@miradexio/client 0.1.0

package/dist/verification/chainflip.js

@@ -0,0 +1,377 @@
+import { check, errMsg, failOf, resultOf } from './shared.js';
+import { CHAINFLIP_REST_RETRY_BACKOFF_MS, CHAINFLIP_REST_RETRY_TOTAL_MS, VERIFY_FETCH_TIMEOUT_MS, } from './constants.js';
+import { VerificationError } from '../types/index.js';
+import { ChainflipDepositChannelSchema, } from '../wire/chainflip.zod.js';
+import { chainflipEndpointsForNetwork, } from './chainflip-networks.js';
+const CHANNEL_SAFETY_MARGIN_MS = 90 * 60 * 1000;
+/**
+ * Verify a Chainflip deposit address by reading the SDK-owned broker REST
+ * endpoint and confirming the channel binding matches the user's expected
+ * destination. The verifier URL comes from the SDK's hardcoded per-network
+ * registry (`chainflip-networks.ts`) — `v.status_url` from the server is
+ * intentionally ignored.
+ *
+ * Single-source design rationale: the only browser-reachable mainnet
+ * state-chain RPC node (`mainnet-archive.chainflip.io`) does not expose a
+ * single-channel lookup method, so a true two-source cross-check isn't
+ * feasible without proxying or fetching the entire open-channel set.
+ * Trust posture: the broker is Chainflip's own infrastructure (same
+ * trust assumption a Chainflip-hosted UI makes); a misreport cannot move
+ * funds because the user's wallet still holds them.
+ *
+ * Fails closed when the network has no configured verifier endpoint.
+ */
+export async function verifyChainflip(depositAddress, v, params, fetchFn, network, signal) {
+    const endpoints = chainflipEndpointsForNetwork(network);
+    if (!endpoints) {
+        return failOf('chainflip', [
+            check('Chainflip verifier configured', false, `No verification endpoints registered for network "${network}"`),
+        ]);
+    }
+    if (params.fromChain === undefined || params.toChain === undefined) {
+        return failOf('chainflip', [
+            check('Chainflip verification inputs', false, 'fromChain/toChain required for chainflip channel check'),
+        ]);
+    }
+    const checks = [];
+    try {
+        await verifyChainflipChannel({
+            channelId: v.channel_id,
+            endpoints,
+            expected: {
+                destAddress: params.destAddress,
+                refundAddress: params.refundAddress.length > 0 ? params.refundAddress : undefined,
+                srcChain: params.fromChain,
+                destChain: params.toChain,
+                destAsset: params.toToken,
+            },
+            fetchFn,
+            signal,
+        });
+        checks.push(check('Chainflip channel verified', true, 'Broker binding matches expected'));
+        const channelDepositOk = depositAddress.length > 0;
+        checks.push(check('Deposit address present', channelDepositOk, channelDepositOk ? `${depositAddress.slice(0, 12)}...` : 'Missing'));
+    }
+    catch (err) {
+        checks.push(check('Chainflip channel verified', false, errMsg(err)));
+    }
+    return resultOf('chainflip', checks);
+}
+/**
+ * Read a Chainflip deposit channel from the appropriate verifier and
+ * confirm it binds to the caller's expected destination/refund address.
+ *
+ * @throws {VerificationError} `E_CHAINFLIP_CHANNEL_MISBINDING` when the
+ *   broker disagrees with the caller's expected destination/refund.
+ * @throws {VerificationError} `E_CHAINFLIP_CHANNEL_EXPIRING` when the
+ *   channel expires within the safety margin.
+ * @throws {VerificationError} `E_CHAINFLIP_AMOUNT_BELOW_MIN` /
+ *   `E_CHAINFLIP_AMOUNT_ABOVE_MAX` when `depositAmountSats` is out of band.
+ */
+export async function verifyChainflipChannel(input) {
+    const timeoutMs = input.timeoutMs ?? VERIFY_FETCH_TIMEOUT_MS;
+    const channel = input.endpoints.mode === 'rest'
+        ? await fetchBrokerChannelRest(input.endpoints.statusUrl, input.channelId, input.fetchFn, timeoutMs, input.signal)
+        : await fetchBrokerChannelJsonRpc(input.endpoints.rpcUrl, input.channelId, input.fetchFn, timeoutMs, input.signal);
+    requireBindsExpected(channel, input.expected);
+    if (input.depositAmountSats !== undefined) {
+        requireAmountInBand(channel, input.depositAmountSats);
+    }
+    if (channel.expiryTime) {
+        requireExpiryMargin(channel.expiryTime);
+    }
+}
+/**
+ * Coerce a Chainflip broker REST response into a `ChainflipDepositChannel`.
