@quantovainc/qcore 0.1.31 → 0.1.33

package/shared.js

@@ -28,7 +28,15 @@ function checkAmount(amount) {
 }
 
 function accountIndex(index) {
-  const i = BigInt(index);
+  if (typeof index === 'number' && !Number.isSafeInteger(index)) {
+    throw new Error('the account index must be a whole number in the safe integer range, a number that large silently rounds and would sign with a different account key');
+  }
+  let i;
+  try {
+    i = BigInt(index);
+  } catch {
+    throw new Error('the account index must be a whole number');
+  }
   if (i < 0n || i > 0xffffffffffffffffn) {
     throw new Error('the account index must fit in an unsigned 64 bit integer');
   }
@@ -51,6 +59,53 @@ function accountNonce(nonce) {
   return n;
 }
 
+const VALIDITY_BLOCKS = 300n;
+const MAX_PLAUSIBLE_HEAD = 1n << 40n;
+const HEAD_BLOCKS_PER_SEC = 4n;
+const HEAD_SLACK_SECS = 60n;
+const TRANSFER_METER = 1210n;
+
+function meterLimitOf(meterLimit) {
+  if (typeof meterLimit === 'number' && !Number.isSafeInteger(meterLimit)) {
+    throw new Error('the meter limit must be a whole number in the safe integer range');
+  }
+  let meter;
+  try {
+    meter = BigInt(meterLimit);
+  } catch {
+    throw new Error('the meter limit must be a whole number');
+  }
+  if (meter < 0n || meter > 0xffffffffffffffffn) {
+    throw new Error('the meter limit must fit in an unsigned 64 bit integer');
+  }
+  return meter;
+}
+
+function vmCallFee(transferFee, meterLimit) {
+  const meter = meterLimitOf(meterLimit);
+  let units = (meter + TRANSFER_METER - 1n) / TRANSFER_METER;
+  if (units < 1n) units = 1n;
+  return BigInt(transferFee) * units;
+}
+
+function validUntil(info) {
+  const head = info && info.head_height;
+  if (head == null) throw new Error('the gateway did not report a head height to bound the transaction to');
+  if (typeof head === 'number' && !Number.isSafeInteger(head)) {
+    throw new Error('the gateway reported a head height outside the safe integer range');
+  }
+  let h;
+  try {
+    h = BigInt(head);
+  } catch {
+    throw new Error('the gateway reported a head height that is not a whole number');
+  }
+  if (h < 0n || h > MAX_PLAUSIBLE_HEAD) {
+    throw new Error('the gateway reported a head height past any height this chain can have reached');
+  }
+  return h + VALIDITY_BLOCKS;
+}
+
 function gatewayFee(fee) {
   if (typeof fee === 'number' && !Number.isSafeInteger(fee)) {
     throw new Error('the gateway reported a fee outside the safe integer range, a number that large silently rounds and would sign a different fee');
@@ -83,7 +138,7 @@ async function readBounded(res) {
     if (done) break;
     total += value.byteLength;
     if (total > MAX_RESPONSE) {
-      try { await reader.cancel(); } catch { /* already closing */ }
+      try { await reader.cancel(); } catch {}
       throw new Error('the response is too large');
     }
     chunks.push(value);
@@ -198,12 +253,6 @@ function makeClient(core) {
         this.network = opts.network instanceof Network ? opts.network : Network.forUrl(base);
       }
       this.base = requireSafeTransport(base).replace(/\/$/, '');
-      // The chain name the gateway reports is hashed into the signature preimage of
-      // every signing path, so whoever names it decides which network a signature is
-      // valid on. `Network.forUrl` leaves chainId null, which is the default for
-      // `new Client(url)`, and the configured check is skipped when it is null, so by
-      // default the endpoint chose. Bind it with expectedChainId, or rely on the pin,
-      // which at least refuses a gateway that changes its mind mid session.
       this.expectedChainId =
         typeof opts.expectedChainId === 'string' && opts.expectedChainId.length > 0
           ? opts.expectedChainId
@@ -231,12 +280,6 @@ function makeClient(core) {
       if (!this.acknowledgeMainnet && this._isMainnetId(id)) {
         throw new Error(`the gateway reports the mainnet chain ${name}; refusing to sign a mainnet transaction without acknowledgeMainnet`);
       }
-      // Pin on first ACCEPTED use, after every refusal above. With nothing configured
-      // the endpoint names the chain, and the least this can do is refuse one that
-      // answers differently later in the same session, which is how a signature ends
-      // up bound to a network the caller never chose while every earlier call looked
