crypto-aio 0.0.3 → 0.2.0

package/dist/core/driver/types.d.ts

@@ -0,0 +1,379 @@
+import type { CodesOf } from '../errors/codes';
+import type { Logger } from '../events/logger';
+import type { AddressFormatter, NormalizedAddress } from '../model/address';
+import type { AssetMetadata, AssetRef, TokenRef } from '../model/asset';
+import type { Capability } from '../model/capability';
+import type { ChainInfo, NetworkInfo } from '../model/chain';
+import type { FeeEstimateDraft, FeeOverride, FeeSpeed } from '../model/fee';
+import type { DriverIntent } from '../model/intent';
+import type { OrderingData, OrderingKind } from '../model/ordering';
+import type { AttemptRef, Decoding, RawTx, SignedTx, TransferSource, TxFailure, UnsignedTx } from '../model/transaction';
+import type { KeyRef, SignatureBundle } from '../signing/types';
+import type { Transport } from '../transport/types';
+import type { Clock } from '../util/clock';
+/**
+ * Family-specific wallet settings (e.g. `utxo.addressType`, TON wallet identity). The `hd`
+ * key is reserved and core-built: the core sets it to the wallet's `WalletHdOptions` when
+ * the wallet has an `xpub`, and a user's or caller's `hd` never reaches a driver, since a
+ * driver trusts `hd` to validate change addresses.
+ */
+export type WalletOptions = Readonly<Record<string, unknown>>;
+export interface WalletKey {
+    readonly scheme: string;
+    readonly publicKey: Uint8Array;
+    readonly keyRef?: KeyRef;
+}
+export interface BuildContext {
+    readonly from: string;
+    readonly keys: readonly WalletKey[];
+    readonly wallet: WalletOptions;
+    /** Allocated by the core for `nonce` and `seqno` ordering. */
+    readonly ordering?: OrderingData;
+    /** Inputs held by other live Operations of this wallet (`inputs` ordering). */
+    readonly excludeInputs?: readonly string[];
+    /**
+     * The decimals the core scaled the intent's amounts with: the asset's registered
+     * metadata, or what the chain gave. Drivers work in base units. One whose transaction
+     * signs the decimals (Solana's `transferChecked`) reads them from the chain and must
+     * refuse a mismatch with this value (`ASSET_RESOLUTION`): the amounts were then scaled
+     * wrong. Absent where no transfer is built (a replacement or a cancel).
+     */
+    readonly decimals?: number;
+    readonly signal?: AbortSignal;
+}
+export type FundsCheck = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly asset: AssetRef;
+    readonly required: bigint;
+    readonly available: bigint;
+};
+/**
+ * `refused`: state-dependent (may become valid, or may already be included) — observed only.
+ * `rejected`: permanently invalid by construction (malformed, bad signature, wrong chain).
+ */
+export type BroadcastResult = {
+    readonly kind: 'accepted';
+} | {
+    readonly kind: 'already-known';
+} | {
+    readonly kind: 'refused';
+    readonly code: CodesOf<'chain'>;
+    readonly reason: string;
+} | {
+    readonly kind: 'rejected';
+    readonly reason: string;
+};
+export interface DriverTxObservation {
+    readonly seen: 'none' | 'mempool' | 'block';
+    readonly txHash?: string;
+    readonly blockHeight?: bigint;
+    readonly blockHash?: string;
+    /** For included transactions: false when execution failed or reverted. */
+    readonly success?: boolean;
+    /**
+     * With `success: false`, why, as a short fixed text: no addresses, amounts or node
+     * text, which can carry either. The monitor records it on the observation
+     * (`TxStatus.reason`).
+     */
+    readonly reason?: string;
+    /**
+     * With `success: false`, what failed (`TxFailure`). Absent is `'reverted'`; a driver sets
+     * `'unevidenced'` when the transaction executed but shows no transfer to the recipient.
+     */
+    readonly failure?: TxFailure;
+}
+export interface DriverTransfer {
+    /** Deterministic within the transaction, e.g. `native`, `log:3`, `vout:1`, `ix:0.2`. */
+    readonly locator: string;
+    readonly from: readonly string[];
+    readonly to: string;
+    readonly asset: AssetRef;
+    readonly amount: bigint;
+    readonly source: TransferSource;
+    readonly memo?: string;
+}
+export interface DriverTransaction {
+    readonly id: string;
+    readonly observation: DriverTxObservation;
+    readonly fee?: readonly {
+        readonly asset: AssetRef;
+        readonly amount: bigint;
+    }[];
+    readonly transfers: readonly DriverTransfer[];
+    readonly decoding: Decoding;
+    readonly raw?: RawTx;
+    readonly timestamp?: number;
+    readonly details: Readonly<Record<string, unknown>>;
+}
+export interface DriverBlock {
+    readonly height: bigint;
+    readonly hash: string;
+    readonly parentHash: string;
+    readonly timestamp?: number;
+    readonly transactionIds?: readonly string[];
+}
+export interface AddressCodec {
+    validate(address: string): boolean;
+    /**
+     * Throws `ValidationError('INVALID_ADDRESS')`. The returned `variant` is part of the
+     * intent hash: it must hold only JSON scalars (strings, finite numbers, booleans, `null`)
+     * and should contain only semantic fields that change what the transfer does (for example
+     * TON's `bounceable`), never encoding-only choices, so two spellings of one recipient
+     * with the same meaning hash the same.
+     */
+    normalize(address: string): NormalizedAddress;
+    fromPublicKey(publicKey: Uint8Array, wallet?: WalletOptions): NormalizedAddress;
+    readonly format?: AddressFormatter;
+}
+export interface ChainReader {
+    getBalance(address: string, asset: AssetRef): Promise<bigint>;
+    getBlockHeight(): Promise<bigint>;
+    /** Highest block satisfying the network's finality policy. */
+    getFinalizedHeight(): Promise<bigint>;
+    getBlock(ref: bigint | string): Promise<DriverBlock | null>;
+    getTransaction(id: string): Promise<DriverTransaction | null>;
+    /**
+     * Current view of an Attempt (uses `purpose: 'monitor'` reads). `ordering` and `from` are
+     * `undefined` for a transaction the library does not manage (a status lookup by id).
