@provablehq/sdk 0.11.2 → 0.11.4

package/dist/mainnet/browser.cjs

@@ -439,7 +439,15 @@ class IndexedDBKeyStore {
  * @returns {string} the encrypted authorization in RFC 4648 standard Base64.
  */
 function encryptAuthorization(publicKey, authorization) {
-    return encryptMessage(publicKey, authorization.toBytesLe());
+    // Zeroize the intermediate plaintext bytes regardless of success or
+    // failure — same pattern as encryptRegistrationRequest.
+    const bytes = authorization.toBytesLe();
+    try {
+        return encryptMessage(publicKey, bytes);
+    }
+    finally {
+        zeroizeBytes(bytes);
+    }
 }
 /**
  * Encrypt a ProvingRequest with a cryptobox X25519 public key (libsodium-compatible wire format).
@@ -450,7 +458,62 @@ function encryptAuthorization(publicKey, authorization) {
  * @returns {string} the encrypted ProvingRequest in RFC 4648 standard Base64.
  */
 function encryptProvingRequest(publicKey, provingRequest) {
-    return encryptMessage(publicKey, provingRequest.toBytesLe());
+    // Zeroize the intermediate plaintext bytes regardless of success or
+    // failure — same pattern as encryptRegistrationRequest.
+    const bytes = provingRequest.toBytesLe();
+    try {
+        return encryptMessage(publicKey, bytes);
+    }
+    finally {
+        zeroizeBytes(bytes);
+    }
+}
+/**
+ * Serialize a ProvingRequest for later encryption with
+ * `encryptSerializedProvingRequest`.
+ *
+ * Useful when the request may have to be encrypted more than once: the
+ * delegated proving service's one-time keys are single-use, so a client that
+ * needs to resend a request (e.g. after the service rejected a spent or
+ * unknown `key_id`) can keep the serialized form and re-encrypt it for a
+ * fresh key instead of rebuilding and re-signing the request.
+ *
+ * The returned buffer contains the plaintext request (including the signed
+ * authorization and its inputs) and is owned by the caller: keep it only as
+ * long as a resend may still be needed, then overwrite it with
+ * `zeroizeBytes(serialized)`. Zeroization in JavaScript is best-effort (see
+ * `zeroizeBytes`), and transient copies made inside the wasm boundary by
+ * `toBytesLe` are outside its reach.
+ *
+ * @param {ProvingRequest} provingRequest the ProvingRequest to serialize.
+ *
+ * @returns {Uint8Array} the serialized ProvingRequest bytes.
+ */
+function serializeProvingRequest(provingRequest) {
+    return provingRequest.toBytesLe();
+}
+/**
+ * Encrypt an already-serialized ProvingRequest (as produced by
+ * `serializeProvingRequest`) with a cryptobox X25519 public key
+ * (libsodium-compatible wire format).
+ *
+ * Produces exactly the same ciphertext format as `encryptProvingRequest` —
+ * `encryptSerializedProvingRequest(pk, serializeProvingRequest(req))` and
+ * `encryptProvingRequest(pk, req)` are interchangeable from the proving
+ * service's point of view.
+ *
+ * The input buffer is not mutated and deliberately not zeroized here: the
+ * caller keeps ownership so the same bytes can be re-encrypted for another
+ * one-time key (retry). Call `zeroizeBytes(serializedProvingRequest)` once
+ * no resend can be needed anymore.
+ *
+ * @param {string} publicKey The cryptobox X25519 public key to encrypt with (encoded in RFC 4648 standard Base64).
+ * @param {Uint8Array} serializedProvingRequest the serialized ProvingRequest bytes.
+ *
+ * @returns {string} the encrypted ProvingRequest in RFC 4648 standard Base64.
+ */
+function encryptSerializedProvingRequest(publicKey, serializedProvingRequest) {
+    return encryptMessage(publicKey, serializedProvingRequest);
 }
 /**
  * Encrypt a view key with a cryptobox X25519 public key (libsodium-compatible wire format).
@@ -461,7 +524,15 @@ function encryptProvingRequest(publicKey, provingRequest) {
  * @returns {string} the encrypted view key in RFC 4648 standard Base64.
  */
 function encryptViewKey(publicKey, viewKey) {
-    return encryptMessage(publicKey, viewKey.toBytesLe());
+    // Zeroize the intermediate plaintext bytes regardless of success or
+    // failure — same pattern as encryptRegistrationRequest.
+    const bytes = viewKey.toBytesLe();
+    try {
+        return encryptMessage(publicKey, bytes);
+    }
+    finally {
+        zeroizeBytes(bytes);
+    }
 }
 /**
  * Encrypt a record scanner registration request.
