@openzeppelin/miden-multisig-client 0.16.1 → 0.17.0-rc.1

package/src/procedures.ts

@@ -11,13 +11,12 @@
  * human-readable encoding and should not be copied into this table.
  */
 export const PROCEDURE_ROOTS = {
-  update_signers: '0x34963b067dbba634e57b416bc2f2a9a8d4ac24147f40b2900148c9ba44774274',
-  update_procedure_threshold: '0xec74c4b96ce593c11017ae54dec9c0ae5e0d242e8b3074eb3908d961300aed67',
-  auth_tx: '0x0708020dce7b91b61116e3eb27e5d686e129a83df3c540e0a7693b4523814e72',
-  update_guardian: '0xeceb1f2c2d7d20312dbaf091e9a27a2b63f9fcba120948043069793a5715bc96',
-  verify_guardian: '0xe6a8a62d37117f55a79b5345aa3d263ab16e973d486bac9a1612663dfdecf82d',
-  send_asset: '0xfb1c73d10de1954e9e8948964e3e77cf4e33759d2e012cb00eb10c50f2974eb4',
-  receive_asset: '0x6170fd6d682d91777b551fd866258f43cc657f1291f8f071500f4e56e9c153da',
+  update_signers: '0xa261cfd3c8791ac5abe1e78e14eade2f20789d73ab1c23c430418de59bc3380e',
+  update_procedure_threshold: '0x97587c61d49313b1d5a3c8b7437e0080e67ed9bd9d3e7206bcae562f934ccd03',
+  auth_tx: '0xa6aa6f69d9358535272ba433cd48d20628a5c69598e00c6dd01a22e83a5f15df',
+  update_guardian: '0x0a614ff7c81a561cbd2a4c2d9482031a7a841ca5de33349daed23a9d871b3675',
+  send_asset: '0x595bc83258726a66bd904912cfd5186c07cbd902dfbc115b7d6bc8105efc57e3',
+  receive_asset: '0x34a56dd18f6fe5aab63198b9dcfc6467e793ebabb37d56b994b902504635da13',
 } as const;
 
 /**

package/src/proposal/metadata.test.ts

@@ -157,3 +157,79 @@ describe('ProposalMetadataCodec p2id noteType (issue #322)', () => {
     expect(() => ProposalMetadataCodec.validate(md)).toThrow(/unsupported noteType/);
   });
 });
+
+describe('ProposalMetadataCodec p2id P2IDE heights (issue #366)', () => {
+  const baseWire: GuardianProposalMetadata = {
+    proposalType: 'p2id',
+    recipientId: '0xrecipient',
+    faucetId: '0xfaucet',
+    amount: '1000',
+  };
+
+  it('round-trips reclaim and timelock heights through the codec', () => {
+    const md = ProposalMetadataCodec.fromGuardian({
+      ...baseWire,
+      reclaimHeight: 12345,
+      timelockHeight: 700,
+    }) as P2IdProposalMetadata;
+    expect(md.reclaimHeight).toBe(12345);
+    expect(md.timelockHeight).toBe(700);
+
+    const wire = ProposalMetadataCodec.toGuardian(md);
+    expect(wire.reclaimHeight).toBe(12345);
+    expect(wire.timelockHeight).toBe(700);
+  });
+
+  it('leaves heights absent for plain P2ID proposals (pre-#366 wire shape)', () => {
+    const md = ProposalMetadataCodec.fromGuardian(baseWire) as P2IdProposalMetadata;
+    expect(md.reclaimHeight).toBeUndefined();
+    expect(md.timelockHeight).toBeUndefined();
+
+    const wire = ProposalMetadataCodec.toGuardian(md);
+    expect(wire.reclaimHeight).toBeUndefined();
+    expect(wire.timelockHeight).toBeUndefined();
+  });
+
+  it('fromGuardian rejects a zero height (encodes "no constraint" on-chain)', () => {
+    expect(() =>
+      ProposalMetadataCodec.fromGuardian({ ...baseWire, reclaimHeight: 0 }),
+    ).toThrow(/unsupported reclaimHeight/);
+  });
+
+  it('fromGuardian rejects a non-integer or out-of-range height', () => {
+    expect(() =>
+      ProposalMetadataCodec.fromGuardian({ ...baseWire, timelockHeight: 1.5 }),
+    ).toThrow(/unsupported timelockHeight/);
+    expect(() =>
+      ProposalMetadataCodec.fromGuardian({ ...baseWire, reclaimHeight: 0x1_0000_0000 }),
+    ).toThrow(/unsupported reclaimHeight/);
+  });
+
+  it('validate rejects an invalid height', () => {
+    const md = {
+      proposalType: 'p2id',
+      description: '',
+      recipientId: '0xrecipient',
+      faucetId: '0xfaucet',
+      amount: '1000',
+      reclaimHeight: -1,
+    } as unknown as P2IdProposalMetadata;
+    expect(() => ProposalMetadataCodec.validate(md)).toThrow(/unsupported reclaimHeight/);
+  });
+
+  it('toGuardian rejects an invalid height instead of emitting it on the wire', () => {
+    const base = {
+      proposalType: 'p2id',
+      description: '',
+      recipientId: '0xrecipient',
+      faucetId: '0xfaucet',
+      amount: '1000',
+    };
+    expect(() =>
+      ProposalMetadataCodec.toGuardian({ ...base, reclaimHeight: 0 } as P2IdProposalMetadata),
+    ).toThrow(/unsupported reclaimHeight/);
+    expect(() =>
+      ProposalMetadataCodec.toGuardian({ ...base, timelockHeight: 1.5 } as P2IdProposalMetadata),
+    ).toThrow(/unsupported timelockHeight/);
+  });
+});

