@myzonerocks/pact 0.1.3 → 0.1.6

package/src/adapters/stripe.ts

@@ -10,6 +10,8 @@ import { Money } from "../money.js";
 import { State } from "../state.js";
 import type { Quote, Authorization, Settlement } from "../message.js";
 import { RefundKind, type AdapterEvent } from "../adapter.js";
+import { idempotencyKey } from "../protocol.js";
+import { fetchWithTimeout } from "./http.js";
 import type { InteractivePayInLeg, PayInCapabilities, CollectResult, PayInPreparation } from "../leg.js";
 
 // The public base of the Stripe REST API. It is the same for every integration
@@ -29,7 +31,6 @@ const metadataIntentKey = "pact_intent_id";
 const defaultToleranceSeconds = 300;
 
 // The protocol identifier used to bind an idempotency key to one protocol step.
-const idPrefix = "pact";
 
 // PaymentIntent is the subset of Stripe's PaymentIntent this leg reads.
 // clientSecret is present only on a freshly created intent and is the single
@@ -108,9 +109,8 @@ export interface StripeConfig {
   currencies: string[];
   api: StripeApi;
   webhookKey: string;
-  // clock returns the current time in Unix seconds, for webhook timestamp
-  // checks. When absent, timestamps are checked against zero.
-  clock?: () => number;
+  // clock returns the current time in Unix seconds, for webhook timestamp checks.
+  clock: () => number;
   // tolerance is the webhook timestamp tolerance in seconds; defaults to 300.
   tolerance?: number;
   ids: () => string;
@@ -136,11 +136,16 @@ export class StripeLeg implements InteractivePayInLeg {
     if (!cfg.webhookKey) {
       throw new Error("stripe: config requires a webhook signing key");
     }
+    // Without a clock every webhook timestamp reads as far in the past and
+    // silently fails the tolerance check, so a real webhook never verifies.
+    if (!cfg.clock) {
+      throw new Error("stripe: config requires a clock for webhook timestamp checks");
+    }
     this.id = cfg.id ?? "stripe";
     this.currencies = cfg.currencies;
     this.api = cfg.api;
     this.webhookKey = cfg.webhookKey;
-    this.clock = cfg.clock ?? (() => 0);
+    this.clock = cfg.clock;
     this.tolerance = cfg.tolerance ?? defaultToleranceSeconds;
     this.ids = cfg.ids;
     this.methods = cfg.methods;
@@ -204,13 +209,16 @@ export class StripeLeg implements InteractivePayInLeg {
   // refundIn reverses a captured payment, in full or in part. Stripe supports
   // both, so the leg accepts the full and partial refund kinds and rejects a
   // counter-transfer it cannot express.
-  async refundIn(intentId: string, kind: RefundKind, reason: string): Promise<Settlement> {
+  async refundIn(intentId: string, kind: RefundKind, amount: Money, reason: string): Promise<Settlement> {
     if (kind !== RefundKind.Full && kind !== RefundKind.Partial) {
       throw new Error(`stripe: cannot perform refund kind ${kind}`);
     }
     const pi = await this.api.findPaymentIntent(intentId);
+    // Stripe refunds the full capture when no amount is set, so a full refund
+    // leaves amount zero and a partial one carries the exact minor units to return.
+    const minor = kind === RefundKind.Partial ? minorToInteger(amount) : 0;
     const refund = await this.api.createRefund(
-      { paymentIntentId: pi.id, amount: 0, reason },
+      { paymentIntentId: pi.id, amount: minor, reason },
       idempotencyKey(intentId, "refund"),
     );
     return {
@@ -249,11 +257,6 @@ function signatureHeader(headers: Record<string, string[]>): string {
   return "";
 }
 
-// idempotencyKey binds a Stripe mutation to one protocol step so a retry reuses
-// the original result instead of acting twice.
-function idempotencyKey(ref: string, step: string): string {
-  return `${idPrefix}:${ref}:${step}`;
-}
 
