@xochi/client 0.1.1 → 0.1.2

package/dist/cjs/shared/shieldedPreview.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Riddler's shielded terms preview wire (`POST /xochi/shielded/preview`,
+ * Riddler#1296): the typed request and response shapes and a decoder.
+ *
+ * There is NO transport method: the preview needs a `quote`-scoped Riddler
+ * credential, so only the Xochi Worker calls it, and the Worker proxy route is
+ * a follow-up owned by xochi#635. These shapes exist so that proxy and its
+ * consumers decode the solver's answer with the same schema the solver
+ * publishes (`packages/spec/wire/openapi.json`, `ShieldedPreviewResponse`).
+ *
+ * The preview is NOT a signing payload: `preview_digest` is the EIP-712 digest
+ * of `ShieldedPreviewV1` under the `Xochi Shielded Preview` domain, which no
+ * `ShieldedTermsV1` signature verifies against (`@xochi/spec`
+ * `conformance/shielded-terms.json`, PROPOSED). `executable` is always false.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShieldedPreviewResponseSchema = exports.ShieldedPreviewSchema = exports.ShieldedFeeBreakdownSchema = exports.ShieldedCorridorSchema = exports.ShieldedNetworkIdentitySchema = exports.aztecValue = void 0;
+exports.decodeShieldedPreview = decodeShieldedPreview;
+const zod_1 = require("zod");
+const schemas_js_1 = require("./schemas.js");
+/** 32-byte hex (`0x` + 64). */
+const bytes32 = zod_1.z.string().regex(/^0x[0-9a-fA-F]{64}$/);
+/**
+ * A 32-byte Aztec address or field element. The decoder checks the shape only;
+ * the solver has already refused zero and values at or above the BN254 modulus.
+ * A 20-byte EVM address never fits.
+ */
+exports.aztecValue = bytes32;
+/** Canonical unsigned decimal string (uint256 members). */
+const uintString = zod_1.z.string().regex(/^(0|[1-9][0-9]*)$/);
+/** Canonical positive base-unit amount. */
+const baseUnits = zod_1.z.string().regex(/^[1-9][0-9]*$/);
+exports.ShieldedNetworkIdentitySchema = zod_1.z.object({
+    aztec_chain_id: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+    protocol_version: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+    rollup_address: schemas_js_1.ethAddress,
+    l1_chain_id: zod_1.z.string().regex(/^[1-9][0-9]*$/),
+    genesis_or_network_digest: bytes32,
+});
+exports.ShieldedCorridorSchema = zod_1.z.object({
+    corridor_id: bytes32,
+    revision: zod_1.z.number().int().min(1).max(4294967295),
+    manifest_digest: bytes32,
+});
+exports.ShieldedFeeBreakdownSchema = zod_1.z.object({
+    gas_floor: uintString,
+    solver_fee_bps: zod_1.z.number().int().min(0).max(10000),
+    solver_fee: uintString,
+    price_impact_bps: zod_1.z.number().int().min(0).max(10000),
+    price_impact: uintString,
+    venue_fee_bps: zod_1.z.number().int().min(0).max(10000),
+    venue_fee: uintString,
+    routing_fee_bps: zod_1.z.number().int().min(0).max(10000),
+    routing_fee: uintString,
+    total_bps: zod_1.z.number().int().min(0).max(40000),
+    total_fee: uintString,
+});
+/** `ShieldedPreviewV1` in snake_case: the terms minus the per-execution members. */
+exports.ShieldedPreviewSchema = zod_1.z.object({
+    protocol_version: zod_1.z.literal("xochi.shielded.preview.v1"),
+    environment: zod_1.z.string().min(1),
+    source: zod_1.z.object({
+        chain_id: zod_1.z.number().int().positive(),
+        token_address: schemas_js_1.ethAddress,
+        wallet: schemas_js_1.ethAddress,
+        collector: schemas_js_1.ethAddress,
+        amount: baseUnits,
+    }),
+    destination: zod_1.z.object({
+        settlement_type: zod_1.z.literal("shielded"),
+        privacy_level: zod_1.z.literal("private"),
+        disclosure_profile: zod_1.z.literal("recipient-private-public-amount-v1"),
+        rail: zod_1.z.literal("a_tracer"),
+        network: exports.ShieldedNetworkIdentitySchema,
+        corridor: exports.ShieldedCorridorSchema,
+        asset_id: zod_1.z.string().min(1),
+        token_address: exports.aztecValue,
+        recipient_binding_id: zod_1.z.string().min(1),
+        recipient_descriptor_digest: bytes32,
+        recipient_address: exports.aztecValue,
+        amount: baseUnits,
+        fee_payer: exports.aztecValue,
+    }),
+    fee_breakdown: exports.ShieldedFeeBreakdownSchema,
+    refund_address: schemas_js_1.ethAddress,
+    refund_amount: baseUnits,
+    collect_before: zod_1.z.number().int().nonnegative(),
+    settlement_service_deadline: zod_1.z.number().int().nonnegative(),
+    recipient_binding_digest: bytes32,
+    policy_revision: zod_1.z.number().int().nonnegative(),
+});
+exports.ShieldedPreviewResponseSchema = zod_1.z.object({
+    executable: zod_1.z.literal(false),
+    preview_version: zod_1.z.literal("xochi.shielded.preview.v1"),
+    preview_digest: bytes32,
+    recipient_binding_digest: bytes32,
+    domain: zod_1.z.object({
+        name: zod_1.z.literal("Xochi Shielded Preview"),
+        version: zod_1.z.literal("1"),
+        chain_id: zod_1.z.number().int().positive(),
+        salt: bytes32,
+    }),
+    preview: exports.ShieldedPreviewSchema,
+    manifest: zod_1.z.object({
+        manifest_digest: bytes32,
+        aztec_sdk_version: zod_1.z.string().min(1),
+        recipient_account_class_id: exports.aztecValue,
+    }),
+});
+/**
+ * Decode a preview response. Throws (zod) on any shape the solver does not
+ * publish, including an executable or terms-shaped answer, and on a fee
+ * breakdown whose totals disagree: `total_fee` must be `max(gas_floor, layers)` (the gas
+ * floor is a minimum fee, as in FeePolicy) and `total_bps` the four rates.
+ */
+function decodeShieldedPreview(body) {
+    const decoded = exports.ShieldedPreviewResponseSchema.parse(body);
+    const f = decoded.preview.fee_breakdown;
+    const layers = BigInt(f.solver_fee) + BigInt(f.price_impact) + BigInt(f.venue_fee) + BigInt(f.routing_fee);
+    const gasFloor = BigInt(f.gas_floor);
+    const totalFee = layers > gasFloor ? layers : gasFloor;
+    const totalBps = f.solver_fee_bps + f.price_impact_bps + f.venue_fee_bps + f.routing_fee_bps;
+    if (BigInt(f.total_fee) !== totalFee || f.total_bps !== totalBps) {
+        throw new Error("shielded preview fee_breakdown totals disagree with max(gas_floor, layers)");
+    }
+    return decoded;
+}