package/src/proposal/metadata.ts

@@ -1,7 +1,7 @@
 import type { ProposalMetadata as GuardianProposalMetadata } from '@openzeppelin/guardian-client';
 import type { ProposalMetadata } from '../types.js';
 import { isProcedureName } from '../procedures.js';
-import { isP2idNoteVisibility } from '../types/proposal.js';
+import { isP2idNoteVisibility, parseP2ideHeight } from '../types/proposal.js';
 
 export class ProposalMetadataCodec {
   static toGuardian(metadata: ProposalMetadata): GuardianProposalMetadata {
@@ -10,6 +10,7 @@ export class ProposalMetadataCodec {
       description: metadata.description,
       salt: metadata.saltHex,
       requiredSignatures: metadata.requiredSignatures,
+      chainAnchor: metadata.chainAnchor,
     };
 
     switch (metadata.proposalType) {
@@ -30,6 +31,11 @@ export class ProposalMetadataCodec {
           // keeps the pre-#322 wire shape and matches the Rust encoder (which
           // round-trips through the NoteType enum). Absent => public.
           noteType: metadata.noteType === 'private' ? 'private' : undefined,
+          // Validated on encode too: the create path already rejects bad
+          // heights when building the note, but metadata handed directly to
+          // the codec must not reach the wire with a value cosigners reject.
+          reclaimHeight: parseP2ideHeight('reclaimHeight', metadata.reclaimHeight),
+          timelockHeight: parseP2ideHeight('timelockHeight', metadata.timelockHeight),
         };
       case 'switch_guardian':
         return {
@@ -68,6 +74,7 @@ export class ProposalMetadataCodec {
       description: guardian.description ?? '',
       saltHex: guardian.salt,
       requiredSignatures: guardian.requiredSignatures,
+      chainAnchor: guardian.chainAnchor,
     };
 
     switch (guardian.proposalType) {
@@ -87,6 +94,8 @@ export class ProposalMetadataCodec {
           faucetId: guardian.faucetId,
           amount: guardian.amount,
           noteType: guardian.noteType,
+          reclaimHeight: parseP2ideHeight('reclaimHeight', guardian.reclaimHeight),
+          timelockHeight: parseP2ideHeight('timelockHeight', guardian.timelockHeight),
         };
       case 'consume_notes':
         if (!guardian.noteIds || guardian.noteIds.length === 0) {
@@ -138,7 +147,7 @@ export class ProposalMetadataCodec {
         };
       default:
         // Any proposal type the SDK does not model collapses to the 'custom'
-        // bucket while preserving the original label (issue #266).
+        // bucket while preserving the original label.
         return {
           ...base,
           proposalType: 'custom',
@@ -182,6 +191,8 @@ export class ProposalMetadataCodec {
         if (metadata.noteType !== undefined && !isP2idNoteVisibility(metadata.noteType)) {
           throw new Error(`p2id proposal has unsupported noteType '${metadata.noteType}'`);
         }
+        parseP2ideHeight('reclaimHeight', metadata.reclaimHeight);
+        parseP2ideHeight('timelockHeight', metadata.timelockHeight);
         return metadata;
       case 'custom':
         // Custom proposals are opaque to the SDK; nothing to validate beyond