 // minorToInteger narrows a Money amount to the safe integer Stripe expects,
 // refusing anything that would overflow. Fiat amounts fit comfortably; the guard
@@ -484,7 +487,7 @@ class HttpStripeApi implements StripeApi {
       Authorization: `Bearer ${this.secretKey}`,
       "Stripe-Version": apiVersion,
     };
-    const resp = await fetch(this.baseURL + path, { ...init, headers });
+    const resp = await fetchWithTimeout(this.baseURL + path, { ...init, headers });
     const body = await resp.text();
     if (resp.status >= 300) {
       throw new Error(`stripe: ${path} returned ${resp.status}: ${stripeErrorMessage(body)}`);

package/src/bridge.ts

@@ -131,14 +131,21 @@ export function applyInverseRate(dst: Money, rate: string, srcCurrency: string,
 // parseRate reads a decimal rate like "129.45" into a numerator and denominator,
 // so the conversion stays exact integer arithmetic with no floating point.
 export function parseRate(rate: string): [bigint, bigint] {
+  // Bound the length so an untrusted rate can't force a huge bigint parse and
+  // exponentiation in the FX math.
+  if (rate.length > 80) {
+    throw new Error("pact: rate has more than 80 characters");
+  }
+  // A non-negative integer part with no leading zeros and an optional fractional
+  // part; no sign, no radix prefix, no whitespace, matching the amount grammar so
+  // the SDKs never disagree on a rate's validity or value.
+  if (!/^(0|[1-9][0-9]*)(\.[0-9]+)?$/.test(rate)) {
+    throw new Error(`pact: ${JSON.stringify(rate)} is not a canonical decimal rate`);
+  }
   const dot = rate.indexOf(".");
   const whole = dot < 0 ? rate : rate.slice(0, dot);
   const frac = dot < 0 ? "" : rate.slice(dot + 1);
-  const digits = whole + frac;
-  if (!/^\d+$/.test(digits)) {
-    throw new Error(`pact: ${JSON.stringify(rate)} is not a decimal rate`);
-  }
-  const num = BigInt(digits);
+  const num = BigInt(whole + frac);
   const den = frac.length > 0 ? pow10(frac.length) : 1n;
   return [num, den];
 }

package/src/canonical.ts

@@ -26,6 +26,11 @@ export class CanonicalWriter {
     return this;
   }
 
+  // str writes a string as its raw UTF-8 bytes. No Unicode normalization is
+  // applied: the bytes are hashed as given, so two participants that compose the
+  // same text in different Unicode forms produce different hashes. Callers that
+  // need them to agree must normalize before building a message; string fields are
+  // otherwise treated as opaque bytes.
   str(s: string): this {
     return this.bytes(encoder.encode(s));
   }

package/src/client.ts

@@ -18,9 +18,17 @@ import {
 import { authorize as signAuthorization, verifyAuthorization, type Signer, type Verifier } from "./signing.js";
 import { PassThroughBridge, type Bridge, type ConvertResult } from "./bridge.js";
 import { railInList, isInteractivePayInLeg, type PayInLeg, type PayOutLeg, type CollectResult, type PayInPreparation } from "./leg.js";
-import type { AdapterEvent } from "./adapter.js";
-import { route, type Policy, PolicyKind, NoQuoteError, isExpired } from "./router.js";
-import { permissiveKyc, allowRisk, withinLimits, type KycProvider, type RiskHook } from "./compliance.js";
+import { RefundKind, type AdapterEvent } from "./adapter.js";
+import { route, type Policy, PolicyKind, NoQuoteError, isExpired, maxFundingOptions } from "./router.js";
+import {
+  permissiveKyc,
+  allowRisk,
+  withinLimits,
+  strictSignerAuthorizer,
+  type KycProvider,
+  type RiskHook,
+  type SignerAuthorizer,
+} from "./compliance.js";
 import { MemoryLedger, eventReceipt, type Ledger, type LedgerEvent } from "./ledger.js";
 
 // Clock returns the current time in Unix milliseconds; IdGen returns a fresh
@@ -50,6 +58,7 @@ export interface ClientConfig {
   verifier: Verifier;
   kyc?: KycProvider;
   risk?: RiskHook;
+  signerAuth?: SignerAuthorizer;
   clock?: Clock;
   idGen?: IdGen;
   skew?: number;
@@ -87,6 +96,7 @@ export class Client {
   private readonly verifier: Verifier;
   private readonly kyc: KycProvider;
   private readonly risk: RiskHook;
+  private readonly signerAuth: SignerAuthorizer;
   private readonly clock: Clock;
   private readonly idGen: IdGen;
   private readonly skew: number;
@@ -105,6 +115,7 @@ export class Client {
     this.verifier = cfg.verifier;
     this.kyc = cfg.kyc ?? permissiveKyc;
     this.risk = cfg.risk ?? allowRisk;
+    this.signerAuth = cfg.signerAuth ?? strictSignerAuthorizer;
     this.clock = cfg.clock ?? systemClock;
     this.idGen = cfg.idGen ?? randomId;
     this.skew = cfg.skew ?? DEFAULT_SKEW_MILLIS;
@@ -113,6 +124,11 @@ export class Client {
 
