brainchain-worker 0.18.3 → 0.19.0

package/dist/exit.js

@@ -1,16 +1,32 @@
 // `exit`: the worker's USDG on BrainChain paid back within a minute instead of the bridge's seven days. The desk pays
 // it on Robinhood Chain, or, with `--to-solana`, as USDC on Solana through Relay: the transfer to the desk carries the
-// Solana address after its arguments, so nothing else is signed and nothing is needed on Robinhood Chain.
+// Solana address after its arguments, so nothing else is signed and nothing is needed on Robinhood Chain. The token and
+// the desk the service names are checked against this release before anything is signed.
+import { PublicKey } from "@solana/web3.js";
 import bs58 from "bs58";
-import { createPublicClient, createWalletClient, encodeFunctionData, erc20Abi, formatUnits, http, parseUnits } from "viem";
-import { RECEIPT_MS } from "./chain.js";
+import { createPublicClient, createWalletClient, encodeFunctionData, erc20Abi, formatUnits, http, isAddress, parseUnits } from "viem";
+import { RECEIPT_MS, reason } from "./chain.js";
 import { chainOf } from "./network.js";
-/** A Solana address: 32 bytes in base58. */
+/**
+ * Keys no one can spend USDC from. Program ids are often on the curve, so the
+ * curve alone does not catch them: the all-zero address, which the desk also
+ * reads as no destination, the token programs, USDC's mint and Relay's depository.
+ */
+const NOT_WALLETS = new Set([
+    "11111111111111111111111111111111",
+    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA",
+    "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb",
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL",
+    "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
+    "99vQwtBwYtrqqD9YSXbdum3KBdxPAVxYTaQ3cfnJSrN2",
+]);
+/** A Solana address a wallet can spend from: 32 bytes in base58, on the ed25519 curve. A program-derived address is off it, and USDC sent there is stranded. */
 export function isSolanaAddress(value) {
-    if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(value))
+    if (!/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(value) || NOT_WALLETS.has(value))
         return false;
     try {
-        return bs58.decode(value).length === 32;
+        const bytes = bs58.decode(value);
+        return bytes.length === 32 && PublicKey.isOnCurve(bytes);
     }
     catch {
         return false;
@@ -27,13 +43,39 @@ export function exitFee(amount, terms) {
     const fee = proportional > floor ? proportional : floor;
     return fee > amount ? amount : fee;
 }
+const units = (value) => typeof value === "string" && /^\d{1,30}$/.test(value);
+/** What the service answers for its exit terms, refused here when it is not the shape the rest of `exit` reads. */
 export async function exitTerms(service, fetchImpl = fetch) {
-    const response = await fetchImpl(`${service}/exits`, { signal: AbortSignal.timeout(20_000) });
+    const host = new URL(service).host;
+    const response = await fetchImpl(`${service}/exits`, { signal: AbortSignal.timeout(20_000) }).catch(() => {
+        throw new Error(`Could not reach the BrainChain service at ${host} for the exit terms. Nothing was sent.`);
+    });
     if (response.status === 404)
         throw new Error("Fast exits are off on this network");
     if (!response.ok)
-        throw new Error(`${service}/exits answered ${response.status}`);
-    return (await response.json());
+        throw new Error(`The BrainChain service at ${host} answered ${response.status} when asked for the exit terms. Nothing was sent.`);
+    const terms = (await response.json().catch(() => undefined));
+    const readable = typeof terms?.desk === "string" &&
+        isAddress(terms.desk, { strict: false }) &&
+        typeof terms.token === "string" &&
+        isAddress(terms.token, { strict: false }) &&
+        Number.isInteger(terms.feeBps) &&
+        terms.feeBps >= 0 &&
+        [terms.minFeeUnits, terms.minUnits, terms.maxUnits].every(units);
+    if (!readable)
+        throw new Error(`The BrainChain service at ${host} named the exit terms in a form exit cannot read. Nothing was sent.`);
+    return terms;
+}
+/** Why the terms cannot be signed for: a transfer goes to whatever token and desk they name, and only this release says which those are. */
+export function termsProblem(network, terms) {
+    const host = new URL(network.service).host;
+    if (terms.token.toLowerCase() !== network.contracts.bountyToken.toLowerCase()) {
+        return `The BrainChain service at ${host} names the token ${terms.token} for an exit, and ${network.name}'s ${network.bountySymbol} is ${network.contracts.bountyToken}. Nothing was sent.`;
+    }
+    if (terms.desk.toLowerCase() !== network.exitDesk.toLowerCase()) {
