@miradexio/client 0.1.0

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,wFAAwF;AACxF,cAAc,yBAAyB,CAAC;AACxC,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC"}

package/dist/types/keys.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Keys generated by keygen-wasm for atomic swap. Lowercase matches the WASM
+ * module's output convention.
+ */
+export interface ClientKeys {
+    readonly s_b_bitcoin: string;
+    readonly s_b_monero: string;
+    readonly s_b: string;
+    readonly dleq_proof: string;
+    readonly v_b: string;
+    readonly b: string;
+    readonly B: string;
+}
+/**
+ * Server API expects uppercase S_b_* keys. This maps from WASM output to API
+ * format. Only the public key B is sent; the private key b never leaves the
+ * client.
+ */
+export interface ClientKeysApi {
+    readonly S_b_bitcoin: string;
+    readonly S_b_monero: string;
+    readonly dleq_proof: string;
+    readonly v_b: string;
+    readonly B: string;
+    /**
+     * 32-byte hex master seed for the per-swap libp2p identity. Forwarded by
+     * the server to the sidecar so a recovery binary (eigenwallet swap CLI)
+     * can re-derive the same peer-id from the keystore. Optional — older
+     * keystores or callers that don't care about cross-binary recovery omit it.
+     */
+    readonly libp2p_seed_hex?: string;
+}
+//# sourceMappingURL=keys.d.ts.map

package/dist/types/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/types/keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC"}

package/dist/types/keys.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=keys.js.map

package/dist/types/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/types/keys.ts"],"names":[],"mappings":""}

package/dist/types/protocol.d.ts

@@ -0,0 +1,93 @@
+import type { ErrorCode } from './errors.js';
+/** Alice's protocol parameters returned after negotiation (Messages 0-1). */
+export interface ProtocolParams {
+    readonly A: string;
+    readonly S_a_bitcoin: string;
+    readonly cancel_timelock: number;
+    readonly punish_timelock: number;
+    readonly redeem_address: string;
+    readonly punish_address: string;
+    readonly tx_cancel_fee_sats: number;
+    readonly tx_refund_fee_sats: number;
+    readonly tx_redeem_fee_sats: number;
+    readonly tx_punish_fee_sats: number;
+    readonly amnesty_amount_sats?: number | null;
+    readonly remaining_refund_timelock?: number | null;
+    readonly tx_partial_refund_fee_sats?: number | null;
+    readonly tx_reclaim_fee_sats?: number | null;
+    readonly tx_withhold_fee_sats?: number | null;
+    readonly tx_mercy_fee_sats?: number | null;
+    readonly S_a_monero?: string | null;
+    readonly dleq_proof_s_a?: string | null;
+    readonly v_a?: string | null;
+    readonly monero_lock_address?: string | null;
+    readonly xmr_amount_pico?: string | null;
+    /**
+     * Alice's adaptor-encrypted signature on the TxFullRefund BIP143 digest
+     * (bincode-serialised EncryptedSignature, hex). Present once Alice has
+     * sent her Message3 in the setup protocol. Consumed by client-side refund.
+     * `null` when the variant is `Partial` (amnesty-only) — that swap has no
+     * full-refund path; the escape hatch is `tx_partial_refund_encsig` instead.
+     */
+    readonly tx_full_refund_encsig?: string | null;
+    /**
+     * Alice's adaptor-encrypted signature on the TxPartialRefund (amnesty
+     * variant) digest. Present only when the swap uses the amnesty path.
+     * `null` when the variant is `Legacy` (full-only).
+     */
+    readonly tx_partial_refund_encsig?: string | null;
+    /**
+     * Alice's plain ECDSA pre-sig on TxCancel (delivered in Message3, mirrors
+     * the Rust core's `tx_cancel_sig_a`). Persisted in the recovery snapshot
+     * before /fund. Currently informational only; the sidecar still publishes
+     * TxCancel. V-16 enabling-work toward an autonomous client-side cancel
+     * path that does not depend on the sidecar's cooperation.
+     */
+    readonly tx_cancel_sig?: string | null;
+    /**
+     * Unsigned lock PSBT (base64). Client signs once, returns via /fund action.
+     * Populated by the sidecar at prepare time; absent until then.
+     */
+    readonly unsigned_lock_psbt?: string | null;
+    /**
+     * Monero lock verification data — populated once the scanner observes
+     * Alice's XMR lock transaction. Absent until then.
+     */
+    readonly monero_tx_hash?: string | null;
+    readonly monero_tx_key?: string | null;
+    readonly monero_restore_height?: number | null;
+    /**
+     * Combined view key v_a + v_b. Server-computed convenience (client could
+     * derive via curve arithmetic). Absent until XMR lock is observed.
+     */
+    readonly combined_view_key?: string | null;
+    /**
+     * BIP143 sighash for TxRedeem as the sidecar computes it. The driver
+     * recomputes the digest locally from the signed PSBT (or from the on-chain
+     * TxLock on the resume path) and compares byte-for-byte before releasing the
+     * encrypted signature. Absent until the sidecar surfaces it.
+     */
+    readonly tx_redeem_digest?: string | null;
+    /**
+     * Maker (Alice) libp2p peer-id and multiaddrs. Persisted into the recovery
+     * snapshot so eigenwallet (or another runtime) can re-dial the maker after
+     * a crash without going through rendezvous discovery again.
+     */
+    readonly maker_peer_id?: string | null;
+    readonly maker_multiaddrs?: ReadonlyArray<string> | null;
+}
+/**
+ * Thrown when the protocol-level state is inconsistent (missing required field,
+ * terminal state reached unexpectedly, driver timeout). Distinct from
+ * `VerificationError` which is thrown when a cryptographic check fails.
+ *
+ * Carries `category: 'protocol'` so {@link withRetry} fails immediately
+ * instead of retrying — protocol errors are not transient.
+ */
+import { MiradexError } from '../lib/errors.js';
+export declare class ProtocolError extends MiradexError {
+    readonly name = "ProtocolError";
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string);
+}
+//# sourceMappingURL=protocol.d.ts.map

