@unicitylabs/sphere-sdk 0.14.5 → 0.14.6-dev.1

package/dist/core/index.cjs

@@ -9483,7 +9483,18 @@ function pause(ms, signal) {
     );
   });
 }
-async function awaitProofBounded(deps, transaction, external) {
+async function retryTransient(attempt, signal, intervalMs) {
+  for (; ; ) {
+    try {
+      return await attempt();
+    } catch (err) {
+      if (signal.aborted) throw err;
+      if (!isTransientGatewayError(err)) throw err;
+      await pause(intervalMs, signal);
+    }
+  }
+}
+function certificationDeadline(timeoutMs, external, label) {
   const controller = new AbortController();
   const relayAbort = () => {
     controller.abort(external?.reason);
@@ -9493,34 +9504,29 @@ async function awaitProofBounded(deps, transaction, external) {
     else external.addEventListener("abort", relayAbort, { once: true });
   }
   const timer = setTimeout(() => {
-    controller.abort(
-      new SphereError(
-        `inclusion proof not confirmed within ${String(deps.timeoutMs)} ms`,
-        "AGGREGATOR_ERROR"
-      )
-    );
-  }, deps.timeoutMs);
-  try {
-    for (; ; ) {
-      try {
-        return await (0, import_InclusionProofUtils.waitInclusionProof)(
-          deps.client,
-          deps.trustBase,
-          deps.predicateVerifier,
-          transaction,
-          controller.signal,
-          deps.intervalMs
-        );
-      } catch (err) {
-        if (controller.signal.aborted) throw err;
-        if (!isTransientGatewayError(err)) throw err;
-        await pause(deps.intervalMs, controller.signal);
-      }
+    controller.abort(new SphereError(`${label} within ${String(timeoutMs)} ms`, "AGGREGATOR_ERROR"));
+  }, timeoutMs);
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      external?.removeEventListener("abort", relayAbort);
     }
-  } finally {
-    clearTimeout(timer);
-    external?.removeEventListener("abort", relayAbort);
-  }
+  };
+}
+async function awaitProofBounded(deps, transaction, signal) {
+  return retryTransient(
+    () => (0, import_InclusionProofUtils.waitInclusionProof)(
+      deps.client,
+      deps.trustBase,
+      deps.predicateVerifier,
+      transaction,
+      signal,
+      deps.intervalMs
+    ),
+    signal,
+    deps.intervalMs
+  );
 }
 
 // token-engine/errors.ts
@@ -9562,6 +9568,21 @@ var CheckpointTrustbaseMismatchError = class extends SphereError {
   }
 };
 
+// token-engine/certification-outcome.ts
+function certificationFailure(err, failLabel, submitError, submitRejectedCleanly) {
+  if (err instanceof Error && err.message === `Invalid inclusion proof status: ${import_InclusionProofVerificationRule.InclusionProofVerificationStatus.TRANSACTION_HASH_MISMATCH}`) {
+    return new TransferConflictError(
+      `${failLabel}: the source state was already consumed by a different transaction (lost race \u2014 abort this intent and re-plan under a new transferId)`,
+      err
+    );
+  }
+  if (submitRejectedCleanly) return submitError;
+  return new ProofUnconfirmedError(
+    `${failLabel}: certification unconfirmed \u2014 the source spend may be on-chain; keep the intent open and resume under the same transferId`,
+    submitError ?? err
+  );
+}
+
 // token-engine/token-blob.ts
 var TOKEN_BLOB_TAG = 39051n;
 var TOKEN_BLOB_VERSION = 1;
@@ -10084,10 +10105,28 @@ var SphereTokenEngine = class {
    *                                   failure, not a resume case).
    */
   async submitAndAwaitProof(certificationData, transaction, failLabel, failCode, options) {
+    const deadline = certificationDeadline(
+      this.proofTimeoutMs,
+      options?.signal,
+      `${failLabel}: not certified`
+    );
+    try {
+      return await this.submitThenProve(certificationData, transaction, failLabel, failCode, deadline.signal);
+    } finally {
+      deadline.dispose();
+    }
+  }
+  /** One certification attempt under one deadline: the metered submit retries
+   *  transient answers instead of falling through to a proof that cannot exist. */
+  async submitThenProve(certificationData, transaction, failLabel, failCode, signal) {
     let submitError = null;
     let submitRejectedCleanly = false;
     try {
-      const response = await this.deps.client.submitCertificationRequest(certificationData);
+      const response = await retryTransient(
+        () => this.deps.client.submitCertificationRequest(certificationData),
+        signal,
+        this.deps.proofPollIntervalMs ?? DEFAULT_PROOF_POLL_INTERVAL_MS
+      );
       if (response.status !== import_CertificationResponse.CertificationStatus.SUCCESS) {
         submitError = new SphereError(`${failLabel}: ${response.status}`, failCode);
         submitRejectedCleanly = CLEAN_REJECT_STATUSES.has(response.status);
@@ -10101,33 +10140,21 @@ var SphereTokenEngine = class {
           client: this.deps.client,
           trustBase: this.deps.trustBase,
           predicateVerifier: this.deps.predicateVerifier,
-          timeoutMs: this.proofTimeoutMs,
           intervalMs: this.deps.proofPollIntervalMs ?? DEFAULT_PROOF_POLL_INTERVAL_MS
           // #683
         },
         transaction,
-        options?.signal
+        signal
       );
     } catch (err) {
-      if (err instanceof Error && err.message === `Invalid inclusion proof status: ${import_InclusionProofVerificationRule.InclusionProofVerificationStatus.TRANSACTION_HASH_MISMATCH}`) {
-        throw new TransferConflictError(
-          `${failLabel}: the source state was already consumed by a different transaction (lost race \u2014 abort this intent and re-plan under a new transferId)`,
-          err
-        );
-      }
-      if (submitRejectedCleanly) throw submitError;
-      throw new ProofUnconfirmedError(
-        `${failLabel}: certification unconfirmed \u2014 the source spend may be on-chain; keep the intent open and resume under the same transferId`,
-        submitError ?? err
-      );
+      throw certificationFailure(err, failLabel, submitError, submitRejectedCleanly);
     }
   }
   /**
-   * One inclusion-proof wait, with the deadline OWNED here (#739). The SDK's own
-   * default deadline is unreliable — see lateDeliveringSignal — and a lost one
-   * means an op that never settles, which also wedges PaymentsFacade.stop().
-   * A deadline hit throws, and the caller maps that to ProofUnconfirmedError
-   * (keep-open), which is the correct posture: the spend may be on-chain.
+   * One inclusion-proof wait, with the deadline OWNED here (#739) so it is bounded
+   * and configurable rather than the SDK's fixed default. A hit throws, and the
+   * caller maps it to ProofUnconfirmedError (keep-open) — the correct posture,
+   * since the spend may be on-chain.
    */
   /** Fail fast if this engine's key does not own the token's current state. */
   assertOwned(token) {
@@ -11462,7 +11489,7 @@ function createMachineStores(kv) {
 }
 
