@xochi/client 0.0.0-stage → 0.1.1

package/dist/esm/machine/solverPin.js

@@ -0,0 +1,210 @@
+/**
+ * Fail-closed pin for origin-pull authorizations: binds both WHERE the funds go
+ * and HOW MUCH, before the wallet signs.
+ *
+ * Two axes can move funds on the origin leg. The recipient (pull `to` for
+ * ERC-3009, `spender` for Permit2) decides who collects. The amount (`value` for
+ * ERC-3009, `permitted.amount` for Permit2) decides how much. The user's
+ * signature is the on-chain authority for both (ERC-3009 moves exactly `value`,
+ * Permit2 caps the pull at `permitted.amount`), so a pull whose amount exceeds
+ * the intended input can overdraw the wallet even to a correctly-pinned
+ * recipient. This pin binds the recipient to an operator allowlist AND the amount
+ * to the intended input, refusing to sign on either mismatch. The trust anchors
+ * are the client's own config and the user's own quoted amount, neither of which
+ * the quote server can influence.
+ *
+ * Defense in depth: the Xochi worker independently refuses to serve a quote whose
+ * pull amount does not equal `from_amount` (packages/worker-lib), and the
+ * on-chain token / Permit2 contract verifies the signature over the amount
+ * actually pulled. So a compromised quote server cannot overdraw even if this
+ * client check is bypassed.
+ *
+ * Permit2 has no on-chain recipient guard (the spender chooses the recipient at
+ * call time), so its recipient is ALWAYS fail-closed: an unpinned permit2 pull is
+ * rejected. ERC-3009 binds `to` in the signed digest and the token enforces
+ * `msg.sender == to`, so an unpinned `to` stays bounded (accepted unless a hard
+ * pin is requested). Once an allowlist is configured, both methods enforce it.
+ *
+ * Mirrors the raxol agent-side pin (`solver_allowed?/2`). See GitHub #333
+ * (recipient pin) and the #170 origin-leg amount binding.
+ */
+import { extractPullAmount } from "../shared/index.js";
+const ERC3009_TYPE = "ReceiveWithAuthorization";
+const PERMIT2_TYPE = "PermitWitnessTransferFrom";
+/**
+ * Validate a served origin-pull authorization against the solver pin. Returns
+ * `{ ok: true }` when the wallet may sign, or `{ ok: false, field, reason }` to
+ * abort before signing.
+ *
+ * `expectedAmount` is the intended input amount (origin-token smallest units, the
+ * user's own quoted `from_amount`). The pull is rejected unless its collected
+ * amount equals it, so a served pull cannot overdraw beyond what the user meant
+ * to spend even when the recipient is correctly pinned.
+ */
+export function validateSolverPin(pull, config, expectedAmount) {
+    // message values are `unknown` off the wire; checkRecipient guards the field.
+    const message = pull.message;
+    let recipient;
+    switch (pull.primaryType) {
+        case ERC3009_TYPE:
+            recipient = checkRecipient("pull_to", message.to, "erc3009", config.erc3009Allowlist, config);
+            break;
+        case PERMIT2_TYPE:
+            recipient = checkRecipient("pull_spender", message.spender, "permit2", config.permit2Allowlist, config);
+            break;
+        default:
+            return {
+                ok: false,
+                field: "pull_type",
+                reason: `unsupported origin-pull authorization type: ${pull.primaryType}`,
+            };
+    }
+    if (!recipient.ok)
+        return recipient;
+    return checkAmount(pull, expectedAmount);
+}
+/**
+ * Bind the DESTINATION leg of the intent payload to what the client rendered,
+ * before the wallet signs it.
+ *
+ * `validateSolverPin` above protects the origin leg: how much leaves the wallet
+ * and who collects it. This is the mirror for the other end -- how much comes
+ * back and who receives it -- and it exists because those two fields are the only
+ * ones a user cannot verify by reading a wallet prompt. A payload whose
+ * `toAmount` is lower than the number on screen, or whose `recipient` is an
+ * address the user never chose, produces a wallet prompt that looks entirely
+ * normal.
+ *
+ * The trust anchor is the same as the origin pin's and that is the whole point:
+ * the expectation comes from the client's own rendered quote, never from another
+ * field of the same served response. The Xochi worker independently refuses to
+ * serve a quote whose `eip712.message.toAmount` disagrees with the `to_amount` it
+ * advertises (`servedPayoutMismatch`, packages/worker-lib), so against a healthy
+ * backend this check never fires. It covers what that one structurally cannot:
+ * anything that reaches the payload after the worker has vouched for it, or a
+ * worker that is itself compromised. A firing check here is an incident, not a
+ * tuning problem.
+ *
+ * Fail-closed on a missing or unreadable field: never sign a payout we cannot
