@openzeppelin/miden-multisig-client 0.17.0-rc.2 → 0.17.0-rc.3

package/dist/recovery/recoverNotes.js

@@ -0,0 +1,163 @@
+/**
+ * Wallet-facing orchestration of the note-recovery primitives.
+ *
+ * After key-based recovery the local Miden store starts empty (or, in a
+ * shared store, its global cursors may already be past this account's
+ * notes). Each recovery primitive rescans one source normal forward sync
+ * would skip: the private-note transport backlog, the notes embedded in
+ * pending consume-notes proposals, and the chain's historical public notes
+ * for the account's tag. `Multisig.recoverNotes` runs them as a single flow
+ * and finishes with a normal sync so recovered notes are verified and ready
+ * to consume.
+ *
+ * The TS counterpart of the Rust SDK's `MultisigClient::recover_notes`,
+ * with matching semantics and report shape.
+ */
+import { errorMessage } from '../connectivity.js';
+import { RecoveryCancelledError } from './proposalNoteImport.js';
+import { BackfillRangeError } from './publicNoteBackfill.js';
+/**
+ * The guardian-switch slice of {@link RecoverNotesOptions}: only the
+ * proposal-embedded note import runs. Internal — the public entry point is
+ * `Multisig.preservePreSwitchProposalNotes`, which adds the switch-specific
+ * safety contract (timeout, cancellation, warnings) around this slice. The
+ * `satisfies` clause forces every non-range option to be listed, so adding
+ * a recovery strategy fails to compile until the switch path decides on it.
+ */
+export const GUARDIAN_SWITCH_RECOVERY_OPTIONS = {
+    transportDrain: false,
+    proposalImport: true,
+    publicBackfill: false,
+    syncAfter: false,
+};
+function countImported(outcomes) {
+    return outcomes.filter((o) => o.status === 'imported').length;
+}
+/**
+ * Runs the enabled recovery strategies in order — transport drain, proposal
+ * import, public backfill, final sync — folding each strategy-level throw
+ * into a {@link RecoveryStepProblem} so no step failure aborts the flow.
+ *
+ * The optional `cancelled` token makes the run cooperatively cancellable:
+ * the orchestrator checks it before each step, and a
+ * {@link RecoveryCancelledError} from inside a step is recorded as one
+ * non-retryable problem on the interrupted step, after which no further
+ * step runs — cancellation never masquerades as a GUARDIAN or node outage.
+ *
+ * Throws only for an inverted backfill range (a caller error). See
+ * `Multisig.recoverNotes` for the wallet-facing entry point.
+ */
+export async function runNoteRecovery(options, steps, cancelled) {
+    if (options.fromBlock !== undefined &&
+        options.toBlock !== undefined &&
+        options.fromBlock > options.toBlock) {
+        throw new Error(`backfill range is inverted: fromBlock ${options.fromBlock} > toBlock ${options.toBlock}`);
+    }
+    const report = {
+        problems: [],
+        synced: false,
+        imported: 0,
+        retryable: false,
+    };
+    // Set once a cancellation is observed (token flipped, or a
+    // RecoveryCancelledError surfaced from a step): the remaining steps are
+    // skipped and exactly one problem records the interruption point.
+    let stopped = false;
+    const interrupted = (step, err) => {
+        if (!(err instanceof RecoveryCancelledError)) {
+            return false;
+        }
+        report.problems.push({ step, reason: errorMessage(err), retryable: false });
+        stopped = true;
+        return true;
+    };
+    const startStep = (step) => {
+        if (stopped) {
+            return false;
+        }
+        if (cancelled?.()) {
+            report.problems.push({
+                step,
+                reason: 'note recovery stopped before completion by its caller',
+                retryable: false,
+            });
+            stopped = true;
+            return false;
+        }
+        return true;
+    };
+    if (options.transportDrain !== false && startStep('transport-drain')) {
+        try {
+            report.transport = await steps.transportDrain();
+        }
+        catch (err) {
+            if (!interrupted('transport-drain', err)) {
+                // The drain's contract: a throw means the local store itself failed,
+                // which a rerun is unlikely to fix.
+                report.problems.push({
+                    step: 'transport-drain',
+                    reason: errorMessage(err),
+                    retryable: false,
+                });
+            }
+        }
+    }
+    if (options.proposalImport !== false && startStep('proposal-import')) {
+        try {
+            report.proposalImport = await steps.proposalImport();
+        }
+        catch (err) {
+            if (!interrupted('proposal-import', err)) {
+                report.problems.push({
+                    step: 'proposal-import',
+                    reason: `failed to list pending proposals: ${errorMessage(err)}`,
+                    retryable: true,
+                });
+            }
+        }
+    }
+    if (options.publicBackfill !== false && startStep('public-backfill')) {
+        try {
+            report.backfill = await steps.publicBackfill();
+        }
+        catch (err) {
+            if (!interrupted('public-backfill', err)) {
+                // With the fully-explicit range validated above, a throw here is
+                // normally the chain-tip lookup (a node RPC failure, worth retrying);
+                // an invalid range against the resolved tip is a caller error and is
+                // not — mirroring the Rust orchestrator's `InvalidConfig` check.
+                report.problems.push({
+                    step: 'public-backfill',
+                    reason: errorMessage(err),
+                    retryable: !(err instanceof BackfillRangeError),
+                });
+            }
+        }
+    }
+    if (options.syncAfter !== false && startStep('sync')) {
+        try {
+            await steps.sync();
+            report.synced = true;
+        }
+        catch (err) {
+            if (!interrupted('sync', err)) {
+                report.problems.push({
+                    step: 'sync',
+                    reason: `recovery imports succeeded but the verifying sync failed; rerun a sync: ${errorMessage(err)}`,
+                    retryable: true,
+                });
+            }
+        }
+    }
+    report.imported =
+        (report.transport?.imported ?? 0) +
+            countImported(report.proposalImport ?? []) +
+            countImported(report.backfill?.outcomes ?? []);
+    report.retryable =
+        report.problems.some((p) => p.retryable) ||
+            report.transport?.retryable === true ||
+            (report.proposalImport ?? []).some((o) => o.retryable) ||
+            report.backfill?.retryable === true;
+    return report;
+}
+//# sourceMappingURL=recoverNotes.js.map