package/dist/types/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/types/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAIpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClD;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,qBAAa,aAAc,SAAQ,YAAY;IAC7C,SAAkB,IAAI,mBAAmB;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;gBACb,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;CAI7C"}

package/dist/types/protocol.js

@@ -0,0 +1,18 @@
+/**
+ * Thrown when the protocol-level state is inconsistent (missing required field,
+ * terminal state reached unexpectedly, driver timeout). Distinct from
+ * `VerificationError` which is thrown when a cryptographic check fails.
+ *
+ * Carries `category: 'protocol'` so {@link withRetry} fails immediately
+ * instead of retrying — protocol errors are not transient.
+ */
+import { MiradexError } from '../lib/errors.js';
+export class ProtocolError extends MiradexError {
+    name = 'ProtocolError';
+    code;
+    constructor(code, message) {
+        super(message, 'protocol');
+        this.code = code;
+    }
+}
+//# sourceMappingURL=protocol.js.map

package/dist/types/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/types/protocol.ts"],"names":[],"mappings":"AAmFA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC3B,IAAI,GAAG,eAAe,CAAC;IAChC,IAAI,CAAY;IACzB,YAAY,IAAe,EAAE,OAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/types/status.d.ts

@@ -0,0 +1,3 @@
+export type TerminalStatus = 'completed' | 'failed' | 'refunded' | 'withheld' | 'expired';
+export declare const TERMINAL_STATUSES: ReadonlySet<string>;
+//# sourceMappingURL=status.d.ts.map

package/dist/types/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/types/status.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,CAAC;AAYd,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAMhD,CAAC"}

package/dist/types/status.js

@@ -0,0 +1,23 @@
+// Terminal-status set and the narrow literal type used by client-side
+// reducers for terminal checks. SwapStatus itself now lives in
+// src/wire/server/swap.zod.ts as a zod-inferred type; consumers that
+// need SwapStatus / SwapProvider / RequiredAction / RequiredActionType /
+// ActionUrgency import them through the package barrel.
+// Accept any string because SwapStatus now includes a forward-compat
+// `unknown:${string}` tail; .has() just returns false for unknown values.
+//
+// `punished` is intentionally NOT terminal: in atomicswap, when Alice
+// publishes TxPunish (Bob lost the refund window) the sidecar autonomously
+// runs the cooperative_xmr_redeem_after_punish libp2p protocol with Alice
+// to recover s_a, then surfaces it via `cooperative_redemption_data` and
+// flips the required action to `sweep`. The driver finishes the swap with
+// an XMR sweep that lands the row in `completed`. Treating `punished` as
+// terminal would make the driver bail mid-recovery.
+export const TERMINAL_STATUSES = new Set([
+    'completed',
+    'failed',
+    'refunded',
+    'withheld',
+    'expired',
+]);
+//# sourceMappingURL=status.js.map