   // createIntent mints an intent and records it as a draft.
   createIntent(spec: IntentSpec): Intent {
+    // A zero deadline means "never expires", which would let an intent advance
+    // forever and bypass the liveness bound. Require a real deadline at creation.
+    if (!spec.expiresAt) {
+      throw new Error("pact: intent requires a non-zero expiry deadline");
+    }
     const intent: Intent = {
       id: this.idGen(),
       senderRef: spec.senderRef,
@@ -132,6 +148,9 @@ export class Client {
   // recipient's currency and a pay-out leg that can deliver it, prices the whole
   // corridor, and returns the options for the payer to choose among.
   async quoteOptions(intent: Intent, funding: Funding[]): Promise<Quote[]> {
+    if (funding.length > maxFundingOptions) {
+      throw new Error(`pact: ${funding.length} funding options exceed the maximum of ${maxFundingOptions}`);
+    }
     const quotes: Quote[] = [];
     let lastErr: unknown;
     for (const f of funding) {
@@ -145,6 +164,9 @@ export class Client {
         continue;
       }
       try {
+        // Corridors are priced in order so the router sees a stable ranking, matching
+        // the other SDKs; the loop is bounded by the configured funding options.
+        // eslint-disable-next-line no-await-in-loop
         quotes.push(await this.composeQuote(intent, payInLeg, f));
       } catch (err) {
         lastErr = err;
@@ -242,11 +264,17 @@ export class Client {
     if (isExpired(quote.expiresAt, now, this.skew)) {
       throw new Error("pact: quote has expired");
     }
-    const status = await this.kyc.status(signer.identity());
+    // The signer must be allowed to act for the sender, and compliance is measured
+    // against the sender — the party actually funding the payment — not whoever
+    // holds the signing key.
+    if (!this.signerAuth.authorized(signer.identity(), intent.senderRef)) {
+      throw new Error("pact: signer is not authorized to act for the intent's sender");
+    }
+    const status = await this.kyc.status(intent.senderRef);
     if (!withinLimits(status, quote)) {
       throw new Error("pact: quote exceeds KYC limit");
     }
-    const decision = this.risk.evaluate(signer.identity(), intent, quote);
+    const decision = this.risk.evaluate(intent.senderRef, intent, quote);
     if (!decision.allow) {
       throw new Error(`pact: risk hook vetoed authorization: ${decision.reason}`);
     }
@@ -264,12 +292,33 @@ export class Client {
   // driven forward by advance as provider events arrive, so no promise or
   // connection is held open per payment and durable state lives only in the
   // ledger.
-  async initiate(intent: Intent, quote: Quote, auth: Authorization): Promise<State> {
-    verifyAuthorization(auth, intent, quote, this.verifier);
+  // resolvePayIn rejects an expired intent and returns the corridor's pay-in leg — the
+  // expiry-and-leg check the immediate and interactive starts share.
+  private resolvePayIn(intent: Intent, quote: Quote): PayInLeg {
+    if (isExpired(intent.expiresAt, this.clock(), this.skew)) {
+      throw new Error("pact: intent has expired");
+    }
     const payInLeg = this.payIn.get(quote.payInAdapterId);
     if (!payInLeg) {
       throw new Error(`pact: no pay-in leg ${JSON.stringify(quote.payInAdapterId)}`);
     }
+    return payInLeg;
+  }
+
+  async initiate(intent: Intent, quote: Quote, auth: Authorization): Promise<State> {
+    verifyAuthorization(auth, intent, quote, this.verifier);
+    if (!this.signerAuth.authorized(auth.signerIdentity, intent.senderRef)) {
+      throw new Error("pact: signer is not authorized to act for the intent's sender");
+    }
+    const payInLeg = this.resolvePayIn(intent, quote);
+
+    // A retry of an already-submitted corridor must not collect a second time. The
+    // pay-in leg carries its own provider idempotency for the narrow window where a
+    // collection completed but its record was lost.
+    const submitted = this.ledger.state(intent.id);
+    if (submitted === State.Submitted || submitted === State.Collecting) {
+      return submitted;
+    }
 