package/dist/recovery/recoverNotes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoverNotes.js","sourceRoot":"","sources":["../../src/recovery/recoverNotes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAA6B,MAAM,yBAAyB,CAAC;AAgGxF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,KAAK;CACsD,CAAC;AAiBzE,SAAS,aAAa,CAAC,QAAsC;IAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA4B,EAC5B,KAAwB,EACxB,SAAyB;IAEzB,IACE,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,OAAO,CAAC,OAAO,KAAK,SAAS;QAC7B,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,EACnC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yCAAyC,OAAO,CAAC,SAAS,cAAc,OAAO,CAAC,OAAO,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAuB;QACjC,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,2DAA2D;IAC3D,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,WAAW,GAAG,CAAC,IAAkB,EAAE,GAAY,EAAW,EAAE;QAChE,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,IAAkB,EAAW,EAAE;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,EAAE,EAAE,EAAE,CAAC;YAClB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,IAAI;gBACJ,MAAM,EAAE,uDAAuD;gBAC/D,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,IAAI,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,CAAC,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzC,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC;oBACzB,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,IAAI,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,qCAAqC,YAAY,CAAC,GAAG,CAAC,EAAE;oBAChE,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,IAAI,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzC,iEAAiE;gBACjE,sEAAsE;gBACtE,qEAAqE;gBACrE,iEAAiE;gBACjE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC;oBACzB,SAAS,EAAE,CAAC,CAAC,GAAG,YAAY,kBAAkB,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,2EAA2E,YAAY,CAAC,GAAG,CAAC,EAAE;oBACtG,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAQ;QACb,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,IAAI,CAAC,CAAC;YACjC,aAAa,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;YAC1C,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,SAAS;QACd,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,MAAM,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI;YACpC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,MAAM,CAAC,QAAQ,EAAE,SAAS,KAAK,IAAI,CAAC;IAEtC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/recovery/transportDrain.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Recovery primitives for restoring note state after device loss.
+ *
+ * After recovery on a fresh device the local store has no note-transport
+ * cursor — and in a shared dirty store another account's sync may have
+ * advanced the cursor past notes belonging to the newly recovered account.
+ * The primitives here rescan sources that normal forward sync would skip.
+ */
+import type { MidenClient } from '@miden-sdk/miden-sdk';
+/**
+ * Outcome class of a private-note transport backlog drain:
+ * - `completed` — the full transport backlog was scanned; every note the
+ *   transport still holds for the tracked tags is now in the local store.
+ * - `unavailable` — the transport could not be consulted at all: it is
+ *   disabled for the injected `MidenClient` (no `noteTransportUrl`
+ *   configured) or unreachable before anything was imported (`imported` is
+ *   always 0 — a connection lost mid-drain after partial progress reports
+ *   `failed` instead). The rest of a recovery flow should proceed without
+ *   transport notes.
+ * - `failed` — the drain started but did not finish; the backlog may be
+ *   partially imported. `retryable` distinguishes transient failures (rerun
+ *   the drain) from permanent ones.
+ */
+export type TransportRecoveryStatus = 'completed' | 'unavailable' | 'failed';
+/**
+ * Result of {@link drainPrivateNoteBacklog}.
+ *
+ * Transport problems are reported here rather than thrown so a transport
+ * failure never aborts the rest of a recovery flow.
+ */
+export interface TransportRecoveryReport {
+    /** Outcome class of the drain. */
+    status: TransportRecoveryStatus;
+    /**
+     * Number of note records newly imported into the local store by this
+     * drain. Can be non-zero even on `failed`: batches imported before the
+     * failure stay imported.
+     */
+    imported: number;
+    /**