+ * read.
+ */
+export function validatePayoutPin(intent, expected) {
+    const message = intent.message;
+    const servedAmount = message.toAmount;
+    if (typeof servedAmount !== "string" && typeof servedAmount !== "number") {
+        return {
+            ok: false,
+            field: "payout_amount",
+            reason: "intent payout amount is missing or unparseable",
+        };
+    }
+    if (!sameAmount(servedAmount, expected.toAmount)) {
+        return {
+            ok: false,
+            field: "payout_amount",
+            reason: `intent payout ${String(servedAmount)} does not match the quoted output ${expected.toAmount}`,
+        };
+    }
+    // Fail closed rather than skip: not knowing the expected recipient is exactly
+    // the case where signing blind is worst.
+    if (!expected.recipient) {
+        return {
+            ok: false,
+            field: "payout_recipient",
+            reason: "no expected recipient to check the payout against",
+        };
+    }
+    const servedRecipient = message.recipient;
+    if (typeof servedRecipient !== "string" || servedRecipient === "") {
+        return {
+            ok: false,
+            field: "payout_recipient",
+            reason: "intent payout recipient is missing or unparseable",
+        };
+    }
+    if (!sameRecipient(servedRecipient, expected.recipient)) {
+        return {
+            ok: false,
+            field: "payout_recipient",
+            reason: `intent payout recipient ${servedRecipient} is not the address this quote was for`,
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Compare two smallest-unit amounts by value, not by spelling.
+ *
+ * A string compare would reject `"0998000"` or a numeric `998000` against
+ * `"998000"` even though both mean the same payout, and this check fails closed:
+ * a false negative blocks a legitimate swap at the wallet prompt. BigInt is also
+ * required for correctness at scale, since an 18-decimal payout is past
+ * `Number.MAX_SAFE_INTEGER`. Falls back to exact string equality only when a
+ * value will not parse as an integer, so an unexpected format still has to match
+ * verbatim rather than being waved through.
+ */
+function sameAmount(served, expected) {
+    try {
+        return BigInt(served) === BigInt(expected);
+    }
+    catch {
+        return String(served) === expected;
+    }
+}
+/**
+ * Compare two recipients per address family. An EVM (`0x`-hex) pair compares
+ * case-insensitively; anything else (base58 Tron/Solana) is case-sensitive and
+ * compares verbatim, because lowercasing a base58 address changes it. Mirrors
+ * the worker-side rule and Riddler's own `token_value/1`.
+ */
+function sameRecipient(a, b) {
+    return a.startsWith("0x") && b.startsWith("0x") ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+/**
+ * Bind the pull's collected amount to the intended input. Fail-closed: a
+ * missing/unparseable amount is rejected (never sign an authorization whose value
+ * we cannot read), as is any amount that does not match exactly. Riddler builds
+ * the pull value straight from `from_amount` with no fee or buffer, so exact
+ * equality is correct.
+ */
+function checkAmount(pull, expectedAmount) {
+    const amount = extractPullAmount(pull);
+    if (amount === null) {
+        return {
+            ok: false,
+            field: "pull_amount",
+            reason: "origin-pull amount is missing or unparseable",
+        };
+    }
+    if (amount !== expectedAmount) {
+        return {
+            ok: false,
+            field: "pull_amount",
+            reason: `origin-pull amount ${amount.toString()} does not match the intended input ${expectedAmount.toString()}`,
+        };
+    }
+    return { ok: true };
+}
+function checkRecipient(field, recipient, method, allowlist, config) {
+    const addr = typeof recipient === "string" ? recipient.toLowerCase() : null;
+    if (allowlist.length === 0) {
+        // No pin configured for this method. ERC-3009 is bounded by the signed `to`
+        // + on-chain msg.sender == to, so accept unless a hard pin is demanded.
+        // Permit2 has no such guard, so it must always be pinned.
+        if (method === "erc3009" && !config.requirePin)
+            return { ok: true };
+        return {
+            ok: false,
+            field,
+            reason: method === "permit2"
+                ? "permit2 origin pull requires a pinned spender address"
+                : "solver pin required but no allowlist is configured",
+        };
+    }
+    if (addr !== null && allowlist.includes(addr))
+        return { ok: true };
+    return {
+        ok: false,
+        field,
+        reason: `origin-pull ${field} ${String(recipient)} is not an allowed solver address`,
+    };
+}

