@provablehq/veil-aleo-sdk 0.9.0 → 0.11.0

package/dist/index.js

@@ -194,7 +194,6 @@ function mnemonicToHDKey(mnemonic, options = {}) {
 }
 
 // src/provableApi.ts
-var DEFAULT_PROVABLE_API_URL = "https://api.provable.com";
 var EXPIRY_SKEW_MS = 5 * 60 * 1e3;
 function memoryCredentialStore(initial) {
   let held = initial;
@@ -206,35 +205,15 @@ function memoryCredentialStore(initial) {
   };
 }
 async function registerProvableApi(params) {
-  const baseUrl = params.baseUrl ?? DEFAULT_PROVABLE_API_URL;
-  const transport = params.transport ?? fetch;
-  const response = await transport(`${baseUrl}/consumers`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ username: params.username })
-  });
-  if (!response.ok) {
-    const body2 = await response.text();
-    if (response.status === 409) {
-      throw new Error(
-        `Provable API username '${params.username}' is already registered. Credentials cannot be recovered from a username: supply the existing consumerId and apiKey, or register under a different name. (HTTP 409: ${body2})`
-      );
-    }
-    throw new Error(
-      `Provable API consumer registration failed (HTTP ${response.status}): ${body2}`
-    );
-  }
-  const body = await response.json();
-  if (!body.consumer?.id || !body.key) {
-    throw new Error("Provable API consumer registration response carried no consumer id and key.");
-  }
-  return { consumerId: body.consumer.id, apiKey: body.key };
+  void params;
+  return void 0;
 }
 async function mintJwt(credentials, baseUrl, transport) {
   const response = await transport(`${baseUrl}/jwts/${encodeURIComponent(credentials.consumerId)}`, {
     method: "POST",
     headers: { "X-Provable-API-Key": credentials.apiKey }
   });
+  if (response.status === 404) return void 0;
   if (!response.ok) {
     throw new Error(
       `Provable API JWT mint failed (HTTP ${response.status}): ${await response.text()}`
@@ -251,42 +230,20 @@ async function mintJwt(credentials, baseUrl, transport) {
   return { jwt: header, expiration: body.exp * 1e3 };
 }
 function createProvableSession(options = {}) {
-  const baseUrl = options.baseUrl ?? DEFAULT_PROVABLE_API_URL;
+  const baseUrl = options.baseUrl;
   const transport = options.transport ?? fetch;
   const consumers = { proving: false, recordScanning: false };
   let credentials = options.credentials;
-  let registered = false;
   let credentialsInFlight;
   let jwt;
   let jwtInFlight;
-  async function resolveCredentials(usernameOverride) {
-    if (credentials) return credentials;
-    const stored = await options.store?.load();
-    if (stored) {
+  let noJwtRoute = false;
+  function getCredentials() {
+    if (credentials) return Promise.resolve(credentials);
+    credentialsInFlight ??= Promise.resolve(options.store?.load()).then((stored) => {
       credentials = stored;
-      return credentials;
-    }
-    const username = usernameOverride ?? (typeof options.username === "function" ? options.username() : options.username);
-    if (!username) {
-      throw new Error(
-        "No Provable API credentials available \u2014 pass credentials, a store holding them, or a username to register with."
-      );
-    }
-    const issued = await registerProvableApi({ username, baseUrl, transport });
-    credentials = issued;
-    registered = true;
-    try {
-      await options.store?.save(issued);
-    } catch (cause) {
-      throw new Error(
-        `Registered Provable API consumer ${issued.consumerId}, but persisting its credentials failed. They are live for this process \u2014 read them from getCredentials() and store them yourself \u2014 but the API key cannot be reissued, so a restart loses it.`,
-        { cause }
-      );
-    }
-    return credentials;
-  }
-  function getCredentials({ username } = {}) {
-    credentialsInFlight ??= resolveCredentials(username).finally(() => {
+      return stored;
+    }).finally(() => {
       credentialsInFlight = void 0;
     });
     return credentialsInFlight;
@@ -295,8 +252,11 @@ function createProvableSession(options = {}) {
     const stale = !jwt || Date.now() >= jwt.expiration - EXPIRY_SKEW_MS;
     if (!forceRefresh && !stale) return Promise.resolve(jwt);
     jwtInFlight ??= (async () => {
+      if (!baseUrl || noJwtRoute) return void 0;
       const resolved = await getCredentials();
+      if (!resolved) return void 0;
       jwt = await mintJwt(resolved, baseUrl, transport);
+      if (!jwt) noJwtRoute = true;
       return jwt;
     })().finally(() => {
       jwtInFlight = void 0;
@@ -304,7 +264,7 @@ function createProvableSession(options = {}) {
     return jwtInFlight;
   }
   return {
-    registeredConsumer: () => registered,
+    registeredConsumer: () => false,
     getCredentials,
     getJwt,
     consumers,
@@ -317,23 +277,21 @@ function getProvableSession(client) {
   return client.proving?.session;
 }
 async function authenticateProvableApi(client, params = {}) {
-  if (client.proving?.keyedAuth) {
-    throw new Error(
-      "This client authenticates with a provisioned API key \u2014 every request already carries it, and there is no consumer or JWT to resolve. Remove the authenticateProvableApi call."
