@quantovainc/qcore 0.1.33 → 0.2.0

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@quantovainc/qcore",
-  "version": "0.1.33",
+  "version": "0.2.0",
   "description": "Quantova's post quantum client core for JavaScript. Signs with ML-DSA-65 and builds Q1 addresses.",
   "scripts": {
     "build": "bash scripts/build.sh",
-    "test": "node test-types.js && node test-conformance.js && node test-order-nonce.js && node test-chain-binding.js && node test-sign-validate.js && node test-transport.js && node test-fee-cap.js && node test-network.js && node test-typed-order.js && node test-asset-guards.js && node test-account-index.js"
+    "test": "node test-entry-parity.mjs && node test-browser.mjs && node test-types.js && node test-conformance.js && node test-order-nonce.js && node test-chain-binding.js && node test-sign-validate.js && node test-transport.js && node test-fee-cap.js && node test-network.js && node test-typed-order.js && node test-asset-guards.js && node test-account-index.js"
   },
   "keywords": [
     "post-quantum",

package/pkg/package.json

@@ -2,7 +2,7 @@
   "name": "qcore-js",
   "type": "module",
   "description": "The JavaScript binding for the Quantova client core, generated over QCore with wasm-bindgen. The core does the key derivation, the post quantum signing, and the wire, the page does the fetch.",
-  "version": "0.1.33",
+  "version": "0.2.0",
   "license": "Apache-2.0 OR MIT",
   "repository": {
     "type": "git",

package/pkg-node/package.json

@@ -1,7 +1,7 @@
 {
   "name": "qcore-js",
   "description": "The JavaScript binding for the Quantova client core, generated over QCore with wasm-bindgen. The core does the key derivation, the post quantum signing, and the wire, the page does the fetch.",
-  "version": "0.1.33",
+  "version": "0.2.0",
   "license": "Apache-2.0 OR MIT",
   "repository": {
     "type": "git",

package/shared.js

@@ -331,11 +331,34 @@ function makeClient(core) {
     _checkedNonce(reported, expected, key) {
       const n = accountNonce(reported);
       if (!this._nextNonces) this._nextNonces = new Map();
+      if (!this._signedNonces) this._signedNonces = new Map();
       const local = key != null ? this._nextNonces.get(key) : undefined;
       const e = expected != null ? BigInt(expected) : local;
-      if (e == null) return n;
-      if (n > e) throw new Error(`the gateway reported nonce ${n} above the expected ${e}; refusing so a signature cannot be banked for a nonce the account has not reached`);
-      return expected != null ? e : n;
+      let slot;
+      if (e == null) {
+        slot = n;
+      } else {
+        if (n > e) throw new Error(`the gateway reported nonce ${n} above the expected ${e}; refusing so a signature cannot be banked for a nonce the account has not reached`);
+        slot = expected != null ? e : n;
+      }
+      return slot;
+    }
+
+    // Refuse a second, different transaction at a nonce this session already
+    // signed at. A gateway can broadcast a transaction and still report it
+    // rejected, or walk the nonce it reports back to a slot already used.
+    // Either way two valid signatures for one slot let it choose which the
+    // chain runs. An identical retry is harmless and still allowed.
+    _guardSigned(key, slot, txHex) {
+      if (key == null) return;
+      if (!this._signedNonces) this._signedNonces = new Map();
+      let held = this._signedNonces.get(key);
+      if (!held) { held = new Map(); this._signedNonces.set(key, held); }
+      const seen = held.get(String(slot));
+      if (seen != null && seen !== txHex) {
+        throw new Error(`a different transaction was already signed for nonce ${slot} in this session; one nonce carries one signature`);
+      }
+      held.set(String(slot), txHex);
     }
 