+ *
+ * The v2 hosted-broker endpoint (`/v2/swaps/<id>`) returns the swap status
+ * with a nested `depositChannel` carrying just the addressing primitives —
+ * the binding fields the verifier checks (`srcChain`, `destChain`,
+ * `destAsset`, `destAddress`, `refundAddress`) live at the wrapper top
+ * level. Localnet / older brokers still emit the flat shape with
+ * everything on the channel itself. Both are accepted: parser tries flat
+ * first, then merges nested-channel + wrapper, with the wrapper taking
+ * priority for any field the channel omits.
+ *
+ * Tolerates unknown / extra fields and unknown `state` values — Chainflip's
+ * v2 surface evolves faster than any enum we'd hardcode.
+ */
+function parseBrokerResponse(raw) {
+    const flat = ChainflipDepositChannelSchema.safeParse(raw);
+    if (flat.success && flat.data.srcChain && flat.data.destChain) {
+        return flat.data;
+    }
+    if (typeof raw !== 'object' || raw === null) {
+        throw flat.error ?? new Error('Chainflip broker response is not an object');
+    }
+    const wrapper = raw;
+    const nestedRaw = wrapper['depositChannel'];
+    if (typeof nestedRaw !== 'object' || nestedRaw === null) {
+        throw flat.error;
+    }
+    const channel = ChainflipDepositChannelSchema.parse(nestedRaw);
+    // Hoist the binding fields the verifier checks. The wrapper's value
+    // wins when the nested channel doesn't carry it (typical for
+    // chainflip's v2 response), but we never overwrite a non-null channel
+    // value with the wrapper. `refundAddress` sits inside one of several
+    // nested params objects depending on the Chainflip API revision —
+    // historically `fillOrKillParams.refundAddress` or
+    // `refundParameters.refundAddress`, sometimes at the wrapper level
+    // and sometimes under `depositChannel`. Walk every known path before
+    // declaring it missing.
+    return {
+        ...channel,
+        srcChain: channel.srcChain ?? readPath(wrapper, [['srcChain']]),
+        srcAsset: channel.srcAsset ?? readPath(wrapper, [['srcAsset']]),
+        destChain: channel.destChain ?? readPath(wrapper, [['destChain']]),
+        destAsset: channel.destAsset ?? readPath(wrapper, [['destAsset']]),
+        destAddress: channel.destAddress ?? readPath(wrapper, [['destAddress']]),
+        refundAddress: channel.refundAddress ??
+            readPath(wrapper, [
+                ['refundAddress'],
+                ['refundParameters', 'refundAddress'],
+                ['refundParameters', 'refund_address'],
+                ['fillOrKillParams', 'refundAddress'],
+                ['fillOrKillParams', 'refund_address'],
+                ['depositChannel', 'refundParameters', 'refundAddress'],
+                ['depositChannel', 'refundParameters', 'refund_address'],
+                ['depositChannel', 'fillOrKillParams', 'refundAddress'],
+                ['depositChannel', 'fillOrKillParams', 'refund_address'],
+            ]),
+    };
+}
+/**
+ * Walk a list of dotted paths against `obj`, returning the first string
+ * value found. Returns undefined if no path resolves to a string.
+ */
+function readPath(obj, paths) {
+    for (const path of paths) {
+        let cur = obj;
+        for (const key of path) {
+            if (typeof cur !== 'object' || cur === null) {
+                cur = undefined;
+                break;
+            }
+            cur = cur[key];
+        }
+        if (typeof cur === 'string' && cur.length > 0)
+            return cur;
+    }
+    return undefined;
+}
+async function fetchBrokerChannelRest(baseUrl, channelId, fetchFn, timeoutMs, externalSignal) {
+    // Path-based lookup: GET ${baseUrl}/${channelId}. Trim a trailing
+    // slash so callers may pass `https://host/v2/swaps` or
+    // `https://host/v2/swaps/` interchangeably.
+    //
+    // `cache: 'no-store'` short-circuits the browser HTTP cache. Without it,
+    // a page reload re-issues the request with `If-None-Match` /
+    // `If-Modified-Since` from a previous successful fetch, the broker
+    // returns **304 Not Modified** with an empty body, and we have nothing
+    // to parse. (`res.ok` is false for 304 — only 200-299 qualify.) We need
+    // a parseable body every time, so always force a fresh round-trip.
