@unicitylabs/sphere-sdk 0.9.2-dev.0 → 0.9.2-dev.1

package/dist/core/index.cjs

@@ -3116,9 +3116,14 @@ function planOps(params) {
       ops.push({ plainKey, wireKey: wk, baseVersion: cur.version, sealVersion: cur.version + 1, isDelete: false, value });
     }
   }
-  for (const [wk, cur] of known) {
-    if (!cur.deleted && !liveWire.has(wk) && !reserved?.has(wk)) {
-      ops.push({ plainKey: "", wireKey: wk, baseVersion: cur.version, sealVersion: cur.version + 1, isDelete: true });
+  const sweptWire = /* @__PURE__ */ new Set();
+  for (const tokenId of params.tombstonedTokenIds ?? []) {
+    const wk = wireKeyOf(tokenId);
+    if (sweptWire.has(wk)) continue;
+    sweptWire.add(wk);
+    const cur = known.get(wk);
+    if (cur && !cur.deleted && !liveWire.has(wk) && !reserved?.has(wk)) {
+      ops.push({ plainKey: tokenId, wireKey: wk, baseVersion: cur.version, sealVersion: cur.version + 1, isDelete: true });
     }
   }
   return ops;
@@ -3230,10 +3235,13 @@ var LoadDeltaTracker = class {
    */
   async beginLoad(known) {
     this.baseline = await this.loadBaseline();
-    this.accState = new Map(known);
-    if (this.baseline && !verifyRoot(this.bindingFor(this.baseline.cursor, this.baseline.root), this.baseline.sig, this.ownerPubForVerify())) {
-      this.baseline = null;
+    if (this.baseline) {
+      const entries = new Map(this.baseline.entries ?? []);
+      const sigOk = verifyRoot(this.bindingFor(this.baseline.cursor, this.baseline.root), this.baseline.sig, this.ownerPubForVerify());
+      const entriesOk = (this.baseline.entries?.length ?? 0) > 0 && computeRoot(entries) === this.baseline.root;
+      if (!sigOk || !entriesOk) this.baseline = null;
     }
+    this.accState = this.baseline ? new Map(this.baseline.entries ?? []) : new Map(known);
   }
   /**
    * Re-arm the tracker for a SANCTIONED-RESET re-pass (Task 8.2). After a verified
@@ -3265,7 +3273,7 @@ var LoadDeltaTracker = class {
     if (!mono.ok) return mono;
     this.fold(page.entries);
     if (this.baseline) {
-      const verdict = this.checkRoot();
+      const verdict = this.checkRegression();
       if (!verdict.ok) return verdict;
     }
     return { ok: true, reset: false };
@@ -3301,14 +3309,22 @@ var LoadDeltaTracker = class {
     this.accState = state;
   }
   /**
-   * The folded root must equal the signed baseline root: the wallet is the only
-   * writer, so a delta it did not author (no intervening flush advanced the
-   * baseline) means the server injected state — a rollback.
+   * Multi-device anti-rollback (finding: vault-anti-rollback-single-writer). Alarm
+   * ONLY on a REGRESSION of a committed entry — a baseline key now MISSING from, or
+   * at a LOWER version than, the folded server state. New keys and higher versions
+   * are legitimate FORWARD progress (this OR another device wrote them), never a
+   * rollback. Vault versions are strictly monotonic per key (create→update→delete→
+   * resurrect all increment), so a version going backwards (or a known entry
+   * vanishing) is the rollback signature, independent of which device authored the
+   * forward writes. (The old root-EQUALITY check assumed a SINGLE writer and so
+   * false-alarmed on every peer-device write — which broke multi-device sync.)