-      // entirely normal. Pinning a name we refused to sign for would be wrong: it was
-      // never a chain this client accepted.
       if (this._pinnedChainName === null) {
         this._pinnedChainName = name;
       } else if (this._pinnedChainName !== name) {
@@ -277,19 +320,43 @@ function makeClient(core) {
     head() { return this._call('head', '{}'); }
     async account(address) {
       const acct = await this._call('get_account', core.account_body(address));
-      if (acct && acct.address != null && acct.address !== address) {
+      if (!acct || typeof acct.address !== 'string') {
+        throw new Error(`the gateway answered about ${address} without naming the account, refusing to trust it`);
+      }
+      if (acct.address !== address) {
         throw new Error(`the gateway answered for ${acct.address} when asked about ${address}, refusing to trust it`);
       }
       return acct;
     }
-    _checkedNonce(reported, expected) {
+    _checkedNonce(reported, expected, key) {
       const n = accountNonce(reported);
-      if (expected != null) {
-        const e = BigInt(expected);
-        if (n < e) throw new Error(`the gateway reported nonce ${n} below the expected ${e}; refusing so a replayed lower nonce cannot force a second payment`);
-        if (n > e + 16n) throw new Error(`the gateway reported nonce ${n} far above the expected ${e}; refusing`);
+      if (!this._nextNonces) this._nextNonces = new Map();
+      const local = key != null ? this._nextNonces.get(key) : undefined;
+      const e = expected != null ? BigInt(expected) : local;
+      if (e == null) return n;
+      if (n > e) throw new Error(`the gateway reported nonce ${n} above the expected ${e}; refusing so a signature cannot be banked for a nonce the account has not reached`);
+      return expected != null ? e : n;
+    }
+
+    _remember(key, used, outcome) {
+      if (!this._nextNonces) this._nextNonces = new Map();
+      if (outcome && outcome.verdict === 'accepted') this._nextNonces.set(key, BigInt(used) + 1n);
+    }
+
+    _validity(info) {
+      const until = validUntil(info);
+      const head = until - VALIDITY_BLOCKS;
+      const now = BigInt(Math.floor(Date.now() / 1000));
+      if (this._headFloor) {
+        const { height, at } = this._headFloor;
+        if (head < height) throw new Error(`the gateway reports head ${head} below the ${height} it reported earlier, refusing to sign`);
+        const elapsed = now > at ? now - at : 0n;
+        const allowed = (elapsed + HEAD_SLACK_SECS) * HEAD_BLOCKS_PER_SEC;
+        if (head > height + allowed) throw new Error(`the gateway head leapt from ${height} to ${head} faster than blocks are made, refusing to sign`);
+      } else {
+        this._headFloor = { height: head, at: now };
       }
-      return n;
+      return until;
     }
     transaction(txId) { return this._call('get_transaction', core.transaction_body(txId)); }
     block(height) { return this._call('get_block', core.block_by_height_body(BigInt(height))); }
@@ -307,62 +374,70 @@ function makeClient(core) {
       const info = await this.nodeInfo();
       this._guardMainnet();
       const chainId = this._signingChainId(info);
-      const fee = info && info.fee && info.fee.transfer_quon;
-      if (fee == null) throw new Error('the gateway did not report a transfer fee');
-      if (gatewayFee(fee) > ceiling) {
+      const reported = info && info.fee && info.fee.transfer_quon;
+      if (reported == null) throw new Error('the gateway did not report a transfer fee');
+      const fee = gatewayFee(reported);
+      if (fee > ceiling) {
         throw new Error(`the gateway fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
       }
       const from = core.address(seedHex, accountIndex(index));
       const acct = await this.account(from);
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
-      const nonce = this._checkedNonce(acct.nonce, expectedNonce);
+      const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(
-        core.sign_transfer(seedHex, accountIndex(index), to, String(amount), nonce, String(fee), chainId)
+        core.sign_transfer(seedHex, accountIndex(index), to, String(amount), nonce, String(fee), chainId, this._validity(info))
       );
       const outcome = await this.submit(signed.tx_hex);
+      this._remember(from, nonce, outcome);
       return { signed, outcome };
     }
 