package/dist/types/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/types/status.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,+DAA+D;AAC/D,qEAAqE;AACrE,yEAAyE;AACzE,wDAAwD;AASxD,qEAAqE;AACrE,0EAA0E;AAC1E,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAS;IACpE,WAAW;IACX,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;CACV,CAAC,CAAC"}

package/dist/types/verification.d.ts

@@ -0,0 +1,49 @@
+import type { ErrorCode } from './errors.js';
+export interface VerificationCheck {
+    readonly name: string;
+    readonly passed: boolean;
+    readonly detail: string;
+}
+export interface VerificationResult {
+    readonly verified: boolean;
+    readonly provider: string;
+    readonly checks: readonly VerificationCheck[];
+    readonly timestamp: number;
+}
+/**
+ * Thrown when an independent cryptographic or protocol-safety check fails.
+ * Always carries a stable `code` from `ERROR_CODES`.
+ *
+ * Carries `category: 'verification'` so {@link withRetry} fails immediately
+ * — a failed independent invariant cannot be fixed by retrying the same call.
+ *
+ * @security Every loud failure of an independent invariant in the client
+ * surfaces as this error; callers switch on `code` for UX.
+ */
+import { MiradexError } from '../lib/errors.js';
+export declare class VerificationError extends MiradexError {
+    readonly name = "VerificationError";
+    readonly code: ErrorCode;
+    constructor(code: ErrorCode, message: string);
+}
+export type SafeBigInt = bigint & {
+    readonly __safeBigInt: unique symbol;
+};
+export interface BlockHeightSource {
+    readonly getTipHeight: () => Promise<number>;
+}
+export interface FeePolicy {
+    readonly minRelaySatsPerVbyte: bigint;
+    readonly maxSatsPerVbyte: bigint;
+}
+export interface AmnestyPolicy {
+    readonly maxRatioBps: number;
+}
+export interface DustPolicy {
+    readonly p2wpkhDustSats: bigint;
+    readonly p2wshDustSats: bigint;
+}
+export declare const DEFAULT_FEE_POLICY: FeePolicy;
+export declare const DEFAULT_AMNESTY_POLICY: AmnestyPolicy;
+export declare const DEFAULT_DUST_POLICY: DustPolicy;
+//# sourceMappingURL=verification.d.ts.map

package/dist/types/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/types/verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,qBAAa,iBAAkB,SAAQ,YAAY;IACjD,SAAkB,IAAI,uBAAuB;IAC7C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;gBACb,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;CAI7C;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,eAAO,MAAM,kBAAkB,EAAE,SAGvB,CAAC;AAOX,eAAO,MAAM,sBAAsB,EAAE,aAA+C,CAAC;AAErF,eAAO,MAAM,mBAAmB,EAAE,UAGxB,CAAC"}

package/dist/types/verification.js

@@ -0,0 +1,34 @@
+/**
+ * Thrown when an independent cryptographic or protocol-safety check fails.
+ * Always carries a stable `code` from `ERROR_CODES`.
+ *
+ * Carries `category: 'verification'` so {@link withRetry} fails immediately
+ * — a failed independent invariant cannot be fixed by retrying the same call.
+ *
+ * @security Every loud failure of an independent invariant in the client
+ * surfaces as this error; callers switch on `code` for UX.
+ */
+import { MiradexError } from '../lib/errors.js';
+export class VerificationError extends MiradexError {
+    name = 'VerificationError';
+    code;
+    constructor(code, message) {
+        super(message, 'verification');
+        this.code = code;
+    }
+}
+export const DEFAULT_FEE_POLICY = {
+    minRelaySatsPerVbyte: 1n,
+    maxSatsPerVbyte: 500n,
+};
+// Mirrors the Rust upstream's MAX_ANTI_SPAM_DEPOSIT_RATIO = 0.2 (20%) at
+// xmr-atomic-swap/core/swap-env/src/config.rs:226. The Rust ASB allows
+// makers to configure anti_spam_deposit_ratio anywhere in [0, 0.2]; if the
+// SDK cap were tighter (e.g. 0.1) we'd reject swaps from any maker
+// running at the Rust-permitted maximum. 2_000 bps == 20%.
+export const DEFAULT_AMNESTY_POLICY = { maxRatioBps: 2_000 };
+export const DEFAULT_DUST_POLICY = {
+    p2wpkhDustSats: 294n,
+    p2wshDustSats: 330n,
+};
+//# sourceMappingURL=verification.js.map