+        return `The BrainChain service at ${host} names the desk ${terms.desk}, and this release of brainchain-worker pays only ${network.exitDesk}. Nothing was sent.`;
+    }
+    return undefined;
 }
 export async function exitRecord(service, tx, fetchImpl = fetch) {
     const response = await fetchImpl(`${service}/exits/${tx}`, { signal: AbortSignal.timeout(20_000) });
@@ -43,15 +85,22 @@ export async function exitRecord(service, tx, fetchImpl = fetch) {
         throw new Error(`${service}/exits answered ${response.status}`);
     return (await response.json()).exits[0];
 }
-export function createExitChain(network, account) {
-    const read = createPublicClient({ chain: chainOf(network), transport: http(network.rpc, { timeout: 20_000 }) });
+export function createExitChain(network, account, receiptMs = RECEIPT_MS) {
+    const read = createPublicClient({ chain: chainOf(network), transport: http(network.rpc, { timeout: 20_000 }), pollingInterval: 1_000 });
     const wallet = createWalletClient({ account, chain: chainOf(network), transport: http(network.rpc, { timeout: 20_000 }) });
     return {
         account: account.address,
         bountyBalance: (token) => read.readContract({ address: token, abi: erc20Abi, functionName: "balanceOf", args: [account.address] }),
+        async unmined() {
+            const [pending, latest] = await Promise.all([read.getTransactionCount({ address: account.address, blockTag: "pending" }), read.getTransactionCount({ address: account.address })]);
+            return pending - latest;
+        },
         async sendToDesk(token, desk, amount, solana) {
             const hash = await wallet.sendTransaction({ to: token, data: exitCalldata(desk, amount, solana) });
-            const receipt = await read.waitForTransactionReceipt({ hash, timeout: RECEIPT_MS });
+            // Sent is not lost: the transfer can still land, so another run would pay the desk twice.
+            const receipt = await read.waitForTransactionReceipt({ hash, timeout: receiptMs }).catch((error) => {
+                throw new Error(`The transfer to the desk was sent (${hash}) and could not be confirmed (${reason(error)}). Follow it at ${network.service}/exits/${hash} before running exit again: another run sends another transfer.`);
+            });
             if (receipt.status !== "success")
                 throw new Error(`the transfer to the desk reverted (${hash})`);
             return hash;
@@ -64,11 +113,14 @@ export async function exit(network, chain, options) {
     const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     if (options.toSolana !== undefined) {
         if (!isSolanaAddress(options.toSolana))
-            throw new Error(`"${options.toSolana}" is not a Solana address`);
+            throw new Error(`"${options.toSolana}" is not the address of a Solana wallet, so USDC sent there could not be spent`);
         if (network.id !== "mainnet")
             throw new Error("--to-solana is mainnet only: Relay connects Solana with Robinhood Chain mainnet, not the testnets");
     }
     const terms = await exitTerms(network.service, fetchImpl);
+    const refused = termsProblem(network, terms);
+    if (refused)
+        throw new Error(refused);
     const balance = await chain.bountyBalance(terms.token);
     const amount = options.amount === undefined ? balance : parseUnits(options.amount, 6);
     const min = BigInt(terms.minUnits);
@@ -82,34 +134,45 @@ export async function exit(network, chain, options) {
     if (amount < min)
         throw new Error(`An exit is at least ${show(min)}`);
     if (amount > max)
-        throw new Error(`An exit is at most ${show(max)}; send the rest in another exit`);
+        throw new Error(`An exit is at most ${show(max)}, and nothing was sent. Give --amount up to that, and send the rest in another exit.`);
     const fee = exitFee(amount, terms);
     const net = amount - fee;
-    log(`Exit ${show(amount)} from ${network.name}: ${show(net)} arrives on the parent chain (chain ${terms.payoutChainId}) after a ${show(fee)} fee.`);
-    if (options.toSolana !== undefined)
-        log(`Paid as USDC on Solana to ${options.toSolana}, less Relay's own fee, unless the move would cost more than 3% (or 0.50 USD); then it is paid on the parent chain.`);
+    const paid = options.toSolana === undefined
+        ? `${show(net)} arrives on the parent chain (chain ${terms.payoutChainId}) after a ${show(fee)} fee.`
+        : `${show(net)} after a ${show(fee)} fee is paid as USDC on Solana to ${options.toSolana}, less Relay's own fee. The desk prices that move once the transfer arrives; one that would cost more than 3% (or 0.50 USD) is paid in ${symbol} on the parent chain (chain ${terms.payoutChainId}) instead.`;