package/dist/esm/machine/state.d.ts

@@ -0,0 +1,167 @@
+/**
+ * The intent lifecycle's state, and the error value it carries.
+ */
+import type { ChainId, IntentStatus, SelectableChainId, SettlementType } from "../shared/index.js";
+import type { QuoteResponse } from "./wire.js";
+import type { StoredDepositAttestation } from "./deposit.js";
+/**
+ * A failure the UI can categorize by HTTP code and, on 429/503 backpressure,
+ * run a retry countdown for. Most failures are a plain string instead.
+ */
+export interface StructuredError {
+    message: string;
+    code?: number;
+    retryAfter?: number;
+    reason?: string;
+}
+/**
+ * Why a sign ceremony stopped before the wallet was asked for the signature
+ * that moves funds, while the quote is still the one to show. Typed so the
+ * renderer words it and nothing parses a message. No funds move on any of
+ * these: the first three stop Confirm before any prompt; the pull kinds stop
+ * after signature 1, before signature 2 (the origin pull) is requested.
+ */
+export type SignRefusal = 
+/** The wallet is not on the origin chain the signature binds. */
+{
+    kind: "wrong_chain";
+    chainId: SelectableChainId;
+}
+/** The account or network changed since this quote was made. */
+ | {
+    kind: "wallet_changed";
+}
+/** The payload to sign does not pay what the quote shows, to whom it shows. */
+ | {
+    kind: "payout_mismatch";
+}
+/** The served origin-pull authorization names an unpinned spender/recipient or amount. */
+ | {
+    kind: "pull_unpinned";
+}
+/** The token approval the origin pull needs was not granted. */
+ | {
+    kind: "approval_required";
+};
+export interface IntentState {
+    status: IntentStatus;
+    intentId: string | null;
+    quoteId: string | null;
+    quote: QuoteResponse | null;
+    error: string | StructuredError | null;
+    txHash: string | null;
+    receivingTxHash: string | null;
+    /** Public fill receipt (Riddler #632) + its chain; drives the receipt CTA and the settled state. */
+    settlementTxHash: string | null;
+    settlementChainId: ChainId | null;
+    /**
+     * Riddler's granular fill substatus, verbatim (`filling` | `filled` | ...).
+     * Read only to tell a delivered destination leg apart from one still in
+     * flight: Riddler can hold an intent at top-level `settling` with
+     * `substatus: filled` indefinitely (xochi#376). Never advances the lifecycle.
+     * Also `filled` when a status poll reads `settlementConfirmed` (a private
+     * intent's fill confirmed, its receipt withheld from an anonymous read).
+     */
+    substatus: string | null;
+    /**
+     * True while the latest status poll was the server's anonymous view of a
+     * stealth or shielded intent (xochi#563): its on-chain legs were withheld, so
+     * null hashes mean "not shown", not "not there". The host offers wallet SIWE
+     * recovery on it; a later owner read (no marker) clears it. Never a token.
+     */
+    legsWithheld: boolean;
+    reconciling: boolean;
+    /** Plain-language refund explanation; set only on a `refunded` status. */
+    refundReason: string | null;
+    /**
+     * Wallet account connected when this quote was produced. The quote's EIP-712
+     * digest is bound to it, so `sign()` refuses when the live wallet has since
+     * switched accounts (wrong-signer), and a mid-flow change resets the intent.
+     * Null until a quote lands.
+     */
+    quotedAddress: string | null;
+    /** Wallet chain id at quote time; guards against a wrong-chain signature. */
+    quotedChainId: number | null;
+    /**
+     * Pay amount (base units) this quote was requested at. The receipt renders
+     * the HELD quote against THIS figure, never the live input field: during the
+     * debounce-plus-fetch window after an edit, the two describe different
+     * trades, and mixing them shows a garbage implied rate and a false
+     * below-market flag. Null until a quote lands.
+     */
+    quotedFromAmount: string | null;
+    /**
+     * Settlement preference this quote was requested under. The receipt states