+     */
+    observe(ref: AttemptRef, ordering: OrderingData | undefined, from: string | undefined): Promise<DriverTxObservation>;
+    getTokenMetadata?(ref: TokenRef): Promise<AssetMetadata>;
+    /** Canonicalizes a token contract (e.g. EIP-55); identity for asset ids. */
+    normalizeTokenRef?(ref: TokenRef): TokenRef;
+}
+export interface TxBuilder {
+    estimateFee(intent: DriverIntent, ctx: BuildContext): Promise<FeeEstimateDraft>;
+    checkFunds(intent: DriverIntent, fee: FeeEstimateDraft, ctx: BuildContext): Promise<FundsCheck>;
+    build(intent: DriverIntent, fee: FeeEstimateDraft, ctx: BuildContext): Promise<UnsignedTx>;
+    assemble(unsigned: UnsignedTx, signatures: readonly SignatureBundle[]): Promise<SignedTx>;
+    /**
+     * The signatures a payload signed elsewhere carries for `unsigned`'s requests,
+     * e.g. a PSBT a cold signer returned. No I/O. Throws `ValidationError('INVALID_INTENT')`
+     * when `signed` is not the prepared transaction; one it does not tell apart still fails
+     * the core's check with `SIGNATURE_MISMATCH`. Only signature bytes are taken from it: the
+     * core verifies each one against its stored request, as for any bundle. A request
+     * without a signature in `signed` is left out (a partial set).
+     */
+    signaturesFrom?(unsigned: UnsignedTx, signed: RawTx): readonly SignatureBundle[];
+}
+export interface Broadcaster {
+    /**
+     * Throws (ambiguous) on transport failure; returns a classified result otherwise.
+     * `signed.ref.id` is empty for bare broadcasts (`Blockchain.broadcast`); never rely on it.
+     */
+    broadcast(signed: SignedTx, options?: {
+        readonly fanout?: number;
+        readonly signal?: AbortSignal;
+    }): Promise<BroadcastResult>;
+}
+export type FinalityLevel = 'latest' | 'finalized';
+/**
+ * Finalized-state checks behind `proven` verdicts; implementations use quorum reads.
+ * Only a definitive negative proof answers "no". Every other RPC error (state or
+ * history not available, pruned data, indexing in progress, a non-definitive error) throws
+ * a retryable `ProviderError('PROVIDER_UNAVAILABLE')`, which decides nothing.
+ */
+export interface ProofSource {
+    finalizedHead(): Promise<{
+        readonly height: bigint;
+        readonly hash: string;
+        readonly timestamp?: number;
+    }>;
+    includedFinal(ref: AttemptRef, ordering: OrderingData, from: string): Promise<{
+        readonly included: false;
+    } | {
+        readonly included: true;
+        readonly success: boolean;
+        readonly blockHeight: bigint;
+        readonly blockHash: string;
+        readonly txHash: string;
+        /**
+         * With `success: false`, a short fixed text, never node text. It is recorded as
+         * proven.
+         */
+        readonly reason?: string;
+        /** With `success: false`, what failed, as `DriverTxObservation.failure`. */
+        readonly failure?: TxFailure;
+    }>;
+    /** Whether the ordering slot (nonce/seqno/an input) is consumed by ANY transaction at `level`. */
+    slotConsumed(ordering: OrderingData, from: string, level: FinalityLevel): Promise<boolean>;
+    /** Whether expiry has passed per finalized state (expiry/seqno models; false otherwise). */
+    expired(ordering: OrderingData): Promise<boolean>;
+    /**
+     * The hash of the block at `height` on the chain at `level`, or `null` when there is
+     * none yet (above the head, or above the finalized height for `'finalized'`). Confirms
+     * the monitor's orphan decisions and the scanner's rollback and TOO_DEEP verdicts.
+     */
+    blockHash(height: bigint, level: FinalityLevel): Promise<string | null>;
+}
+export interface SequenceSource {
+    /** Next nonce/seqno including pending transactions. */
+    pending(address: string): Promise<bigint>;
+    /** Next nonce/seqno per the latest block. */
+    latest(address: string): Promise<bigint>;
+}
+export interface ReplacementPolicy {
+    readonly replace: boolean;
+    readonly cancel: boolean;
+    buildReplacement?(previous: UnsignedTx, fee: FeeSpeed | FeeOverride, ctx: BuildContext): Promise<UnsignedTx>;
+    /**
+     * A transaction for `previous`'s slot that does not execute the transfer (e.g. a
+     * self-transfer). Without `fee` it pays the network's minimum bump over `previous`; with
+     * one, that fee, refused (FEE_TOO_LOW) below the bump. `previous` may itself be a cancel
+     * (a repeat cancel bumps a stuck one).
+     */
+    buildCancel?(previous: UnsignedTx, ctx: BuildContext, fee?: FeeSpeed | FeeOverride): Promise<UnsignedTx>;
+    /**
+     * Orders two transactions of one slot by the price a node compares when one replaces
+     * the other: negative when `a` pays less, positive when it pays more, `0` when neither
+     * does. A repeat cancel bumps from the highest earlier cancel by this order; without it,
+     * the core compares their total charges, which a gas limit can skew.
+     */
+    comparePrice?(a: UnsignedTx, b: UnsignedTx): number;
+}
+export interface ScanFilter {
+    readonly addresses?: readonly string[];
+    readonly assets?: readonly AssetRef[];
+}
+export interface BlockSource {
+    header(height: bigint): Promise<DriverBlock | null>;
+    transactions(block: DriverBlock, filter?: ScanFilter): Promise<readonly DriverTransaction[]>;
+}
+export interface AddressHistorySource {
+    list(address: string, options: {
+        readonly cursor?: string;
+        readonly limit: number;
+    }): Promise<{
+        readonly items: readonly DriverTransaction[];
+        readonly next?: string;
+    }>;
+}
+export interface DriverLimits {
+    readonly maxOutputs: number;
+}
+/**
+ * A native SDK client for `crypto-aio/native` and how to release it. `close` frees
+ * what the client holds (sockets, timers, workers); the root container's `close()` runs it
+ * once, before closing its pooled drivers.
+ */
+export interface DisposableNativeClient {
+    readonly client: unknown;
+    close?(): void | Promise<void>;
+}
+/**
+ * The driver port: every method's contract, as the core relies on it. Purpose, retry
+ * class and quorum are the `CallOptions` a driver passes to its `Transport` (defaults:
+ * purpose `read`, retry `safe`, no quorum). A `monitor` or `proof` read only goes to
+ * endpoints that are not lagging.