-    );
-  }
   const session = getProvableSession(client);
   if (!session) {
-    throw new Error(
-      "No Provable API session on this client \u2014 pass consumerId and apiKey, or a credentialStore, when creating it."
-    );
+    return {
+      credentials: void 0,
+      expiration: void 0,
+      registered: false,
+      applied: { proving: false, recordScanning: false }
+    };
   }
-  const credentials = await session.getCredentials({ username: params.username });
-  const { expiration } = await session.getJwt({ forceRefresh: params.forceRefresh });
+  const credentials = await session.getCredentials();
+  const minted = credentials ? await session.getJwt({ forceRefresh: params.forceRefresh }) : void 0;
   return {
     credentials,
-    expiration,
-    registered: session.registeredConsumer(),
+    expiration: minted?.expiration,
+    registered: false,
     applied: { ...session.consumers }
   };
 }
@@ -344,8 +302,32 @@ function provableApiActions() {
 }
 
 // src/index.ts
-var DEFAULT_PROVER_URL = "https://api.provable.com/prove";
-var DEFAULT_SCANNER_URL = "https://api.provable.com/scanner";
+var DEFAULT_PROVER_URL = "https://edge.provable.com/api/prove";
+var DEFAULT_SCANNER_URL = "https://edge.provable.com/api/scanner";
+var DEFAULT_NETWORK_URL = "https://edge.provable.com/api/v2";
+var EDGE_GATEWAY = "https://edge.provable.com/api";
+function legacyMintRoot(...targets) {
+  for (const target of targets) {
+    if (!target || target.startsWith(EDGE_GATEWAY)) continue;
+    try {
+      return new URL(target).origin;
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+function sessionForCredentials(options, ...targets) {
+  if (options.auth) return void 0;
+  if (options.session) return options.session;
+  if (options.apiKey && options.consumerId) {
+    return createProvableSession({
+      credentials: { consumerId: options.consumerId, apiKey: options.apiKey },
+      baseUrl: legacyMintRoot(...targets)
+    });
+  }
+  return void 0;
+}
 async function loadNetwork(name) {
   const sdk = await loadSdk(name);
   silenceSdkLogs(sdk);
@@ -402,7 +384,8 @@ function buildSdk(initialNetwork, initialSdk) {
     let networkUrl = options.networkUrl;
     let keyProvider = new currentSdk.AleoKeyProvider();
     keyProvider.useCache(true);
-    options.session?.attach("proving");
+    const session = sessionForCredentials(options, options.proverUrl);
+    session?.attach("proving");
     let configNetwork = network;
     const resolveProverUrl = () => {
       const configured = options.proverUrl ?? (options.mode === "delegated" ? DEFAULT_PROVER_URL : void 0);
@@ -421,7 +404,7 @@ function buildSdk(initialNetwork, initialSdk) {
       // Carried for `authenticateProvableApi` to find on a client. Core never
       // reads binding-specific fields on a proving config — `url` and `apiKey`
       // already travel the same way.
-      session: options.session,
+      session,
       keyedAuth: options.auth,
       buildTransaction: async (txOptions) => {
         const programManager = new currentSdk.ProgramManager(
@@ -443,6 +426,68 @@ function buildSdk(initialNetwork, initialSdk) {
           }
           resolvedImports = merged;
         }
+        if (options.mode === "delegated") {
+          const proverUrl = resolveProverUrl();
+          if (!proverUrl) {
+            throw new ConfigurationError(
+              "Delegated execution requires proverUrl. Pass proverUrl to createProvingConfig or createAleoClient."
