@quantovainc/qcore 0.1.15 → 0.1.17

package/README.md

@@ -180,13 +180,13 @@ The [examples](examples) folder holds a runnable quickstart that mirrors the one
 
 ## Releases and provenance
 
-Releases are published from CI by the publish workflow in `.github/workflows/publish.yml`, which runs on a pushed git tag. It builds the two wasm targets, runs the offline tests, and publishes with npm provenance, so the copy of the package on the registry carries a verified provenance badge that ties it to this exact public commit. Nothing is published to a registry without an explicit tag. This package handles a user's keys and a published version cannot be taken back.
+Releases are published from CI by the publish workflow in `.github/workflows/publish.yml`, which runs on a pushed git tag. It runs the offline tests and publishes with npm provenance, so the published tarball carries a provenance badge that ties it to this exact public commit. The wasm is built from the Rust core and committed to the repository, so confirming that the shipped wasm matches the source means rebuilding it from this commit and comparing the bytes. Nothing is published to a registry without an explicit tag. This package handles a user's keys and a published version cannot be taken back.
 
 For the provenance publish to run, the maintainer adds an `NPM_TOKEN` automation secret to the repository, or configures npm trusted publishing for the package so the workflow authenticates over OIDC with no stored token.
 
 ## Security
 
-To report a vulnerability, see [SECURITY.md](SECURITY.md). Please report privately and not through a public issue.
+To report a vulnerability, please disclose it privately to the Quantova team rather than through a public issue.
 
 ## Ownership and license
 

package/index.d.ts

@@ -23,6 +23,19 @@ export interface OrderLayout {
   regionOff?: number | bigint;
 }
 
+export interface SignedOrderField {
+  offset: number | bigint;
+  width: number | bigint;
+  value: string;
+}
+
+export interface SignedOrderSpec {
+  schemeOff: number | bigint;
+  ptrOff: number | bigint;
+  regionOff?: number | bigint;
+  fields: ReadonlyArray<SignedOrderField>;
+}
+
 export interface TransferResult {
   signed: SignedTx;
   outcome: any;
@@ -51,6 +64,18 @@ export interface QCore {
     owner_index: bigint,
     nonce: bigint,
   ): string;
+  buildTypedOrderCall(
+    chain_id: bigint,
+    contract: string,
+    selector_hex: string,
+    scheme_off: bigint,
+    ptr_off: bigint,
+    region_off: bigint,
+    fields_json: string,
+    owner_seed_hex: string,
+    owner_index: bigint,
+    nonce: bigint,
+  ): string;
   contractAddress(deployer: string, nonce: bigint): string | undefined;
   chainIdFromName(name: string): bigint;
   eventsBody(height: bigint): string;
@@ -161,8 +186,7 @@ export class Client {
     callerIndex: number,
     contract: string,
     selectorHex: string,
-    layout: OrderLayout,
-    fields: ReadonlyArray<number | bigint | string>,
+    orderSpec: SignedOrderSpec,
     ownerSeedHex: string,
     ownerIndex: number,
     meterLimit: number | bigint,

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@quantovainc/qcore",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Quantova's post quantum client core for JavaScript. Signs with ML-DSA-65 and builds Q1 addresses.",
   "scripts": {
-    "build": "wasm-pack build --target bundler --out-dir pkg && wasm-pack build --target nodejs --out-dir pkg-node",
+    "build": "RUSTFLAGS=\"--remap-path-prefix=$HOME/quantova-stack=/qcore --remap-path-prefix=$HOME/.cargo=/cargo --remap-path-prefix=$HOME/.rustup=/rustup\" wasm-pack build --target bundler --out-dir pkg && RUSTFLAGS=\"--remap-path-prefix=$HOME/quantova-stack=/qcore --remap-path-prefix=$HOME/.cargo=/cargo --remap-path-prefix=$HOME/.rustup=/rustup\" wasm-pack build --target nodejs --out-dir pkg-node",
     "test": "node test-conformance.js && node test-sign-validate.js && node test-transport.js && node test-fee-cap.js && node test-network.js"
   },
   "keywords": [

package/pkg/README.md

@@ -180,13 +180,13 @@ The [examples](examples) folder holds a runnable quickstart that mirrors the one
 