+    log(`Exit ${show(amount)} from ${network.name}: ${paid}`);
     if (dry) {
         log("Dry run, nothing sent.");
         return;
     }
+    const unmined = await chain.unmined();
+    if (unmined > 0)
+        throw new Error(`This wallet has a transaction on ${network.name} that is not mined yet, which may be an earlier exit, and another run would send another transfer. Nothing was sent; run exit again once it is mined.`);
     const tx = await chain.sendToDesk(terms.token, terms.desk, amount, options.toSolana);
+    const follow = `${network.service}/exits/${tx}`;
     log(`Sent to the desk on ${network.name} (${tx}). Waiting for the payout, usually under a minute.`);
     const end = Date.now() + (options.waitMs ?? 1_800_000);
     let last = "";
     let record;
     for (;;) {
         record = await exitRecord(network.service, tx, fetchImpl).catch(() => undefined);
-        if (record?.state === "paid" || record?.state === "returned")
+        if (record?.state === "paid" || record?.state === "returned" || record?.state === "held")
             break;
         if (record?.reason && record.reason !== last)
             log(`Waiting: ${record.reason}.`);
         last = record?.reason ?? last;
         if (Date.now() > end) {
-            log(`Still waiting after ${Math.round((options.waitMs ?? 1_800_000) / 60_000)} minutes. The desk pays it or sends it back within a day; follow it at ${network.service}/exits/${tx}.`);
+            const within = options.toSolana === undefined ? "The desk pays it or sends it back within a day" : "Within a day the desk pays it or sends it back, or holds it for a person if Relay has not settled the move";
+            log(`Still waiting after ${Math.round((options.waitMs ?? 1_800_000) / 60_000)} minutes. ${within}; follow it at ${follow}.`);
             return;
         }
         await sleep(options.pollMs ?? 10_000);
     }
+    if (record.state === "held") {
+        log(`The desk holds this exit for a person: ${record.reason ?? "no reason given"}. Nothing more is sent for it until it is settled; follow it at ${follow}.`);
+        process.exitCode = 1;
+        return;
+    }
     if (record.state === "returned") {
         log(`The desk sent it back on ${network.name}: ${record.reason ?? "no reason given"} (${record.returnTx}).`);
         process.exitCode = 1;

package/dist/key.js

@@ -6,7 +6,7 @@ import { stateDir } from "./state.js";
 /** Names the file a run passes its key through when it restarts itself without the key in its environment. */
 const HANDOFF = "BRAINCHAIN_WORKER_KEY_HANDOFF";
 const HANDOFF_NAME = /^brainchain-worker-key-[0-9a-f]{32}$/;
-const expandHome = (path) => (path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path);
+export const expandHome = (path) => (path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path);
 /** Whether the environment names a key, without reading it: a key file can be a pipe, which reads only once. */
 export const keyConfigured = (env = process.env) => Boolean(env[HANDOFF] || env.BRAINCHAIN_WORKER_KEY?.trim() || env.BRAINCHAIN_WORKER_KEY_FILE?.trim());
 /** What is wrong with a key file's text, in words that never repeat any of it. */
@@ -85,19 +85,33 @@ function handoffDir() {
         return stateDir();
     }
 }
+/** A variable that holds a key or says where one is: the worker's and the Solana wallet's, which `run` never uses. */
+const KEY_VARIABLE = /^BRAINCHAIN_(WORKER|SOLANA)_KEY(_FILE)?$/;
+/** A key file that is a pipe has been read and holds nothing, so its name can stay: a restart would put a key piped in to stay out of files in one for a moment. */
+function namesOnlyAPipe(names, env) {
+    if (names.length !== 1 || names[0] !== "BRAINCHAIN_WORKER_KEY_FILE")
+        return false;
+    try {
+        return !statSync(expandHome(env.BRAINCHAIN_WORKER_KEY_FILE.trim())).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 /**
- * Restarts this process in place without BRAINCHAIN_WORKER_KEY in its
- * environment. Deleting the variable would not do: `ps eww` and /proc read the
- * block the process started with, and a command run by `run` can reach both.
- * The pid, the output and the supervisor's view all stay as they were. Returns
- * when there is nothing to clear, or when it could not be cleared.
+ * Restarts this process in place without any key variable in its environment.
+ * Deleting them would not do: `ps eww` and /proc read the block the process
+ * started with, and a command run by `run` can reach both. The pid, the output
+ * and the supervisor's view all stay as they were. Returns when there is
+ * nothing to clear, or when it could not be cleared.
