@ninsei-labs/sdk 0.44.0 → 0.44.1

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.44.1 — 2026-10-20
+
+TWO ENTRIES A BACKEND NEEDS WHEN IT STOPS READING THE PAGE'S SOURCE.
+
+- `./networks` names the registry the engine already holds: `CHAINS`, `DEX_CHAINS`, `DEFAULT_CHAIN` and
+  `ASYNC_ROUTE_PROVIDERS`. A service that validates a chain id or a token against the same data the page
+  reads cannot drift from it. Nothing is re-implemented; the entry only re-exports `engine/core/config.js`.
+- `./core` now also exports `normalizeAmountInput`, the text a person typed reduced to a decimal string, so a
+  backend does not carry a second reader of the same field.
+- `./xmr` now names the block walk a watcher runs: `scanRange`, `viewKeyFormForAddress` and `laterBoundary`, all
+  from `engine/monero/scan.js`. A backend watching a deposit no longer reaches into the page's source.
+
 ## 0.44.0 — 2026-10-19
 
 THE WITHDRAWAL AND THE NODE NOW ASK THE PACKAGE INSTEAD OF CARRYING THEIR OWN COPIES. Every rule below was

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ninsei-labs/sdk",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -69,6 +69,10 @@
       "types": "./src/public/core.d.ts",
       "default": "./src/public/core.mjs"
     },
+    "./networks": {
+      "types": "./src/public/networks.d.ts",
+      "default": "./src/public/networks.mjs"
+    },
     "./recovery": {
       "types": "./src/public/recovery.d.ts",
       "default": "./src/public/recovery.mjs"

package/src/public/core.d.ts

@@ -12,6 +12,12 @@
  */
 export declare function parseAmount(raw: string | number | null | undefined): number | null;
 
+/**
+ * The same field text reduced to something a decimal parser can read: thousands separators removed, a lone comma
+ * read as the decimal separator, anything after a second separator dropped. Empty when the text carries no digit.
+ */
+export declare function normalizeAmountInput(raw: string | number | null | undefined): string;
+
 /**
  * ATOMIC UNITS -> A DECIMAL STRING. One XMR is 10^12 atomic units; the conversion uses BigInt, so a value above
  * 2^53 (about 9007 XMR in piconero) is not rounded. Dust does not vanish: 1 unit is "0.000000000001". `trim`

package/src/public/core.mjs

@@ -3,7 +3,7 @@
 // One function today. It is a separate entry because it belongs to neither the XMR side nor the EVM side, and a
 // consumer forced to import it from either would learn a false lesson about where it lives.
 
-export { parseAmount } from "../../engine/core/format.js";
+export { normalizeAmountInput, parseAmount } from "../../engine/core/format.js";
 
 // XMR AMOUNTS IN ATOMIC UNITS: 12 decimals, bigint, no rounding. `formatXmr` for display and for a field,
 // `parseXmr` for what a person typed.

package/src/public/networks.d.ts

@@ -0,0 +1,50 @@
+// DECLARATIONS FOR THE `./networks` ENTRY.
+//
+// src/public/networks.mjs only NAMES what engine/core/config.js already exports. The declarations cover the fields
+// a consumer of the registry reads; the engine's objects carry more (explorers, price feeds, gas hints) and a
+// consumer is free to read them, but nothing here invents a field the engine does not have.
+
+/** A token the network accepts. `address` is a 20-byte hex string; `decimals` is what its own contract reports. */
+export interface ChainToken {
+  symbol: string;
+  address: string;
+  decimals: number;
+  hidden?: boolean;
+}
+
+/** The DEX deployment on a network, when there is one. */
+export interface ChainUniswap {
+  factory?: string;
+  quoter?: string;
+  /** WETH: the wrapped form of the native coin, used when a route needs an ERC-20. */
+  wrapped?: { address: string; decimals: number };
+  [field: string]: unknown;
+}
+
+export interface Chain {
+  id: string;
+  name: string;
+  vm: string;
+  chainId: number;
+  caip2?: string;
+  testnet?: boolean;
+  native: { symbol: string; decimals: number };
+  rpcUrl?: string;
+  tokens?: ChainToken[];
+  uniswap?: ChainUniswap;
+  [field: string]: unknown;
+}
+
+/** One entry per async route provider (CoWSwap, UniswapX, ...): what it settles and the networks it serves. */
+export interface AsyncRouteProvider {
+  venue?: string;
+  shape?: string;
+  settles?: string;
+  networks?: Record<string, unknown>;
+  [field: string]: unknown;
+}
+
+export declare const CHAINS: readonly Chain[];
+export declare const DEX_CHAINS: readonly string[];
+export declare const DEFAULT_CHAIN: string;
+export declare const ASYNC_ROUTE_PROVIDERS: Readonly<Record<string, AsyncRouteProvider>>;

package/src/public/networks.mjs

@@ -0,0 +1,9 @@
+// THE NETWORK REGISTRY, FOR A CONSUMER THAT IS NOT THE BROWSER.
+//
+// The registry is one structure: each network names its chain id, its native coin, the tokens it accepts and,
+// where it exists, the DEX deployment. A backend that validates a chain id and a token against it must read the
+// same data the page reads, or the two drift apart silently.
+//
+// Names only: the engine owns the values. Nothing here is re-implemented.
+
+export { ASYNC_ROUTE_PROVIDERS, CHAINS, DEFAULT_CHAIN, DEX_CHAINS } from "../../engine/core/config.js";

package/src/public/xmr.d.ts

@@ -471,3 +471,25 @@ export declare function probeMoneroNode(options: {
   fetchImpl?: typeof fetch;
   timeoutMs?: number;
 }): Promise<NodeProbeOk | NodeProbeRefusal>;
+
+/** The watch key form that matches the address's view public key, or null when none does. */
+export declare function viewKeyFormForAddress(viewSecret: string, expectedViewPubHex: string): string | null;
+
+/** A boundary height derived from a later unlock_time, or null when the time names no height. */
+export declare function laterBoundary(...args: unknown[]): unknown;
+
+/** One transaction that carries an output for a watched address. */
+export interface ScannedMatch {
+  [field: string]: unknown;
+}
+
+/** Walk a block range and return the transactions that pay a watched address. */
+export declare function scanRange(options: {
+  daemonUrl: string;
+  fromHeight: number;
+  toHeight: number;
+  watched: unknown;
+  log?: (event: unknown) => void;
+  concurrency?: number;
+  nowSec?: number | null;
+}): Promise<ScannedMatch[]>;

package/src/public/xmr.mjs

@@ -20,6 +20,9 @@ export {
   prefixFor,
 } from "../../engine/monero/address.js";
 
+// THE BLOCK WALK A WATCHER RUNS: the same scanner the page uses, without a wallet.
+export { laterBoundary, scanRange, viewKeyFormForAddress } from "../../engine/monero/scan.js";
+
 export { createHalves } from "../../engine/atomic/halves.js";
 export { createDleq2 } from "../../engine/atomic/dleq2.js";
 

package/src/version.mjs

@@ -6,4 +6,4 @@
 // tools/sync-version.mjs. Do not edit it by hand - set the version in package.json and run `npm run sync:version`.
 // The `version` check in tools/check.mjs refuses a mismatch, and refuses a runtime read of package.json here.
 
-export const SDK_VERSION = "0.44.0";
+export const SDK_VERSION = "0.44.1";