in flight: its remaining transitions
+     * are dropped, whatever it is parked on is unparked, and the guard is
+     * released at once so `start()` is accepted in the SAME tick. Subscribers
+     * are kept — the consumer watching the last run is the one watching the
+     * next.
+     */
+    reset() {
+        this._runToken = null;
+        // Bump the generation BEFORE unparking, so the abandoned run's next
+        // checkpoint already reads as superseded.
+        this._store.reset();
+        this._onAbandon();
+    }
+    /**
+     * Hook for a flow that parks: unpark it. Called by `reset()` after the
+     * generation has been bumped, so anything the abandoned run does with the
+     * result is dropped.
+     */
+    _onAbandon() {
+        // A flow with nothing parked has nothing to unpark.
+    }
+}
+//# sourceMappingURL=flow.js.map

package/dist/flows/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/flows/flow.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAgB,IAAI;IAUtB,YAAsB,OAAU;QAPhC;;;;WAIG;QACK,cAAS,GAAkB,IAAI,CAAC;QAGpC,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAI,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,4EAA4E;IAC5E,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,QAA4B;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACG,KAAK,CAAC,KAAQ;;YAChB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;oBAAS,CAAC;gBACP,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK;oBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxD,CAAC;QACL,CAAC;KAAA;IAED;;;;;;OAMG;IACH,KAAK;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,oEAAoE;QACpE,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,UAAU,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACO,UAAU;QAChB,oDAAoD;IACxD,CAAC;CAIJ"}

package/dist/flows/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Flows: the headless money-path state machines.
+ *
+ * `domain/` holds rules that are pure functions. These are the same idea one
+ * level up — a rule that unfolds over time, with side effects the consumer
+ * injects as ports. They own the ORDER of a deposit and a withdrawal, the
+ * guards around them, and the codes that describe where a run got to. They own
+ * no UI, no framework, no network and no words.
+ *
+ * Every application drove its own copy of the deposit pipeline before this, and
+ * the copies had already started to differ.
+ */
+export { Flow } from './flow';
+export { FlowStore } from './observable';
+export type { WaitableTransaction } from './observable';
+export { CONTRACT_TTL_MS, DepositFlow, INVALID_ACCEPTANCE_SIGNATURE_MESSAGE, INVALID_AUTH_SIGNATURE_MESSAGE, NO_SPENDER_MESSAGE, } from './deposit-flow';
+export type { ContractMessageRequest, DepositFailure, DepositFlowInput, DepositFlowOptions, DepositPhase, DepositPorts, DepositState, DepositStep, GenerateContractRequest, KycSignature, LegacyContractRequest, LoanAgreementRequest, } from './deposit-flow';
+export { NO_KYC_PARAMS_MESSAGE, WithdrawFlow } from './withdraw-flow';
+export type { WithdrawFailure, WithdrawFlowInput, WithdrawPhase, WithdrawPorts, WithdrawState, WithdrawStep, } from './withdraw-flow';