+ *
+ * | Method | Purpose | Retry | Quorum | Returns / throws |
+ * | --- | --- | --- | --- | --- |
+ * | `reader.getBalance`, `getBlock`, `getTransaction` | `read` | `safe` | none | `null` when not found; provider errors propagate |
+ * | `reader.getTokenMetadata` | `read` | `safe` | none (a driver may use a quorum) | A token's own unusable metadata (no contract, a reverting or malformed `decimals`/`symbol`) throws `ValidationError('ASSET_RESOLUTION')`, which the core caches per container (only a non-retryable `ASSET_RESOLUTION` is cached); every other failure, e.g. a transient provider failure (propagated retryable) or any other provider error, is not cached and the next lookup queries again. Stricter than this minimum, the EVM driver reads `decimals()` and `symbol()` under `quorum: 'proof'`: the metadata is cached for the container's life, and one endpoint's wrong `decimals` would mis-scale every amount; endpoints that disagree throw retryable `PROVIDER_INCONSISTENT`, which is not cached |
+ * | `reader.getBlockHeight`, `getFinalizedHeight` | `monitor` | `safe` | none | propagate; they feed the stale-view guards and confirmation depths |
+ * | `reader.observe(ref, ordering, from)` | `monitor` | `safe` | none | `{ seen: 'none' }` when not visible; `ordering` and `from` are `undefined` for a transaction the library does not manage |
+ * | `sequence.pending`, `sequence.latest` | `monitor` | `safe` | none | propagate |
+ * | `proofs.*` (`finalizedHead`, `includedFinal`, `slotConsumed`, `expired`, `blockHash`) | `proof` | `safe` | `'proof'` | endpoints that disagree throw retryable `PROVIDER_INCONSISTENT`, and the core then decides nothing. Only a definitive negative proof answers "no"; every other RPC error throws retryable `PROVIDER_UNAVAILABLE`, which decides nothing (see below). Only `slotConsumed(…, 'latest')` may be a single `monitor` read: the core records it as observed evidence |
+ * | `broadcaster.broadcast` | `broadcast` | `ambiguous-on-failure` | none (passes `fanout` and `signal` through) | classifies a definitive `RPC_ERROR` into a `BroadcastResult`; rethrows an ambiguous one (`error.ambiguous`) and every other failure unclassified |
+ * | `builder.estimateFee`, `checkFunds`, `build` | `read` | `safe` | none | `ValidationError` / `UnsupportedCapabilityError` for an intent it cannot build |
+ * | `builder.assemble` | no I/O | – | – | `SigningError('SIGNING_FAILED')` when a signature is missing |
+ * | `builder.signaturesFrom` (optional) | no I/O | – | – | `ValidationError('INVALID_INTENT')` when the signed payload is not the prepared transaction |
+ * | `replacement.buildReplacement`, `buildCancel` | `read` | `safe` | none | `ChainError('FEE_TOO_LOW')` below the network's bump; `buildCancel` honours a given `fee` and never substitutes its own |
+ * | `blocks.header` | `monitor` | `safe` | none | `null` while the height is not visible |
+ * | `blocks.transactions` | `monitor` | `safe` | none | retryable `PROVIDER_INCONSISTENT` when the block at `block.height` no longer has `block.hash` |
+ * | `history.list` | `read` (indexer transport when configured) | `safe` | none | propagate |
+ * | `createNativeClient` | no I/O | – | – | a fresh SDK instance on every call, never the pooled one |
+ * | `signingSchemes` (optional) | no I/O | – | – | `ConfigError('CONFIG_INVALID')` for wallet options it refuses |
+ *
+ * Further rules:
+ * - On a proof path (`proofs.*`), only a definitive negative proof may
+ *   answer "no" (`included: false`, a slot not consumed, a `null` block hash). Every other
+ *   RPC error, including state or history not available, pruned data, an index still being
+ *   built ("transaction indexing is in progress"), or an endpoint's non-definitive error,
+ *   must surface as a retryable `ProviderError('PROVIDER_UNAVAILABLE')`, which decides
+ *   nothing: the core looks again later and never takes it for an answer.
+ * - `BlockSource` heights are dense: every height up to the head has one block, and
+ *   `header(h)` is `null` only while `h` is not visible, never for a skipped slot.
+ * - A provider must serve headers at least about 2 × `reorgWindow` below the head. A new
+ *   cursor loads `reorgWindow` blocks below its start, and a rollback refills its window
+ *   below the common ancestor.
+ * - `ScanFilter.addresses`: when non-empty, return at least every transaction with a transfer
+ *   from or to one of them; empty (`[]`) or absent means no filter. `ScanFilter.assets` is a
+ *   hint only: a driver may narrow by it or ignore it, and the core does not filter again.
+ * - `fee.details.requestedFee` is reserved. On replacements the core records the requested
+ *   fee spec there, so a driver never sets or reads it.
+ * - `DriverContext` has no asset resolver and `DriverIntent` carries no decimals. Amounts
+ *   reach drivers in base units only; a driver that needs a token's decimals (Solana's
+ *   `transferChecked`) reads them from the chain itself.
+ */
+export interface ChainDriver {
+    readonly ordering: OrderingKind;
+    readonly capabilities: ReadonlySet<Capability>;
+    readonly address: AddressCodec;
+    readonly reader: ChainReader;
+    readonly builder: TxBuilder;
+    readonly broadcaster: Broadcaster;
+    readonly proofs: ProofSource;
+    readonly sequence?: SequenceSource;
+    readonly replacement?: ReplacementPolicy;
+    readonly blocks?: BlockSource;
+    readonly history?: AddressHistorySource;
+    /** Two-level, capability-gated family API: `ext.<family>.<method>(...) → Promise`. */
+    readonly ext?: Readonly<Record<string, Readonly<Record<string, (...args: never[]) => Promise<unknown>>>>>;
+    limits?(wallet: WalletOptions): DriverLimits;
+    /**
+     * The signature schemes a wallet with these options signs with, when its options narrow
+     * the chain's `schemes` (a Bitcoin `p2tr` wallet signs with `secp256k1-schnorr` only). No
+     * I/O; it throws `CONFIG_INVALID` for options the driver refuses. When the core resolves
+     * a wallet that has a signer, it refuses (`CONFIG_INVALID`) one that does not declare each
+     * of them, before reading any key: the transfer would otherwise be built, reserved and
+     * fail only at signing. Without this method, a signer needs one of the chain's schemes.