+    const url = `${baseUrl.replace(/\/+$/, '')}/${encodeURIComponent(channelId)}`;
+    const start = Date.now();
+    let attempt = 0;
+    let lastError = new VerificationError('E_CHAINFLIP_HTTP', 'broker request not yet attempted');
+    while (Date.now() - start < CHAINFLIP_REST_RETRY_TOTAL_MS) {
+        if (externalSignal?.aborted) {
+            throw new VerificationError('E_CHAINFLIP_HTTP', 'verification aborted by caller');
+        }
+        try {
+            // `cache` is part of the standard fetch RequestInit but absent from
+            // the Node-only types this package compiles against (lib: ES2022).
+            // Cast through the broader browser shape — the option is a no-op in
+            // Node where it isn't supported, and exactly what we need in browsers.
+            // Combine the per-fetch timeout with the caller's abort signal so
+            // either path cancels the in-flight request.
+            const init = {
+                signal: combineSignals(AbortSignal.timeout(timeoutMs), externalSignal),
+                cache: 'no-store',
+            };
+            const res = await fetchFn(url, init);
+            if (res.ok) {
+                const raw = await res.json();
+                // Chainflip's `/v2/swaps/<composite>` returns the swap **status**
+                // wrapper — a top-level object with `state` and a NESTED
+                // `depositChannel`. The legacy `/v0/deposit_channels/<id>` endpoint
+                // returned the channel flat; both shapes are still seen in the wild.
+                // Try the status shape first (the v2 path we actually call), unwrap
+                // its `depositChannel`, and fall back to the flat shape so the
+                // verifier survives both response styles without touching the rest
+                // of the pipeline.
+                return parseBrokerResponse(raw);
+            }
+            // 304 only happens if the cache directive above is somehow ignored
+            // (older browsers, service workers, intermediary proxies). Treat it
+            // as a directive to retry without conditional headers — but, since
+            // the body is empty, we cannot proceed without a fresh fetch.
+            // Falling through to the retry loop is the right move: the next
+            // attempt will be a fresh request.
+            if (res.status === 304) {
+                lastError = new VerificationError('E_CHAINFLIP_HTTP', 'broker returned 304 — cache directive bypassed, retrying');
+            }
+            else if (res.status >= 400 && res.status < 500 && res.status !== 404) {
+                // 4xx other than 404 means a real misconfiguration (bad path,
+                // malformed id) — retrying won't help; bail out immediately.
+                throw new VerificationError('E_CHAINFLIP_HTTP', `broker HTTP ${String(res.status)}`);
+            }
+            else {
+                // 404 (channel not yet ingested by REST) and 5xx (gateway / state
+                // chain RPC blip) are expected transient outcomes worth retrying.
+                lastError = new VerificationError('E_CHAINFLIP_HTTP', `broker HTTP ${String(res.status)}`);
+            }
+        }
+        catch (err) {
+            if (err instanceof VerificationError)
+                throw err;
+            // Network error, timeout, or zod parse failure — treat as transient.
+            lastError = new VerificationError('E_CHAINFLIP_HTTP', err instanceof Error ? err.message : String(err));
+        }
+        const backoffMs = CHAINFLIP_REST_RETRY_BACKOFF_MS[attempt] ??
+            CHAINFLIP_REST_RETRY_BACKOFF_MS[CHAINFLIP_REST_RETRY_BACKOFF_MS.length - 1] ??
+            30_000;
+        attempt += 1;
+        if (Date.now() - start + backoffMs >= CHAINFLIP_REST_RETRY_TOTAL_MS)
+            break;
+        await sleepAbortable(backoffMs, externalSignal);
+        if (externalSignal?.aborted) {
+            throw new VerificationError('E_CHAINFLIP_HTTP', 'verification aborted by caller');
+        }
+    }
+    throw lastError;
+}
+/**
+ * Combine a per-fetch timeout signal with an optional external abort signal.
+ * If only one is provided, return it directly so consumers without
+ * `AbortSignal.any` support (older runtimes) still work in the common case.
+ */
+function combineSignals(timeout, external) {
+    if (external === undefined)
+        return timeout;
+    // `AbortSignal.any` is in Node 20+ and all modern browsers — the same
+    // baseline `AbortSignal.timeout` already requires.
+    return AbortSignal.any([timeout, external]);
+}
+/**
+ * Like `setTimeout` as a promise, but resolves early when the optional
+ * external signal aborts. Intentionally does NOT throw on abort — the
+ * caller checks `signal.aborted` after the await and decides how to fail.
+ */
+function sleepAbortable(ms, signal) {
+    if (signal === undefined) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        };
+        if (signal.aborted) {
+            clearTimeout(timer);
+            resolve();
+            return;
+        }
+        signal.addEventListener('abort', onAbort);
+    });
+}
+/**
+ * Regtest-only path. The localnet chainflip-broker exposes the legacy
+ * `cf_deposit_channel_info` state-chain RPC method that the public
+ * mainnet hosted broker does not.