     // A direct corridor collects straight to the recipient; a bridged one
     // collects into escrow first.
@@ -293,13 +342,13 @@ export class Client {
   // server-side into escrow, and the leg must offer interactive collection.
   async interactiveInitiate(intent: Intent, quote: Quote, auth: Authorization): Promise<{ preparation: PayInPreparation; state: State }> {
     verifyAuthorization(auth, intent, quote, this.verifier);
+    if (!this.signerAuth.authorized(auth.signerIdentity, intent.senderRef)) {
+      throw new Error("pact: signer is not authorized to act for the intent's sender");
+    }
     if (!isDirect(quote)) {
       throw new Error("pact: interactive pay-in is only available on a direct corridor");
     }
-    const payInLeg = this.payIn.get(quote.payInAdapterId);
-    if (!payInLeg) {
-      throw new Error(`pact: no pay-in leg ${JSON.stringify(quote.payInAdapterId)}`);
-    }
+    const payInLeg = this.resolvePayIn(intent, quote);
     if (!isInteractivePayInLeg(payInLeg)) {
       throw new Error(`pact: pay-in leg ${JSON.stringify(quote.payInAdapterId)} does not offer interactive collection`);
     }
@@ -333,14 +382,14 @@ export class Client {
     // A direct corridor's pay-in confirms and it settles.
     if (fromPayIn && current === State.Submitted) {
       if (failed) return this.recordFailure(intentId, authHash, quote, event.reason);
-      const ref = payInRef(events);
+      const collected = collectResult(events);
       const settlement: Settlement = {
         intentId,
         state: State.Settled,
         adapterId: quote.payInAdapterId,
-        providerTxRef: ref,
+        providerTxRef: collected.providerRef,
         onchainTxHash: "",
-        receiptHash: corridorReceipt(authHash, ref, ref, quote.fxRate, "", State.Settled),
+        receiptHash: corridorReceipt(authHash, collected.providerRef, collected.providerRef, collected.received, "", State.Settled),
         reason: "",
         settledAt: this.clock(),
       };
@@ -384,11 +433,32 @@ export class Client {
       throw new Error(`pact: no bridge ${JSON.stringify(quote.bridgeId)}`);
     }
     const collected = collectResult(events);
-    this.ledger.apply({
+    // Claim the escrow hold before converting or disbursing. If a concurrent
+    // advance already claimed it, this call did not win, so abort rather than run
+    // the conversion and pay-out a second time.
+    const { created } = this.ledger.apply({
       intentId: intent.id,
       to: State.Held,
       payloadHash: hashString(domain("held"), collected.providerRef),
     });
+    if (!created) {
+      return { settlement: lastSettlement(events), state: this.ledger.state(intent.id) };
+    }
+    // An expired corridor must not convert at a stale rate; unwind the collection
+    // to a refund instead of driving it forward past its deadline.
+    if (isExpired(intent.expiresAt, this.clock(), this.skew)) {
+      return this.unwind(intent.id, quote, authHash, "intent expired before conversion");
+    }
+
+    // The pay-in must have collected at least the source net of fees; a short
+    // collection unwinds rather than disbursing the full quote against it.
+    try {
+      if (collected.received.cmp(quote.srcAmount.sub(quote.fees)) < 0) {
+        return this.unwind(intent.id, quote, authHash, "bridged corridor collected less than the quoted source amount");
+      }
+    } catch {
+      return this.unwind(intent.id, quote, authHash, "bridged corridor collected in an unexpected currency");
+    }
 