+     * A watch-only wallet is not checked.
+     */
+    signingSchemes?(wallet: WalletOptions): readonly string[];
+    /**
+     * A fresh, caller-owned SDK client for `crypto-aio/native`: a new SDK instance on every
+     * call, never the pooled one.
+     */
+    createNativeClient?(): DisposableNativeClient;
+    close?(): Promise<void>;
+}
+/**
+ * A factory's `create()` must call `transport.setProbes(...)` exactly once, before any
+ * other traffic, on every `Transport` it receives here — including `indexer`, when present.
+ * `setProbes` resets health/identity state, so calling it again later, or skipping it on one
+ * of the two transports, leaves that transport's health checks silently unconfigured.
+ *
+ * There is no asset resolver here, and `DriverIntent` carries no decimals: drivers work
+ * in base units only.
+ */
+export interface DriverContext {
+    readonly chain: ChainInfo;
+    readonly network: NetworkInfo;
+    readonly library: string;
+    readonly transport: Transport;
+    readonly indexer?: Transport;
+    readonly clock: Clock;
+    readonly log: Logger;
+    readonly options: Readonly<Record<string, unknown>>;
+}
+export interface DriverFactory {
+    create(ctx: DriverContext): Promise<ChainDriver>;
+}
+export interface PeerDependency {
+    readonly name: string;
+    readonly range: string;
+}
+/** Static metadata (no SDK import) plus a lazy `load()` that `require()`s the driver module. */
+export interface AdapterManifest {
+    readonly family: string;
+    readonly library: string;
+    readonly chains: readonly string[];
+    readonly capabilities: readonly Capability[];
+    readonly indexerCapabilities?: readonly Capability[];
+    readonly requiresIndexer?: boolean;
+    readonly peerDependencies: readonly PeerDependency[];
+    load(): Promise<DriverFactory>;
+}

package/dist/core/driver/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/core/driver/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/driver/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { CodesOf } from '../errors/codes';\nimport type { Logger } from '../events/logger';\nimport type { AddressFormatter, NormalizedAddress } from '../model/address';\nimport type { AssetMetadata, AssetRef, TokenRef } from '../model/asset';\nimport type { Capability } from '../model/capability';\nimport type { ChainInfo, NetworkInfo } from '../model/chain';\nimport type { FeeEstimateDraft, FeeOverride, FeeSpeed } from '../model/fee';\nimport type { DriverIntent } from '../model/intent';\nimport type { OrderingData, OrderingKind } from '../model/ordering';\nimport type {\n  AttemptRef,\n  Decoding,\n  RawTx,\n  SignedTx,\n  TransferSource,\n  TxFailure,\n  UnsignedTx,\n} from '../model/transaction';\nimport type { KeyRef, SignatureBundle } from '../signing/types';\nimport type { Transport } from '../transport/types';\nimport type { Clock } from '../util/clock';\n\n/**\n * Family-specific wallet settings (e.g. `utxo.addressType`, TON wallet identity). The `hd`\n * key is reserved and core-built: the core sets it to the wallet's `WalletHdOptions` when\n * the wallet has an `xpub`, and a user's or caller's `hd` never reaches a driver, since a\n * driver trusts `hd` to validate change addresses.\n */\nexport type WalletOptions = Readonly<Record<string, unknown>>;\n\nexport interface WalletKey {\n  readonly scheme: string;\n  readonly publicKey: Uint8Array;\n  readonly keyRef?: KeyRef;\n}\n\nexport interface BuildContext {\n  readonly from: string;\n  readonly keys: readonly WalletKey[];\n  readonly wallet: WalletOptions;\n  /** Allocated by the core for `nonce` and `seqno` ordering. */\n  readonly ordering?: OrderingData;\n  /** Inputs held by other live Operations of this wallet (`inputs` ordering). */\n  readonly excludeInputs?: readonly string[];\n  /**\n   * The decimals the core scaled the intent's amounts with: the asset's registered\n   * metadata, or what the chain gave. Drivers work in base units. One whose transaction\n   * signs the decimals (Solana's `transferChecked`) reads them from the chain and must\n   * refuse a mismatch with this value (`ASSET_RESOLUTION`): the amounts were then scaled\n   * wrong. Absent where no transfer is built (a replacement or a cancel).\n   */\n  readonly decimals?: number;\n  readonly signal?: AbortSignal;\n}\n\nexport type FundsCheck =\n  | { readonly ok: true }\n  | {\n      readonly ok: false;\n      readonly asset: AssetRef;\n      readonly required: bigint;\n      readonly available: bigint;\n    };\n\n/**\n * `refused`: state-dependent (may become valid, or may already be included) — observed only.\n * `rejected`: permanently invalid by construction (malformed, bad signature, wrong chain).\n */\nexport type BroadcastResult =\n  | { readonly kind: 'accepted' }\n  | { readonly kind: 'already-known' }\n  | { readonly kind: 'refused'; readonly code: CodesOf<'chain'>; readonly reason: string }\n  | { readonly kind: 'rejected'; readonly reason: string };\n\nexport interface DriverTxObservation {\n  readonly seen: 'none' | 'mempool' | 'block';\n  readonly txHash?: string;\n  readonly blockHeight?: bigint;\n  readonly blockHash?: string;\n  /** For included transactions: false when execution failed or reverted. */\n  readonly success?: boolean;\n  /**\n   * With `success: false`, why, as a short fixed text: no addresses, amounts or node\n   * text, which can carry either. The monitor records it on the observation\n   * (`TxStatus.reason`).\n   */\n  readonly reason?: string;\n  /**\n   * With `success: false`, what failed (`TxFailure`). Absent is `'reverted'`; a driver sets\n   * `'unevidenced'` when the transaction executed but shows no transfer to the recipient.