  */
 export function clearKeyFromEnvironment(key, warn, env = process.env, execve = process.execve) {
-    if (env.BRAINCHAIN_WORKER_KEY === undefined)
+    const names = Object.keys(env).filter((name) => KEY_VARIABLE.test(name));
+    if (names.length === 0 || namesOnlyAPipe(names, env))
         return;
     if (typeof execve !== "function")
-        return warn(`warning: Node.js ${process.version} cannot clear the key from this process's environment; Node.js 22.15 or later can`);
-    const { BRAINCHAIN_WORKER_KEY: _, ...rest } = env;
+        return warn(`warning: Node.js ${process.version} cannot clear the key variables from this process's environment; Node.js 22.15 or later can`);
+    const rest = Object.fromEntries(Object.entries(env).filter(([name]) => !KEY_VARIABLE.test(name)));
     let file;
     try {
         file = join(handoffDir(), `brainchain-worker-key-${randomBytes(16).toString("hex")}`);
@@ -107,6 +121,6 @@ export function clearKeyFromEnvironment(key, warn, env = process.env, execve = p
     catch (error) {
         if (file !== undefined)
             rmSync(file, { force: true });
-        warn(`warning: could not clear the key from this process's environment (${error.message})`);
+        warn(`warning: could not clear the key variables from this process's environment (${error.message})`);
     }
 }

package/dist/mint.js

@@ -23,8 +23,8 @@ export const wethAbi = parseAbi([
 export const MAX_MINT = 10;
 /** How often a delivered task's status is read until it settles. */
 const STATUS_SEC = 300;
-/** Each step from grading to a ruling on appeal has a window of at most 6 hours, so a task unsettled two days after delivery is left. */
-const WATCH_SEC = 2 * 86_400;
+/** Grading, a dispute, its ruling, the appeal window and the ruling on appeal take up to 48 hours on set 3.5.0, so a task unsettled three days after delivery is left. */
+const WATCH_SEC = 3 * 86_400;
 /** A day after payment the task joins the public pool, so the worker's own attempts stop an hour short of it. */
 const OWN_SEC = 23 * 3_600;
 /** The least time between two mint attempts for one task. */
@@ -93,7 +93,8 @@ export async function pendingTasks(network, worker, fetcher = fetch) {
     if (!Array.isArray(tasks) || !tasks.every((id) => typeof id === "string" && /^\d{1,78}$/.test(id))) {
         throw new Error(`The BrainChain service at ${host} listed the tasks waiting for a Proof in a form the worker cannot read`);
     }
-    return [...new Set(tasks)].map((id) => BigInt(id));
+    // Task ids restart with each board and the list spans them, so a repeated id is another task.
+    return tasks.map((id) => BigInt(id));
 }
 const proofCount = (n) => `${n} Proof${n === 1 ? "" : "s"}`;
 /** "task 12", "tasks 12 and 15", "tasks 12, 15 and 18". */
@@ -159,7 +160,7 @@ export async function mint(network, chain, options) {
         return log(`The BrainChain service lists no paid task of ${chain.account} waiting for a Proof, so there is nothing to mint.`);
     const batch = listed.slice(0, Math.min(options.count ?? MAX_MINT, MAX_MINT));
     const left = listed.length - batch.length;
-    const rest = left > 0 ? ` ${left} more paid task${left === 1 ? " waits" : "s wait"} for a Proof: run mint again.` : "";
+    const rest = left > 0 ? ` ${left} more paid task${left === 1 ? " waits" : "s wait"} for a Proof, for a later mint.` : "";
     const funds = await afford(proofs, chain, batch.length, { dry: options.dry, claiming: () => log("Claiming test WETH from the faucet..."), now: options.now ?? wall });
     const each = `${formatEther(funds.price)} WETH each plus gas`;
     if (options.dry) {
@@ -180,6 +181,8 @@ export async function mint(network, chain, options) {
     }
     if (rest)
         log(rest.trim());
+    // The service scans in rounds and caches the list, so it still shows these tasks for a while.