@@ -1532,7 +1603,7 @@ class AleoNetworkClient {
             else {
                 this.headers = {
                     // This is replaced by the actual version by a Rollup plugin
-                    "X-Aleo-SDK-Version": "0.11.2",
+                    "X-Aleo-SDK-Version": "0.11.4",
                     "X-Aleo-environment": environment(),
                 };
             }
@@ -1548,7 +1619,7 @@ class AleoNetworkClient {
         else {
             this.headers = {
                 // This is replaced by the actual version by a Rollup plugin
-                "X-Aleo-SDK-Version": "0.11.2",
+                "X-Aleo-SDK-Version": "0.11.4",
                 "X-Aleo-environment": environment(),
             };
         }
@@ -2409,7 +2480,7 @@ class AleoNetworkClient {
     async getProgramAmendmentCount(programId) {
         try {
             this.ctx = { "X-ALEO-METHOD": "getProgramAmendmentCount" };
-            const raw = await this.fetchRaw("/programs/" + programId + "/amendment_count");
+            const raw = await this.fetchRaw("/program/" + programId + "/amendment_count");
             return JSON.parse(raw);
         }
         catch (error) {
@@ -5837,83 +5908,84 @@ class ProgramManager {
         this._keyStore = keyStore;
     }
     /**
-     * Build a ProgramImportsBuilder from a program and its imports.
-     * Fetches imports from the network if not provided, resolves transitive
-     * dependencies, and optionally pre-loads cached keys from the KeyStore.
-     *
-     * @param loadKeys When true (default), loads cached proving/verifying keys
-     *   from the KeyStore into the builder. Set to false for authorization and
-     *   proving request paths where keys are not synthesized.
+     * Collect static imports declared by the entry program together with any
+     * caller-provided imports, then resolve missing transitive dependencies.
+     * Caller-provided program sources take precedence over network sources.
      */
-    async buildProgramImports(program, imports, loadKeys, entryFunction) {
-        const builder = new mainnet_js.ProgramImports();
+    async collectProgramImports(program, imports, tolerateNetworkErrors) {
         const programSource = typeof program === "string" ? program : program.toString();
-        const programObj = mainnet_js.Program.fromString(programSource);
-        const importNames = programObj.getImports();
-        if (importNames.length === 0 && (!imports || Object.keys(imports).length === 0)) {
-            return { builder, importEditions: new Map() };
-        }
-        let resolvedImports = {};
-        if (imports) {
-            resolvedImports = { ...imports };
-        }
-        if (importNames.length > 0 && !imports) {
+        const providedImports = { ...(imports ?? {}) };
+        let resolvedImports = { ...providedImports };
+        if (ProgramManager.getImportNames(programSource).length > 0) {
             try {
-                resolvedImports = await this.networkClient.getProgramImports(programSource);
+                const networkImports = await this.networkClient.getProgramImports(programSource, { ...resolvedImports });
+                resolvedImports = { ...networkImports, ...providedImports };
             }
             catch (e) {
+                if (!tolerateNetworkErrors)
+                    throw e;
                 logger.warn(`Failed to resolve program imports from network: ${e}.`);
             }
         }
-        // Build a map of which functions each import actually calls,
-        // so we only load keys for functions in the call chain.
-        const calledFunctions = ProgramManager.callGraphToMap(programObj.getCallGraph(entryFunction));
-        // Phase 1: Collect all programs via BFS, discovering transitive imports.
-        // The initial getProgramImports call above already resolves the full
-        // transitive closure via recursive DFS.  The BFS loop here only needs
-        // to handle user-provided imports whose transitive deps may not yet be
-        // known.  For each unknown import we issue a single getProgram() call
-        // (not a full recursive getProgramImports) and fetch siblings in
-        // parallel to minimize round-trips.
         const collected = new Map();
-        const collectQueue = Object.entries(resolvedImports).map(([name, src]) => [name, typeof src === "string" ? src : src.toString()]);
+        const collectQueue = Object.entries(resolvedImports).map(([name, source]) => [name, typeof source === "string" ? source : source.toString()]);
         while (collectQueue.length > 0) {
             const [name, source] = collectQueue.shift();
             if (collected.has(name))
                 continue;
             collected.set(name, source);
-            // Discover transitive imports for collection (call-graph tracing
-            // happens in a separate pass after topological sorting).
             try {
                 const subImports = ProgramManager.getImportNames(source);
-                if (subImports.length > 0) {
-                    // Fetch only unknown transitive imports — the source for
-                    // programs already in collected/resolvedImports is known, so
-                    // we skip them.  Fetches within a BFS level run in parallel.
-                    const unknownImports = subImports.filter((id) => !collected.has(id) && !(id in resolvedImports));
-                    if (unknownImports.length > 0) {
-                        const fetched = await Promise.all(unknownImports.map(async (id) => {
-                            try {
-                                const src = await this.networkClient.getProgram(id);
-                                return [id, src];
-                            }
-                            catch {
-                                return null;
-                            }
-                        }));
-                        for (const entry of fetched) {
-                            if (entry && !collected.has(entry[0])) {
-                                collectQueue.push(entry);
-                            }
+                const unknownImports = subImports.filter((id) => !collected.has(id) && !(id in resolvedImports));
+                if (unknownImports.length > 0) {
+                    const fetched = await Promise.all(unknownImports.map(async (id) => {
+                        try {
+                            const importedSource = await this.networkClient.getProgram(id);
+                            return [id, importedSource];
+                        }
+                        catch (e) {
+                            if (!tolerateNetworkErrors)
+                                throw e;
+                            return null;
+                        }
+                    }));
+                    for (const entry of fetched) {
+                        if (entry && !collected.has(entry[0])) {
+                            collectQueue.push(entry);
                         }
                     }
                 }
             }
             catch (e) {
+                if (!tolerateNetworkErrors)
+                    throw e;
                 logger.warn(`Failed to resolve transitive imports for ${name}: ${e}`);
             }
         }
-        // Phase 2: Add programs in topological order (leaves first).
