@myzonerocks/pact 0.1.2 → 0.1.4

package/src/router.ts

@@ -28,28 +28,52 @@ export function isExpired(deadline: number, now: number, skew: number): boolean
   return deadline + skew <= now;
 }
 
+// maxQuotes and maxFundingOptions bound the lists the router ranks and the client
+// quotes over, so a caller (or an adapter-supplied list forwarded through one)
+// cannot force unbounded work. The limits are generous next to any real corridor.
+export const maxQuotes = 256;
+export const maxFundingOptions = 64;
+
 // route selects one quote deterministically. It first discards quotes that are
 // expired against now or that exceed the identity's KYC limit, then ranks the
 // survivors by the policy. Ties break by pay-in adapter, then pay-out adapter,
 // then quote id, so the choice is total and stable and never depends on input
 // order or randomness.
 export function route(quotes: Quote[], policy: Policy, kyc: KycStatus, now: number, skew: number): Quote {
+  if (quotes.length > maxQuotes) {
+    throw new NoQuoteError(`quote set of ${quotes.length} exceeds the maximum of ${maxQuotes}`);
+  }
   const eligible = quotes.filter((q) => !isExpired(q.expiresAt, now, skew) && withinLimits(kyc, q));
   if (eligible.length === 0) {
     throw new NoQuoteError("all quotes expired or over limit");
   }
+  // Ranking by cost compares source amounts, which is meaningful only in one
+  // currency: the router holds no rate to weigh a dollar against a shilling. A
+  // mixed-currency set would otherwise fall through to the id tie-break and
+  // quietly crown a costlier quote, so it is refused rather than mis-ranked.
+  if (policy.kind === PolicyKind.Cheapest && spansSourceCurrencies(eligible)) {
+    throw new NoQuoteError("cannot rank by cost across source currencies without a common rate");
+  }
   const rank = rankFn(policy);
   eligible.sort((a, b) => {
     const primary = rank(a, b);
     if (primary !== 0) return primary;
-    if (a.payInAdapterId !== b.payInAdapterId) return a.payInAdapterId < b.payInAdapterId ? -1 : 1;
-    if (a.payOutAdapterId !== b.payOutAdapterId) return a.payOutAdapterId < b.payOutAdapterId ? -1 : 1;
-    if (a.id !== b.id) return a.id < b.id ? -1 : 1;
-    return 0;
+    const byPayIn = compareUtf8(a.payInAdapterId, b.payInAdapterId);
+    if (byPayIn !== 0) return byPayIn;
+    const byPayOut = compareUtf8(a.payOutAdapterId, b.payOutAdapterId);
+    if (byPayOut !== 0) return byPayOut;
+    return compareUtf8(a.id, b.id);
   });
   return eligible[0] as Quote;
 }
 
+// spansSourceCurrencies reports whether the quotes carry more than one distinct
+// source currency, the case a cost ranking cannot resolve without a rate.
+function spansSourceCurrencies(quotes: Quote[]): boolean {
+  const first = quotes[0]!.srcAmount.currency;
+  return quotes.some((q) => q.srcAmount.currency !== first);
+}
+
 function rankFn(policy: Policy): (a: Quote, b: Quote) => number {
   switch (policy.kind) {
     case PolicyKind.Fastest:
@@ -81,6 +105,22 @@ function cmpNumber(a: number, b: number): number {
   return a < b ? -1 : a > b ? 1 : 0;
 }
 
+// compareUtf8 orders two strings by their UTF-8 byte encoding, so the tie-break
+// agrees with the Go SDK. A plain string comparison orders by UTF-16 code unit,
+// which disagrees for characters above U+FFFF and would break determinism across
+// languages on a non-ASCII adapter id.
+const utf8Encoder = new TextEncoder();
+function compareUtf8(a: string, b: string): number {
+  if (a === b) return 0;
+  const ab = utf8Encoder.encode(a);
+  const bb = utf8Encoder.encode(b);
+  const n = Math.min(ab.length, bb.length);
+  for (let i = 0; i < n; i++) {
+    if (ab[i] !== bb[i]) return ab[i]! < bb[i]! ? -1 : 1;
+  }
+  return ab.length < bb.length ? -1 : ab.length > bb.length ? 1 : 0;
+}
+
 // cmpMoney orders two quotes by source amount. Amounts in different currencies
 // are treated as incomparable and reported equal, deferring to the tie-break so
 // the router never throws on a mixed-currency quote set.

package/src/wire.ts

@@ -1,5 +1,5 @@
 import { Money } from "./money.js";
-import { State } from "./state.js";
+import { State, stateName } from "./state.js";
 import { CanonicalWriter } from "./canonical.js";
 import type { Intent, Quote, Authorization, Settlement } from "./message.js";
 