 // modules/payments-v2/machine/TransferMachine.ts
-var CERTIFY_WIDTH = 8;
+var CERTIFY_WIDTH = 20;
 var KEEP_OPEN_CODES = /* @__PURE__ */ new Set([
   "CERTIFICATION_UNCONFIRMED",
   "CHECKPOINT_PERSIST_FAILED",
@@ -11558,12 +11585,15 @@ var TransferMachine = class {
       payload: r.payload,
       ...r.payload.memo !== void 0 ? { memo: r.payload.memo } : {}
     };
-    const { committed, conflicts } = await this.resumeOps(ctx, engine, r);
+    const outcomes = await this.resumeOps(ctx, engine, r);
+    const { committed, cls, firstError } = summarize(outcomes);
+    const conflicts = this.toConflicts(engine, r, outcomes);
     if (committed.length === 0 && conflicts.length > 0) throw conflicts[0].error;
     let deliveryPending = false;
     if (committed.length > 0) {
       deliveryPending = await this.deliverSet(r.transferId, r.payload.recipient, r.payload.memo, committed);
     }
+    if (cls !== null && cls !== "conflict") throw firstError;
     await this.applyCommitted(engine, r.transferId, committed);
     if (conflicts.length > 0) {
       return { deliveryPending, partial: await this.settlePartial(engine, r, committed, conflicts) };
@@ -11648,25 +11678,28 @@ var TransferMachine = class {
     );
     return { recipientBlob: outputs[0].blob.token, changeBlob: outputs[1].blob.token };
   }
+  /** Raw outcomes; `summarize` alone decides what they mean — same as the send path. */
   async resumeOps(ctx, engine, r) {
-    const committed = [];
-    const conflicts = [];
+    const outcomes = [];
     for (const op of buildOps(r.payload)) {
       const journaled = op.kind === "direct" ? r.journaled.get(op.opIndex) : void 0;
       if (journaled !== void 0) {
-        committed.push({ op, certified: true, recipientBlob: hexToBytes4(journaled.blobHex) });
+        outcomes.push({ op, certified: true, recipientBlob: hexToBytes4(journaled.blobHex) });
         continue;
       }
-      const source = r.sources.get(op.sourceTokenId);
-      const outcome = await this.certifyOne(ctx, engine, op, source);
-      if (outcome.certified) {
-        committed.push(outcome);
-        continue;
-      }
-      if (classifyError(outcome.error) !== "conflict") throw outcome.error;
-      conflicts.push({ op, error: outcome.error, amount: conflictAmount(engine, r.payload, op, source) });
+      outcomes.push(await this.certifyOne(ctx, engine, op, r.sources.get(op.sourceTokenId)));
+      const last = outcomes[outcomes.length - 1];
+      if (last.error !== void 0 && classifyError(last.error) !== "conflict") break;
     }
-    return { committed, conflicts };
+    return outcomes;
+  }
+  /** Conflicted ops with the amount each leaves undelivered (#690 shortfall math). */
+  toConflicts(engine, r, outcomes) {
+    return outcomes.filter((o) => !o.certified && classifyError(o.error) === "conflict").map((o) => ({
+      op: o.op,
+      error: o.error,
+      amount: conflictAmount(engine, r.payload, o.op, r.sources.get(o.op.sourceTokenId))
+    }));
   }
   async deliverSet(transferId, recipientPubkey, memo, committed) {
     const journaled = committed.filter((o) => o.error === void 0 && o.recipientBlob !== void 0);