+ */
+async function fetchBrokerChannelJsonRpc(rpcUrl, channelId, fetchFn, timeoutMs, externalSignal) {
+    const body = {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'cf_deposit_channel_info',
+        params: { channel_id: channelId },
+    };
+    const res = await fetchFn(rpcUrl, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+        signal: combineSignals(AbortSignal.timeout(timeoutMs), externalSignal),
+    });
+    if (!res.ok) {
+        throw new VerificationError('E_CHAINFLIP_HTTP', `state-chain HTTP ${String(res.status)}`);
+    }
+    const raw = (await res.json());
+    return ChainflipDepositChannelSchema.parse(raw.result);
+}
+/**
+ * Canonicalise a chain identifier so the SDK can compare its caller-side
+ * value (the public crypto-server API emits the base name `ethereum`)
+ * against Chainflip's REST response (TitleCase like `Ethereum`). Just
+ * lowercases — the server is responsible for stripping its internal
+ * routing prefix, so we don't second-guess it here.
+ */
+function canonicalChain(chain) {
+    return chain ? chain.toLowerCase() : undefined;
+}
+/** Canonicalise a token symbol — Chainflip is consistent on uppercase but
+ *  callers occasionally pass mixed case. */
+function canonicalAsset(asset) {
+    return asset ? asset.toLowerCase() : undefined;
+}
+/** Ethereum-style addresses come back in unspecified case from Chainflip;
+ *  the user always sends lowercase from the wallet. Compare case-insensitively
+ *  for hex addresses; Bitcoin/Polkadot/Solana addresses are case-sensitive
+ *  and pass through unchanged. */
+function canonicalAddress(addr) {
+    if (!addr)
+        return undefined;
+    return addr.startsWith('0x') ? addr.toLowerCase() : addr;
+}
+function requireBindsExpected(channel, expected) {
+    if (canonicalAddress(channel.destAddress) !== canonicalAddress(expected.destAddress)) {
+        throw new VerificationError('E_CHAINFLIP_CHANNEL_MISBINDING', `channel destAddress ${String(channel.destAddress)} != expected ${expected.destAddress}`);
+    }
+    if (canonicalChain(channel.srcChain) !== canonicalChain(expected.srcChain)) {
+        throw new VerificationError('E_CHAINFLIP_CHANNEL_MISBINDING', `channel srcChain ${String(channel.srcChain)} != expected ${expected.srcChain}`);
+    }
+    if (canonicalChain(channel.destChain) !== canonicalChain(expected.destChain)) {
+        throw new VerificationError('E_CHAINFLIP_CHANNEL_MISBINDING', `channel destChain ${String(channel.destChain)} != expected ${expected.destChain}`);
+    }
+    if (canonicalAsset(channel.destAsset) !== canonicalAsset(expected.destAsset)) {
+        throw new VerificationError('E_CHAINFLIP_CHANNEL_MISBINDING', `channel destAsset ${String(channel.destAsset)} != expected ${expected.destAsset}`);
+    }
+    // Refund address is a soft check: Chainflip's `/v2/swaps/<id>` doesn't
+    // always expose it (the field lives in the broker's deposit-channel
+    // creation request, not necessarily in the status query). When the
+    // channel object carries one, we strictly require it to match — that
+    // catches a real attack where the broker rebinds the refund. When it
+    // doesn't carry one, we skip silently rather than fail the whole
+    // verification on a check we can't perform. The destination address
+    // (the path funds actually flow through on success) is the strict
+    // gate above; this one only matters on the refund-on-failure branch.