+    log("`mint --dry` lists these tasks until the service has seen these mints, which can take minutes. A mint before then, here or by `run --mint`, pays for another piece.");
 }
 /**
  * What `run` does once a task is delivered: it watches the task until it
@@ -216,7 +219,7 @@ export function createSettlementWatch(options) {
         }
         if (outcome === undefined) {
             if (clock() - entry.deliveredAt >= WATCH_SEC)
-                drop(key, "not settled two days after delivery, so the worker stops watching it");
+                drop(key, "not settled three days after delivery, so the worker stops watching it");
             else
                 later(entry, STATUS_SEC);
             return false;

package/dist/network.js

@@ -37,6 +37,7 @@ export const TESTNET = {
         router: "0x1BBe71Dd3af85309A5c7Ab00B190F38f34Fe3569",
         gas: "Get Robinhood Chain testnet ETH at https://faucet.testnet.chain.robinhood.com",
     },
+    exitDesk: "0xf848984c8A0D9E49Cc9C97380C62b34C6f3b97D1",
     contracts: {
         taskBoard: "0x7A7cC5D35A642CCc268C7B263fF800bc7eBD52A4",
         staking: "0x6aFC3EFB49CF9b14C2F7c6C4f6C0bb3eF0125e2b",
@@ -49,20 +50,20 @@ export const TESTNET = {
         bountyToken: "0xC4ec72794bF3Ce9ba1DE4B38085464c2eb0cDCf2",
     },
 };
-// The 3.3.0 set. Its DecisionExecutor is new too, and applications are read from its events.
-export const MAINNET_TASK_BOARD = "0x8385bb4b8990411CcdD8e851B2676da1A4C1f3C4";
-export const MAINNET_WORKER_STAKING = "0x21Fe66c04da07f85D855E9920251Df7d584c3D9F";
-export const MAINNET_PROPOSAL_BONDS = "0x1129435A110AB3Ffd3fFEE345A48f648DdE3D52c";
-export const MAINNET_DECISION_EXECUTOR = "0x98BEA2E455539dB38b7337d81C673326128EA17F";
+// The 3.5.0 set. Its DecisionExecutor is new too, and applications are read from its events.
+export const MAINNET_TASK_BOARD = "0x44b8464342Bbfb9B565FAE494DfDefa37D33A211";
+export const MAINNET_WORKER_STAKING = "0xa4351E2b84eb634E93D9082907B2d0D3Aa91B98F";
+export const MAINNET_PROPOSAL_BONDS = "0x33260Cd6b4F368031F5AF2B5413d0CE6bb2aFAA4";
+export const MAINNET_DECISION_EXECUTOR = "0xFD268Ae2c1Ec0Db03C3C6b17E1AEDE973729FE29";
 const BRAIN = "0x3367085Eb6C79BfB0fCa4f1433ec77bFA8CB8a37";
-/** BrainChain mainnet, release 3.4.0. */
+/** BrainChain mainnet, release 3.5.0. */
 export const MAINNET = {
     id: "mainnet",
     name: "BrainChain",
     chainId: 274663,
     rpc: "https://rpc.usebrainchain.com",
     service: "https://brain.usebrainchain.com",
-    fromBlock: 839n,
+    fromBlock: 965n,
     explorer: "https://usebrainchain.com",
     stakeSymbol: "BRAIN",
     bountySymbol: "USDG",
@@ -97,14 +98,19 @@ export const MAINNET = {
         gas: "Send it a little ETH on Robinhood Chain",
         tokens: { stake: "0xC80333bf7f4078e14Ce5b6e223aF607aDcA44418", bounty: "0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168" },
     },
+    exitDesk: "0xafB0C4Ef895D4895040cdC6435B96D3EE8350c6E",
+    retired: [
+        { release: "3.4.0", taskBoard: "0x8385bb4b8990411CcdD8e851B2676da1A4C1f3C4", staking: "0x21Fe66c04da07f85D855E9920251Df7d584c3D9F" },
+        { release: "3.3.0", taskBoard: "0x72C890AA996bF7efcA88e3F5063B626560215160", staking: "0x0fb02559e704549794EdF3FBBBe91DB88bB849ee" },
+    ],
     contracts: {
         taskBoard: MAINNET_TASK_BOARD,
         staking: MAINNET_WORKER_STAKING,
         bonds: MAINNET_PROPOSAL_BONDS,
         executor: MAINNET_DECISION_EXECUTOR,
-        registry: "0x870B0BFB24aF2C06180FbEe266117305e0B0E00F",
-        log: "0xFdFEDb376c9632A4D6F15a1697E2b6853f12B4d7",
-        gate: "0x48c2Ed99Dc786ba667eFcFF721ff4cA92a1f344A",
+        registry: "0xA7f8A21Cc9574DB049F525a4fd499DA49c0D51ed",
+        log: "0x2EF509bd9cA1e7C5FBe2C2FD7Ff25cE9F6f9cB68",
+        gate: "0x71B2dc3dEC1aEB000936380981DfC51E47AA4fb8",
         stakeToken: BRAIN,
         bountyToken: "0x8eBFEce96c0AeF7Fd23425D846a302a552c8c451",
     },

package/dist/propose.js

@@ -1,6 +1,6 @@