     let converted: ConvertResult;
     try {
@@ -396,6 +466,16 @@ export class Client {
     } catch (err) {
       return this.unwind(intent.id, quote, authHash, reasonOf(err));
     }
+    // Value must be conserved across the escrow: the conversion has to deliver at
+    // least the quoted destination amount before the pay-out is sent. A moved rate
+    // or a short conversion unwinds to a refund rather than draining escrow.
+    try {
+      if (converted.delivered.cmp(quote.dstAmount) < 0) {
+        return this.unwind(intent.id, quote, authHash, "bridged conversion delivered less than the quoted destination amount");
+      }
+    } catch {
+      return this.unwind(intent.id, quote, authHash, "bridged conversion delivered in an unexpected currency");
+    }
     let disbursed;
     try {
       disbursed = await payOutLeg.disburse(intent.id, quote, recipientDestination(intent));
@@ -431,20 +511,34 @@ export class Client {
     events: LedgerEvent[],
   ): { settlement: Settlement; state: State } {
     const inRef = payInRef(events);
-    const { payOut: outRef, bridge: bridgeRef } = disburseRefs(events);
+    const { payOut: outRef, bridge: bridgeRef, delivered } = disburseRefs(events);
     const settlement: Settlement = {
       intentId,
       state: State.Settled,
       adapterId: quote.payOutAdapterId,
       providerTxRef: outRef,
       onchainTxHash: "",
-      receiptHash: corridorReceipt(authHash, inRef, outRef, quote.fxRate, bridgeRef, State.Settled),
+      receiptHash: corridorReceipt(authHash, inRef, outRef, delivered, bridgeRef, State.Settled),
       reason: "",
       settledAt: this.clock(),
     };
     return this.finishAdvance(intentId, State.Settled, settlement);
   }
 
+  // claimRefund reserves the refunding step before any money moves. It returns the
+  // recorded outcome to echo when another refund already claimed the step, or null when
+  // this call won it and should proceed to move funds. Both refund paths go through it,
+  // so a refund is issued at most once however the calls race.
+  private claimRefund(intentId: string, reason: string): { settlement: Settlement; state: State } | null {
+    const { created } = this.ledger.apply({
+      intentId,
+      to: State.Refunding,
+      payloadHash: hashString(domain("refunding"), reason),
+    });
+    if (created) return null;
+    return { settlement: lastSettlement(this.ledger.events(intentId)), state: this.ledger.state(intentId) };
+  }
+
   // unwind refunds the payer from escrow when a bridged corridor cannot complete
   // its pay-out, moving to refunding then refunded.
   private async unwind(
@@ -453,22 +547,91 @@ export class Client {
     authHash: Uint8Array,
     reason: string,
   ): Promise<{ settlement: Settlement; state: State }> {
-    this.ledger.apply({
-      intentId,
-      to: State.Refunding,
-      payloadHash: hashString(domain("refunding"), reason),
-    });
+    // Claim the refund before moving money. A duplicate pay-out-failed webhook enters
+    // unwind twice; only the call that wins the refunding step may issue the counter-
+    // transfer, so the refund cannot fire a second time.
+    const echo = this.claimRefund(intentId, reason);
+    if (echo) return echo;
     const payInLeg = this.payIn.get(quote.payInAdapterId);
     if (payInLeg) {
-      await payInLeg.refundIn(intentId, payInLeg.payInCapabilities().refunds, reason);
+      const kind = payInLeg.payInCapabilities().refunds;
+      // A pay-in rail that cannot refund in place leaves the corridor refunding
+      // for the operator to complete out of band, rather than recording a refund
+      // that never moved funds.
+      if (kind === RefundKind.None) {
+        throw new Error(`pact: pay-in leg ${JSON.stringify(quote.payInAdapterId)} cannot refund automatically; manual return required: ${reason}`);
+      }
+      await payInLeg.refundIn(intentId, kind, quote.srcAmount, reason);
+    }
+    // The escrow unwind returns the whole collection, so the receipt attests the
+    // source amount the payer funded as the amount refunded.
+    const settlement: Settlement = {
+      intentId,
+      state: State.Refunded,
+      adapterId: quote.payInAdapterId,
+      providerTxRef: "",
+      onchainTxHash: "",
+      receiptHash: corridorReceipt(authHash, "", "", quote.srcAmount, "", State.Refunded),
+      reason,
+      settledAt: this.clock(),
+    };
+    return this.finishAdvance(intentId, State.Refunded, settlement);
+  }
+
+  // refund returns funds to the payer for a settled intent. The amount is
+  // explicit, so a host can issue a partial refund, and it must be in the source
+  // currency and no greater than what the payer funded. The pay-in leg must
+  // advertise a refund it can honour — and a partial one for a partial amount.
+  // Like every advance it is keyed on the target state, so a second refund for the
+  // same intent is a no-op.
+  async refund(intentId: string, amount: Money, reason: string): Promise<{ settlement: Settlement; state: State }> {
+    const events = this.ledger.events(intentId);
+    const replayed = replay(events);
+    if (!replayed) {
+      throw new Error("pact: intent has no recorded authorization to refund");
     }
+    const { intent, quote, authorization: auth } = replayed;
+    const current = this.ledger.state(intentId);
+    // A refund is single-occurrence: once refunded, a repeat is an idempotent
+    // no-op that echoes the outcome rather than moving funds again.
+    if (current === State.Refunded) {
+      return { settlement: lastSettlement(events), state: current };
+    }
+    if (current !== State.Settled) {
+      throw new Error("pact: only a settled intent can be refunded");
+    }
+    if (amount.currency !== quote.srcAmount.currency || amount.exponent !== quote.srcAmount.exponent) {
+      throw new Error("pact: refund must be in the funded source currency");
+    }
+    if (amount.value() <= 0n) {
+      throw new Error("pact: refund amount must be positive");
+    }
+    const over = amount.cmp(quote.srcAmount);
+    if (over > 0) {
+      throw new Error("pact: refund exceeds the amount funded");
+    }
+    const payInLeg = this.payIn.get(quote.payInAdapterId);
+    if (!payInLeg) {
+      throw new Error(`pact: no pay-in leg ${JSON.stringify(quote.payInAdapterId)}`);
+    }
+    const kind = refundKindFor(payInLeg.payInCapabilities().refunds, over === 0);
+    if (kind === undefined) {
+      throw new Error(`pact: pay-in leg ${JSON.stringify(quote.payInAdapterId)} cannot perform this refund`);
+    }
+    const authHash = authorizationHash(intentHash(intent), quoteHash(quote), auth.signerIdentity, auth.signedAt);
+    // Claim the refunding step before moving money. Two overlapping refund calls both
+    // pass the settled check above; only the one that wins this step issues the return,
+    // so the payer is never refunded twice.
+    const echo = this.claimRefund(intentId, reason);
+    if (echo) return echo;
+    await payInLeg.refundIn(intentId, kind, amount, reason);
     const settlement: Settlement = {
       intentId,
       state: State.Refunded,
       adapterId: quote.payInAdapterId,
       providerTxRef: "",
       onchainTxHash: "",
-      receiptHash: corridorReceipt(authHash, "", "", quote.fxRate, "", State.Refunded),
+      receiptHash: corridorReceipt(authHash, "", "", amount, "", State.Refunded),
       reason,
       settledAt: this.clock(),
     };
@@ -488,7 +651,9 @@ export class Client {
       adapterId: quote.payInAdapterId,
       providerTxRef: "",
       onchainTxHash: "",
-      receiptHash: corridorReceipt(authHash, "", "", quote.fxRate, "", State.Failed),
+      // A pay-in that failed before escrow moved no value, so the receipt binds a
+      // zero amount alongside the failure.
+      receiptHash: corridorReceipt(authHash, "", "", Money.zero(), "", State.Failed),
       reason,
       settledAt: this.clock(),
     };
@@ -501,13 +666,22 @@ export class Client {
   }
 