package/dist/types/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/types/verification.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IAC/B,IAAI,GAAG,mBAAmB,CAAC;IACpC,IAAI,CAAY;IACzB,YAAY,IAAe,EAAE,OAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAsBD,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,oBAAoB,EAAE,EAAE;IACxB,eAAe,EAAE,IAAI;CACb,CAAC;AAEX,yEAAyE;AACzE,uEAAuE;AACvE,2EAA2E;AAC3E,mEAAmE;AACnE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAkB,EAAE,WAAW,EAAE,KAAK,EAAW,CAAC;AAErF,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;CACX,CAAC"}

package/dist/verification/atomic-swap.d.ts

@@ -0,0 +1,9 @@
+import type { AtomicSwapVerification, VerificationResult } from '../types/index.js';
+import { type ProtocolContext, type VerifyParams } from './shared.js';
+/**
+ * Verify an atomic-swap deposit address — script type, refund address
+ * binding, timelock range, and (if supplied) sidecar-claimed lock address
+ * consistency.
+ */
+export declare function verifyAtomicSwap(v: AtomicSwapVerification, params: VerifyParams, protocol?: ProtocolContext): VerificationResult;
+//# sourceMappingURL=atomic-swap.d.ts.map

package/dist/verification/atomic-swap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-swap.d.ts","sourceRoot":"","sources":["../../src/verification/atomic-swap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EAEtB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAmB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,sBAAsB,EACzB,MAAM,EAAE,YAAY,EACpB,QAAQ,CAAC,EAAE,eAAe,GACzB,kBAAkB,CA6BpB"}

package/dist/verification/atomic-swap.js

@@ -0,0 +1,22 @@
+import { ATOMICSWAP_TIMELOCK_MAX_BLOCKS, ATOMICSWAP_TIMELOCK_MIN_BLOCKS, } from './constants.js';
+import { check, resultOf } from './shared.js';
+/**
+ * Verify an atomic-swap deposit address — script type, refund address
+ * binding, timelock range, and (if supplied) sidecar-claimed lock address
+ * consistency.
+ */
+export function verifyAtomicSwap(v, params, protocol) {
+    const checks = [];
+    checks.push(check('P2WSH deposit type', v.deposit_type === 'P2WSH', `Type: ${v.deposit_type}`));
+    const refundOk = v.refund_address === params.refundAddress;
+    checks.push(check('Refund address in script', refundOk, refundOk ? 'Refund address matches' : 'Refund address mismatch'));
+    const timelockOk = v.timelock_blocks >= ATOMICSWAP_TIMELOCK_MIN_BLOCKS &&
+        v.timelock_blocks <= ATOMICSWAP_TIMELOCK_MAX_BLOCKS;
+    checks.push(check('Timelock range', timelockOk, `${v.timelock_blocks} blocks (~${v.timelock_hours}h)`));
+    if (protocol?.lock_address) {
+        const lockOk = v.lock_address === protocol.lock_address;
+        checks.push(check('Lock address match', lockOk, lockOk ? 'Consistent' : 'Mismatch'));
+    }
+    return resultOf('atomicswap', checks);
+}
+//# sourceMappingURL=atomic-swap.js.map

package/dist/verification/atomic-swap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-swap.js","sourceRoot":"","sources":["../../src/verification/atomic-swap.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAA2C,MAAM,aAAa,CAAC;AAEvF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,CAAyB,EACzB,MAAoB,EACpB,QAA0B;IAE1B,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE,SAAS,CAAC,CAAC,YAAY,EAAE,CAAC,CACnF,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa,CAAC;IAC3D,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0BAA0B,EAC1B,QAAQ,EACR,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAChE,CACF,CAAC;IAEF,MAAM,UAAU,GACd,CAAC,CAAC,eAAe,IAAI,8BAA8B;QACnD,CAAC,CAAC,eAAe,IAAI,8BAA8B,CAAC;IACtD,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,gBAAgB,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,eAAe,aAAa,CAAC,CAAC,cAAc,IAAI,CAAC,CAC3F,CAAC;IAEF,IAAI,QAAQ,EAAE,YAAY,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/verification/chainflip-networks.d.ts