+     * the HELD quote's settlement, never the live form's: the two come apart when
+     * the user flips settlement while a quote is on screen, and the wallet signs
+     * the held one. Null until a quote lands.
+     */
+    quotedSettlement: SettlementType | null;
+    /**
+     * Deposit-acceptance deadline (unix seconds) for a deposit route, or null.
+     *
+     * Held on the INTENT, not read off `state.quote`, because it is a fact about
+     * the solver's acceptance window rather than about a price. The two come apart
+     * on a resumed swap: no quote is ever synthesized (a stale price shown as
+     * current would be a lie), so a quote-sourced deadline was undefined there and
+     * the status poll fell back to its flat 10-minute ceiling while the restored
+     * screen counted down the real 30-minute window. The poll then stopped and
+     * said so, next to a countdown saying otherwise.
+     *
+     * `pollCeilingAttempts` reads this, so it must be set anywhere an intent can
+     * enter `awaiting_deposit`: quote ingest and resume both.
+     */
+    depositDeadline: number | null;
+    /**
+     * The VERIFIED deposit binding: the exact fields the solver signed plus the
+     * signature over them, as proven by `verifyDepositAttestation` at ingest.
+     *
+     * Held so it can be persisted with the swap record and re-proven on resume. A
+     * resumed deposit address is read back out of localStorage, which is not a
+     * trust boundary, so it has to be checked by the same code that checks a live
+     * one rather than trusted because it was ours once. Null on any route without
+     * an attested deposit.
+     */
+    attestedDeposit: StoredDepositAttestation | null;
+    /**
+     * True once the status poll has hit its ceiling and stopped for this intent.
+     *
+     * Surfaced because a stopped poll and a poll that has found nothing yet are
+     * otherwise indistinguishable on screen: both render a spinner. A view that
+     * claims to be checking must be able to tell whether it still is.
+     */
+    pollExhausted: boolean;
+    /**
+     * Set on a `failed` read after an execute (or a revealed deposit address)
+     * that does not carry the Worker's nothing-moved marker
+     * (`failureMayHaveMoved`): the order did not complete and the funds may have
+     * moved. Terminal and never offered Retry: the phase is `may-have-moved`, the
+     * poll is stopped, and no quote starts until Reset.
+     */
+    mayHaveMoved: boolean;
+    /**
+     * Set when this client stops resending an execute the Worker answered
+     * not-accepted (`decideExecuteResend` gives up), when the execute's own
+     * answer says the intent reads `quoted` again (the Worker ended its claim
+     * without finishing the intent), or when a resumed `executing` intent (no
+     * quote and no sign flow in this tab) reads `quoted`: the order was not
+     * sent, but the signed request stays executable until its deadline, so
+     * there is no Retry yet. The status stays `executing`, the phase is
+     * `not-sent`, and the poll runs on until the Worker ends the intent:
+     * `failed` with `NOT_EXECUTED_SUBSTATUS` is Retry, and so is a 404 read past
+     * the Worker's finish (`unexecutedFinishAt`: only the quote sweep deletes a
+     * row, only one never claimed, and past the finish nothing can claim it). A
+     * 404 before the finish, or with no quote to compute it (a resumed intent),
+     * holds: it may come from a router, a proxy or a rollback while the signed
+     * request is still claimable. Cleared by any other read than `quoted`
+     * (another execute claimed it: shown in doubt) and by leaving `executing`.
+     */
+    notSent: boolean;
+    /**
+     * Set when a sign ceremony was refused before the funds-moving signature
+     * (see SignRefusal). The intent is `quoted` so the quote stays on screen; a
+     * new quote, a successful Confirm or a reset clears it.
+     */
+    refusal: SignRefusal | null;
+}
+export declare const INITIAL_INTENT_STATE: IntentState;