-    async register(seedHex, index, maxFeeQuon) {
+    async register(seedHex, index, maxFeeQuon, expectedNonce) {
       const ceiling = feeCeiling(maxFeeQuon);
       const info = await this.nodeInfo();
       this._guardMainnet();
       const chainId = this._signingChainId(info);
-      const fee = info && info.fee && info.fee.transfer_quon;
-      if (fee == null) throw new Error('the gateway did not report a transfer fee');
-      if (gatewayFee(fee) > ceiling) {
+      const reported = info && info.fee && info.fee.transfer_quon;
+      if (reported == null) throw new Error('the gateway did not report a transfer fee');
+      const fee = gatewayFee(reported);
+      if (fee > ceiling) {
         throw new Error(`the gateway fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
       }
       const from = core.address(seedHex, accountIndex(index));
       const acct = await this.account(from);
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
-      const signed = JSON.parse(core.signRegister(seedHex, accountIndex(index), accountNonce(acct.nonce), String(fee), chainId));
+      const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
+      const signed = JSON.parse(core.signRegister(seedHex, accountIndex(index), nonce, String(fee), chainId, this._validity(info)));
       const outcome = await this.submit(signed.tx_hex);
+      this._remember(from, nonce, outcome);
       return { signed, outcome };
     }
 
-    async call(seedHex, index, target, argsHex, meterLimit, maxFeeQuon) {
+    async call(seedHex, index, target, argsHex, meterLimit, maxFeeQuon, expectedNonce) {
       if (!core.valid_address(target)) throw new Error('the target is not a q1 address');
       const ceiling = feeCeiling(maxFeeQuon);
       const info = await this.nodeInfo();
       this._guardMainnet();
       const chainId = this._signingChainId(info);
-      const fee = info && info.fee && info.fee.transfer_quon;
-      if (fee == null) throw new Error('the gateway did not report a transfer fee');
-      if (gatewayFee(fee) > ceiling) {
-        throw new Error(`the gateway fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
+      const reported = info && info.fee && info.fee.transfer_quon;
+      if (reported == null) throw new Error('the gateway did not report a transfer fee');
+      const fee = vmCallFee(gatewayFee(reported), meterLimit);
+      if (fee > ceiling) {
+        throw new Error(`the fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
       }
       const from = core.address(seedHex, accountIndex(index));
       const acct = await this.account(from);
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
+      const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(
-        core.sign_call(seedHex, accountIndex(index), target, argsHex, accountNonce(acct.nonce), BigInt(meterLimit), String(fee), chainId)
+        core.sign_call(seedHex, accountIndex(index), target, argsHex, nonce, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
       const outcome = await this.submit(signed.tx_hex);
+      this._remember(from, nonce, outcome);
       return { signed, outcome };
     }
 