+    if (expected.refundAddress !== undefined &&
+        channel.refundAddress !== undefined &&
+        canonicalAddress(channel.refundAddress) !== canonicalAddress(expected.refundAddress)) {
+        throw new VerificationError('E_CHAINFLIP_CHANNEL_MISBINDING', `channel refundAddress ${String(channel.refundAddress)} != expected ${expected.refundAddress}`);
+    }
+}
+function requireAmountInBand(channel, amountSats) {
+    const amount = BigInt(amountSats);
+    if (channel.minBtcAmount !== undefined && amount < BigInt(channel.minBtcAmount)) {
+        throw new VerificationError('E_CHAINFLIP_AMOUNT_BELOW_MIN', `deposit ${amount.toString()} below channel min ${channel.minBtcAmount}`);
+    }
+    if (channel.maxBtcAmount !== undefined && amount > BigInt(channel.maxBtcAmount)) {
+        throw new VerificationError('E_CHAINFLIP_AMOUNT_ABOVE_MAX', `deposit ${amount.toString()} above channel max ${channel.maxBtcAmount}`);
+    }
+}
+function requireExpiryMargin(expiryTime) {
+    const expiryMs = new Date(expiryTime).getTime();
+    if (Number.isNaN(expiryMs))
+        return;
+    const remaining = expiryMs - Date.now();
+    if (remaining < CHANNEL_SAFETY_MARGIN_MS) {
+        throw new VerificationError('E_CHAINFLIP_CHANNEL_EXPIRING', `channel expires in ${(remaining / 60_000).toFixed(1)} minutes, below safety margin`);
+    }
+}
+//# sourceMappingURL=chainflip.js.map

package/dist/verification/chainflip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chainflip.js","sourceRoot":"","sources":["../../src/verification/chainflip.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,6BAA6B,GAE9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,4BAA4B,GAG7B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,cAAsB,EACtB,CAAwB,EACxB,MAAoB,EACpB,OAAgC,EAChC,OAAyB,EACzB,MAAoB;IAEpB,MAAM,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,WAAW,EAAE;YACzB,KAAK,CACH,+BAA+B,EAC/B,KAAK,EACL,qDAAqD,OAAO,GAAG,CAChE;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnE,OAAO,MAAM,CAAC,WAAW,EAAE;YACzB,KAAK,CACH,+BAA+B,EAC/B,KAAK,EACL,wDAAwD,CACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC;YAC3B,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS;YACT,QAAQ,EAAE;gBACR,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBACjF,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,SAAS,EAAE,MAAM,CAAC,OAAO;gBACzB,SAAS,EAAE,MAAM,CAAC,OAAO;aAC1B;YACD,OAAO;YACP,MAAM;SACP,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,EAAE,iCAAiC,CAAC,CAAC,CAAC;QAC1F,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACnE,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AA8BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC7D,MAAM,OAAO,GACX,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM;QAC7B,CAAC,CAAC,MAAM,sBAAsB,CAC1B,KAAK,CAAC,SAAS,CAAC,SAAS,EACzB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,EACb,SAAS,EACT,KAAK,CAAC,MAAM,CACb;QACH,CAAC,CAAC,MAAM,yBAAyB,CAC7B,KAAK,CAAC,SAAS,CAAC,MAAM,EACtB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,EACb,SAAS,EACT,KAAK,CAAC,MAAM,CACb,CAAC;IACR,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,IAAI,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,OAAO,GAAG,GAA8B,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/D,oEAAoE;IACpE,6DAA6D;IAC7D,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,mDAAmD;IACnD,mEAAmE;IACnE,qEAAqE;IACrE,wBAAwB;IACxB,OAAO;QACL,GAAG,OAAO;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAClE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAClE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACxE,aAAa,EACX,OAAO,CAAC,aAAa;YACrB,QAAQ,CAAC,OAAO,EAAE;gBAChB,CAAC,eAAe,CAAC;gBACjB,CAAC,kBAAkB,EAAE,eAAe,CAAC;gBACrC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;gBACtC,CAAC,kBAAkB,EAAE,eAAe,CAAC;gBACrC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;gBACtC,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,CAAC;gBACvD,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;gBACxD,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,CAAC;gBACvD,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;aACzD,CAAC;KACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CACf,GAA4B,EAC5B,KAAqC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,GAAY,GAAG,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,GAAG,GAAG,SAAS,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,OAAe,EACf,SAAiB,EACjB,OAAgC,EAChC,SAAiB,EACjB,cAA4B;IAE5B,kEAAkE;IAClE,uDAAuD;IACvD,4CAA4C;IAC5C,EAAE;IACF,yEAAyE;IACzE,6DAA6D;IAC7D,mEAAmE;IACnE,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAsB,IAAI,iBAAiB,CACtD,kBAAkB,EAClB,kCAAkC,CACnC,CAAC;IAEF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,6BAA6B,EAAE,CAAC;QAC1D,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,6CAA6C;YAC7C,MAAM,IAAI,GAAkD;gBAC1D,MAAM,EAAE,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;gBACtE,KAAK,EAAE,UAAU;aAClB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7B,kEAAkE;gBAClE,yDAAyD;gBACzD,oEAAoE;gBACpE,qEAAqE;gBACrE,oEAAoE;gBACpE,+DAA+D;gBAC/D,mEAAmE;gBACnE,mBAAmB;gBACnB,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,8DAA8D;YAC9D,gEAAgE;YAChE,mCAAmC;YACnC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,SAAS,GAAG,IAAI,iBAAiB,CAC/B,kBAAkB,EAClB,0DAA0D,CAC3D,CAAC;YACJ,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CACpC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,kEAAkE;gBAClE,SAAS,GAAG,IAAI,iBAAiB,CAC/B,kBAAkB,EAClB,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB;gBAAE,MAAM,GAAG,CAAC;YAChD,qEAAqE;YACrE,SAAS,GAAG,IAAI,iBAAiB,CAC/B,kBAAkB,EAClB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GACb,+BAA+B,CAAC,OAAO,CAAC;YACxC,+BAA+B,CAAC,+BAA+B,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3E,MAAM,CAAC;QACT,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,IAAI,6BAA6B;YAAE,MAAM;QAC3E,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,EAClB,gCAAgC,CACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CACrB,OAAoB,EACpB,QAAsB;IAEtB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC3C,sEAAsE;IACtE,mDAAmD;IACnD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,EAAU,EAAE,MAAoB;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,MAAc,EACd,SAAiB,EACjB,OAAgC,EAChC,SAAiB,EACjB,cAA4B;IAE5B,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,CAAC;QACL,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;KAClC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,oBAAoB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;IACvD,OAAO,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED;4CAC4C;AAC5C,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED;;;kCAGkC;AAClC,SAAS,gBAAgB,CAAC,IAAwB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,QAAiD;IAEjD,IAAI,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,uBAAuB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,QAAQ,CAAC,WAAW,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,oBAAoB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,QAAQ,CAAC,QAAQ,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,qBAAqB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,qBAAqB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,IACE,QAAQ,CAAC,aAAa,KAAK,SAAS;QACpC,OAAO,CAAC,aAAa,KAAK,SAAS;QACnC,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,EACpF,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,gCAAgC,EAChC,yBAAyB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,gBAAgB,QAAQ,CAAC,aAAa,EAAE,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgC,EAAE,UAAkB;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,iBAAiB,CACzB,8BAA8B,EAC9B,WAAW,MAAM,CAAC,QAAQ,EAAE,sBAAsB,OAAO,CAAC,YAAY,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,iBAAiB,CACzB,8BAA8B,EAC9B,WAAW,MAAM,CAAC,QAAQ,EAAE,sBAAsB,OAAO,CAAC,YAAY,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IACnC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,wBAAwB,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,8BAA8B,EAC9B,sBAAsB,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CACrF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/verification/constants.d.ts

@@ -0,0 +1,52 @@
+export declare const VERIFY_MAX_ATTEMPTS = 12;
+export declare const VERIFY_RETRY_DELAY_MS = 5000;
+export declare const VERIFY_FETCH_TIMEOUT_MS = 10000;
+/**
+ * Chainflip's hosted broker REST `/v2/swaps/<composite>` lags channel
+ * creation by ~30-60s — the broker creates the on-chain channel via
+ * `broker_request_swap_deposit_address` immediately, but the REST
+ * indexer ingests it on its own cadence. A first-attempt 404 is normal.
+ *
+ * Total retry budget covers the typical worst-case ingest delay; the
+ * backoff schedule starts tight (so the common case clears in seconds)
+ * and lengthens to avoid hammering the gateway during real outages.
+ */
+export declare const CHAINFLIP_REST_RETRY_TOTAL_MS = 120000;
+export declare const CHAINFLIP_REST_RETRY_BACKOFF_MS: readonly number[];
+export declare const ATOMICSWAP_TIMELOCK_MIN_BLOCKS = 5;
+export declare const ATOMICSWAP_TIMELOCK_MAX_BLOCKS = 288;
+/**
+ * Bounds for the BIP68 sequence applied to TxPunish — the relative timelock
+ * Alice must wait after TxCancel confirms before she can broadcast TxPunish.
+ *
+ * The minimum is the size of the refund window Bob is guaranteed: between
+ * TxCancel confirming and TxPunish becoming spendable, Bob must have time to
+ * notice, decrypt the encsig, and broadcast TxFullRefund/TxPartialRefund. A
+ * sub-block window degenerates into a fee race that Alice can win by
+ * out-of-band miner submission.
+ *
+ * Production deployments should configure ASB with the documented mainnet
+ * defaults (≥72). This lower bound (5) is the smallest positive integer that
+ * still rejects the degenerate `0` case the V-1 fix guards against, and exists
+ * to allow regtest tier2/system-test fixtures (which use 50) to run without
+ * patching every consumer of these constants.
+ *
+ * @security Closes V-1 — the Rust core enforces real production bounds via the
+ *   env config (e.g. `bitcoin_punish_timelock` defaults).