package/dist/esm/machine/state.js

@@ -0,0 +1,28 @@
+/**
+ * The intent lifecycle's state, and the error value it carries.
+ */
+export const INITIAL_INTENT_STATE = {
+    status: "idle",
+    intentId: null,
+    quoteId: null,
+    quote: null,
+    error: null,
+    txHash: null,
+    receivingTxHash: null,
+    settlementTxHash: null,
+    settlementChainId: null,
+    substatus: null,
+    legsWithheld: false,
+    reconciling: false,
+    refundReason: null,
+    quotedAddress: null,
+    quotedChainId: null,
+    quotedFromAmount: null,
+    quotedSettlement: null,
+    depositDeadline: null,
+    attestedDeposit: null,
+    pollExhausted: false,
+    mayHaveMoved: false,
+    notSent: false,
+    refusal: null,
+};

package/dist/esm/machine/transition.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Status-transition reducer for status-driven state.
+ *
+ * Validates each move against a predicate, no-ops on an invalid one, and
+ * otherwise merges { status, ...updates }. Pure: the machine reports the
+ * rejected move itself (an `Emit` log effect), so this never touches a console.
+ */
+/**
+ * Apply a validated status transition to a state object. Returns the previous
+ * state unchanged (same reference) when the move is invalid, otherwise the
+ * merged next state. Never mutates `prev`.
+ */
+export declare function applyStatusTransition<TStatus extends string, TState extends {
+    status: TStatus;
+}>(prev: TState, to: TStatus, canTransition: (from: TStatus, to: TStatus) => boolean, updates?: Partial<TState>): TState;

package/dist/esm/machine/transition.js

@@ -0,0 +1,17 @@
+/**
+ * Status-transition reducer for status-driven state.
+ *
+ * Validates each move against a predicate, no-ops on an invalid one, and
+ * otherwise merges { status, ...updates }. Pure: the machine reports the
+ * rejected move itself (an `Emit` log effect), so this never touches a console.
+ */
+/**
+ * Apply a validated status transition to a state object. Returns the previous
+ * state unchanged (same reference) when the move is invalid, otherwise the
+ * merged next state. Never mutates `prev`.
+ */
+export function applyStatusTransition(prev, to, canTransition, updates) {
+    if (!canTransition(prev.status, to))
+        return prev;
+    return { ...prev, status: to, ...updates };
+}

package/dist/esm/machine/validateRequest.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Quote request validation.
+ *
+ * Composable validation functions using functional patterns. Each validator
+ * returns a Result type that can be combined. Pure: the deadline check takes
+ * the clock as an argument, so the machine validates against the same `now`
+ * that stamped the request.
+ */
+import type { QuoteRequest } from "./wire.js";
+export interface SwapValidationResult {
+    isValid: boolean;
+    errors: string[];
+}
+/** Every reason `params` is not a sendable quote request, judged at `nowMs`. */
+export declare const validateSwapParams: (params: Partial<QuoteRequest>, nowMs: number) => SwapValidationResult;