package/dist/esm/machine/machine.d.ts

@@ -219,6 +219,8 @@ export type MsgBody = {
     type: "SignRequested";
 } | {
     type: "PullSignRequested";
+} | {
+    type: "CancelSignRequested";
 } | {
     type: "ResetRequested";
 } | {

package/dist/esm/machine/machine.js

@@ -156,6 +156,10 @@ function step(m, msg, fx) {
             return m.amount ? startQuote(m, fx, msg.now, quoteOpts(m.amount)) : m;
         case "SignRequested":
             return beginSign(m, fx, msg.now);
+        case "CancelSignRequested":
+            if (m.intent.status !== "signing" || !m.sign)
+                return m;
+            return transition(abandonSign(m, fx), fx, "quoted", { error: "Signature cancelled" });
         case "PullSignRequested":
             return beginPullSign(m, fx, msg.now);
         case "ResetRequested":
@@ -717,8 +721,9 @@ function onTimer(m, fx, timer, now) {
                 return resendBackstop(m, fx, now);
             return m.poll && !m.poll.stopped ? pollTick(m, fx, true) : m;
         case "signPrompt":
-            // A deep-link prompt that never re-opened the wallet.
-            return m.sign?.stage === "pull"
+            // A wallet prompt that never resolved. The flow still owns the prompt;
+            // `signFlowFailed` makes any reply arriving after this timer inert.
+            return m.sign
                 ? signFlowFailed(m, fx, {
                     rejected: false,
                     value: "wallet_prompt_timeout",
@@ -826,6 +831,10 @@ function beginSign(m, fx, now) {
             chainId: next.ctx.wallet.chainId,
         },
     });
+    // A wallet request can be dismissed without rejecting (mobile deep links in
+    // particular). Bound every prompt, including signature 1, so the ceremony
+    // always returns to an actionable surface.
+    setTimer(fx, "signPrompt", SIGN_PROMPT_TIMEOUT_MS, false);
     return { ...next, sign: { id, origin: "sign", stage: "intent", intentSignature: null } };
 }
 function beginPullSign(m, fx, now) {
@@ -926,8 +935,7 @@ function onSigned(m, fx, flowId, purpose, result, now) {
     // open; its signature then belongs to no ceremony.
     if (m.intent.status !== "signing")
         return abandonSign(m, fx);
-    if (purpose === "pull")
-        clearTimer(fx, "signPrompt");
+    clearTimer(fx, "signPrompt");
     if (!result.ok)
         return signFlowFailed(m, fx, result.error);
     if (purpose === "pull") {
@@ -1210,7 +1218,7 @@ function endSignFlow(m, flow) {
  * affordance, no prompt timer. Nothing signed so far can execute after this.
  */
 function abandonSign(m, fx) {
-    if (m.sign?.stage === "pull")
+    if (m.sign)
         clearTimer(fx, "signPrompt");
     if (awaitingResend(m))
         clearTimer(fx, "execute");
@@ -1226,12 +1234,16 @@ function signFlowFailed(m, fx, report) {
     const flow = m.sign;
     if (!flow)
         return m;
-    if (flow.stage === "pull")
-        clearTimer(fx, "signPrompt");
+    clearTimer(fx, "signPrompt");
     const next = endSignFlow(m, flow);
     if (flow.origin === "sign") {
         if (report.rejected)
             return transition(next, fx, "quoted", { error: "Signature rejected" });
+        if (report.value === "wallet_prompt_timeout") {
+            return transition(next, fx, "quoted", {
+                error: "Couldn't reach the wallet. Press Confirm to try again.",
+            });
+        }
         log(fx, "error", `${LOG} Sign error:`, report.detail);
         return transition(next, fx, "failed", { error: report.value ?? "Signing failed" });
     }

package/dist/esm/shared/index.d.ts

@@ -13,3 +13,4 @@ export * from "./validators.js";
 export * from "./schemas.js";
 export * from "./api.js";
 export * from "./intentStream.js";
+export * from "./shieldedPreview.js";

package/dist/esm/shared/index.js

@@ -13,3 +13,4 @@ export * from "./validators.js";
 export * from "./schemas.js";
 export * from "./api.js";
 export * from "./intentStream.js";
+export * from "./shieldedPreview.js";