+     * Whether rerunning the drain can plausibly succeed (transient
+     * connectivity failures, the upstream pagination convergence guard).
+     * Always `false` on `completed`.
+     */
+    retryable: boolean;
+    /** Human-readable cause when the drain did not complete. */
+    reason?: string;
+}
+/**
+ * The WASM client surfaces the upstream transport errors as plain messages,
+ * so the message text is the only stable join key (same approach as
+ * `connectivity.ts`). These fragments come from miden-client's
+ * `NoteTransportError` `Display` impls.
+ */
+/** Exported for the drift-guard test, which pins them against the shipped WASM binary. */
+export declare const TRANSPORT_DISABLED_FRAGMENT = "note transport is disabled";
+/** Exported for the drift-guard test, which pins them against the shipped WASM binary. */
+export declare const PAGINATION_GUARD_FRAGMENT = "did not converge";
+/**
+ * `NoteTransportError::Network`'s Display prefix — the transport service
+ * answered with an error. Exported for the drift-guard test.
+ */
+export declare const TRANSPORT_NETWORK_FRAGMENT = "note transport network error";
+/**
+ * `NoteTransportError::Connection`'s Display prefix — endpoint parsing, TLS
+ * configuration, and actual connect failures, indiscriminately. Exported for
+ * the drift-guard test.
+ */
+export declare const TRANSPORT_CONNECTION_FRAGMENT = "connection error";
+/**
+ * `RpcError::RequestError`'s Display prefix — a NODE RPC failure (each
+ * fetched batch is imported through the node, so this is a mid-drain import
+ * failure, not a transport outage). Exported for the drift-guard test.
+ */
+export declare const NODE_RPC_FRAGMENT = "grpc request failed";
+/**
+ * `RpcError::ConnectionError`'s Display text — the NODE could not be
+ * reached at all, which mid-drain is the same interrupted-import class as
+ * {@link NODE_RPC_FRAGMENT}. Exported for the drift-guard test.
+ */
+export declare const NODE_CONNECT_FRAGMENT = "failed to connect to the Miden node";
+/**
+ * The covered-tags bookkeeping key, mirror of miden-client's
+ * `NOTE_TRANSPORT_COVERED_TAGS_KEY` (the JS surface does not re-export it).
+ * Exported for the drift-guard test, which pins it against the shipped WASM
+ * binary so a silent upstream rename cannot degrade the drain to a no-op.
+ */
+export declare const NOTE_TRANSPORT_COVERED_TAGS_KEY = "note_transport_covered_tags";
+/**
+ * `ClientError::StoreError`'s Display prefix in the WASM error chain.
+ * Exported for the drift-guard test, which pins it against the shipped WASM
+ * binary.
+ */
+export declare const STORE_ERROR_FRAGMENT = "storage error";
+/**
+ * Rescans the full private-note transport backlog for every tracked note tag
+ * and imports what it finds, regardless of the stored transport
+ * cursor. Counterpart of `MultisigClient::drain_private_note_backlog`
+ * in the Rust SDK; the WASM boundary exposes only error message text, so
+ * failure classification here is message-based, keyed on the upstream
+ * Display prefixes pinned by the drift-guard test.
+ *
+ * Use after account recovery, passing the **same** `MidenClient` instance
+ * that was injected into `MultisigClient`: a fresh store has no transport
+ * cursor, and in a shared store another account's sync may have advanced the
+ * cursor past this account's notes. The drain is idempotent, tag-scoped (the
+ * recovered account must already be in the store so its note tag is tracked
+ * — `MultisigClient.load` does this), and never regresses an
+ * already-advanced cursor.
+ *
+ * Transport recovery is bounded by the transport service's retention:
+ * senders may bypass the transport entirely and relayed blobs are pruned
+ * after the retention window, so this is a best-effort rescan, **not** a
+ * backup. Transport-disabled and transport-unreachable outcomes are reported
+ * in the {@link TransportRecoveryReport} rather than thrown; this function
+ * only throws when the local store itself fails.
+ *
+ * The rescan runs as many transport syncs as the upstream per-sync tag
+ * backfill cap requires to cover every tracked tag, and a failed drain
+ * restores the pre-drain covered-tags bookkeeping so normal sync keeps
+ * working exactly as it did before the attempt.
+ */
+export declare function drainPrivateNoteBacklog(midenClient: MidenClient): Promise<TransportRecoveryReport>;
+//# sourceMappingURL=transportDrain.d.ts.map