\n   */\n  readonly failure?: TxFailure;\n}\n\nexport interface DriverTransfer {\n  /** Deterministic within the transaction, e.g. `native`, `log:3`, `vout:1`, `ix:0.2`. */\n  readonly locator: string;\n  readonly from: readonly string[];\n  readonly to: string;\n  readonly asset: AssetRef;\n  readonly amount: bigint;\n  readonly source: TransferSource;\n  readonly memo?: string;\n}\n\nexport interface DriverTransaction {\n  readonly id: string;\n  readonly observation: DriverTxObservation;\n  readonly fee?: readonly { readonly asset: AssetRef; readonly amount: bigint }[];\n  readonly transfers: readonly DriverTransfer[];\n  readonly decoding: Decoding;\n  readonly raw?: RawTx;\n  readonly timestamp?: number;\n  readonly details: Readonly<Record<string, unknown>>;\n}\n\nexport interface DriverBlock {\n  readonly height: bigint;\n  readonly hash: string;\n  readonly parentHash: string;\n  readonly timestamp?: number;\n  readonly transactionIds?: readonly string[];\n}\n\nexport interface AddressCodec {\n  validate(address: string): boolean;\n  /**\n   * Throws `ValidationError('INVALID_ADDRESS')`. The returned `variant` is part of the\n   * intent hash: it must hold only JSON scalars (strings, finite numbers, booleans, `null`)\n   * and should contain only semantic fields that change what the transfer does (for example\n   * TON's `bounceable`), never encoding-only choices, so two spellings of one recipient\n   * with the same meaning hash the same.\n   */\n  normalize(address: string): NormalizedAddress;\n  fromPublicKey(publicKey: Uint8Array, wallet?: WalletOptions): NormalizedAddress;\n  readonly format?: AddressFormatter;\n}\n\nexport interface ChainReader {\n  getBalance(address: string, asset: AssetRef): Promise<bigint>;\n  getBlockHeight(): Promise<bigint>;\n  /** Highest block satisfying the network's finality policy. */\n  getFinalizedHeight(): Promise<bigint>;\n  getBlock(ref: bigint | string): Promise<DriverBlock | null>;\n  getTransaction(id: string): Promise<DriverTransaction | null>;\n  /**\n   * Current view of an Attempt (uses `purpose: 'monitor'` reads). `ordering` and `from` are\n   * `undefined` for a transaction the library does not manage (a status lookup by id).\n   */\n  observe(\n    ref: AttemptRef,\n    ordering: OrderingData | undefined,\n    from: string | undefined,\n  ): Promise<DriverTxObservation>;\n  getTokenMetadata?(ref: TokenRef): Promise<AssetMetadata>;\n  /** Canonicalizes a token contract (e.g. EIP-55); identity for asset ids. */\n  normalizeTokenRef?(ref: TokenRef): TokenRef;\n}\n\nexport interface TxBuilder {\n  estimateFee(intent: DriverIntent, ctx: BuildContext): Promise<FeeEstimateDraft>;\n  checkFunds(\n    intent: DriverIntent,\n    fee: FeeEstimateDraft,\n    ctx: BuildContext,\n  ): Promise<FundsCheck>;\n  build(\n    intent: DriverIntent,\n    fee: FeeEstimateDraft,\n    ctx: BuildContext,\n  ): Promise<UnsignedTx>;\n  assemble(\n    unsigned: UnsignedTx,\n    signatures: readonly SignatureBundle[],\n  ): Promise<SignedTx>;\n  /**\n   * The signatures a payload signed elsewhere carries for `unsigned`'s requests,\n   * e.g. a PSBT a cold signer returned. No I/O. Throws `ValidationError('INVALID_INTENT')`\n   * when `signed` is not the prepared transaction; one it does not tell apart still fails\n   * the core's check with `SIGNATURE_MISMATCH`. Only signature bytes are taken from it: the\n   * core verifies each one against its stored request, as for any bundle. A request\n   * without a signature in `signed` is left out (a partial set).\n   */\n  signaturesFrom?(unsigned: UnsignedTx, signed: RawTx): readonly SignatureBundle[];\n}\n\nexport interface Broadcaster {\n  /**\n   * Throws (ambiguous) on transport failure; returns a classified result otherwise.\n   * `signed.ref.id` is empty for bare broadcasts (`Blockchain.broadcast`); never rely on it.\n   */\n  broadcast(\n    signed: SignedTx,\n    options?: { readonly fanout?: number; readonly signal?: AbortSignal },\n  ): Promise<BroadcastResult>;\n}\n\nexport type FinalityLevel = 'latest' | 'finalized';\n\n/**\n * Finalized-state checks behind `proven` verdicts; implementations use quorum reads.\n * Only a definitive negative proof answers \"no\". Every other RPC error (state or\n * history not available, pruned data, indexing in progress, a non-definitive error) throws\n * a retryable `ProviderError('PROVIDER_UNAVAILABLE')`, which decides nothing.\n */\nexport interface ProofSource {\n  finalizedHead(): Promise<{\n    readonly height: bigint;\n    readonly hash: string;\n    readonly timestamp?: number;\n  }>;\n  includedFinal(\n    ref: AttemptRef,\n    ordering: OrderingData,\n    from: string,\n  ): Promise<\n    | { readonly included: false }\n    | {\n        readonly included: true;\n        readonly success: boolean;\n        readonly blockHeight: bigint;\n        readonly blockHash: string;\n        readonly txHash: string;\n        /**\n         * With `success: false`, a short fixed text, never node text. It is recorded as\n         * proven.\n         */\n        readonly reason?: string;\n        /** With `success: false`, what failed, as `DriverTxObservation.failure`. */\n        readonly failure?: TxFailure;\n      }\n  >;\n  /** Whether the ordering slot (nonce/seqno/an input) is consumed by ANY transaction at `level`. */\n  slotConsumed(\n    ordering: OrderingData,\n    from: string,\n    level: FinalityLevel,\n  ): Promise<boolean>;\n  /** Whether expiry has passed per finalized state (expiry/seqno models; false otherwise). */\n  expired(ordering: OrderingData): Promise<boolean>;\n  /**\n   * The hash of the block at `height` on the chain at `level`, or `null` when there is\n   * none yet (above the head, or above the finalized height for `'finalized'`). Confirms\n   * the monitor's orphan decisions and the scanner's rollback and TOO_DEEP verdicts.\n   */\n  blockHash(height: bigint, level: FinalityLevel): Promise<string | null>;\n}\n\nexport interface SequenceSource {\n  /** Next nonce/seqno including pending transactions. */\n  pending(address: string): Promise<bigint>;\n  /** Next nonce/seqno per the latest block. */\n  latest(address: string): Promise<bigint>;\n}\n\nexport interface ReplacementPolicy {\n  readonly replace: boolean;\n  readonly cancel: boolean;\n  buildReplacement?