-import { BaseError, createPublicClient, createWalletClient, decodeErrorResult, decodeFunctionData, encodeAbiParameters, encodeFunctionData, ExecutionRevertedError, getAddress, isAddress, isHex, keccak256, parseAbi, parseEventLogs, size, slice, } from "viem";
-import { erc20Errors } from "./abi.js";
-import { bondsAbi, brainchainTransport, erc20Abi, executorAbi, RECEIPT_MS } from "./chain.js";
+import { BaseError, createPublicClient, createWalletClient, decodeErrorResult, decodeFunctionData, encodeFunctionData, ExecutionRevertedError, getAddress, isAddress, isHex, parseAbi, parseEventLogs, size, } from "viem";
+import { erc20Errors, transferErrors } from "./abi.js";
+import { bondsAbi, brainchainTransport, callVetoed, erc20Abi, executorAbi, openProposalOf, RECEIPT_MS } from "./chain.js";
 import { chainOf } from "./network.js";
 import { gasHelp, stake, when } from "./standing.js";
 /** Every call the executor can be asked to make, by the contract it calls. */
@@ -19,21 +19,20 @@ export const GOVERNED = {
     registry: parseAbi(["function setModel(bytes32 id, address account, uint128 price, bool active)"]),
 };
 const TARGETS = Object.keys(GOVERNED);
-/** What the brain reads from a proposal's URI, cut to the lengths it keeps. */
+/** What the brain reads from a proposal's URI, cut to the lengths it keeps, in UTF-16 units as a JavaScript string counts them. */
 export const LIMITS = { title: 120, rationale: 1_500, current: 300, proposed: 300 };
+/** The most the brain reads of a whole case as JSON; past it, the case reads as blank and Jev decides on the call alone. */
+export const CASE_BYTES = 4_096;
 const proposalsAbi = parseAbi([
     "event Expired(uint256 indexed id)",
     "function decideWithin() view returns (uint64)",
 ]);
-const executorReadsAbi = parseAbi([
-    "function vetoed(address target, bytes4 selector) view returns (bool)",
-    "function vetoedCall(bytes32) view returns (bool)",
-    "function changeThresholdBps() view returns (uint16)",
-]);
+const executorReadsAbi = parseAbi(["function changeThresholdBps() view returns (uint16)"]);
 // The reverts a governed call can hit, so a rehearsal names the rule it broke.
 const callErrorsAbi = [
-    ...parseAbi(["error BadConfig()", "error BadFee()", "error ZeroAddress()", "error NotOwner()", "error NotSelf()", "error NotGuardian()"]),
+    ...parseAbi(["error BadConfig()", "error BadFee()", "error ZeroAddress()", "error NotOwner()", "error NotSelf()", "error NotGuardian()", "error AccountShapedId()", "error UnknownModel()"]),
     ...erc20Errors,
+    ...transferErrors,
 ];
 /** Mirrors ProposalBonds.State. */
 const State = { None: 0, Open: 1, Returned: 2, Burned: 3 };
@@ -169,7 +168,10 @@ export function caseURI(call, input) {
         if (body[key].length > LIMITS[key])
             throw new ProposalError(`--${key} is at most ${LIMITS[key]} characters`);
     }
-    return `data:application/json;base64,${Buffer.from(JSON.stringify(body)).toString("base64")}`;
+    const json = Buffer.from(JSON.stringify(body));
+    if (json.byteLength > CASE_BYTES)
+        throw new ProposalError(`The case is ${json.byteLength} bytes as JSON, and Jev reads at most ${CASE_BYTES}, which text outside the Latin alphabet reaches before the character limits. Shorten it.`);
+    return `data:application/json;base64,${json.toString("base64")}`;
 }
 const LOG_RANGE = 50000n;
 export function createProposals(network, account) {
@@ -204,20 +206,8 @@ export function createProposals(network, account) {
         decideWithin: () => client.readContract({ ...proposals, functionName: "decideWithin" }),
         changeThresholdBps: async () => BigInt(await client.readContract({ address: executor, abi: executorReadsAbi, functionName: "changeThresholdBps" })),
         timelock: () => client.readContract({ address: executor, abi: executorAbi, functionName: "timelock" }),
-        // A set 3.4.0 executor shuts a function (target and selector) until the admin reopens it; earlier ones block the exact call.