    */
-  checkRoot() {
-    const folded = computeRoot(this.accState);
-    if (folded !== this.baseline.root) {
-      return { ok: false, reason: "rollback" };
+  checkRegression() {
+    for (const [key, base] of this.baseline.entries ?? []) {
+      const cur = this.accState.get(key);
+      if (!cur || cur.version < base.version) {
+        return { ok: false, reason: "rollback" };
+      }
     }
     return { ok: true };
   }
@@ -3328,9 +3344,10 @@ var LoadDeltaTracker = class {
    */
   async commitBaseline(cursor, epoch, _epochSig) {
     if (this.config.baseline && this.walletPriv) {
-      const root = computeRoot(this.accState ?? /* @__PURE__ */ new Map());
+      const acc = this.accState ?? /* @__PURE__ */ new Map();
+      const root = computeRoot(acc);
       const sig = signRoot(this.walletPriv, this.bindingFor(cursor, root));
-      const baseline = { cursor, root, sig, epoch };
+      const baseline = { cursor, root, sig, epoch, entries: [...acc] };
       await this.config.baseline.set(this.baselineKey(), JSON.stringify(baseline));
     }
     this.accState = null;
@@ -3347,7 +3364,7 @@ var LoadDeltaTracker = class {
     const root = computeRoot(known);
     const epoch = this.baseline?.epoch ?? 0;
     const sig = signRoot(this.walletPriv, this.bindingFor(cursor, root));
-    const baseline = { cursor, root, sig, epoch };
+    const baseline = { cursor, root, sig, epoch, entries: [...known] };
     this.baseline = baseline;
     await this.config.baseline.set(this.baselineKey(), JSON.stringify(baseline));
   }
@@ -3595,7 +3612,13 @@ var RemoteTokenStorageProvider = class {
     this.wakeClient = new VaultWakeClient({
       vaultUrl: this.config.vaultUrl,
       auth: this.auth,
-      onWake: () => this.emit("storage:remote-updated", { source: "vault-wake" })
+      // Only wake when this provider is actually connected. A stale wake (e.g. fired
+      // after shutdown/identity-switch, before stop() lands) must NOT drive a receive/
+      // sync against torn-down wallet storage ("IndexedDBStorageProvider not connected").
+      onWake: () => {
+        if (this.status !== "connected") return;
+        this.emit("storage:remote-updated", { source: "vault-wake" });
+      }
     });
     this.wakeClient.start();
   }
@@ -3679,11 +3702,13 @@ var RemoteTokenStorageProvider = class {
   }
   /** Diff the TXF snapshot vs internal last-known state into a list of CAS ops. */
   planFlush(localData) {
+    const tombstones = localData._tombstones ?? [];
     return planOps({
       tokens: extractTokens(localData),
       known: this.known,
       wireKeyOf: (plainKey) => this.wireKeyFor(plainKey),
-      changed: (wk, value) => this.hasChanged(wk, value)
+      changed: (wk, value) => this.hasChanged(wk, value),
+      tombstonedTokenIds: tombstones.map((t) => t.tokenId)
     });
   }
   hasChanged(wk, value) {
@@ -4095,6 +4120,16 @@ var RemoteTokenStorageProvider = class {
     for (const e of this.known.values()) if (!e.deleted) n += 1;
     return n;
   }
+  /**
+   * True if the vault's last-known view has this token's wireKey TOMBSTONED — i.e.
+   * another device SPENT it. PaymentsModule.load uses this to DROP a stale local
+   * token the vault marked spent, so the `delete-resurrect` sync path can't
+   * re-create it and inflate the balance (finding: vault-cross-device-resurrect).
+   * `plainKey` is the genesis tokenId (v2TokenId === engine.tokenId === keyFromTokenId base).