 ## Releases and provenance
 
-Releases are published from CI by the publish workflow in `.github/workflows/publish.yml`, which runs on a pushed git tag. It builds the two wasm targets, runs the offline tests, and publishes with npm provenance, so the copy of the package on the registry carries a verified provenance badge that ties it to this exact public commit. Nothing is published to a registry without an explicit tag. This package handles a user's keys and a published version cannot be taken back.
+Releases are published from CI by the publish workflow in `.github/workflows/publish.yml`, which runs on a pushed git tag. It runs the offline tests and publishes with npm provenance, so the published tarball carries a provenance badge that ties it to this exact public commit. The wasm is built from the Rust core and committed to the repository, so confirming that the shipped wasm matches the source means rebuilding it from this commit and comparing the bytes. Nothing is published to a registry without an explicit tag. This package handles a user's keys and a published version cannot be taken back.
 
 For the provenance publish to run, the maintainer adds an `NPM_TOKEN` automation secret to the repository, or configures npm trusted publishing for the package so the workflow authenticates over OIDC with no stored token.
 
 ## Security
 
-To report a vulnerability, see [SECURITY.md](SECURITY.md). Please report privately and not through a public issue.
+To report a vulnerability, please disclose it privately to the Quantova team rather than through a public issue.
 
 ## Ownership and license
 

package/pkg/qcore_js.d.ts

@@ -9,6 +9,8 @@ export function block_by_height_body(height: bigint): string;
 
 export function buildSignedOrderCall(chain_id: bigint, contract: string, selector_hex: string, scheme_off: bigint, ptr_off: bigint, field_offs_csv: string, fields_csv: string, region_off: bigint, owner_seed_hex: string, owner_index: bigint, nonce: bigint): string;
 
+export function buildTypedOrderCall(chain_id: bigint, contract: string, selector_hex: string, scheme_off: bigint, ptr_off: bigint, region_off: bigint, fields_json: string, owner_seed_hex: string, owner_index: bigint, nonce: bigint): string;
+
 export function chainIdFromName(name: string): bigint;
 
 export function contractAddress(deployer: string, nonce: bigint): string | undefined;

package/pkg/qcore_js.js

@@ -5,5 +5,5 @@ import { __wbg_set_wasm } from "./qcore_js_bg.js";
 __wbg_set_wasm(wasm);
 wasm.__wbindgen_start();
 export {
-    account_body, address, block_by_height_body, buildSignedOrderCall, chainIdFromName, contractAddress, eventsBody, localChainId, mainnetChainId, mapSlotKey, mnemonicFromSeed, nonceSlotKey, orderSigner, parseEvents, scalarSlotKey, seedFromMnemonic, signPayableCall, signRegister, sign_call, sign_transfer, storageBody, storageValue, submit_body, testnetChainId, transaction_body, valid_address, vmDeployAddress
+    account_body, address, block_by_height_body, buildSignedOrderCall, buildTypedOrderCall, chainIdFromName, contractAddress, eventsBody, localChainId, mainnetChainId, mapSlotKey, mnemonicFromSeed, nonceSlotKey, orderSigner, parseEvents, scalarSlotKey, seedFromMnemonic, signPayableCall, signRegister, sign_call, sign_transfer, storageBody, storageValue, submit_body, testnetChainId, transaction_body, valid_address, vmDeployAddress
 } from "./qcore_js_bg.js";

package/pkg/qcore_js_bg.js

@@ -103,6 +103,46 @@ export function buildSignedOrderCall(chain_id, contract, selector_hex, scheme_of
     }
 }
 
+/**
+ * @param {bigint} chain_id
+ * @param {string} contract
+ * @param {string} selector_hex
+ * @param {bigint} scheme_off
+ * @param {bigint} ptr_off
+ * @param {bigint} region_off
+ * @param {string} fields_json
+ * @param {string} owner_seed_hex
+ * @param {bigint} owner_index
+ * @param {bigint} nonce
+ * @returns {string}
+ */
+export function buildTypedOrderCall(chain_id, contract, selector_hex, scheme_off, ptr_off, region_off, fields_json, owner_seed_hex, owner_index, nonce) {
+    let deferred6_0;
+    let deferred6_1;
+    try {
+        const ptr0 = passStringToWasm0(contract, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(selector_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(fields_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(owner_seed_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len3 = WASM_VECTOR_LEN;
+        const ret = wasm.buildTypedOrderCall(chain_id, ptr0, len0, ptr1, len1, scheme_off, ptr_off, region_off, ptr2, len2, ptr3, len3, owner_index, nonce);
+        var ptr5 = ret[0];
+        var len5 = ret[1];
+        if (ret[3]) {
+            ptr5 = 0; len5 = 0;
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        deferred6_0 = ptr5;
+        deferred6_1 = len5;
+        return getStringFromWasm0(ptr5, len5);
+    } finally {
+        wasm.__wbindgen_free(deferred6_0, deferred6_1, 1);
+    }
+}
+
 /**
  * @param {string} name
  * @returns {bigint}