package/dist/esm/machine/validateRequest.js

@@ -0,0 +1,123 @@
+/**
+ * Quote request validation.
+ *
+ * Composable validation functions using functional patterns. Each validator
+ * returns a Result type that can be combined. Pure: the deadline check takes
+ * the clock as an argument, so the machine validates against the same `now`
+ * that stamped the request.
+ */
+import { isChainId, isTronChainId, isSettlementType, ETH_ADDRESS_REGEX, ZERO_ADDRESS, ETH_ADDRESS_LENGTH, MAX_DEADLINE_OFFSET_SEC, MAX_SLIPPAGE_PERCENT, MAX_SLIPPAGE_BPS, isValidTronAddress, } from "../shared/index.js";
+const err = (error) => ({ ok: false, error });
+const okVoid = { ok: true };
+/** Chain validators: short-circuit on first error */
+const chain = (...validators) => (value) => {
+    for (const v of validators) {
+        const result = v(value);
+        if (!result.ok)
+            return result;
+    }
+    return okVoid;
+};
+const notEmpty = (s) => (s && s.trim() !== "" ? okVoid : err("Required"));
+const matchesRegex = (regex, message) => (s) => regex.test(s) ? okVoid : err(message);
+const notEqual = (forbidden, message) => (v) => v !== forbidden ? okVoid : err(message);
+// ============================================================
+// Address Validators
+// ============================================================
+const startsWithHex = (s) => s.startsWith("0x") ? okVoid : err("Must start with 0x");
+const hasCorrectLength = (s) => s.length === ETH_ADDRESS_LENGTH ? okVoid : err(`Must be ${ETH_ADDRESS_LENGTH} characters`);
+const hasValidHexChars = matchesRegex(ETH_ADDRESS_REGEX, "Contains invalid characters");
+const notZeroAddress = notEqual(ZERO_ADDRESS, "Zero address is not allowed");
+const validateAddress = chain(notEmpty, startsWithHex, hasCorrectLength, hasValidHexChars, notZeroAddress);
+const validateTokenAddress = chain(validateAddress, notEqual(ZERO_ADDRESS, "Use wrapped token address (WETH)"));
+const errorOf = (result) => (result.ok ? "" : result.error);
+// Individual field validators as simple functions
+const validateWallet = (wallet) => !wallet
+    ? ["Wallet is required"]
+    : !validateAddress(wallet).ok
+        ? [`Wallet: ${errorOf(validateAddress(wallet))}`]
+        : [];
+// Origin may be a non-EVM chain (Tron deposit route) as well as EVM.
+const validateFromChain = (chainId) => chainId === undefined
+    ? ["Source chain is required"]
+    : !isChainId(chainId) && !isTronChainId(chainId)
+        ? ["Invalid source chain"]
+        : [];
+// Destination may be a non-EVM chain (Tron); the origin stays EVM.
+const validateToChain = (chainId) => chainId === undefined
+    ? ["Destination chain is required"]
+    : !isChainId(chainId) && !isTronChainId(chainId)
+        ? ["Invalid destination chain"]
+        : [];
+// The source token can be a Tron TRC-20 (base58) on a Tron-origin deposit route.
+const validateFromToken = (token) => {
+    if (!token)
+        return ["Source token is required"];
+    if (validateTokenAddress(token).ok || isValidTronAddress(token))
+        return [];
+    return [`Source token: ${errorOf(validateTokenAddress(token))}`];
+};
+// The destination token can be a Tron TRC-20 (base58) on a Tron destination, so
+// accept either an EVM token address or a valid Tron address.
+const validateToToken = (token) => {
+    if (!token)
+        return ["Destination token is required"];
+    if (validateTokenAddress(token).ok || isValidTronAddress(token))
+        return [];
+    return [`Destination token: ${errorOf(validateTokenAddress(token))}`];
+};
+const validateFromAmount = (amount) => {
+    if (!amount)
+        return ["Amount is required"];
+    try {
+        const bigAmount = BigInt(amount);
+        return bigAmount > 0n ? [] : ["Amount must be greater than 0"];
+    }
+    catch {
+        return ["Invalid amount format"];
+    }
+};
+const validateDeadline = (deadline, nowMs) => {
+    if (deadline === undefined)
+        return ["Deadline is required"];
+    const now = Math.floor(nowMs / 1000);
+    if (deadline <= now)
+        return ["Deadline must be in the future"];
+    if (deadline > now + MAX_DEADLINE_OFFSET_SEC)
+        return ["Deadline cannot exceed 1 hour"];
+    return [];
+};
+const validateSlippageBps = (bps) => bps === undefined
+    ? ["Slippage tolerance is required"]
+    : bps < 1
+        ? ["Slippage must be at least 0.01%"]
+        : bps > MAX_SLIPPAGE_BPS
+            ? [`Slippage cannot exceed ${MAX_SLIPPAGE_PERCENT}%`]
+            : [];
+const validateSettlement = (pref) => !pref
+    ? ["Settlement preference is required"]
+    : !isSettlementType(pref)
+        ? ["Invalid settlement preference"]
+        : [];
+const validateSameToken = (p) => p.fromToken &&
+    p.toToken &&
+    p.fromChainId === p.toChainId &&
+    p.fromToken.toLowerCase() === p.toToken.toLowerCase()
+    ? ["Cannot swap token to itself"]
+    : [];
+/** Every reason `params` is not a sendable quote request, judged at `nowMs`. */
+export const validateSwapParams = (params, nowMs) => {
+    const errors = [
+        ...(params.preview ? [] : validateWallet(params.wallet)),
+        ...validateFromChain(params.fromChainId),
+        ...validateToChain(params.toChainId),
+        ...validateFromToken(params.fromToken),
+        ...validateToToken(params.toToken),
+        ...validateFromAmount(params.fromAmount),
+        ...validateDeadline(params.deadline, nowMs),
+        ...validateSlippageBps(params.slippageBps),
+        ...validateSettlement(params.settlementPreference),
+        ...validateSameToken(params),
+    ];
+    return { isValid: errors.length === 0, errors };
+};