package/dist/recovery/transportDrain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportDrain.d.ts","sourceRoot":"","sources":["../../src/recovery/transportDrain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,MAAM,EAAE,uBAAuB,CAAC;IAChC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AACxE,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAC5D;;;GAGG;AACH,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AACzE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAChE;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,wCAAwC,CAAC;AAC3E;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,gCAAgC,CAAC;AAgB7E;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAoHpD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,uBAAuB,CAAC,CAqElC"}

package/dist/recovery/transportDrain.js

@@ -0,0 +1,262 @@
+/**
+ * Recovery primitives for restoring note state after device loss.
+ *
+ * After recovery on a fresh device the local store has no note-transport
+ * cursor — and in a shared dirty store another account's sync may have
+ * advanced the cursor past notes belonging to the newly recovered account.
+ * The primitives here rescan sources that normal forward sync would skip.
+ */
+import { errorMessage, isLikelyNetworkError } from '../connectivity.js';
+import { isTransientRpcError } from '../rpc/errors.js';
+/**
+ * The WASM client surfaces the upstream transport errors as plain messages,
+ * so the message text is the only stable join key (same approach as
+ * `connectivity.ts`). These fragments come from miden-client's
+ * `NoteTransportError` `Display` impls.
+ */
+/** Exported for the drift-guard test, which pins them against the shipped WASM binary. */
+export const TRANSPORT_DISABLED_FRAGMENT = 'note transport is disabled';
+/** Exported for the drift-guard test, which pins them against the shipped WASM binary. */
+export const PAGINATION_GUARD_FRAGMENT = 'did not converge';
+/**
+ * `NoteTransportError::Network`'s Display prefix — the transport service
+ * answered with an error. Exported for the drift-guard test.
+ */
+export const TRANSPORT_NETWORK_FRAGMENT = 'note transport network error';
+/**
+ * `NoteTransportError::Connection`'s Display prefix — endpoint parsing, TLS
+ * configuration, and actual connect failures, indiscriminately. Exported for
+ * the drift-guard test.
+ */
+export const TRANSPORT_CONNECTION_FRAGMENT = 'connection error';
+/**
+ * `RpcError::RequestError`'s Display prefix — a NODE RPC failure (each
+ * fetched batch is imported through the node, so this is a mid-drain import
+ * failure, not a transport outage). Exported for the drift-guard test.
+ */
+export const NODE_RPC_FRAGMENT = 'grpc request failed';
+/**
+ * `RpcError::ConnectionError`'s Display text — the NODE could not be
+ * reached at all, which mid-drain is the same interrupted-import class as
+ * {@link NODE_RPC_FRAGMENT}. Exported for the drift-guard test.
+ */
+export const NODE_CONNECT_FRAGMENT = 'failed to connect to the Miden node';
+/**
+ * The covered-tags bookkeeping key, mirror of miden-client's
+ * `NOTE_TRANSPORT_COVERED_TAGS_KEY` (the JS surface does not re-export it).
+ * Exported for the drift-guard test, which pins it against the shipped WASM
+ * binary so a silent upstream rename cannot degrade the drain to a no-op.
+ */
+export const NOTE_TRANSPORT_COVERED_TAGS_KEY = 'note_transport_covered_tags';
+/**
+ * Mirror of miden-client's `Client::MAX_BACKFILL_TAGS_PER_SYNC`: upstream
+ * backfills at most this many uncovered tags per transport sync, deferring
+ * the remainder to the next sync.
+ */
+const MAX_BACKFILL_TAGS_PER_SYNC = 64;
+/**
+ * Mirror of the Rust SDK's `CONNECT_PERMANENT_SIGNALS`: connection-failure
+ * wording a retry cannot fix (misconfigured endpoint, TLS/certificate
+ * problems). Everything else connection-shaped is the peer-still-booting
+ * case and stays retryable.
+ */
+const CONNECT_PERMANENT_SIGNALS = ['certificate', 'tls', 'invalid uri', 'unsupported scheme'];
+/**
+ * `ClientError::StoreError`'s Display prefix in the WASM error chain.
+ * Exported for the drift-guard test, which pins it against the shipped WASM
+ * binary.
+ */
+export const STORE_ERROR_FRAGMENT = 'storage error';
+/**
+ * IndexedDB/Dexie error names that mean the local store itself failed —
+ * these must reject (matching the Rust `StoreError` branch), never be folded
+ * into a transport report.
+ */
+const STORE_ERROR_NAMES = ['QuotaExceededError', 'DatabaseClosedError', 'ReadOnlyError', 'TransactionInactiveError'];
+/**
+ * Does this failure mean the local store is broken (as opposed to a
+ * transport/node problem)? Kept deliberately narrow: `AbortError` counts
+ * only when its message points at an IndexedDB transaction/database abort —
+ * network requests also abort, and those stay transport-classified.
+ */
+function isLocalStoreError(err) {
+    const message = errorMessage(err);
+    const lower = message.toLowerCase();
+    if (lower.includes(STORE_ERROR_FRAGMENT))
+        return true;