(\n    previous: UnsignedTx,\n    fee: FeeSpeed | FeeOverride,\n    ctx: BuildContext,\n  ): Promise<UnsignedTx>;\n  /**\n   * A transaction for `previous`'s slot that does not execute the transfer (e.g. a\n   * self-transfer). Without `fee` it pays the network's minimum bump over `previous`; with\n   * one, that fee, refused (FEE_TOO_LOW) below the bump. `previous` may itself be a cancel\n   * (a repeat cancel bumps a stuck one).\n   */\n  buildCancel?(\n    previous: UnsignedTx,\n    ctx: BuildContext,\n    fee?: FeeSpeed | FeeOverride,\n  ): Promise<UnsignedTx>;\n  /**\n   * Orders two transactions of one slot by the price a node compares when one replaces\n   * the other: negative when `a` pays less, positive when it pays more, `0` when neither\n   * does. A repeat cancel bumps from the highest earlier cancel by this order; without it,\n   * the core compares their total charges, which a gas limit can skew.\n   */\n  comparePrice?(a: UnsignedTx, b: UnsignedTx): number;\n}\n\nexport interface ScanFilter {\n  readonly addresses?: readonly string[];\n  readonly assets?: readonly AssetRef[];\n}\n\nexport interface BlockSource {\n  header(height: bigint): Promise<DriverBlock | null>;\n  transactions(\n    block: DriverBlock,\n    filter?: ScanFilter,\n  ): Promise<readonly DriverTransaction[]>;\n}\n\nexport interface AddressHistorySource {\n  list(\n    address: string,\n    options: { readonly cursor?: string; readonly limit: number },\n  ): Promise<{ readonly items: readonly DriverTransaction[]; readonly next?: string }>;\n}\n\nexport interface DriverLimits {\n  readonly maxOutputs: number;\n}\n\n/**\n * A native SDK client for `crypto-aio/native` and how to release it. `close` frees\n * what the client holds (sockets, timers, workers); the root container's `close()` runs it\n * once, before closing its pooled drivers.\n */\nexport interface DisposableNativeClient {\n  readonly client: unknown;\n  close?(): void | Promise<void>;\n}\n\n/**\n * The driver port: every method's contract, as the core relies on it. Purpose, retry\n * class and quorum are the `CallOptions` a driver passes to its `Transport` (defaults:\n * purpose `read`, retry `safe`, no quorum). A `monitor` or `proof` read only goes to\n * endpoints that are not lagging.\n *\n * | Method | Purpose | Retry | Quorum | Returns / throws |\n * | --- | --- | --- | --- | --- |\n * | `reader.getBalance`, `getBlock`, `getTransaction` | `read` | `safe` | none | `null` when not found; provider errors propagate |\n * | `reader.getTokenMetadata` | `read` | `safe` | none (a driver may use a quorum) | A token's own unusable metadata (no contract, a reverting or malformed `decimals`/`symbol`) throws `ValidationError('ASSET_RESOLUTION')`, which the core caches per container (only a non-retryable `ASSET_RESOLUTION` is cached); every other failure, e.g. a transient provider failure (propagated retryable) or any other provider error, is not cached and the next lookup queries again. Stricter than this minimum, the EVM driver reads `decimals()` and `symbol()` under `quorum: 'proof'`: the metadata is cached for the container's life, and one endpoint's wrong `decimals` would mis-scale every amount; endpoints that disagree throw retryable `PROVIDER_INCONSISTENT`, which is not cached |\n * | `reader.getBlockHeight`, `getFinalizedHeight` | `monitor` | `safe` | none | propagate; they feed the stale-view guards and confirmation depths |\n * | `reader.observe(ref, ordering, from)` | `monitor` | `safe` | none | `{ seen: 'none' }` when not visible; `ordering` and `from` are `undefined` for a transaction the library does not manage |\n * | `sequence.pending`, `sequence.latest` | `monitor` | `safe` | none | propagate |\n * | `proofs.*` (`finalizedHead`, `includedFinal`, `slotConsumed`, `expired`, `blockHash`) | `proof` | `safe` | `'proof'` | endpoints that disagree throw retryable `PROVIDER_INCONSISTENT`, and the core then decides nothing. Only a definitive negative proof answers \"no\"; every other RPC error throws retryable `PROVIDER_UNAVAILABLE`, which decides nothing (see below). Only `slotConsumed(…, 'latest')` may be a single `monitor` read: the core records it as observed evidence |\n * | `broadcaster.broadcast` | `broadcast` | `ambiguous-on-failure` | none (passes `fanout` and `signal` through) | classifies a definitive `RPC_ERROR` into a `BroadcastResult`; rethrows an ambiguous one (`error.ambiguous`) and every other failure unclassified |\n * | `builder.estimateFee`, `checkFunds`, `build` | `read` | `safe` | none | `ValidationError` / `UnsupportedCapabilityError` for an intent it cannot build |\n * | `builder.assemble` | no I/O | – | – | `SigningError('SIGNING_FAILED')` when a signature is missing |\n * | `builder.signaturesFrom` (optional) | no I/O | – | – | `ValidationError('INVALID_INTENT')` when the signed payload is not the prepared transaction |\n * | `replacement.buildReplacement`, `buildCancel` | `read` | `safe` | none | `ChainError('FEE_TOO_LOW')` below the network's bump; `buildCancel` honours a given `fee` and never substitutes its own |\n * | `blocks.header` | `monitor` | `safe` | none | `null` while the height is not visible |\n * | `blocks.transactions` | `monitor` | `safe` | none | retryable `PROVIDER_INCONSISTENT` when the block at `block.height` no longer has `block.hash` |\n * | `history.list` | `read` (indexer transport when configured) | `safe` | none | propagate |\n * | `createNativeClient` | no I/O | – | – | a fresh SDK instance on every call, never the pooled one |\n * | `signingSchemes` (optional) | no I/O | – | – | `ConfigError('CONFIG_INVALID')` for wallet options it refuses |\n *\n * Further rules:\n * - On a proof path (`proofs.*`), only a definitive negative proof may\n *   answer \"no\" (`included: false`, a slot not consumed, a `null` block hash). Every other\n *   RPC error, including state or history not available, pruned data, an index still being\n *   built (\"transaction indexing is in progress\"), or an endpoint's non-definitive error,\n *   must surface as a retryable `ProviderError('PROVIDER_UNAVAILABLE')`, which decides\n *   nothing: the core looks again later and never takes it for an answer.