-        vetoed: async (call) => {
-            try {
-                return await client.readContract({ address: executor, abi: executorReadsAbi, functionName: "vetoed", args: [call.address, slice(call.data, 0, 4)] });
-            }
-            catch {
-                return client.readContract({
-                    address: executor,
-                    abi: executorReadsAbi,
-                    functionName: "vetoedCall",
-                    args: [keccak256(encodeAbiParameters([{ type: "address" }, { type: "bytes" }], [call.address, call.data]))],
-                });
-            }
-        },
+        vetoed: (call) => callVetoed(client, executor, call.address, call.data),
+        openProposal: (call) => openProposalOf(client, network, call.address, call.data),
         async rehearse(call) {
             try {
                 await client.call({ account: executor, to: call.address, data: call.data });
@@ -230,8 +220,13 @@ export function createProposals(network, account) {
                     throw error;
                 const raw = error.walk((e) => typeof e.data === "string");
                 try {
-                    if (raw?.data)
-                        return `${decodeErrorResult({ abi: callErrorsAbi, data: raw.data }).errorName}, the contract's check on these values`;
+                    if (raw?.data) {
+                        const decoded = decodeErrorResult({ abi: callErrorsAbi, data: raw.data });
+                        // A plain Solidity revert carries its reason as text, and its error's name says nothing.
+                        if (decoded.errorName === "Error")
+                            return String(decoded.args?.[0]);
+                        return `${decoded.errorName}, the contract's check on these values`;
+                    }
                 }
                 catch {
                     // Not one of the contracts' own errors; the node's message says more.
@@ -251,7 +246,7 @@ export function createProposals(network, account) {
         },
         async get(id) {
             const p = await client.readContract({ ...proposals, functionName: "get", args: [id] });
-            return { id, proposer: p.proposer, bond: p.bond, createdAt: p.createdAt, state: p.state };
+            return { id, proposer: p.proposer, bond: p.bond, createdAt: p.createdAt, state: p.state, deadline: p.deadline };
         },
         async outcome(id) {
             const [settled, expired] = await Promise.all([
@@ -276,7 +271,7 @@ const days = (seconds) => `${Number(seconds) / 86_400} days`;
 const percent = (bps) => `${Number(bps) / 100}%`;
 export async function propose(network, chain, call, uri, options) {
     const { log } = options;
-    const [bond, balance, gas, within, threshold, timelock, vetoed, revert] = await Promise.all([
+    const [bond, balance, gas, within, threshold, timelock, vetoed, open, revert] = await Promise.all([
         chain.bond(),
         chain.stakeBalance(),
         chain.ethBalance(),
@@ -284,10 +279,13 @@ export async function propose(network, chain, call, uri, options) {
         chain.changeThresholdBps(),
         chain.timelock(),
         chain.vetoed(call),
+        chain.openProposal(call),
         chain.rehearse(call),
     ]);
     if (vetoed)
         throw new ProposalError(`The guardian vetoed ${call.text} on the ${call.target}, so the executor does not queue it until the admin reopens that function`);
+    if (open > 0n)
+        throw new ProposalError(`Proposal ${open} already asks for ${call.text} on the ${call.target} and is still open, and the contract takes one at a time. Follow it with \`npx brainchain-worker proposal ${open}\`.`);
     if (revert)
         throw new ProposalError(`${call.text} would fail if the executor made it now (${revert}), so the bond would be burned for nothing`);
     log(`Proposal on ${network.name}
@@ -315,9 +313,8 @@ export async function proposal(network, chain, id, log) {
         throw new ProposalError(`There is no proposal ${id} on ${network.name}`);
     const head = `Proposal ${id} by ${p.proposer}, bond ${stake(network, p.bond)}`;
     if (p.state === State.Open) {
-        const [within, now] = await Promise.all([chain.decideWithin(), chain.now()]);
-        const closes = p.createdAt + within;
-        const after = now > closes ? `its window closed at ${when(closes)}, so anyone can return the bond with expire` : `Jev decides by ${when(closes)}`;
+        const now = await chain.now();
+        const after = now > p.deadline ? `its window closed at ${when(p.deadline)}, so anyone can return the bond by calling expire on ${network.contracts.bonds}` : `Jev decides by ${when(p.deadline)}`;
         log(`${head}\n  Waiting for Jev: ${after}.`);
         return;
     }

package/dist/relay.js

@@ -1,6 +1,6 @@
-// Relay (relay.link) moves value between Solana and Robinhood Chain in about a second. The worker uses it to fund
-// itself from Solana and to send its earnings there; every quote is checked against what goes in before anything is
-// signed, so a bad price stops the move instead of costing the worker.