+    const name = typeof err === 'object' && err !== null && 'name' in err && typeof err.name === 'string'
+        ? err.name
+        : undefined;
+    if (name !== undefined && STORE_ERROR_NAMES.includes(name))
+        return true;
+    // The WASM bridge may stringify the underlying store error into the
+    // message rather than preserving the name.
+    if (STORE_ERROR_NAMES.some((storeName) => message.includes(storeName)))
+        return true;
+    if (name === 'AbortError' && (lower.includes('transaction') || lower.includes('database'))) {
+        return true;
+    }
+    return false;
+}
+function classifyDrainFailure(err) {
+    const reason = errorMessage(err);
+    const lower = reason.toLowerCase();
+    // No transport configured — retrying cannot help until the MidenClient is
+    // rebuilt with a `noteTransportUrl`. Thrown before anything is fetched.
+    if (lower.includes(TRANSPORT_DISABLED_FRAGMENT)) {
+        return { status: 'unavailable', retryable: false, reason, scanned: false };
+    }
+    // The upstream convergence guard tripped (the server cursor kept advancing
+    // for 1000 iterations without an empty batch) — a server-side bug, not an
+    // honest backlog. Retryable in the sense that a rerun is safe (imports are
+    // idempotent) and succeeds once the server recovers.
+    if (lower.includes(PAGINATION_GUARD_FRAGMENT)) {
+        return { status: 'failed', retryable: true, reason, scanned: true };
+    }
+    // A NODE RPC failure: each fetched batch is imported through the node
+    // (inclusion-proof lookup), so this interrupted the drain mid-way — the
+    // transport itself was reachable. Mirrors the Rust `ClientError::RpcError`
+    // arm: report `failed`, with the shared RPC classifier deciding whether a
+    // rerun can help.
+    if (lower.includes(NODE_RPC_FRAGMENT) || lower.includes(NODE_CONNECT_FRAGMENT.toLowerCase())) {
+        return { status: 'failed', retryable: isTransientRpcError(err), reason, scanned: true };
+    }
+    // The transport answered with an error — worth retrying once the service
+    // recovers.
+    if (lower.includes(TRANSPORT_NETWORK_FRAGMENT)) {
+        return { status: 'unavailable', retryable: true, reason, scanned: true };
+    }
+    // `Connection` wraps endpoint parsing, TLS configuration, and actual
+    // connect failures indiscriminately; permanent wording (mirroring the Rust
+    // SDK's cause-chain classifier) must not tell a recovery flow to loop
+    // retrying a client that can never connect.
+    if (lower.includes(TRANSPORT_CONNECTION_FRAGMENT)) {
+        const permanent = CONNECT_PERMANENT_SIGNALS.some((signal) => lower.includes(signal));
+        return { status: 'unavailable', retryable: !permanent, reason, scanned: true };
+    }
+    // Remaining connectivity-shaped wording (e.g. a raw fetch failure): the
+    // transport could not be reached; worth retrying once connectivity
+    // returns.
+    if (isLikelyNetworkError(err)) {
+        return { status: 'unavailable', retryable: true, reason, scanned: true };
+    }
+    return { status: 'failed', retryable: false, reason, scanned: true };
+}
+/**
+ * Restores the covered-tags value after a failed drain: returning it to its
+ * pre-drain state keeps a client that synced fine before the attempt
+ * syncing fine after it. Unlike the Rust twin — which merges the snapshot
+ * with whatever the interrupted backfill re-covered — this restores the
+ * snapshot verbatim (the WASM surface exposes the set only as an opaque
+ * value); at worst the next successful drain re-covers tags the failed
+ * attempt already handled, which is idempotent. A failed restoring write
+ * throws: the store is left with its bookkeeping cleared and subsequent
+ * normal syncs may re-drain (and re-fail on) old history — a local-store
+ * environment failure the caller must not fold into a transport report.
+ */
+async function restoreCoveredTags(midenClient, snapshot, drainReason) {
+    if (snapshot === null || snapshot === undefined)
+        return;
+    try {
+        await midenClient.settings.set(NOTE_TRANSPORT_COVERED_TAGS_KEY, snapshot);
+    }
+    catch (restoreError) {
+        throw new Error(`the transport drain failed (${drainReason}) and restoring the covered-tags bookkeeping also failed (${errorMessage(restoreError)}); subsequent syncs may re-drain old transport history`);
+    }
+}
+/**
+ * Rescans the full private-note transport backlog for every tracked note tag
+ * and imports what it finds, regardless of the stored transport
+ * cursor. Counterpart of `MultisigClient::drain_private_note_backlog`
+ * in the Rust SDK; the WASM boundary exposes only error message text, so
+ * failure classification here is message-based, keyed on the upstream
+ * Display prefixes pinned by the drift-guard test.
+ *
+ * Use after account recovery, passing the **same** `MidenClient` instance
+ * that was injected into `MultisigClient`: a fresh store has no transport
+ * cursor, and in a shared store another account's sync may have advanced the