   private finish(intentId: string, state: State, settlement: Settlement): Settlement {
-    const event = this.ledger.apply({ intentId, to: state, payloadHash: settlement.receiptHash, settlement });
+    const { event } = this.ledger.apply({ intentId, to: state, payloadHash: settlement.receiptHash, settlement });
     this.notify(event);
     return settlement;
   }
 
-  // expire records that an intent's deadline passed before it settled.
+  // expire records that an intent's deadline passed before it settled. It refuses
+  // to expire an intent whose deadline has not actually passed, so a caller cannot
+  // force a live payment to a terminal expired state.
   expire(intentId: string): void {
+    const recorded = this.ledger.events(intentId).find((e) => e.intent)?.intent;
+    if (!recorded) {
+      throw new Error("pact: intent has no recorded history to expire");
+    }
+    if (!isExpired(recorded.expiresAt, this.clock(), this.skew)) {
+      throw new Error("pact: intent has not reached its deadline");
+    }
     this.ledger.apply({
       intentId,
       to: State.Expired,
@@ -565,25 +739,46 @@ function collectResult(events: LedgerEvent[]): CollectResult {
   for (const e of events) {
     if (e.collect) return e.collect;
   }
-  return { providerRef: "", received: Money.create("", 0, 0n) };
+  return { providerRef: "", received: Money.zero() };
 }
 
 function payInRef(events: LedgerEvent[]): string {
   return collectResult(events).providerRef;
 }
 