@@ -0,0 +1,46 @@
+/**
+ * SDK-owned Chainflip verification endpoints. Hardcoded per network so the
+ * SDK never trusts a server-supplied `verification.status_url`. The verifier
+ * URL is a property of the SDK build, not of any swap response.
+ *
+ * Two distinct verification modes per network:
+ *
+ *   - `'rest'`   — single GET to Chainflip's hosted broker REST at
+ *                  `${statusUrl}/<channelId>`. Used for mainnet and
+ *                  testnet (testnet flag governs atomicswap only;
+ *                  every other provider, including chainflip, runs on
+ *                  the same mainnet infrastructure).
+ *   - `'jsonrpc'` — POST `cf_deposit_channel_info` to the localnet
+ *                  private chainflip-broker. Used for regtest, where
+ *                  the system-tests stack runs its own chainflip-node
+ *                  exposing the legacy state-chain RPC method that the
+ *                  hosted public broker does not.
+ *
+ * Single-source on REST: the only browser-reachable mainnet state-chain
+ * RPC node we found (`mainnet-archive.chainflip.io`) does not expose a
+ * single-channel lookup method — only "all open channels", which is
+ * impractically large to fetch + filter on every swap. The hosted
+ * broker is Chainflip's own infrastructure and shares the same trust
+ * assumption a Chainflip-hosted UI makes; non-custodial guarantees are
+ * unaffected because the broker cannot move user funds.
+ *
+ * Returns `undefined` for any network without a configured verifier — the
+ * SDK fails closed in that case (no fallback to server-supplied URLs).
+ */
+export type ChainflipNetwork = 'mainnet' | 'testnet' | 'regtest';
+export type ChainflipVerificationEndpoints = {
+    /** Hosted broker REST. SDK appends `/<channelId>` to `statusUrl`. */
+    readonly mode: 'rest';
+    readonly statusUrl: string;
+} | {
+    /**
+     * Localnet private chainflip-broker that exposes the legacy
+     * `cf_deposit_channel_info` state-chain RPC. POST a JSON-RPC body
+     * to `rpcUrl`.
+     */
+    readonly mode: 'jsonrpc';
+    readonly rpcUrl: string;
+};
+export declare const CHAINFLIP_VERIFICATION_NETWORKS: Readonly<Partial<Record<ChainflipNetwork, ChainflipVerificationEndpoints>>>;
+export declare function chainflipEndpointsForNetwork(network: ChainflipNetwork): ChainflipVerificationEndpoints | undefined;
+//# sourceMappingURL=chainflip-networks.d.ts.map

package/dist/verification/chainflip-networks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chainflip-networks.d.ts","sourceRoot":"","sources":["../../src/verification/chainflip-networks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjE,MAAM,MAAM,8BAA8B,GACtC;IACE,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IACE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAUN,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC,CAclE,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,gBAAgB,GACxB,8BAA8B,GAAG,SAAS,CAE5C"}

package/dist/verification/chainflip-networks.js

@@ -0,0 +1,24 @@
+const DEFAULT_REGTEST_VERIFIER_URL = 'http://127.0.0.1:9099';
+// Chainflip's mainnet hosted broker REST. The `/v2/swaps/<channelId>` path
+// is the documented public lookup. Mirror in any tooling that calls the
+// same endpoint (`apps/crypto-server/src/swap/services/swap.constants.ts:28`
+// holds the bare host as `CHAINFLIP_BACKEND_URL`).
+const CHAINFLIP_MAINNET_STATUS = 'https://chainflip-swap.chainflip.io/v2/swaps';
+export const CHAINFLIP_VERIFICATION_NETWORKS = {
+    mainnet: {
+        mode: 'rest',
+        statusUrl: CHAINFLIP_MAINNET_STATUS,
+    },
+    testnet: {
+        mode: 'rest',
+        statusUrl: CHAINFLIP_MAINNET_STATUS,
+    },
+    regtest: {
+        mode: 'jsonrpc',
+        rpcUrl: DEFAULT_REGTEST_VERIFIER_URL,
+    },
+};
+export function chainflipEndpointsForNetwork(network) {
+    return CHAINFLIP_VERIFICATION_NETWORKS[network];
+}
+//# sourceMappingURL=chainflip-networks.js.map