+ */
+export declare const ATOMICSWAP_PUNISH_TIMELOCK_MIN_BLOCKS = 5;
+export declare const ATOMICSWAP_PUNISH_TIMELOCK_MAX_BLOCKS = 288;
+/**
+ * Bounds for the BIP68 sequence applied to TxReclaim — the additional wait
+ * after TxPartialRefund confirms before Bob can pull the amnesty back.
+ *
+ * Min is 1 — only the degenerate `0` case is rejected. Matches the Rust
+ * source (xmr-atomic-swap/core/swap-env/src/env.rs:65,88) which sets
+ * `bitcoin_remaining_refund_timelock = 2` for both mainnet and testnet;
+ * a stricter floor here would reject the Rust-shipped defaults.
+ *
+ * @security Closes V-1 (amnesty-path variant) — only `0` is unsafe.
+ */
+export declare const ATOMICSWAP_REMAINING_REFUND_TIMELOCK_MIN_BLOCKS = 1;
+export declare const ATOMICSWAP_REMAINING_REFUND_TIMELOCK_MAX_BLOCKS = 288;
+//# sourceMappingURL=constants.d.ts.map

package/dist/verification/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/verification/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,SAAU,CAAC;AACrD,eAAO,MAAM,+BAA+B,EAAE,SAAS,MAAM,EAE5D,CAAC;AACF,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AACvD,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+CAA+C,IAAI,CAAC;AACjE,eAAO,MAAM,+CAA+C,MAAM,CAAC"}

package/dist/verification/constants.js

@@ -0,0 +1,54 @@
+export const VERIFY_MAX_ATTEMPTS = 12;
+export const VERIFY_RETRY_DELAY_MS = 5_000;
+export const VERIFY_FETCH_TIMEOUT_MS = 10_000;
+/**
+ * Chainflip's hosted broker REST `/v2/swaps/<composite>` lags channel
+ * creation by ~30-60s — the broker creates the on-chain channel via
+ * `broker_request_swap_deposit_address` immediately, but the REST
+ * indexer ingests it on its own cadence. A first-attempt 404 is normal.
+ *
+ * Total retry budget covers the typical worst-case ingest delay; the
+ * backoff schedule starts tight (so the common case clears in seconds)
+ * and lengthens to avoid hammering the gateway during real outages.
+ */
+export const CHAINFLIP_REST_RETRY_TOTAL_MS = 120_000;
+export const CHAINFLIP_REST_RETRY_BACKOFF_MS = [
+    1_000, 2_000, 4_000, 8_000, 16_000, 30_000, 30_000, 30_000,
+];
+export const ATOMICSWAP_TIMELOCK_MIN_BLOCKS = 5;
+export const ATOMICSWAP_TIMELOCK_MAX_BLOCKS = 288;
+/**
+ * Bounds for the BIP68 sequence applied to TxPunish — the relative timelock
+ * Alice must wait after TxCancel confirms before she can broadcast TxPunish.
+ *
+ * The minimum is the size of the refund window Bob is guaranteed: between
+ * TxCancel confirming and TxPunish becoming spendable, Bob must have time to
+ * notice, decrypt the encsig, and broadcast TxFullRefund/TxPartialRefund. A
+ * sub-block window degenerates into a fee race that Alice can win by
+ * out-of-band miner submission.
+ *
+ * Production deployments should configure ASB with the documented mainnet
+ * defaults (≥72). This lower bound (5) is the smallest positive integer that
+ * still rejects the degenerate `0` case the V-1 fix guards against, and exists
+ * to allow regtest tier2/system-test fixtures (which use 50) to run without
+ * patching every consumer of these constants.
+ *
+ * @security Closes V-1 — the Rust core enforces real production bounds via the
+ *   env config (e.g. `bitcoin_punish_timelock` defaults).
+ */
+export const ATOMICSWAP_PUNISH_TIMELOCK_MIN_BLOCKS = 5;
+export const ATOMICSWAP_PUNISH_TIMELOCK_MAX_BLOCKS = 288;
+/**
+ * Bounds for the BIP68 sequence applied to TxReclaim — the additional wait
+ * after TxPartialRefund confirms before Bob can pull the amnesty back.
+ *
+ * Min is 1 — only the degenerate `0` case is rejected. Matches the Rust
+ * source (xmr-atomic-swap/core/swap-env/src/env.rs:65,88) which sets
+ * `bitcoin_remaining_refund_timelock = 2` for both mainnet and testnet;
+ * a stricter floor here would reject the Rust-shipped defaults.
+ *
+ * @security Closes V-1 (amnesty-path variant) — only `0` is unsafe.