\n * - `BlockSource` heights are dense: every height up to the head has one block, and\n *   `header(h)` is `null` only while `h` is not visible, never for a skipped slot.\n * - A provider must serve headers at least about 2 × `reorgWindow` below the head. A new\n *   cursor loads `reorgWindow` blocks below its start, and a rollback refills its window\n *   below the common ancestor.\n * - `ScanFilter.addresses`: when non-empty, return at least every transaction with a transfer\n *   from or to one of them; empty (`[]`) or absent means no filter. `ScanFilter.assets` is a\n *   hint only: a driver may narrow by it or ignore it, and the core does not filter again.\n * - `fee.details.requestedFee` is reserved. On replacements the core records the requested\n *   fee spec there, so a driver never sets or reads it.\n * - `DriverContext` has no asset resolver and `DriverIntent` carries no decimals. Amounts\n *   reach drivers in base units only; a driver that needs a token's decimals (Solana's\n *   `transferChecked`) reads them from the chain itself.\n */\nexport interface ChainDriver {\n  readonly ordering: OrderingKind;\n  readonly capabilities: ReadonlySet<Capability>;\n  readonly address: AddressCodec;\n  readonly reader: ChainReader;\n  readonly builder: TxBuilder;\n  readonly broadcaster: Broadcaster;\n  readonly proofs: ProofSource;\n  readonly sequence?: SequenceSource;\n  readonly replacement?: ReplacementPolicy;\n  readonly blocks?: BlockSource;\n  readonly history?: AddressHistorySource;\n  /** Two-level, capability-gated family API: `ext.<family>.<method>(...) → Promise`. */\n  readonly ext?: Readonly<\n    Record<string, Readonly<Record<string, (...args: never[]) => Promise<unknown>>>>\n  >;\n  limits?(wallet: WalletOptions): DriverLimits;\n  /**\n   * The signature schemes a wallet with these options signs with, when its options narrow\n   * the chain's `schemes` (a Bitcoin `p2tr` wallet signs with `secp256k1-schnorr` only). No\n   * I/O; it throws `CONFIG_INVALID` for options the driver refuses. When the core resolves\n   * a wallet that has a signer, it refuses (`CONFIG_INVALID`) one that does not declare each\n   * of them, before reading any key: the transfer would otherwise be built, reserved and\n   * fail only at signing. Without this method, a signer needs one of the chain's schemes.\n   * A watch-only wallet is not checked.\n   */\n  signingSchemes?(wallet: WalletOptions): readonly string[];\n  /**\n   * A fresh, caller-owned SDK client for `crypto-aio/native`: a new SDK instance on every\n   * call, never the pooled one.\n   */\n  createNativeClient?(): DisposableNativeClient;\n  close?(): Promise<void>;\n}\n\n/**\n * A factory's `create()` must call `transport.setProbes(...)` exactly once, before any\n * other traffic, on every `Transport` it receives here — including `indexer`, when present.\n * `setProbes` resets health/identity state, so calling it again later, or skipping it on one\n * of the two transports, leaves that transport's health checks silently unconfigured.\n *\n * There is no asset resolver here, and `DriverIntent` carries no decimals: drivers work\n * in base units only.\n */\nexport interface DriverContext {\n  readonly chain: ChainInfo;\n  readonly network: NetworkInfo;\n  readonly library: string;\n  readonly transport: Transport;\n  readonly indexer?: Transport;\n  readonly clock: Clock;\n  readonly log: Logger;\n  readonly options: Readonly<Record<string, unknown>>;\n}\n\nexport interface DriverFactory {\n  create(ctx: DriverContext): Promise<ChainDriver>;\n}\n\nexport interface PeerDependency {\n  readonly name: string;\n  readonly range: string;\n}\n\n/** Static metadata (no SDK import) plus a lazy `load()` that `require()`s the driver module. */\nexport interface AdapterManifest {\n  readonly family: string;\n  readonly library: string;\n  readonly chains: readonly string[];\n  readonly capabilities: readonly Capability[];\n  readonly indexerCapabilities?: readonly Capability[];\n  readonly requiresIndexer?: boolean;\n  readonly peerDependencies: readonly PeerDependency[];\n  load(): Promise<DriverFactory>;\n}\n"]}

package/dist/core/errors/codes.d.ts

@@ -0,0 +1,163 @@
+export type ErrorCategory = 'config' | 'unsupported' | 'validation' | 'provider' | 'chain' | 'signing' | 'state' | 'timeout';
+/** Frozen, with every entry: the table is shared by every error and every caller. */
+export declare const ERROR_CODES: {
+    readonly CONFIG_INVALID: {
+        readonly category: "config";
+        readonly retryable: false;
+    };
+    readonly DEPENDENCY_MISSING: {
+        readonly category: "config";
+        readonly retryable: false;
+    };
+    readonly INCOMPATIBLE_SELECTION: {
+        readonly category: "config";
+        readonly retryable: false;
+    };
+    readonly UNSUPPORTED_CAPABILITY: {
+        readonly category: "unsupported";
+        readonly retryable: false;
+    };
+    readonly INVALID_ADDRESS: {
+        readonly category: "validation";
+        readonly retryable: false;
+    };
+    readonly INVALID_AMOUNT: {
+        readonly category: "validation";
+        readonly retryable: false;
+    };
+    readonly ASSET_RESOLUTION: {
+        readonly category: "validation";
+        readonly retryable: false;
+    };
+    readonly INVALID_INTENT: {
+        readonly category: "validation";
+        readonly retryable: false;
+    };
+    readonly PROVIDER_UNAVAILABLE: {
+        readonly category: "provider";
+        readonly retryable: true;
+    };
+    readonly RATE_LIMITED: {
+        readonly category: "provider";
+        readonly retryable: true;
+    };
+    readonly PROVIDER_MISCONFIGURED: {
+        readonly category: "provider";
+        readonly retryable: false;
+    };
+    readonly PROVIDER_INCONSISTENT: {
+        readonly category: "provider";
+        readonly retryable: true;
+    };
+    readonly RPC_ERROR: {
+        readonly category: "provider";
+        readonly retryable: false;
+    };