package/dist/verification/chainflip-networks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chainflip-networks.js","sourceRoot":"","sources":["../../src/verification/chainflip-networks.ts"],"names":[],"mappings":"AA+CA,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAE7D,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;AAEhF,MAAM,CAAC,MAAM,+BAA+B,GAExC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,wBAAwB;KACpC;IACD,OAAO,EAAE;QACP,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,wBAAwB;KACpC;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,4BAA4B;KACrC;CACF,CAAC;AAEF,MAAM,UAAU,4BAA4B,CAC1C,OAAyB;IAEzB,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC"}

package/dist/verification/chainflip.d.ts

@@ -0,0 +1,61 @@
+import type { ChainflipVerification, VerificationResult } from '../types/index.js';
+import { type VerifyParams } from './shared.js';
+import { type ChainflipNetwork, type ChainflipVerificationEndpoints } from './chainflip-networks.js';
+/**
+ * Verify a Chainflip deposit address by reading the SDK-owned broker REST
+ * endpoint and confirming the channel binding matches the user's expected
+ * destination. The verifier URL comes from the SDK's hardcoded per-network
+ * registry (`chainflip-networks.ts`) — `v.status_url` from the server is
+ * intentionally ignored.
+ *
+ * Single-source design rationale: the only browser-reachable mainnet
+ * state-chain RPC node (`mainnet-archive.chainflip.io`) does not expose a
+ * single-channel lookup method, so a true two-source cross-check isn't
+ * feasible without proxying or fetching the entire open-channel set.
+ * Trust posture: the broker is Chainflip's own infrastructure (same
+ * trust assumption a Chainflip-hosted UI makes); a misreport cannot move
+ * funds because the user's wallet still holds them.
+ *
+ * Fails closed when the network has no configured verifier endpoint.
+ */
+export declare function verifyChainflip(depositAddress: string, v: ChainflipVerification, params: VerifyParams, fetchFn: typeof globalThis.fetch, network: ChainflipNetwork, signal?: AbortSignal): Promise<VerificationResult>;
+export interface VerifyChainflipChannelInput {
+    readonly channelId: string;
+    /**
+     * Per-network endpoint config. Discriminated on `mode`:
+     *   - `'rest'`: GET `${statusUrl}/<channelId>` against the hosted
+     *     broker (mainnet/testnet).
+     *   - `'jsonrpc'`: POST `cf_deposit_channel_info` against a localnet
+     *     private chainflip-broker (regtest only).
+     */
+    readonly endpoints: ChainflipVerificationEndpoints;
+    readonly expected: {
+        readonly destAddress: string;
+        readonly refundAddress?: string;
+        readonly srcChain: string;
+        readonly destChain: string;
+        readonly destAsset: string;
+    };
+    readonly depositAmountSats?: string;
+    readonly fetchFn: typeof globalThis.fetch;
+    readonly timeoutMs?: number;
+    /**
+     * Optional external abort signal. When this fires the retry loop bails
+     * immediately instead of running through its full
+     * CHAINFLIP_REST_RETRY_TOTAL_MS budget.
+     */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Read a Chainflip deposit channel from the appropriate verifier and
+ * confirm it binds to the caller's expected destination/refund address.
+ *
+ * @throws {VerificationError} `E_CHAINFLIP_CHANNEL_MISBINDING` when the
+ *   broker disagrees with the caller's expected destination/refund.
+ * @throws {VerificationError} `E_CHAINFLIP_CHANNEL_EXPIRING` when the
+ *   channel expires within the safety margin.
+ * @throws {VerificationError} `E_CHAINFLIP_AMOUNT_BELOW_MIN` /
+ *   `E_CHAINFLIP_AMOUNT_ABOVE_MAX` when `depositAmountSats` is out of band.
+ */
+export declare function verifyChainflipChannel(input: VerifyChainflipChannelInput): Promise<void>;
+//# sourceMappingURL=chainflip.d.ts.map

package/dist/verification/chainflip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chainflip.d.ts","sourceRoot":"","sources":["../../src/verification/chainflip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAqB,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACtG,OAAO,EAAmC,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAWjF,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,8BAA8B,EACpC,MAAM,yBAAyB,CAAC;AAIjC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,cAAc,EAAE,MAAM,EACtB,CAAC,EAAE,qBAAqB,EACxB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,UAAU,CAAC,KAAK,EAChC,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAkD7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,8BAA8B,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,IAAI,CAAC,CAyBf"}