+            );
+          }
+          try {
+            const provingRequest = await programManager.provingRequest({
+              programName: txOptions.programName,
+              functionName: txOptions.functionName,
+              priorityFee: 0,
+              privateFee: txOptions.privateFee ?? false,
+              inputs: txOptions.inputs,
+              ...resolvedImports ? { programImports: resolvedImports } : {},
+              broadcast: false,
+              useFeeMaster: options.useFeeMaster ?? false
+            });
+            await txOptions.onProgress?.({ type: "request-built" });
+            const dpsClient = new AleoNetworkClient(proverUrl);
+            const auth = async (forceRefresh) => {
+              if (options.auth) return { auth: options.auth };
+              if (session) return { jwtData: await session.getJwt({ forceRefresh }) };
+              return { apiKey: options.apiKey, consumerId: options.consumerId };
+            };
+            await txOptions.onProgress?.({ type: "prover-submitted" });
+            let credentials = await auth(false);
+            let result = await dpsClient.submitProvingRequestSafe({
+              provingRequest,
+              url: proverUrl,
+              ...credentials
+            });
+            if (!result.ok && (result.status === 401 || result.status === 403) && session) {
+              credentials = await auth(true);
+              result = await dpsClient.submitProvingRequestSafe({
+                provingRequest,
+                url: proverUrl,
+                ...credentials
+              });
+            }
+            if (!result.ok) {
+              throw new ProvingError({
+                message: `Delegated proving failed (HTTP ${result.status}): ${result.error?.message ?? "unknown error"}`,
+                statusCode: result.status
+              });
+            }
+            const transaction = result.data.transaction;
+            if (!transaction?.id) {
+              throw new ConfigurationError(
+                "DPS response did not contain a transaction ID \u2014 check prover service configuration."
+              );
+            }
+            await txOptions.onProgress?.({
+              type: "prover-returned",
+              transactionId: transaction.id
+            });
+            return transaction;
+          } catch (error) {
+            if (error instanceof BaseError) throw error;
+            throw classifyProvingError(error);
+          }
+        }
         const tx = await programManager.buildExecutionTransaction({
           programName: txOptions.programName,
           functionName: txOptions.functionName,
@@ -530,12 +575,12 @@ function buildSdk(initialNetwork, initialSdk) {
               priorityFee,
               privateFee: execOptions.privateFee ?? false,
               broadcast: true,
-              useFeeMaster: options.useFeeMaster ?? true
+              useFeeMaster: options.useFeeMaster ?? false
             });
             const dpsClient = new AleoNetworkClient(proverUrl);
             const auth = async (forceRefresh) => {
               if (options.auth) return { auth: options.auth };
-              if (options.session) return { jwtData: await options.session.getJwt({ forceRefresh }) };
+              if (session) return { jwtData: await session.getJwt({ forceRefresh }) };
               return { apiKey: options.apiKey, consumerId: options.consumerId };
             };
             let credentials = await auth(false);
@@ -544,7 +589,7 @@ function buildSdk(initialNetwork, initialSdk) {
               url: proverUrl,
               ...credentials
             });
-            if (!result.ok && (result.status === 401 || result.status === 403) && options.session) {
+            if (!result.ok && (result.status === 401 || result.status === 403) && session) {
               credentials = await auth(true);
               result = await dpsClient.submitProvingRequestSafe({
                 provingRequest,
@@ -565,6 +610,15 @@ function buildSdk(initialNetwork, initialSdk) {
           }
           const txId = response.transaction?.id;
           if (!txId) throw new ConfigurationError("DPS response did not contain a transaction ID \u2014 check prover service configuration.");
+          const broadcastResult = response.broadcast_result;
+          if (!broadcastResult || broadcastResult.status !== "Accepted") {