package/src/prover/errors.test.ts

@@ -50,4 +50,12 @@ describe('isTransientProverError', () => {
     expect(isTransientProverError({ code: 14, message: 'unavailable' })).toBe(true);
     expect(isTransientProverError({ code: 3, message: 'timeout text' })).toBe(false);
   });
+
+  it('reads grpc code wording out of plain message text', () => {
+    expect(isTransientProverError(new Error('grpc code: NotFound'))).toBe(false);
+    expect(
+      isTransientProverError(new Error('grpc code: Internal; nested timeout')),
+    ).toBe(false);
+    expect(isTransientProverError(new Error('grpc code: Unavailable'))).toBe(true);
+  });
 });

package/src/prover/errors.ts

@@ -1,178 +1,10 @@
-type ErrorRecord = {
-  cause?: unknown;
-  code?: unknown;
-  status?: unknown;
-  statusCode?: unknown;
-  message?: unknown;
-};
-
-type StructuredEvidence = 'transient' | 'permanent' | 'indeterminate';
-
-const TRANSIENT_GRPC = new Set([
-  'cancelled',
-  'canceled',
-  'deadlineexceeded',
-  'unavailable',
-  'resourceexhausted',
-]);
-
-const PERMANENT_GRPC = new Set([
-  'invalidargument',
-  'failedprecondition',
-  'permissiondenied',
-  'unauthenticated',
-  'notfound',
-  'alreadyexists',
-  'outofrange',
-  'unimplemented',
-  'aborted',
-  'internal',
-  'dataloss',
-]);
-
-const TRANSIENT_HTTP = new Set([408, 429, 502, 503, 504]);
-const NUMERIC_GRPC_CODES = new Map<number, string>([
-  [0, 'ok'],
-  [1, 'cancelled'],
-  [2, 'unknown'],
-  [3, 'invalidargument'],
-  [4, 'deadlineexceeded'],
-  [5, 'notfound'],
-  [6, 'alreadyexists'],
-  [7, 'permissiondenied'],
-  [8, 'resourceexhausted'],
-  [9, 'failedprecondition'],
-  [10, 'aborted'],
-  [11, 'outofrange'],
-  [12, 'unimplemented'],
-  [13, 'internal'],
-  [14, 'unavailable'],
-  [15, 'dataloss'],
-  [16, 'unauthenticated'],
-]);
-
-function normalizeCode(value: unknown): string | undefined {
-  if (typeof value === 'number') {
-    return NUMERIC_GRPC_CODES.get(value);
-  }
-  return typeof value === 'string' ? value.replaceAll(/[\s_-]/g, '').toLowerCase() : undefined;
-}
-
-function grpcEvidence(value: unknown): StructuredEvidence | undefined {
-  const code = normalizeCode(value);
-  if (code === undefined) {
-    return undefined;
-  }
-  if (TRANSIENT_GRPC.has(code)) {
-    return 'transient';
-  }
-  if (PERMANENT_GRPC.has(code)) {
-    return 'permanent';
-  }
-  if (code === 'unknown' || code === 'ok') {
-    return 'indeterminate';
-  }
-  return undefined;
-}
-
-function httpEvidence(value: unknown): StructuredEvidence | undefined {
-  if (typeof value !== 'number' || !Number.isInteger(value) || value < 400 || value > 599) {
-    return undefined;
-  }
-  return TRANSIENT_HTTP.has(value) ? 'transient' : 'permanent';
-}
-
-function httpMessageEvidence(message: string): StructuredEvidence | undefined {
-  let hasTransient = false;
-  for (const match of message.matchAll(
-    /(?:\bhttp(?:\s+status)?|\bstatus\s*:?)\s*(\d{3})\b/g,
-  )) {
-    const evidence = httpEvidence(Number(match[1]));
-    if (evidence === 'permanent') {
-      return 'permanent';
-    }
-    hasTransient ||= evidence === 'transient';
-  }
-  return hasTransient ? 'transient' : undefined;
-}
-
-function flattenedTransient(message: string): boolean {
-  return [
-    'cancelled',
-    'canceled',
-    'deadline exceeded',
-    'timeout',
-    'unavailable',
-    'resource exhausted',
-    'request timeout',
-    'too many requests',
-    'rate limited',
-    'rate limit',
-    'bad gateway',
-    'service unavailable',
-    'gateway timeout',
-    'i/o timeout',
-    'io timeout',
-    'connection reset',
-    'broken pipe',
-  ].some((signal) => message.includes(signal));
-}
-
-function asRecord(value: unknown): ErrorRecord | undefined {
-  return typeof value === 'object' && value !== null ? value as ErrorRecord : undefined;
-}
+import { isTransientError } from '../retry/classify.js';
 