     _remember(key, used, outcome) {
@@ -387,6 +410,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.sign_transfer(seedHex, accountIndex(index), to, String(amount), nonce, String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -408,6 +432,7 @@ function makeClient(core) {
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
       const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(core.signRegister(seedHex, accountIndex(index), nonce, String(fee), chainId, this._validity(info)));
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -432,6 +457,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.sign_call(seedHex, accountIndex(index), target, argsHex, nonce, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -458,6 +484,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.signAssetCall(seedHex, accountIndex(index), target, argsHex, assetIssuer, String(amount), nonce, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -483,6 +510,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.signPayableCall(seedHex, accountIndex(index), target, argsHex, nonce, meterLimitOf(meterLimit), String(fee), String(value), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -546,6 +574,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.sign_call(callerSeedHex, accountIndex(callerIndex), contract, order.call_args, accountNonceUsed, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, accountNonceUsed, outcome);
       this._remember(orderKey, nonce, outcome);

package/shared.mjs

@@ -331,11 +331,34 @@ function makeClient(core) {
     _checkedNonce(reported, expected, key) {
       const n = accountNonce(reported);
       if (!this._nextNonces) this._nextNonces = new Map();
+      if (!this._signedNonces) this._signedNonces = new Map();
       const local = key != null ? this._nextNonces.get(key) : undefined;
       const e = expected != null ? BigInt(expected) : local;
-      if (e == null) return n;
-      if (n > e) throw new Error(`the gateway reported nonce ${n} above the expected ${e}; refusing so a signature cannot be banked for a nonce the account has not reached`);
-      return expected != null ? e : n;
+      let slot;
+      if (e == null) {
+        slot = n;
+      } else {
+        if (n > e) throw new Error(`the gateway reported nonce ${n} above the expected ${e}; refusing so a signature cannot be banked for a nonce the account has not reached`);
+        slot = expected != null ? e : n;
+      }
+      return slot;
+    }
+
+    // Refuse a second, different transaction at a nonce this session already
+    // signed at. A gateway can broadcast a transaction and still report it
+    // rejected, or walk the nonce it reports back to a slot already used.
+    // Either way two valid signatures for one slot let it choose which the
+    // chain runs. An identical retry is harmless and still allowed.
+    _guardSigned(key, slot, txHex) {
+      if (key == null) return;
+      if (!this._signedNonces) this._signedNonces = new Map();
+      let held = this._signedNonces.get(key);
+      if (!held) { held = new Map(); this._signedNonces.set(key, held); }
+      const seen = held.get(String(slot));
+      if (seen != null && seen !== txHex) {
+        throw new Error(`a different transaction was already signed for nonce ${slot} in this session; one nonce carries one signature`);
+      }
+      held.set(String(slot), txHex);
     }
 
     _remember(key, used, outcome) {
@@ -387,6 +410,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.sign_transfer(seedHex, accountIndex(index), to, String(amount), nonce, String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -408,6 +432,7 @@ function makeClient(core) {
       if (!acct || acct.nonce == null) throw new Error('the gateway did not report a nonce');
       const nonce = this._checkedNonce(acct.nonce, expectedNonce, from);
       const signed = JSON.parse(core.signRegister(seedHex, accountIndex(index), nonce, String(fee), chainId, this._validity(info)));
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -432,6 +457,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.sign_call(seedHex, accountIndex(index), target, argsHex, nonce, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -458,6 +484,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.signAssetCall(seedHex, accountIndex(index), target, argsHex, assetIssuer, String(amount), nonce, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -483,6 +510,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.signPayableCall(seedHex, accountIndex(index), target, argsHex, nonce, meterLimitOf(meterLimit), String(fee), String(value), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, nonce, outcome);
       return { signed, outcome };
@@ -546,6 +574,7 @@ function makeClient(core) {
       const signed = JSON.parse(
         core.sign_call(callerSeedHex, accountIndex(callerIndex), contract, order.call_args, accountNonceUsed, meterLimitOf(meterLimit), String(fee), chainId, this._validity(info))
       );
+      this._guardSigned(from, nonce, signed.tx_hex);
       const outcome = await this.submit(signed.tx_hex);
       this._remember(from, accountNonceUsed, outcome);
       this._remember(orderKey, nonce, outcome);