-    async assetCall(seedHex, index, target, argsHex, assetIssuer, amount, meterLimit, maxFeeQuon) {
+    async assetCall(seedHex, index, target, argsHex, assetIssuer, amount, meterLimit, maxFeeQuon, expectedNonce) {
       if (!core.valid_address(target)) throw new Error('the target is not a q1 address');
       if (!core.valid_address(assetIssuer)) throw new Error('the asset issuer is not a q1 address');
       checkAmount(amount);
@@ -370,77 +445,83 @@ function makeClient(core) {
       const info = await this.nodeInfo();
       this._guardMainnet();
       const chainId = this._signingChainId(info);
-      const fee = info && info.fee && info.fee.transfer_quon;
-      if (fee == null) throw new Error('the gateway did not report a transfer fee');
-      if (gatewayFee(fee) > ceiling) {
-        throw new Error(`the gateway fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
+      const reported = info && info.fee && info.fee.transfer_quon;
+      if (reported == null) throw new Error('the gateway did not report a transfer fee');
+      const fee = vmCallFee(gatewayFee(reported), meterLimit);
+      if (fee > ceiling) {
+        throw new Error(`the fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
       }
       const from = core.address(seedHex, accountIndex(index));
       const acct = await this.account(from);
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
+      const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(
-        core.signAssetCall(seedHex, accountIndex(index), target, argsHex, assetIssuer, String(amount), accountNonce(acct.nonce), BigInt(meterLimit), String(fee), chainId)
+        core.signAssetCall(seedHex, accountIndex(index), target, argsHex, assetIssuer, String(amount), nonce, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
       const outcome = await this.submit(signed.tx_hex);
+      this._remember(from, nonce, outcome);
       return { signed, outcome };
     }
 
-    async payableCall(seedHex, index, target, argsHex, value, meterLimit, maxFeeQuon) {
+    async payableCall(seedHex, index, target, argsHex, value, meterLimit, maxFeeQuon, expectedNonce) {
       if (!core.valid_address(target)) throw new Error('the target is not a q1 address');
       checkAmount(value);
       const ceiling = feeCeiling(maxFeeQuon);
       const info = await this.nodeInfo();
       this._guardMainnet();
       const chainId = this._signingChainId(info);
-      const fee = info && info.fee && info.fee.transfer_quon;
-      if (fee == null) throw new Error('the gateway did not report a transfer fee');
-      if (gatewayFee(fee) > ceiling) {
-        throw new Error(`the gateway fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
+      const reported = info && info.fee && info.fee.transfer_quon;
+      if (reported == null) throw new Error('the gateway did not report a transfer fee');
+      const fee = vmCallFee(gatewayFee(reported), meterLimit);
+      if (fee > ceiling) {
+        throw new Error(`the fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
       }
       const from = core.address(seedHex, accountIndex(index));
       const acct = await this.account(from);
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
+      const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(
-        core.signPayableCall(seedHex, accountIndex(index), target, argsHex, accountNonce(acct.nonce), BigInt(meterLimit), String(fee), String(value), chainId)
+        core.signPayableCall(seedHex, accountIndex(index), target, argsHex, nonce, meterLimitOf(meterLimit), String(fee), String(value), chainId, this._validity(info))
       );
       const outcome = await this.submit(signed.tx_hex);
+      this._remember(from, nonce, outcome);
       return { signed, outcome };
     }
 
+    async _slotValue(contract, key) {
+      const resp = await this._call('get_storage_at', JSON.stringify({ address: contract, keys: [key] }));
+      return BigInt(core.storageValue(JSON.stringify(resp), key));
+    }
+
     async contractNonce(contract, signerHex) {
-      const resp = await this._call('get_storage', core.storageBody(contract));
-      return BigInt(core.storageValue(JSON.stringify(resp), core.nonceSlotKey(signerHex)));
+      return this._slotValue(contract, core.nonceSlotKey(signerHex));
     }
 
     async contractScalar(contract, slot) {
-      const resp = await this._call('get_storage', core.storageBody(contract));
-      return BigInt(core.storageValue(JSON.stringify(resp), core.scalarSlotKey(BigInt(slot))));
+      return this._slotValue(contract, core.scalarSlotKey(BigInt(slot)));
     }
 