+   */
+  isPlainKeyDeleted(plainKey) {
+    return this.known.get(this.wireKeyFor(plainKey))?.deleted === true;
+  }
   /** Snapshot the internal last-known state as a merkle `EntryState` map. */
   knownAsEntryState() {
     const out = /* @__PURE__ */ new Map();
@@ -13388,26 +13423,52 @@ var PaymentsModule = class _PaymentsModule {
       await TokenRegistry.waitForReady();
       const providers = this.getTokenStorageProviders();
       const ownAddresses = await this.ownMetaAddresses();
+      let mergedData = null;
+      const mergedHistory = [];
+      const tombKeys = /* @__PURE__ */ new Set();
       for (const [id, provider] of providers) {
-        try {
-          const result = await provider.load();
-          if (result.success && result.data) {
-            const loadedMeta = result.data?._meta;
-            if (!this.isOwnAddress(loadedMeta?.address, ownAddresses)) {
-              logger.warn("Payments", `Load: rejecting data from provider ${id} \u2014 address mismatch (got=${loadedMeta.address.slice(0, 20)}... expected one of this wallet's addresses)`);
-              continue;
-            }
-            this.loadFromStorageData(result.data);
-            await this.rebuildParsedTokenCache();
-            const txfData = result.data;
-            if (txfData._history && txfData._history.length > 0) {
-              await this.importRemoteHistoryEntries(txfData._history);
+        const result = await provider.load().catch((err) => {
+          logger.error("Payments", `Failed to load from provider ${id}:`, err);
+          return null;
+        });
+        if (!result || !result.success || !result.data) continue;
+        const data = result.data;
+        if (!this.isOwnAddress(data?._meta?.address, ownAddresses)) {
+          logger.warn("Payments", `Load: rejecting data from provider ${id} \u2014 address mismatch (got=${data._meta?.address?.slice(0, 20)}... expected one of this wallet's addresses)`);
+          continue;
+        }
+        if (!mergedData) mergedData = { _meta: data._meta };
+        for (const [k, v] of Object.entries(data)) {
+          if (k === "_meta" || k === "_history" || k === "_tombstones") continue;
+          if (!(k in mergedData)) mergedData[k] = v;
+        }
+        for (const t of data._tombstones ?? []) {
+          const tk = `${t.tokenId}:${t.stateHash}`;
+          if (tombKeys.has(tk)) continue;
+          tombKeys.add(tk);
+          (mergedData._tombstones ??= []).push(t);
+        }
+        if (data._history?.length) mergedHistory.push(...data._history);
+        logger.debug("Payments", `Merged token data from provider ${id}`);
+      }
+      if (mergedData) {
+        const deletionCheckers = [...providers.values()].filter(
+          (p) => typeof p.isPlainKeyDeleted === "function"
+        );
+        if (deletionCheckers.length > 0) {
+          for (const k of Object.keys(mergedData)) {
+            if (!/^_[0-9a-f]{64}$/i.test(k)) continue;
+            const plainKey = k.slice(1);
+            if (deletionCheckers.some((p) => p.isPlainKeyDeleted(plainKey))) {
+              delete mergedData[k];
+              logger.debug("Payments", `load(): dropping ${plainKey.slice(0, 12)}\u2026 \u2014 vault marks it spent (cross-device)`);
             }
-            logger.debug("Payments", `Loaded metadata from provider ${id}`);
-            break;
           }
-        } catch (err) {
-          logger.error("Payments", `Failed to load from provider ${id}:`, err);
+        }
+        this.loadFromStorageData(mergedData);
+        await this.rebuildParsedTokenCache();
+        if (mergedHistory.length > 0) {
+          await this.importRemoteHistoryEntries(mergedHistory);
         }
       }
       for (const [id, token] of this.tokens) {
@@ -15221,12 +15282,22 @@ var PaymentsModule = class _PaymentsModule {
     }
     this.syncDebounceTimer = setTimeout(() => {
       this.syncDebounceTimer = null;
+      const storage = this.deps?.storage;
+      if (storage?.isConnected && !storage.isConnected()) {
+        logger.debug("Payments", "Remote-update wake ignored \u2014 wallet storage not connected");
+        return;
+      }
       void (async () => {
         try {
           await this.receive();
         } catch (err) {
           logger.debug("Payments", "Auto-receive from remote update failed:", err);
         }
+        try {
+          await this.load();
+        } catch (err) {
+          logger.debug("Payments", "Auto-load (reconcile) from remote update failed:", err);
+        }
         try {
           const result = await this.sync();
           const data = eventData;