package/pkg/qcore_js_bg.wasm.d.ts

@@ -5,6 +5,7 @@ export const account_body: (a: number, b: number) => [number, number];
 export const address: (a: number, b: number, c: bigint) => [number, number, number, number];
 export const block_by_height_body: (a: bigint) => [number, number];
 export const buildSignedOrderCall: (a: bigint, b: number, c: number, d: number, e: number, f: bigint, g: bigint, h: number, i: number, j: number, k: number, l: bigint, m: number, n: number, o: bigint, p: bigint) => [number, number, number, number];
+export const buildTypedOrderCall: (a: bigint, b: number, c: number, d: number, e: number, f: bigint, g: bigint, h: bigint, i: number, j: number, k: number, l: number, m: bigint, n: bigint) => [number, number, number, number];
 export const chainIdFromName: (a: number, b: number) => bigint;
 export const contractAddress: (a: number, b: number, c: bigint) => [number, number];
 export const eventsBody: (a: bigint) => [number, number];

package/pkg-node/README.md

@@ -180,13 +180,13 @@ The [examples](examples) folder holds a runnable quickstart that mirrors the one
 
 ## Releases and provenance
 
-Releases are published from CI by the publish workflow in `.github/workflows/publish.yml`, which runs on a pushed git tag. It builds the two wasm targets, runs the offline tests, and publishes with npm provenance, so the copy of the package on the registry carries a verified provenance badge that ties it to this exact public commit. Nothing is published to a registry without an explicit tag. This package handles a user's keys and a published version cannot be taken back.
+Releases are published from CI by the publish workflow in `.github/workflows/publish.yml`, which runs on a pushed git tag. It runs the offline tests and publishes with npm provenance, so the published tarball carries a provenance badge that ties it to this exact public commit. The wasm is built from the Rust core and committed to the repository, so confirming that the shipped wasm matches the source means rebuilding it from this commit and comparing the bytes. Nothing is published to a registry without an explicit tag. This package handles a user's keys and a published version cannot be taken back.
 
 For the provenance publish to run, the maintainer adds an `NPM_TOKEN` automation secret to the repository, or configures npm trusted publishing for the package so the workflow authenticates over OIDC with no stored token.
 
 ## Security
 
-To report a vulnerability, see [SECURITY.md](SECURITY.md). Please report privately and not through a public issue.
+To report a vulnerability, please disclose it privately to the Quantova team rather than through a public issue.
 
 ## Ownership and license
 

package/pkg-node/qcore_js.d.ts

@@ -9,6 +9,8 @@ export function block_by_height_body(height: bigint): string;
 
 export function buildSignedOrderCall(chain_id: bigint, contract: string, selector_hex: string, scheme_off: bigint, ptr_off: bigint, field_offs_csv: string, fields_csv: string, region_off: bigint, owner_seed_hex: string, owner_index: bigint, nonce: bigint): string;
 
+export function buildTypedOrderCall(chain_id: bigint, contract: string, selector_hex: string, scheme_off: bigint, ptr_off: bigint, region_off: bigint, fields_json: string, owner_seed_hex: string, owner_index: bigint, nonce: bigint): string;
+
 export function chainIdFromName(name: string): bigint;
 
 export function contractAddress(deployer: string, nonce: bigint): string | undefined;

package/pkg-node/qcore_js.js

@@ -109,6 +109,47 @@ function buildSignedOrderCall(chain_id, contract, selector_hex, scheme_off, ptr_
 }
 exports.buildSignedOrderCall = buildSignedOrderCall;
 