+ * cursor past this account's notes. The drain is idempotent, tag-scoped (the
+ * recovered account must already be in the store so its note tag is tracked
+ * — `MultisigClient.load` does this), and never regresses an
+ * already-advanced cursor.
+ *
+ * Transport recovery is bounded by the transport service's retention:
+ * senders may bypass the transport entirely and relayed blobs are pruned
+ * after the retention window, so this is a best-effort rescan, **not** a
+ * backup. Transport-disabled and transport-unreachable outcomes are reported
+ * in the {@link TransportRecoveryReport} rather than thrown; this function
+ * only throws when the local store itself fails.
+ *
+ * The rescan runs as many transport syncs as the upstream per-sync tag
+ * backfill cap requires to cover every tracked tag, and a failed drain
+ * restores the pre-drain covered-tags bookkeeping so normal sync keeps
+ * working exactly as it did before the attempt.
+ */
+export async function drainPrivateNoteBacklog(midenClient) {
+    const before = (await midenClient.notes.list()).length;
+    // Records are never removed by a drain, so the length delta is the count
+    // of newly imported records. Caveat: it is a store delta — notes imported
+    // by concurrent activity on the same store (a background sync, another
+    // tab) during the drain are attributed to it.
+    const importedSince = async () => Math.max((await midenClient.notes.list()).length - before, 0);
+    // Snapshot the covered-tags value before clearing it: the clear is
+    // durable, and upstream re-marks a tag covered only after its backfill
+    // succeeds — so without a restore, a drain that fails on a tag with a
+    // permanently bad relay blob would leave every tag uncovered and make
+    // every subsequent normal sync re-attempt (and fail) the same backfill.
+    // Store errors here propagate like the count above.
+    const coveredSnapshot = await midenClient.settings.get(NOTE_TRANSPORT_COVERED_TAGS_KEY);
+    let cleared = false;
+    try {
+        // The incremental fetch doubles as the transport probe: miden-sdk 0.16's
+        // syncNoteTransport silently no-ops when the transport is disabled, but
+        // this drain must report `unavailable`, and fetchPrivate still throws
+        // the upstream disabled error.
+        await midenClient.notes.fetchPrivate();
+        // miden-sdk 0.16 replaced the explicit full drain with covered-tag
+        // bookkeeping inside syncNoteTransport: every tag not yet marked covered
+        // is drained from the start with a local cursor (the global cursor is
+        // never regressed), then the steady-state fetch runs. Clearing the
+        // covered-tags marker first forces that full per-tag re-drain — exactly
+        // the recovery semantic this primitive promises. Imports dedupe, so
+        // re-draining already-seen history is harmless.
+        await midenClient.settings.remove(NOTE_TRANSPORT_COVERED_TAGS_KEY);
+        cleared = true;
+        // Upstream backfills at most `MAX_BACKFILL_TAGS_PER_SYNC` uncovered tags
+        // per sync, so run enough passes to cover every tracked tag before
+        // reporting the backlog fully scanned.
+        const tagCount = (await midenClient.tags.list()).length;
+        const passes = Math.max(1, Math.ceil(tagCount / MAX_BACKFILL_TAGS_PER_SYNC));
+        for (let pass = 0; pass < passes; pass += 1) {
+            await midenClient.syncNoteTransport();
+        }
+    }
+    catch (err) {
+        // A broken local store is an environment failure, not a transport
+        // outcome: the whole recovery flow needs to know, so it propagates
+        // (matching the Rust `StoreError` branch) instead of being folded into
+        // the report.
+        if (isLocalStoreError(err)) {
+            throw err;
+        }
+        const { status, retryable, reason, scanned } = classifyDrainFailure(err);
+        if (cleared) {
+            await restoreCoveredTags(midenClient, coveredSnapshot, reason);
+        }
+        // Count even when the drain failed: each fetched batch is imported as it
+        // arrives, so notes recovered before the failure stay in the store. A
+        // disabled transport throws before fetching anything, so skip the
+        // re-count entirely.
+        const imported = scanned ? await importedSince() : 0;
+        if (status === 'unavailable' && imported > 0) {
+            // `unavailable` promises "nothing was imported"; a connection lost
+            // mid-drain after partial progress is an interrupted drain, so report
+            // it as a failure — keeping the classified retryability, like the
+            // Rust twin.
+            return { status: 'failed', imported, retryable, reason };
+        }
+        return { status, imported, retryable, reason };
+    }
+    return { status: 'completed', imported: await importedSince(), retryable: false };
+}
+//# sourceMappingURL=transportDrain.js.map