+            const message = broadcastResult?.status === "Skipped" ? "Delegated prover skipped transaction broadcast" : broadcastResult?.message ?? "Delegated prover did not report an accepted transaction broadcast";
+            const error = new Error(message);
+            if (broadcastResult && "status_code" in broadcastResult) {
+              error.status = Number(broadcastResult.status_code);
+            }
+            throw classifyBroadcastError(error, txId);
+          }
           const confirmedTx = await waitForConfirmation(buildPollingClient(), txId, options.confirmationTimeout);
           const { transitions, outputs } = extractTransitions(confirmedTx, decryptor);
           return { transactionId: txId, transitions, outputs };
@@ -670,11 +724,11 @@ function buildSdk(initialNetwork, initialSdk) {
       );
     }
   }
-  async function scanOwned(scanner, params, hasCredentials, session) {
+  async function scanOwned(scanner, params, session) {
     const ownedFilter = buildOwnedFilter(params);
     const ALWAYS_RETRY = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
     const AUTH_RETRY = /* @__PURE__ */ new Set([401, 403]);
-    const canReMint = hasCredentials || !!session;
+    const canReMint = !!session && !!await session.getJwt();
     const retryable = (status) => ALWAYS_RETRY.has(status) || canReMint && AUTH_RETRY.has(status);
     const MAX_ATTEMPTS = 4;
     let last = "";
@@ -691,9 +745,8 @@ function buildSdk(initialNetwork, initialSdk) {
         lastStatus = void 0;
       }
       if (attempt === MAX_ATTEMPTS - 1) break;
-      if (lastStatus !== void 0 && AUTH_RETRY.has(lastStatus)) {
-        if (session) scanner.setJwtData(await session.getJwt({ forceRefresh: true }));
-        else scanner.setJwtData(void 0);
+      if (canReMint && lastStatus !== void 0 && AUTH_RETRY.has(lastStatus)) {
+        scanner.setJwtData(await session.getJwt({ forceRefresh: true }));
       }
       await new Promise((resolve) => setTimeout(resolve, 500 * 2 ** attempt));
     }
@@ -707,7 +760,7 @@ function buildSdk(initialNetwork, initialSdk) {
     });
     if (!options.session && options.apiKey && !options.consumerId) {
       throw new ConfigurationError(
-        "Record scanning with an apiKey also needs consumerId \u2014 a JWT is minted from the pair. Pass both, pass a session, or omit both for an unauthenticated service."
+        "Record scanning with an apiKey also needs consumerId. Pass both, use auth: { mode: 'api-key' } for a provisioned key, or omit both for the open gateway."
       );
     }
     let scannerSdk = { RecordScanner, ViewKey };
@@ -715,7 +768,7 @@ function buildSdk(initialNetwork, initialSdk) {
     let viewKey;
     let viewKeyString;
     let registration = makeRegisterOnce(options.startBlock ?? 0);
-    let credential = options.auth ?? options.session;
+    let credential = options.auth ?? sessionForCredentials(options, options.url);
     const sessionOf = (source) => source && !("mode" in source) ? source : void 0;
     sessionOf(credential)?.attach("recordScanning");
     const url = options.url ?? DEFAULT_SCANNER_URL;
@@ -736,6 +789,7 @@ function buildSdk(initialNetwork, initialSdk) {
       registration = makeRegisterOnce(options.startBlock ?? 0);
     }
     return {
+      url,
       setAccount: (account) => {
         viewKeyString = account.viewKey;
         buildScanner();
@@ -774,8 +828,7 @@ function buildSdk(initialNetwork, initialSdk) {
         const activeSession = sessionOf(credential);
         if (activeSession) activeScanner.setJwtData(await activeSession.getJwt());
         await activeRegistration.ensure(activeScanner, activeViewKey);
-        const canReMint = !credential && !!(options.apiKey && options.consumerId);
-        return scanOwned(activeScanner, params, canReMint, activeSession);
+        return scanOwned(activeScanner, params, activeSession);
       },
       switchNetwork: async (newNetwork) => {
         if (newNetwork !== "mainnet" && newNetwork !== "testnet") {
@@ -796,11 +849,11 @@ function buildSdk(initialNetwork, initialSdk) {
     });
     if (!options.session && options.apiKey && !options.consumerId) {
       throw new ConfigurationError(
-        "Record scanning with an apiKey also needs consumerId \u2014 a JWT is minted from the pair. Pass both, pass a session, or omit both for an unauthenticated service."
+        "Record scanning with an apiKey also needs consumerId. Pass both, use auth: { mode: 'api-key' } for a provisioned key, or omit both for the open gateway."