+/**
+ * Prover-policy classification: the shared classifier with no transport-text
+ * extras — a bare "connection error" from a prover is treated as its
+ * considered answer.
+ */
 export function isTransientProverError(error: unknown): boolean {
-  const seen = new Set<object>();
-  const messages: string[] = [];
-  let hasTransient = false;
-  let hasPermanent = false;
-  let current: unknown = error;
-
-  while (current !== undefined && current !== null) {
-    const record = asRecord(current);
-    if (record !== undefined) {
-      if (seen.has(record)) {
-        break;
-      }
-      seen.add(record);
-      for (const evidence of [
-        grpcEvidence(record.code),
-        httpEvidence(record.status),
-        httpEvidence(record.statusCode),
-      ]) {
-        hasTransient ||= evidence === 'transient';
-        hasPermanent ||= evidence === 'permanent';
-      }
-      if (typeof record.message === 'string') {
-        const message = record.message.toLowerCase();
-        messages.push(message);
-        const evidence = httpMessageEvidence(message);
-        hasTransient ||= evidence === 'transient';
-        hasPermanent ||= evidence === 'permanent';
-      } else {
-        const message = String(current).toLowerCase();
-        messages.push(message);
-        const evidence = httpMessageEvidence(message);
-        hasTransient ||= evidence === 'transient';
-        hasPermanent ||= evidence === 'permanent';
-      }
-      current = record.cause;
-    } else {
-      const message = String(current).toLowerCase();
-      messages.push(message);
-      const evidence = httpMessageEvidence(message);
-      hasTransient ||= evidence === 'transient';
-      hasPermanent ||= evidence === 'permanent';
-      break;
-    }
-  }
-
-  if (hasPermanent) {
-    return false;
-  }
-  if (hasTransient) {
-    return true;
-  }
-  return messages.some(flattenedTransient);
+  return isTransientError(error);
 }

package/src/prover/retry.test.ts

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vitest';
-import { retryDelay } from './retry.js';
+import { retryDelay } from '../retry/runtime.js';
 
 interface Fixtures {
   delays: Array<{ retryIndex: number; unitRandom: number; delayMs: number }>;

package/src/prover/retry.ts

@@ -1,46 +1,21 @@
 import type { TransactionExecution, TransactionProof } from '@miden-sdk/miden-sdk';
 import type { ResolvedProverConfig } from './config.js';
 import { isTransientProverError } from './errors.js';
-
-const BASE_DELAY_MS = 500;
-const MAX_DELAY_MS = 8_000;
-
-export interface RetryRuntime {
-  sleep(delayMs: number): Promise<void>;
-  unitRandom(): number;
-}
-
-export const productionRetryRuntime: RetryRuntime = {
-  sleep: (delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs)),
-  unitRandom: () => Math.random(),
-};
-
-export function retryDelay(retryIndex: number, unitRandom: number): number {
-  const exponent = Math.min(retryIndex, 1023);
-  const raw = BASE_DELAY_MS * 2 ** exponent;
-  const finiteRandom = Number.isFinite(unitRandom) ? unitRandom : 0.5;
-  const boundedRandom = Math.min(Math.max(finiteRandom, 0), 1 - Number.EPSILON);
-  return Math.min(Math.floor(raw * (0.75 + boundedRandom * 0.5)), MAX_DELAY_MS);
-}
+import type { RetryRuntime } from '../retry/runtime.js';
+import { productionRetryRuntime, retryTransient } from '../retry/runtime.js';
 
 export async function proveWithRetry(
   execution: TransactionExecution,
   config: ResolvedProverConfig,
   runtime: RetryRuntime = productionRetryRuntime,
 ): Promise<TransactionProof> {
-  for (let attempt = 0; attempt < config.maxAttempts; attempt += 1) {
-    try {
+  return retryTransient(
+    async () => {
       const prover = config.createProver();
-      return prover === undefined
-        ? await execution.prove()
-        : await execution.prove({ prover });
-    } catch (error) {
-      if (!isTransientProverError(error) || attempt + 1 >= config.maxAttempts) {
-        throw error;
-      }
-      await runtime.sleep(retryDelay(attempt, runtime.unitRandom()));
-    }
-  }
-
-  throw new Error('unreachable prover retry state');
+      return prover === undefined ? await execution.prove() : await execution.prove({ prover });
+    },
+    config.maxAttempts,
+    isTransientProverError,
+    runtime,
+  );
 }

package/src/prover/workflow.test.ts

@@ -1,18 +1,21 @@
 import type {
   AccountId,
+  ChainAnchor,
   MidenClient,
   TransactionProver,
   TransactionRequest,
 } from '@miden-sdk/miden-sdk';
 import { describe, expect, it, vi } from 'vitest';
 import type { ResolvedProverConfig } from './config.js';
-import type { RetryRuntime } from './retry.js';
+import type { RetryRuntime } from '../retry/runtime.js';
 import { ProverWorkflow } from './workflow.js';
 
 function asType<T>(value: unknown): T {
   return value as T;
 }
 
+const anchor = asType<ChainAnchor>({ marker: 'anchor' });
+
 describe('ProverWorkflow', () => {
   it('executes once, retries proof with fresh provers, submits once, and applies once', async () => {
     const transient = Object.assign(new Error('temporarily unavailable'), {
@@ -47,12 +50,14 @@ describe('ProverWorkflow', () => {
       runtime,
     );
 
