@xochi/client 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@xochi/client` are documented here. Format follows [Keep
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-10-27
+
+### Added
+
+- Typed wire shapes and a zod decoder for Riddler's shielded terms preview (`POST /xochi/shielded/preview`, Riddler#1296): `ShieldedPreviewResponseSchema`, `ShieldedPreviewSchema`, `ShieldedFeeBreakdownSchema`, `ShieldedNetworkIdentitySchema`, `ShieldedCorridorSchema`, the `ShieldedPreviewRequestWire` / `ShieldedPreviewResponseWire` types and `decodeShieldedPreview(body)`, which also refuses a fee breakdown whose totals do not add up. Shapes only, with no transport method: the preview needs a `quote`-scoped Riddler credential, and the Xochi Worker proxy route that would expose it is a follow-up owned by xochi#635. A test holds the schemas' members to the vendored `wire/openapi.json`.
+
+### Fixed
+
+- A wallet signature prompt can be cancelled immediately, and every prompt now times out after 90 seconds. A dismissed WalletConnect request previously left consumers in `signing` forever with no retry action; `CancelSignRequested` returns the unchanged quote to its confirm surface, timeout returns to retry or quote refresh as its expiry allows, and any late signature is ignored.
+
 ## [0.1.1] - 2026-10-26
 
 ### Added

package/README.md

@@ -83,6 +83,7 @@ Lifecycle rules the machine enforces, beyond the signer checks under [Fund safet
 - Confirm is gated on `canSignQuote` and `holdsCurrentQuote`: a held quote is signable (and a deposit address revealable) only while its quoted amount and trade match the form. The trade key is built from the same normalised fields as the quote request (`normalizeTradeFields`), so an edit that leaves the request unchanged keeps the quote.
 - A new amount, a trade/wallet context change, Reset, a resume, or entering `signing` / `awaiting_deposit` / `executing` drops in-flight quote flights. Refresh is ignored past `quoting`, Allocate outside `ALLOCATABLE_STATES` (idle / pending / quoting / quoted), and a quote reply that finds the trade past `quoting` or ended is dropped; a failed allocation never reopens a trade as `quoted`.
 - The sign ceremony survives `signing -> executing` only for the machine's own execute step (`sign.stage === "execute"`); a status-driven move abandons it, and a signature reply outside `signing` is ignored.
+- Every wallet prompt arms the one-shot `signPrompt` timer for `SIGN_PROMPT_TIMEOUT_MS` (90 s). Schedule it like the other timers. A host should expose `CancelSignRequested` while `view(model).phase === "awaiting-wallet"`; cancellation returns to the unchanged quote, clears the live ceremony and ignores a late signature. A timeout does the same, then normal quote expiry may move the receipt to its refresh surface.
 - `StreamStatus` frames for another intent are ignored. Read stream frames with `mapStatusFrame`: it passes in-flight frames only, so every terminal arrives by the poll with its receipt and reason. A `failed` frame a host dispatches itself follows the poll's rule ([Fund safety](#fund-safety)).
 - An execute reported `notAccepted` (below) waits with no status read and resends from the `execute` timer under a new flow id; a status move off `executing`, Reset, or any end of the ceremony drops the pending resend (`clear:execute`). **Hosts must schedule the `execute` timer** like the others and render the `busy` signing slot. A host that drops the timer is slowed, not stranded: the poll timer stays armed through the wait, and the first poll tick (every `STATUS_POLL_MS`, 4 s) or returning tab (`VisibilityChanged`) at or after the resend time does the timer's work, so the resend goes up to 4 s late. The deadline check still decides: a resend that late can fall inside `EXECUTE_RESEND_MARGIN_SECS`, and then the machine stops resending ("not sent yet", [Fund safety](#fund-safety)) instead.
 