-// disburseRefs returns the pay-out provider reference and the bridge receipt
-// reference recorded on the disbursing step.
-function disburseRefs(events: LedgerEvent[]): { payOut: string; bridge: string } {
+// disburseRefs returns the pay-out provider reference, the bridge receipt
+// reference, and the amount the bridge actually delivered, all recorded on the
+// disbursing step.
+function disburseRefs(events: LedgerEvent[]): { payOut: string; bridge: string; delivered: Money } {
   let payOut = "";
   let bridge = "";
+  let delivered = Money.zero();
   for (const e of events) {
     if (e.state === State.Disbursing) {
       if (e.settlement) payOut = e.settlement.providerTxRef;
-      if (e.bridge) bridge = e.bridge.receiptRef;
+      if (e.bridge) {
+        bridge = e.bridge.receiptRef;
+        delivered = e.bridge.delivered;
+      }
     }
   }
-  return { payOut, bridge };
+  return { payOut, bridge, delivered };
+}
+
+// refundKindFor maps a pay-in leg's advertised refund capability and whether the
+// refund is for the full funded amount to the kind the leg is handed, returning
+// undefined for a refund the rail cannot express.
+function refundKindFor(capability: RefundKind, full: boolean): RefundKind | undefined {
+  switch (capability) {
+    case RefundKind.CounterTransfer:
+      return RefundKind.CounterTransfer;
+    case RefundKind.Partial:
+      return full ? RefundKind.Full : RefundKind.Partial;
+    case RefundKind.Full:
+      return full ? RefundKind.Full : undefined;
+    default:
+      return undefined;
+  }
 }
 
 // lastSettlement returns the settlement recorded on an intent's most recent

package/src/compliance.ts

@@ -32,18 +32,35 @@ export const permissiveKyc: KycProvider = {
 };
 
 // withinLimits reports whether a quote's source amount is inside an identity's
-// per-payment cap. An absent cap or a currency mismatch is treated as no
-// applicable limit.
+// per-payment cap. An absent cap means no limit. A cap that cannot be compared to
+// the quote — because it is in a different currency — fails closed: the payment is
+// refused rather than slipped past by funding in a currency the cap can't measure.
 export function withinLimits(status: KycStatus, quote: Quote): boolean {
   const cap = status.limits.perPayment;
   if (!cap) return true;
   try {
     return quote.srcAmount.cmp(cap) <= 0;
   } catch {
-    return true;
+    return false;
   }
 }
 
+// SignerAuthorizer decides whether the identity that signed an authorization is
+// allowed to act for the intent's sender. The default requires them to be the
+// same party. A custodial host that signs for its users on one platform key
+// supplies its own, so it can attest that its signer speaks for a given sender —
+// and so compliance is measured against the party actually being charged.
+export interface SignerAuthorizer {
+  authorized(signerIdentity: string, senderRef: string): boolean;
+}
+
+// strictSignerAuthorizer is the default: the signer must be the sender.
+export const strictSignerAuthorizer: SignerAuthorizer = {
+  authorized(signerIdentity: string, senderRef: string): boolean {
+    return signerIdentity === senderRef;
+  },
+};
+
 // RiskDecision is the outcome of a RiskHook consultation.
 export interface RiskDecision {
   allow: boolean;

package/src/crypto.ts

@@ -42,7 +42,10 @@ export function ed25519Sign(privateKey: KeyObject, message: Uint8Array): Uint8Ar
 }
 
 export function ed25519Verify(publicKeyRaw: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean {
-  if (publicKeyRaw.length !== 32) {
+  // A key or signature of the wrong length can never verify; reject it up front.
+  // The underlying verifier already rejects a non-canonical S, so a malleated
+  // signature never verifies.
+  if (publicKeyRaw.length !== 32 || signature.length !== 64) {
     return false;
   }
   const spki = Buffer.concat([spkiPublicPrefix, Buffer.from(publicKeyRaw)]);

package/src/index.ts

@@ -84,7 +84,6 @@ export {
   randomId,
   recipientDestination,
 } from "./client.js";
-export { FakeLeg, FakeRates, FakeVault } from "./fake.js";
 export {
   WireKind,
   type WireMessage,