+/**
+ * @param {bigint} chain_id
+ * @param {string} contract
+ * @param {string} selector_hex
+ * @param {bigint} scheme_off
+ * @param {bigint} ptr_off
+ * @param {bigint} region_off
+ * @param {string} fields_json
+ * @param {string} owner_seed_hex
+ * @param {bigint} owner_index
+ * @param {bigint} nonce
+ * @returns {string}
+ */
+function buildTypedOrderCall(chain_id, contract, selector_hex, scheme_off, ptr_off, region_off, fields_json, owner_seed_hex, owner_index, nonce) {
+    let deferred6_0;
+    let deferred6_1;
+    try {
+        const ptr0 = passStringToWasm0(contract, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(selector_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(fields_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(owner_seed_hex, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len3 = WASM_VECTOR_LEN;
+        const ret = wasm.buildTypedOrderCall(chain_id, ptr0, len0, ptr1, len1, scheme_off, ptr_off, region_off, ptr2, len2, ptr3, len3, owner_index, nonce);
+        var ptr5 = ret[0];
+        var len5 = ret[1];
+        if (ret[3]) {
+            ptr5 = 0; len5 = 0;
+            throw takeFromExternrefTable0(ret[2]);
+        }
+        deferred6_0 = ptr5;
+        deferred6_1 = len5;
+        return getStringFromWasm0(ptr5, len5);
+    } finally {
+        wasm.__wbindgen_free(deferred6_0, deferred6_1, 1);
+    }
+}
+exports.buildTypedOrderCall = buildTypedOrderCall;
+
 /**
  * @param {string} name
  * @returns {bigint}

package/shared.js

@@ -183,12 +183,18 @@ function makeClient(core) {
       const configured = this.network && this.network.chainId;
       if (configured && name !== configured) {
         throw new Error(`the gateway reports chain ${name} but this client is configured for ${configured}; refusing to sign a transaction that would be valid on a network you did not choose`);
-      } else if (!configured && name === 'Q-main-net-1' && !this.acknowledgeMainnet) {
+      } else if (!configured && !this.acknowledgeMainnet && this._isMainnetId(BigInt(core.chainIdFromName(name)))) {
         throw new Error(`the gateway reports the mainnet chain ${name} but this client did not choose a network; refusing to sign a mainnet transaction without acknowledgeMainnet`);
       }
       return BigInt(core.chainIdFromName(name));
     }
 
+    // The canonical mainnet name is still an open convention (the chain crate's id vs the "Q-main-net-1"
+    // preset), so until it is settled the gate prompts for either candidate rather than miss the real one.
+    _isMainnetId(id) {
+      return id === BigInt(core.mainnetChainId()) || id === BigInt(core.chainIdFromName('Q-main-net-1'));
+    }
+
     async _call(method, body) {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
@@ -297,7 +303,7 @@ function makeClient(core) {
       return BigInt(core.storageValue(JSON.stringify(resp), core.scalarSlotKey(BigInt(slot))));
     }
 
-    async callSignedOrder(callerSeedHex, callerIndex, contract, selectorHex, layout, fields, ownerSeedHex, ownerIndex, meterLimit, maxFeeQuon) {
+    async callSignedOrder(callerSeedHex, callerIndex, contract, selectorHex, orderSpec, ownerSeedHex, ownerIndex, meterLimit, maxFeeQuon) {
       if (!core.valid_address(contract)) throw new Error('the contract is not a q1 address');
       const ceiling = feeCeiling(maxFeeQuon);
       const info = await this.nodeInfo();
@@ -310,15 +316,16 @@ function makeClient(core) {
       }
       const signer = core.orderSigner(ownerSeedHex, BigInt(ownerIndex));
       const nonce = await this.contractNonce(contract, signer);
-      const order = JSON.parse(core.buildSignedOrderCall(
+      // orderSpec.fields are the signed fields in message order, each { offset, width, value } read
+      // from the interface descriptor, so a wide amount or an address is signed at its true width.
+      const order = JSON.parse(core.buildTypedOrderCall(
         chainId,
         contract,
         selectorHex,
-        BigInt(layout.schemeOff),
-        BigInt(layout.ptrOff),
-        (layout.fieldOffs || []).join(','),
-        (fields || []).map(String).join(','),
-        BigInt(layout.regionOff || 0),
+        BigInt(orderSpec.schemeOff),
+        BigInt(orderSpec.ptrOff),
+        BigInt(orderSpec.regionOff || 0),
+        JSON.stringify(orderSpec.fields || []),
         ownerSeedHex,
         BigInt(ownerIndex),
         nonce,