package/dist/recovery/transportDrain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportDrain.js","sourceRoot":"","sources":["../../src/recovery/transportDrain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA2CvD;;;;;GAKG;AACH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACxE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAC5D;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AACzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAChE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qCAAqC,CAAC;AAC3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAE7E;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;AAC9F;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,EAAE,0BAA0B,CAAC,CAAC;AAErH;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QACtF,CAAC,CAAC,GAAG,CAAC,IAAI;QACV,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,oEAAoE;IACpE,2CAA2C;IAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,SAAS,oBAAoB,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,sEAAsE;IACtE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IACD,yEAAyE;IACzE,YAAY;IACZ,IAAI,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,wEAAwE;IACxE,mEAAmE;IACnE,WAAW;IACX,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,kBAAkB,CAC/B,WAAwB,EACxB,QAAiB,EACjB,WAAmB;IAEnB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACxD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,6DAA6D,YAAY,CAAC,YAAY,CAAC,wDAAwD,CAC1L,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACvD,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,aAAa,GAAG,KAAK,IAAqB,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAEhE,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACxF,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,CAAC;QACH,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,+BAA+B;QAC/B,MAAM,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,wEAAwE;QACxE,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QACnE,OAAO,GAAG,IAAI,CAAC;QACf,yEAAyE;QACzE,mEAAmE;QACnE,uCAAuC;QACvC,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,CAAC,CAAC;QAC7E,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,WAAW,CAAC,iBAAiB,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,mEAAmE;QACnE,uEAAuE;QACvE,cAAc;QACd,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,kBAAkB,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,qBAAqB;QACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,aAAa,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC7C,mEAAmE;YACnE,sEAAsE;YACtE,kEAAkE;YAClE,aAAa;YACb,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC"}