+// Relay (relay.link) moves value between Solana and Robinhood Chain in about a second. `fund` uses it to bring USDC
+// from Solana; every quote is checked against what goes in before anything is signed, so a bad price stops the move
+// instead of costing the worker.
 export const RELAY_API = "https://api.relay.link";
 export const SOLANA_CHAIN_ID = 792703809;
 /** USDC on Solana. */
@@ -8,6 +8,8 @@ export const SOLANA_USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 export const NATIVE = "0x0000000000000000000000000000000000000000";
 /** The most a move may cost, as a share of its dollar value; small moves may cost up to FIXED_LOSS_USD instead. */
 export const MAX_LOSS = 0.03;
+/** The stake token's market alone costs about 3.7% at any size on top of Relay's fee, so the stake leg gets more room. */
+export const MAX_STAKE_LOSS = 0.05;
 /** Relay's fee is partly fixed (about 0.2 USD), so a small move is allowed to lose up to this much in dollars. */
 export const FIXED_LOSS_USD = 0.5;
 export class RelayError extends Error {
@@ -26,33 +28,37 @@ export async function relayQuote(request, fetchImpl = fetch) {
     const requestId = body.steps.find((s) => s.requestId)?.requestId;
     if (!requestId)
         throw new RelayError("Relay's quote carries no request id to follow");
+    const out = body.details.currencyOut;
     return {
         requestId,
         steps: body.steps,
         inUsd: Number(body.details.currencyIn?.amountUsd ?? 0),
-        outUsd: Number(body.details.currencyOut?.amountUsd ?? 0),
-        outAmount: BigInt(body.details.currencyOut?.amount ?? 0),
-        outFormatted: String(body.details.currencyOut?.amountFormatted ?? "0"),
+        outUsd: Number(out?.amountUsd ?? 0),
+        outAmount: /^\d+$/.test(String(out?.amount)) ? BigInt(out.amount) : 0n,
+        outFormatted: String(out?.amountFormatted ?? "0"),
+        recipient: body.details.recipient,
+        outCurrency: out?.currency?.address,
+        outChainId: out?.currency?.chainId,
     };
 }
-/** Refuses a quote that loses more than MAX_LOSS of its dollar value, or FIXED_LOSS_USD on a small move. */
-export function checkReturn(quote) {
+/** Refuses a quote that loses more than `maxLoss` of its dollar value, or FIXED_LOSS_USD on a small move. */
+export function checkReturn(quote, maxLoss = MAX_LOSS) {
     if (!(quote.inUsd > 0))
         throw new RelayError("Relay's quote has no dollar value for what goes in, so its price cannot be checked");
     const loss = quote.inUsd - quote.outUsd;
-    const allowed = Math.max(quote.inUsd * MAX_LOSS, FIXED_LOSS_USD);
+    const allowed = Math.max(quote.inUsd * maxLoss, FIXED_LOSS_USD);
     if (loss > allowed) {
-        throw new RelayError(`Relay would keep ${loss.toFixed(2)} USD of ${quote.inUsd.toFixed(2)}, more than the ${allowed.toFixed(2)} this command accepts (3%, or 0.50 USD on a small move). Nothing was sent; try again later.`);
+        throw new RelayError(`Relay would keep ${loss.toFixed(2)} USD of ${quote.inUsd.toFixed(2)}, more than the ${allowed.toFixed(2)} this command accepts (${Math.round(maxLoss * 100)}%, or 0.50 USD on a small move). Nothing was sent; try again later.`);
     }
 }
 export async function relayStatus(requestId, fetchImpl = fetch) {
-    const response = await fetchImpl(`${RELAY_API}/intents/status/v2?requestId=${requestId}`, { signal: AbortSignal.timeout(20_000) });
+    const response = await fetchImpl(`${RELAY_API}/intents/status/v2?requestId=${encodeURIComponent(requestId)}`, { signal: AbortSignal.timeout(20_000) });
     const body = (await response.json().catch(() => ({})));
     if (body.status === "success" || body.status === "failure" || body.status === "refund")
         return body.status;
     return "pending";
 }
-/** Follows a move until Relay says it landed, failed or was refunded, for at most `ms`. */
+/** Follows a move until Relay answers anything but pending, for at most `ms`. Its `failure` is usually not final: Relay can still retry or refund. */
 export async function waitForRelay(requestId, ms = 600_000, fetchImpl = fetch, sleep = (t) => new Promise((r) => setTimeout(r, t))) {
     const end = Date.now() + ms;
     for (;;) {