-    await workflow.submit(
+    await workflow.submitAt(
       asType<AccountId>({}),
       asType<TransactionRequest>({}),
+      anchor,
     );
 
     expect(executeRequest).toHaveBeenCalledTimes(1);
+    expect(executeRequest.mock.calls[0][2]).toEqual({ anchor });
     expect(prove).toHaveBeenCalledTimes(2);
     expect(provers).toHaveLength(2);
     expect(provers[0]).not.toBe(provers[1]);
@@ -83,12 +88,43 @@ describe('ProverWorkflow', () => {
     );
 
     await expect(
-      workflow.submit(asType<AccountId>({}), asType<TransactionRequest>({})),
+      workflow.submitAt(asType<AccountId>({}), asType<TransactionRequest>({}), anchor),
     ).rejects.toBe(final);
     expect(prove).toHaveBeenCalledTimes(2);
     expect(runtime.sleep).toHaveBeenCalledTimes(1);
   });
 
+  it('never re-submits when submission fails with transient-looking wording', async () => {
+    const rateLimited = Object.assign(new Error('Too Many Requests!'), {
+      code: 'ResourceExhausted',
+    });
+    const submit = vi.fn().mockRejectedValue(rateLimited);
+    const prove = vi.fn().mockResolvedValue({ submit });
+    const client = {
+      transactions: { executeRequest: vi.fn().mockResolvedValue({ prove }) },
+    };
+    const runtime: RetryRuntime = {
+      sleep: vi.fn().mockResolvedValue(undefined),
+      unitRandom: () => 0.5,
+    };
+    const workflow = new ProverWorkflow(
+      asType<MidenClient>(client),
+      {
+        kind: 'remote',
+        maxAttempts: 5,
+        createProver: () => asType<TransactionProver>({}),
+      },
+      runtime,
+    );
+
+    await expect(
+      workflow.submitAt(asType<AccountId>({}), asType<TransactionRequest>({}), anchor),
+    ).rejects.toBe(rateLimited);
+    expect(prove).toHaveBeenCalledTimes(1);
+    expect(submit).toHaveBeenCalledTimes(1);
+    expect(runtime.sleep).not.toHaveBeenCalled();
+  });
+
   it('uses the injected prover directly when no cloneable remote override exists', async () => {
     const apply = vi.fn().mockResolvedValue({});
     const submit = vi.fn().mockResolvedValue({ apply });
@@ -102,7 +138,7 @@ describe('ProverWorkflow', () => {
       createProver: () => undefined,
     });
 
-    await workflow.submit(asType<AccountId>({}), asType<TransactionRequest>({}));
+    await workflow.submitAt(asType<AccountId>({}), asType<TransactionRequest>({}), anchor);
 
     expect(prove).toHaveBeenCalledWith();
   });

package/src/prover/workflow.ts

@@ -1,6 +1,11 @@
-import type { AccountId, MidenClient, TransactionRequest } from '@miden-sdk/miden-sdk';
+import type {
+  AccountId,
+  ChainAnchor,
+  MidenClient,
+  TransactionRequest,
+} from '@miden-sdk/miden-sdk';
 import type { ResolvedProverConfig } from './config.js';
-import type { RetryRuntime } from './retry.js';
+import type { RetryRuntime } from '../retry/runtime.js';
 import { proveWithRetry } from './retry.js';
 
 export class ProverWorkflow {
@@ -10,8 +15,15 @@ export class ProverWorkflow {
     private readonly runtime?: RetryRuntime,
   ) {}
 
-  async submit(accountId: AccountId, request: TransactionRequest): Promise<void> {
-    const execution = await this.client.transactions.executeRequest(accountId, request);
+  /** Proves, submits, and applies a request at its signed chain anchor. */
+  async submitAt(
+    accountId: AccountId,
+    request: TransactionRequest,
+    anchor: ChainAnchor,
+  ): Promise<void> {
+    const execution = await this.client.transactions.executeRequest(accountId, request, {
+      anchor,
+    });
     const proof = await proveWithRetry(execution, this.config, this.runtime);
     const submission = await proof.submit();
     await submission.apply();