+ */
+export const ATOMICSWAP_REMAINING_REFUND_TIMELOCK_MIN_BLOCKS = 1;
+export const ATOMICSWAP_REMAINING_REFUND_TIMELOCK_MAX_BLOCKS = 288;
+//# sourceMappingURL=constants.js.map

package/dist/verification/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/verification/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,OAAO,CAAC;AACrD,MAAM,CAAC,MAAM,+BAA+B,GAAsB;IAChE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC3D,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,qCAAqC,GAAG,GAAG,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,+CAA+C,GAAG,GAAG,CAAC"}

package/dist/verification/index.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Deposit-address verification dispatcher.
+ *
+ * Each provider has a dedicated verification path that validates the deposit
+ * address against the provider's own infrastructure (THORNode vaults,
+ * Chainflip channels, NEAR intent registry, atomic-swap lock script). Common
+ * client-side checks (address presence, output amount, destination match) run
+ * for every provider.
+ */
+import type { Logger } from '../interfaces/logger.js';
+import type { SwapVerification, VerificationResult } from '../types/index.js';
+import { verifyAtomicSwap } from './atomic-swap.js';
+import { verifyThorchain } from './thorchain.js';
+import { verifyChainflip } from './chainflip.js';
+import { verifyNearIntents } from './near-intents.js';
+import type { ProtocolContext } from './shared.js';
+import type { ChainflipNetwork } from './chainflip-networks.js';
+export { parseThorchainMemo, requireMemoBindsDestination } from './memo.js';
+export type { ParsedThorchainMemo } from './memo.js';
+export { verifyAtomicSwap, verifyThorchain, verifyChainflip, verifyNearIntents };
+export { fetchThorchainVaults, verifyThorchainQuote } from './thorchain.js';
+export type { FetchThorchainVaultsInput, VerifyThorchainQuoteInput, } from './thorchain.js';
+export { verifyChainflipChannel } from './chainflip.js';
+export type { VerifyChainflipChannelInput } from './chainflip.js';
+export { CHAINFLIP_VERIFICATION_NETWORKS, chainflipEndpointsForNetwork, } from './chainflip-networks.js';
+export type { ChainflipNetwork, ChainflipVerificationEndpoints, } from './chainflip-networks.js';
+export { THORCHAIN_VERIFICATION_NETWORKS, thorchainEndpointsForNetwork, } from './thorchain-networks.js';
+export type { ThorchainNetwork, ThorchainVerificationEndpoints, } from './thorchain-networks.js';
+export { fetchNearIntentStatus, requireIntentBinds, requireIntentDeadlineMargin, verifyNearIntentOnChain, } from './near-intents.js';
+export type { FetchNearIntentStatusInput, RequireIntentBindsInput, VerifyNearIntentOnChainInput, } from './near-intents.js';
+export { fetchConsensusRate } from './rate-oracle.js';
+export type { RateOracleConfig } from './rate-oracle.js';
+export { VERIFY_FETCH_TIMEOUT_MS, VERIFY_MAX_ATTEMPTS, VERIFY_RETRY_DELAY_MS } from './constants.js';
+export interface VerifyDepositParams {
+    readonly depositAddress: string;
+    readonly verification: SwapVerification;
+    readonly destAddress: string;
+    readonly refundAddress: string;
+    readonly toToken: string;
+    readonly amount: string;
+    readonly fromChain?: string;
+    readonly toChain?: string;
+    readonly fromToken?: string;
+    readonly network?: ChainflipNetwork;
+    readonly protocol?: ProtocolContext;
+    readonly expectedAmountOut?: string;
+    readonly expectedDestAddress?: string;
+    readonly fetchFn?: typeof globalThis.fetch;
+    readonly resume?: boolean;
+    readonly logger?: Logger;
+    /**
+     * External abort signal. Wired from the engine's AbortController so a
+     * caller-side `engine.destroy()` actually stops verification mid-flight.
+     * Without this, the chainflip REST retry loop alone can keep polling
+     * for up to CHAINFLIP_REST_RETRY_TOTAL_MS (120 s) after the engine has
+     * been told to stop — burning user bandwidth and racing whatever the
+     * caller spun up to replace it.
+     */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Verify a deposit address against the authoritative infrastructure for its
+ * provider. Common client-side checks (address presence, output amount,
+ * destination match) run for every provider.
+ *
+ * @throws {VerificationError} `E_PROVIDER_UNKNOWN` for an unrecognised
+ *   provider; `E_UNEXPECTED_TIMELOCK` when `timelock_blocks` is set for a
+ *   non-atomicswap provider.
+ */
+export declare function verifyDepositAddress(params: VerifyDepositParams): Promise<VerificationResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/verification/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verification/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAEnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAC5E,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,YAAY,EACV,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,gBAAgB,EAChB,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAErG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA8G7B"}