-    async callSignedOrder(callerSeedHex, callerIndex, contract, selectorHex, orderSpec, ownerSeedHex, ownerIndex, meterLimit, maxFeeQuon, expectedOrderNonce) {
+    async callSignedOrder(callerSeedHex, callerIndex, contract, selectorHex, orderSpec, ownerSeedHex, ownerIndex, meterLimit, maxFeeQuon, expectedOrderNonce, expectedNonce) {
       if (!core.valid_address(contract)) throw new Error('the contract is not a q1 address');
       const ceiling = feeCeiling(maxFeeQuon);
       const info = await this.nodeInfo();
       this._guardMainnet();
       const chainId = this._signingChainId(info);
-      const fee = info && info.fee && info.fee.transfer_quon;
-      if (fee == null) throw new Error('the gateway did not report a transfer fee');
-      if (gatewayFee(fee) > ceiling) {
-        throw new Error(`the gateway fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
+      const reported = info && info.fee && info.fee.transfer_quon;
+      if (reported == null) throw new Error('the gateway did not report a transfer fee');
+      const fee = vmCallFee(gatewayFee(reported), meterLimit);
+      if (fee > ceiling) {
+        throw new Error(`the fee ${fee} is above the maximum you allowed ${maxFeeQuon}, refusing to sign`);
       }
       const signer = core.orderSigner(ownerSeedHex, accountIndex(ownerIndex));
-      // The owner authorisation carries no deadline, so this nonce is the only thing
-      // that stops it being replayed. Reading it from the gateway hands the party the
-      // signature protects against the one term that expires it: answer with a future
-      // nonce and the reply is a valid order banked until the contract counter reaches
-      // it. Pass expectedOrderNonce to bind what you meant to sign; without it you are
-      // trusting the endpoint with the owner key.
-      const nonce = await this.contractNonce(contract, signer);
-      if (expectedOrderNonce != null && BigInt(expectedOrderNonce) !== nonce) {
+      const orderKey = contract + '/' + signer;
+      const reportedOrder = await this.contractNonce(contract, signer);
+      if (expectedOrderNonce != null && BigInt(expectedOrderNonce) !== reportedOrder) {
         throw new Error(
-          `the gateway reported order nonce ${nonce} but you expected ${expectedOrderNonce}, refusing to sign`
+          `the gateway reported order nonce ${reportedOrder} but you expected ${expectedOrderNonce}, refusing to sign`
         );
       }
+      const nonce = this._checkedNonce(reportedOrder, expectedOrderNonce, orderKey);
       const order = JSON.parse(core.buildTypedOrderCall(
         chainId,
         contract,
@@ -448,7 +529,12 @@ function makeClient(core) {
         BigInt(orderSpec.schemeOff),
         BigInt(orderSpec.ptrOff),
         BigInt(orderSpec.regionOff || 0),
-        JSON.stringify(orderSpec.fields || []),
+        JSON.stringify(orderSpec.fields || [], (k, v) => {
+          if (typeof v !== 'bigint') return v;
+          if (k === 'value') return v.toString();
+          if (v > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`the order field ${k} ${v} is too large to carry`);
+          return Number(v);
+        }),
         ownerSeedHex,
         accountIndex(ownerIndex),
         nonce,
@@ -456,13 +542,16 @@ function makeClient(core) {
       const from = core.address(callerSeedHex, accountIndex(callerIndex));
       const acct = await this.account(from);
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
+      const accountNonceUsed = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(
-        core.sign_call(callerSeedHex, accountIndex(callerIndex), contract, order.call_args, accountNonce(acct.nonce), BigInt(meterLimit), String(fee), chainId)
+        core.sign_call(callerSeedHex, accountIndex(callerIndex), contract, order.call_args, accountNonceUsed, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
       const outcome = await this.submit(signed.tx_hex);
+      this._remember(from, accountNonceUsed, outcome);
+      this._remember(orderKey, nonce, outcome);
       return { order, signed, outcome, orderNonce: nonce };
     }
   };
 }
 
-module.exports = { makeClient, feeCeiling, checkAmount, generateSeed, readBounded, requireSafeTransport, Network };
+module.exports = { makeClient, feeCeiling, checkAmount, generateSeed, readBounded, requireSafeTransport, validUntil, vmCallFee, VALIDITY_BLOCKS, Network };