+    readonly INSUFFICIENT_FUNDS: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly NONCE_CONFLICT: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly NONCE_TOO_HIGH: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly FEE_TOO_LOW: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly TX_REFUSED: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly TX_REJECTED: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly TX_REVERTED: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    /** Included and executed, but no transfer to the recipient shows: value may have moved. */
+    readonly TX_UNEVIDENCED: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly TX_EXPIRED: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly TX_REPLACED: {
+        readonly category: "chain";
+        readonly retryable: false;
+    };
+    readonly SIGNER_UNAVAILABLE: {
+        readonly category: "signing";
+        readonly retryable: false;
+    };
+    readonly SIGNING_FAILED: {
+        readonly category: "signing";
+        readonly retryable: false;
+    };
+    readonly SIGNATURE_MISMATCH: {
+        readonly category: "signing";
+        readonly retryable: false;
+    };
+    readonly POLICY_REJECTED: {
+        readonly category: "signing";
+        readonly retryable: false;
+    };
+    readonly KEY_NOT_EXPORTABLE: {
+        readonly category: "signing";
+        readonly retryable: false;
+    };
+    readonly IDEMPOTENCY_CONFLICT: {
+        readonly category: "state";
+        readonly retryable: false;
+    };
+    readonly FENCING: {
+        readonly category: "state";
+        readonly retryable: false;
+    };
+    readonly VERSION_CONFLICT: {
+        readonly category: "state";
+        readonly retryable: true;
+    };
+    readonly INVALID_TRANSITION: {
+        readonly category: "state";
+        readonly retryable: false;
+    };
+    readonly NOT_FOUND: {
+        readonly category: "state";
+        readonly retryable: false;
+    };
+    readonly SEQUENCE_BUSY: {
+        readonly category: "state";
+        readonly retryable: true;
+    };
+    /** The outcome may have happened (e.g. a delivered broadcast) but was not recorded. */
+    readonly STATE_UNRECORDED: {
+        readonly category: "state";
+        readonly retryable: true;
+    };
+    readonly SCANNER_REORG_TOO_DEEP: {
+        readonly category: "state";
+        readonly retryable: false;
+    };
+    /** A stored Operation's record format is newer than this version reads. */
+    readonly RECORD_FORMAT_UNSUPPORTED: {
+        readonly category: "state";
+        readonly retryable: false;
+    };
+    readonly TIMEOUT: {
+        readonly category: "timeout";
+        readonly retryable: true;
+    };
+};
+export type ErrorCode = keyof typeof ERROR_CODES;
+export type CodesOf<C extends ErrorCategory> = {
+    [K in ErrorCode]: (typeof ERROR_CODES)[K]['category'] extends C ? K : never;
+}[ErrorCode];

package/dist/core/errors/codes.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ERROR_CODES = void 0;
+/** Frozen, with every entry: the table is shared by every error and every caller. */
+exports.ERROR_CODES = deepFreezeCodes({
+    CONFIG_INVALID: { category: 'config', retryable: false },
+    DEPENDENCY_MISSING: { category: 'config', retryable: false },
+    INCOMPATIBLE_SELECTION: { category: 'config', retryable: false },
+    UNSUPPORTED_CAPABILITY: { category: 'unsupported', retryable: false },
+    INVALID_ADDRESS: { category: 'validation', retryable: false },
+    INVALID_AMOUNT: { category: 'validation', retryable: false },
+    ASSET_RESOLUTION: { category: 'validation', retryable: false },
+    INVALID_INTENT: { category: 'validation', retryable: false },
+    PROVIDER_UNAVAILABLE: { category: 'provider', retryable: true },
+    RATE_LIMITED: { category: 'provider', retryable: true },
+    PROVIDER_MISCONFIGURED: { category: 'provider', retryable: false },
+    PROVIDER_INCONSISTENT: { category: 'provider', retryable: true },
+    RPC_ERROR: { category: 'provider', retryable: false },
+    INSUFFICIENT_FUNDS: { category: 'chain', retryable: false },
+    NONCE_CONFLICT: { category: 'chain', retryable: false },
+    NONCE_TOO_HIGH: { category: 'chain', retryable: false },
+    FEE_TOO_LOW: { category: 'chain', retryable: false },
+    TX_REFUSED: { category: 'chain', retryable: false },
+    TX_REJECTED: { category: 'chain', retryable: false },
+    TX_REVERTED: { category: 'chain', retryable: false },
+    /** Included and executed, but no transfer to the recipient shows: value may have moved. */
+    TX_UNEVIDENCED: { category: 'chain', retryable: false },
+    TX_EXPIRED: { category: 'chain', retryable: false },
+    TX_REPLACED: { category: 'chain', retryable: false },
+    SIGNER_UNAVAILABLE: { category: 'signing', retryable: false },
+    SIGNING_FAILED: { category: 'signing', retryable: false },
+    SIGNATURE_MISMATCH: { category: 'signing', retryable: false },
+    POLICY_REJECTED: { category: 'signing', retryable: false },
+    KEY_NOT_EXPORTABLE: { category: 'signing', retryable: false },
+    IDEMPOTENCY_CONFLICT: { category: 'state', retryable: false },
+    FENCING: { category: 'state', retryable: false },
+    VERSION_CONFLICT: { category: 'state', retryable: true },
+    INVALID_TRANSITION: { category: 'state', retryable: false },
+    NOT_FOUND: { category: 'state', retryable: false },
+    SEQUENCE_BUSY: { category: 'state', retryable: true },
+    /** The outcome may have happened (e.g. a delivered broadcast) but was not recorded. */
+    STATE_UNRECORDED: { category: 'state', retryable: true },
+    SCANNER_REORG_TOO_DEEP: { category: 'state', retryable: false },
+    /** A stored Operation's record format is newer than this version reads. */
+    RECORD_FORMAT_UNSUPPORTED: { category: 'state', retryable: false },
+    TIMEOUT: { category: 'timeout', retryable: true },
+});
+function deepFreezeCodes(codes) {
+    for (const definition of Object.values(codes))
+        Object.freeze(definition);
+    return Object.freeze(codes);
+}
+//# sourceMappingURL=codes.js.map