+        return collected;
+    }
+    /**
+     * Build a ProgramImportsBuilder from a program and its imports.
+     * Fetches missing imports from the network, resolves transitive
+     * dependencies, and optionally pre-loads cached keys from the KeyStore.
+     *
+     * @param loadKeys When true (default), loads cached proving/verifying keys
+     *   from the KeyStore into the builder. Set to false for authorization and
+     *   proving request paths where keys are not synthesized.
+     */
+    async buildProgramImports(program, imports, loadKeys, entryFunction) {
+        const builder = new mainnet_js.ProgramImports();
+        const programSource = typeof program === "string" ? program : program.toString();
+        const programObj = mainnet_js.Program.fromString(programSource);
+        const importNames = programObj.getImports();
+        if (importNames.length === 0 && (!imports || Object.keys(imports).length === 0)) {
+            return { builder, importEditions: new Map() };
+        }
+        const collected = await this.collectProgramImports(programSource, imports, true);
+        // Build a map of which functions each import actually calls,
+        // so we only load keys for functions in the call chain.
+        const calledFunctions = ProgramManager.callGraphToMap(programObj.getCallGraph(entryFunction));
+        // Add programs in topological order (leaves first).
         // A simple DFS post-order ensures dependencies are added before
         // dependents, regardless of the order collected entries arrived.
         const sorted = [];
@@ -8386,7 +8458,7 @@ class ProgramManager {
             throw new Error("Authorization must be provided if estimating fee for Authorization.");
         }
         const programSource = program ? program.toString() : await this.networkClient.getProgram(programName, edition);
-        const programImports = imports ?? await this.networkClient.getProgramImports(programSource);
+        const programImports = Object.fromEntries(await this.collectProgramImports(programSource, imports, false));
         return mainnet_js.ProgramManager.estimateFeeForAuthorization(authorization, programSource, programImports, edition);
     }
     /**
@@ -8421,7 +8493,7 @@ class ProgramManager {
             throw new Error("Function name must be specified when estimating fee.");
         }
         const programSource = program ? program.toString() : await this.networkClient.getProgram(programName, edition);
-        const programImports = imports ? imports : await this.networkClient.getProgramImports(programSource);
+        const programImports = Object.fromEntries(await this.collectProgramImports(programSource, imports, false));
         return mainnet_js.ProgramManager.estimateExecutionFee(programSource, functionName, programImports, edition);
     }
     // Internal utility function for getting a credits.aleo record
@@ -8465,7 +8537,7 @@ class ProgramManager {
      * import { AleoKeyProvider, getOrInitConsensusVersionTestHeights, ProgramManager, NetworkRecordProvider } from "@provablehq/sdk/mainnet.js";
      *
      * // Initialize the development consensus heights in order to work with devnode.
-     * getOrInitConsensusVersionTestHeights("0,1,2,3,4,5,6,7,8,9,10,11,12,13,14");
+     * getOrInitConsensusVersionTestHeights("0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16");
      *
      * // Create a new NetworkClient and RecordProvider.
      * const recordProvider = new NetworkRecordProvider(account, networkClient);
@@ -8592,7 +8664,7 @@ class ProgramManager {
      * import { ProgramManager, NetworkRecordProvider, getOrInitConsensusVersionTestHeights } from "@provablehq/sdk/mainnet.js";
      *
      * // Initialize the development consensus heights in order to work with a local devnode.
-     * getOrInitConsensusVersionTestHeights("0,1,2,3,4,5,6,7,8,9,10,11,12,13,14");
+     * getOrInitConsensusVersionTestHeights("0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16");
      *
      * // Create a new NetworkClient, and RecordProvider
      * const recordProvider = new NetworkRecordProvider(account, networkClient);
@@ -9412,6 +9484,7 @@ exports.defaultTransport = defaultTransport;
 exports.encryptAuthorization = encryptAuthorization;
 exports.encryptProvingRequest = encryptProvingRequest;
 exports.encryptRegistrationRequest = encryptRegistrationRequest;
+exports.encryptSerializedProvingRequest = encryptSerializedProvingRequest;
 exports.encryptViewKey = encryptViewKey;
 exports.generateHookData = generateHookData;
 exports.getLogLevel = getLogLevel;
@@ -9425,6 +9498,7 @@ exports.isViewKeyStrategy = isViewKeyStrategy;
 exports.logAndThrow = logAndThrow;
 exports.programChecksum = programChecksum;
 exports.provingKeyLocator = provingKeyLocator;
+exports.serializeProvingRequest = serializeProvingRequest;
 exports.setLogLevel = setLogLevel;
 exports.sha256Hex = sha256Hex;
 exports.toAddress = toAddress;