package/dist/cjs/machine/machine.d.ts

@@ -219,6 +219,8 @@ export type MsgBody = {
     type: "SignRequested";
 } | {
     type: "PullSignRequested";
+} | {
+    type: "CancelSignRequested";
 } | {
     type: "ResetRequested";
 } | {

package/dist/cjs/machine/machine.js

@@ -162,6 +162,10 @@ function step(m, msg, fx) {
             return m.amount ? startQuote(m, fx, msg.now, quoteOpts(m.amount)) : m;
         case "SignRequested":
             return beginSign(m, fx, msg.now);
+        case "CancelSignRequested":
+            if (m.intent.status !== "signing" || !m.sign)
+                return m;
+            return transition(abandonSign(m, fx), fx, "quoted", { error: "Signature cancelled" });
         case "PullSignRequested":
             return beginPullSign(m, fx, msg.now);
         case "ResetRequested":
@@ -723,8 +727,9 @@ function onTimer(m, fx, timer, now) {
                 return resendBackstop(m, fx, now);
             return m.poll && !m.poll.stopped ? pollTick(m, fx, true) : m;
         case "signPrompt":
-            // A deep-link prompt that never re-opened the wallet.
-            return m.sign?.stage === "pull"
+            // A wallet prompt that never resolved. The flow still owns the prompt;
+            // `signFlowFailed` makes any reply arriving after this timer inert.
+            return m.sign
                 ? signFlowFailed(m, fx, {
                     rejected: false,
                     value: "wallet_prompt_timeout",
@@ -832,6 +837,10 @@ function beginSign(m, fx, now) {
             chainId: next.ctx.wallet.chainId,
         },
     });
+    // A wallet request can be dismissed without rejecting (mobile deep links in
+    // particular). Bound every prompt, including signature 1, so the ceremony
+    // always returns to an actionable surface.
+    setTimer(fx, "signPrompt", exports.SIGN_PROMPT_TIMEOUT_MS, false);
     return { ...next, sign: { id, origin: "sign", stage: "intent", intentSignature: null } };
 }
 function beginPullSign(m, fx, now) {
@@ -932,8 +941,7 @@ function onSigned(m, fx, flowId, purpose, result, now) {
     // open; its signature then belongs to no ceremony.
     if (m.intent.status !== "signing")
         return abandonSign(m, fx);
-    if (purpose === "pull")
-        clearTimer(fx, "signPrompt");
+    clearTimer(fx, "signPrompt");
     if (!result.ok)
         return signFlowFailed(m, fx, result.error);
     if (purpose === "pull") {
@@ -1216,7 +1224,7 @@ function endSignFlow(m, flow) {
  * affordance, no prompt timer. Nothing signed so far can execute after this.
  */
 function abandonSign(m, fx) {
-    if (m.sign?.stage === "pull")
+    if (m.sign)
         clearTimer(fx, "signPrompt");
     if (awaitingResend(m))
         clearTimer(fx, "execute");
@@ -1232,12 +1240,16 @@ function signFlowFailed(m, fx, report) {
     const flow = m.sign;
     if (!flow)
         return m;
-    if (flow.stage === "pull")
-        clearTimer(fx, "signPrompt");
+    clearTimer(fx, "signPrompt");
     const next = endSignFlow(m, flow);
     if (flow.origin === "sign") {
         if (report.rejected)
             return transition(next, fx, "quoted", { error: "Signature rejected" });
+        if (report.value === "wallet_prompt_timeout") {
+            return transition(next, fx, "quoted", {
+                error: "Couldn't reach the wallet. Press Confirm to try again.",
+            });
+        }
         log(fx, "error", `${LOG} Sign error:`, report.detail);
         return transition(next, fx, "failed", { error: report.value ?? "Signing failed" });
     }

package/dist/cjs/shared/index.d.ts

@@ -13,3 +13,4 @@ export * from "./validators.js";
 export * from "./schemas.js";
 export * from "./api.js";
 export * from "./intentStream.js";
+export * from "./shieldedPreview.js";

package/dist/cjs/shared/index.js

@@ -29,3 +29,4 @@ __exportStar(require("./validators.js"), exports);
 __exportStar(require("./schemas.js"), exports);
 __exportStar(require("./api.js"), exports);
 __exportStar(require("./intentStream.js"), exports);
+__exportStar(require("./shieldedPreview.js"), exports);