package/dist/transaction/consumeNotes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consumeNotes.d.ts","sourceRoot":"","sources":["../../src/transaction/consumeNotes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,IAAI,EACJ,kBAAkB,EAClB,aAAa,EACb,IAAI,EACL,MAAM,sBAAsB,CAAC;AAW9B,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElF;;;GAGG;AACH,wBAAgB,4CAA4C,CAC1D,KAAK,EAAE,IAAI,EAAE,EACb,OAAO,GAAE,gBAAqB,GAC7B;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CA2B7C;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AACxD,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC"}
+{"version":3,"file":"consumeNotes.d.ts","sourceRoot":"","sources":["../../src/transaction/consumeNotes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,IAAI,EACJ,kBAAkB,EAClB,aAAa,EACb,IAAI,EACL,MAAM,sBAAsB,CAAC;AAW9B,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElF;;;GAGG;AACH,wBAAgB,4CAA4C,CAC1D,KAAK,EAAE,IAAI,EAAE,EACb,OAAO,GAAE,gBAAqB,GAC7B;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CA8B7C;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AACxD,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC"}

package/dist/transaction/consumeNotes.js

@@ -19,7 +19,10 @@ export function buildConsumeNotesTransactionRequestFromNotes(notes, options = {}
     const authSaltForBuilder = WordType.fromHex(normalizeHexWord(authSaltHex));
     let txBuilder = new TransactionRequestBuilder();
     txBuilder = txBuilder.withInputNotes(noteAndArgsArray);
-    txBuilder = txBuilder.withAuthArg(authSaltForBuilder);
+    txBuilder = txBuilder.withFeeConversionSalt(authSaltForBuilder);
+    // Borrows rather than consumes: the glue passes `__wbg_ptr` without taking it,
+    // so the handle stays ours to release once the builder has read it.
+    authSaltForBuilder.free?.();
     if (options.signatureAdviceMap) {
         txBuilder = txBuilder.extendAdviceMap(options.signatureAdviceMap);
     }

package/dist/transaction/consumeNotes.js.map

@@ -1 +1 @@
-{"version":3,"file":"consumeNotes.js","sourceRoot":"","sources":["../../src/transaction/consumeNotes.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,IAAI,IAAI,QAAQ,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD;;;GAGG;AACH,MAAM,UAAU,4CAA4C,CAC1D,KAAa,EACb,UAA4B,EAAE;IAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,gBAAgB,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;IAC/E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAE3E,IAAI,SAAS,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAChD,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACvD,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEtD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE;QAC1B,IAAI,EAAE,iBAAiB;KACxB,CAAC;AACJ,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAmC,EACnC,OAAiB,EACjB,UAA4B,EAAE;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,kCAAkC,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"consumeNotes.js","sourceRoot":"","sources":["../../src/transaction/consumeNotes.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,IAAI,IAAI,QAAQ,GACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD;;;GAGG;AACH,MAAM,UAAU,4CAA4C,CAC1D,KAAa,EACb,UAA4B,EAAE;IAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,gBAAgB,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC;IAC/E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAE3E,IAAI,SAAS,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAChD,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACvD,SAAS,GAAG,SAAS,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAChE,+EAA+E;IAC/E,oEAAoE;IACpE,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE;QAC1B,IAAI,EAAE,iBAAiB;KACxB,CAAC;AACJ,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAmC,EACnC,OAAiB,EACjB,UAA4B,EAAE;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,kCAAkC,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC"}

package/dist/transaction/p2id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"p2id.d.ts","sourceRoot":"","sources":["../../src/transaction/p2id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAML,IAAI,EAOJ,QAAQ,EAIT,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB,EAAE,kBAAkB;IAClF,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAUrE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAErG;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAMvD;AA4CD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CASN;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,sBAA2B,GACnC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CA+B7C"}
+{"version":3,"file":"p2id.d.ts","sourceRoot":"","sources":["../../src/transaction/p2id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAML,IAAI,EAOJ,QAAQ,EAIT,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB,EAAE,kBAAkB;IAClF,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAUrE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAErG;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAMvD;AA4CD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CASN;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,sBAA2B,GACnC;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAkC7C"}

package/dist/transaction/p2id.js

@@ -76,7 +76,10 @@ export function buildP2idTransactionRequest(senderId, recipientId, faucetId, amo
     const authSaltForBuilder = WordType.fromHex(normalizeHexWord(authSaltHex));
     let txBuilder = new TransactionRequestBuilder();
     txBuilder = txBuilder.withOwnOutputNotes(outputNotes);
-    txBuilder = txBuilder.withAuthArg(authSaltForBuilder);
+    txBuilder = txBuilder.withFeeConversionSalt(authSaltForBuilder);
+    // Borrows rather than consumes: the glue passes `__wbg_ptr` without taking it,
+    // so the handle stays ours to release once the builder has read it.
+    authSaltForBuilder.free?.();
     if (options.signatureAdviceMap) {
         txBuilder = txBuilder.extendAdviceMap(options.signatureAdviceMap);
     }