@@ -146,7 +146,14 @@ class WireReader {
     }
     const view = new DataView(this.buf.buffer, this.buf.byteOffset + this.pos, 8);
     this.pos += 8;
-    return Number(view.getBigUint64(0, false));
+    const value = view.getBigUint64(0, false);
+    // A value above 2^53 cannot be held exactly in a JS number, so reject it
+    // rather than decode a Go or Dart value into a silently different one. Every
+    // real field here — millisecond timestamps, ordinals, latency — fits easily.
+    if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new Error("pact: u64 field exceeds the exact-integer range");
+    }
+    return Number(value);
   }
 
   money(): Money {
@@ -231,11 +238,21 @@ export function decodeAuthorization(b: Uint8Array): Authorization {
   return auth;
 }
 
+// stateFromOrdinal rejects an ordinal outside the known states rather than pass
+// an out-of-range number through as a State, so a corrupt wire byte cannot decode
+// to a nonexistent state.
+function stateFromOrdinal(n: number): State {
+  if (!(n in stateName)) {
+    throw new Error(`pact: unknown settlement state ordinal ${n}`);
+  }
+  return n as State;
+}
+
 export function decodeSettlement(b: Uint8Array): Settlement {
   const r = new WireReader(b);
   const settlement: Settlement = {
     intentId: r.str(),
-    state: r.u64() as State,
+    state: stateFromOrdinal(r.u64()),
     adapterId: r.str(),
     providerTxRef: r.str(),
     onchainTxHash: r.str(),

package/src/fake.ts

@@ -1,96 +0,0 @@
-import { State } from "./state.js";
-import { RefundKind } from "./adapter.js";
-import type { Money } from "./money.js";
-import type { Quote, Authorization, Settlement } from "./message.js";
-import type { RateSource, EscrowVault } from "./bridge.js";
-import type {
-  PayInLeg,
-  PayOutLeg,
-  PayInCapabilities,
-  PayOutCapabilities,
-  CollectResult,
-  DisburseResult,
-} from "./leg.js";
-
-// FakeLeg is a deterministic, in-memory pay-in and pay-out leg. It settles
-// instantly with no network and implements both sides so a test can build a
-// direct corridor from one leg or a bridged corridor from two. failPayout makes
-// its disburse fail so a test can exercise the escrow-unwind path.
-export class FakeLeg implements PayInLeg, PayOutLeg {
-  failPayout = false;
-
-  constructor(
-    readonly id: string,
-    private readonly rail: string,
-    private readonly currency: string,
-    private readonly ids: () => string,
-  ) {}
-
-  payInCapabilities(): PayInCapabilities {
-    return { rails: [this.rail], currencies: [this.currency], refunds: RefundKind.Full };
-  }
-
-  // collect takes the payer's funds. received is the net the bridge converts —
-  // the source the payer paid less the corridor fees.
-  async collect(_intentId: string, quote: Quote, _auth: Authorization, _deliverTo: string): Promise<CollectResult> {
-    return { providerRef: this.ids(), received: quote.srcAmount.sub(quote.fees) };
-  }
-
-  async refundIn(intentId: string, _kind: RefundKind, reason: string): Promise<Settlement> {
-    return this.terminal(intentId, reason);
-  }
-
-  payOutCapabilities(): PayOutCapabilities {
-    return { rails: [this.rail], currencies: [this.currency], reversible: false };
-  }
-
-  async disburse(_intentId: string, _quote: Quote, _recipientRef: string): Promise<DisburseResult> {
-    if (this.failPayout) {
-      throw new Error("fake: payout failed");
-    }
-    return { providerRef: this.ids() };
-  }
-
-  async reverseOut(intentId: string, reason: string): Promise<Settlement> {
-    return this.terminal(intentId, reason);
-  }
-
-  private terminal(intentId: string, reason: string): Settlement {
-    return {
-      intentId,
-      state: State.Refunded,
-      adapterId: this.id,
-      providerTxRef: this.ids(),
-      onchainTxHash: "",
-      receiptHash: new Uint8Array(0),
-      reason,
-      settledAt: 0,
-    };
-  }
-}
-
-// FakeRates is an in-memory rate source keyed by "FROM:TO", standing in for a
-// price feed so a bridge can be tested without a live market.
-export class FakeRates implements RateSource {
-  constructor(private readonly table: Record<string, string>) {}
-
-  async rate(from: string, to: string): Promise<string> {
-    const rate = this.table[`${from}:${to}`];
-    if (rate === undefined) {
-      throw new Error(`fake: no rate for ${from}:${to}`);
-    }
-    return rate;
-  }
-}
-
-// FakeVault is an in-memory escrow that records holds and releases, standing in
-// for the custody a real bridge relies on.
-export class FakeVault implements EscrowVault {
-  async hold(intentId: string, _amount: Money): Promise<string> {
-    return `escrow-${intentId}`;
-  }
-
-  async release(_intentId: string): Promise<void> {
-    // Nothing to release in memory.
-  }
-}