package/dist/esm/machine/view.d.ts

@@ -0,0 +1,3 @@
+import { type Model } from "./machine.js";
+import { type Receipt } from "./receipt.js";
+export declare function view(model: Model): Receipt;

package/dist/esm/machine/view.js

@@ -0,0 +1,71 @@
+/**
+ * view(model) -> Receipt. Pure; the renderer draws this and nothing it derives
+ * on its own from the raw quote.
+ */
+import { MAX_EXECUTE_RESENDS } from "../shared/index.js";
+import { canSignQuote } from "./decisions.js";
+import { holdsCurrentQuote } from "./machine.js";
+import { phaseFromStatus } from "./phase.js";
+import { costOf, payoutOf, settlementDisclosure, } from "./receipt.js";
+function quoteSlot(model) {
+    const { status, quote } = model.intent;
+    // The receipt STAYS MOUNTED while a replacement is fetched, but only over a
+    // solvable quote: after a decline the held quote's figures are empty.
+    if (quote && (status === "quoted" || (status === "quoting" && quote.canSolve))) {
+        return {
+            kind: "ready",
+            executable: !quote.preview,
+            refreshing: status === "quoting",
+            expiresInSec: model.quoteExpiresIn,
+        };
+    }
+    if (status === "quoting")
+        return { kind: "loading" };
+    if (quote && !quote.canSolve)
+        return { kind: "declined", reason: quote.error ?? null };
+    return { kind: "none" };
+}
+function signingSlot(model) {
+    const quote = model.intent.quote;
+    const signatures = quote?.pullAuthorization ? 2 : 1;
+    const flow = model.sign;
+    if (flow) {
+        if (flow.stage === "execute") {
+            const attempt = flow.execute;
+            return typeof attempt?.resendAt === "number"
+                ? {
+                    kind: "busy",
+                    retryAt: Math.ceil(attempt.resendAt / 1000),
+                    resend: attempt.resends + 1,
+                    of: MAX_EXECUTE_RESENDS,
+                }
+                : { kind: "submitted" };
+        }
+        return flow.stage === "intent"
+            ? { kind: "in_wallet", step: 1, of: signatures }
+            : { kind: "in_wallet", step: 2, of: 2 };
+    }
+    if (model.awaitingPull)
+        return { kind: "awaiting_second" };
+    // A quote for a trade the form no longer describes is shown, never offered.
+    if (!canSignQuote(model.intent.status, quote) || !holdsCurrentQuote(model)) {
+        return { kind: "unavailable" };
+    }
+    if (model.intent.refusal)
+        return { kind: "refused", refusal: model.intent.refusal };
+    return quote?.depositAddress ? { kind: "deposit" } : { kind: "ready", signatures };
+}
+export function view(model) {
+    const { status, reconciling, mayHaveMoved, notSent, quote, quotedSettlement } = model.intent;
+    // A held quote is disclosed under the settlement it was requested (and is
+    // signed) under, not whatever the form says now.
+    const settlement = (quote && quotedSettlement) || model.ctx.settlementPreference;
+    return {
+        phase: phaseFromStatus(status, { reconciling, mayHaveMoved, notSent }),
+        quote: quoteSlot(model),
+        payout: payoutOf(quote),
+        cost: costOf(quote),
+        settlement: settlementDisclosure(settlement),
+        signing: signingSlot(model),
+    };
+}