       );
     }
     const viewKey = ViewKey.from_string(options.viewKey);
-    const session = options.session;
+    const session = sessionForCredentials(options, options.url);
     const credentialProps = options.auth ? { auth: options.auth } : session ? {} : {
       ...options.consumerId ? { consumerId: options.consumerId } : {},
       ...options.apiKey ? { apiKey: options.apiKey } : {}
@@ -817,7 +870,7 @@ function buildSdk(initialNetwork, initialSdk) {
       requestRecords: async (params) => {
         if (session) scanner.setJwtData(await session.getJwt());
         await registration.ensure(scanner, viewKey);
-        return scanOwned(scanner, params, !!(options.apiKey && options.consumerId), session);
+        return scanOwned(scanner, params, session);
       }
     };
   }
@@ -829,28 +882,28 @@ function buildSdk(initialNetwork, initialSdk) {
       credentialStore: options.credentialStore,
       session: options.session
     });
-    if (options.auth && options.records && !options.records.setAuth) {
+    const networkUrl = options.networkUrl ?? DEFAULT_NETWORK_URL;
+    const records = options.records ?? createRemoteScanner();
+    if (options.auth && !records.setAuth) {
       throw new ConfigurationError(
         "Provisioned-key auth needs a record provider with setAuth \u2014 pass a scanner from createRemoteScanner, or construct the provider with the key."
       );
     }
     const account = privateKeyToAccount(options.privateKey);
-    const transport = http(options.networkUrl, { network });
+    const transport = http(networkUrl, { network });
     const credentials = options.consumerId && options.apiKey ? { consumerId: options.consumerId, apiKey: options.apiKey } : void 0;
     const configured = !!(credentials || options.credentialStore || options.session);
     const session = options.auth ? void 0 : options.session ?? createProvableSession({
       credentials,
       store: options.credentialStore ?? memoryCredentialStore(),
-      // Resolved lazily: only a registration needs it. The derived default
-      // carries a random suffix because a username is spent once — an account
-      // that lost its stored key must still be able to register, and the old
-      // key is unrecoverable. A caller-supplied name is used verbatim, so a
-      // collision fails rather than quietly registering something else.
-      username: options.username ?? (() => `veil-${account.address.slice(5, 13)}-${Math.random().toString(36).slice(2, 8)}`)
+      // The prover names the legacy gateway first; a legacy scanner url
+      // counts too, so a client on the default prover that scans the
+      // legacy service still mints for it.
+      baseUrl: legacyMintRoot(options.proverUrl, records.url)
     });
     const proving = createProvingConfig({
       mode: options.provingMode ?? "delegated",
-      networkUrl: options.networkUrl,
+      networkUrl,
       proverUrl: options.proverUrl,
       session,
       auth: options.auth,
@@ -859,20 +912,20 @@ function buildSdk(initialNetwork, initialSdk) {
       apiKey: options.apiKey,
       consumerId: options.consumerId,
       account,
-      ...options.useFeeMaster !== void 0 ? { useFeeMaster: options.useFeeMaster } : {},
+      // The hosted prover pays fees by default, so an account holding no public
+      // credits can write; a caller funding its own fees opts out.
+      useFeeMaster: options.useFeeMaster ?? true,
       ...options.confirmationTimeout !== void 0 ? { confirmationTimeout: options.confirmationTimeout } : {}
     });
     const publicClient = createPublicClient({ transport });
-    if (options.records) {
-      if (options.auth) options.records.setAuth?.(options.auth);
-      else if (configured && session) options.records.setSession?.(session);
-      options.records.setAccount({ viewKey: account.viewKey });
-    }
+    if (options.auth) records.setAuth?.(options.auth);
+    else if (configured && session) records.setSession?.(session);
+    records.setAccount({ viewKey: account.viewKey });
     const walletClient = createWalletClient({
       account,
       transport,
       proving,
-      ...options.records ? { recordProvider: options.records } : {}
+      recordProvider: records
     }).extend(provableApiActions());
     return { publicClient, walletClient, account };
   }
@@ -1002,6 +1055,7 @@ function createDevnodeClient(options) {
 }
 export {
   BLS12377HDKey,
+  DEFAULT_NETWORK_URL,
   DEFAULT_PROVER_URL,
   DEFAULT_SCANNER_URL,
   DEVNODE_ADDR,