Deliver one output; return its stored keccak256(solver || timestamp:u32) record.
filler authorizes the invocation and must approve this contract to pull the
context-priced amount. solver is the nonzero origin claimant ID, independent
of the payer. output is the full mandate; its context's recipient tag derives
the native recipient.
fill_deadline is an inclusive Unix-second limit and must be the origin order's
committed deadline: the record lives only until fill_deadline + NOT_FILLED_WINDOW,
so an understated deadline lets anyone mint a valid non-fill once it lapses.
New fills transfer to the recipient, store the record in temporary storage
extended to the fill horizon, and emit OutputFilled. Existing fills return the
old record without payment or another event, after all validation; retries extend
the record to this call's horizon (never shortening it). Any failure rolls
everything back.
Wrong domain, unsupported callback, invalid or exclusive context, zero solver, arithmet
fn fill(
env: soroban_sdk::Env,
filler: soroban_sdk::Address,
solver: soroban_sdk::BytesN<32>,
order_id: soroban_sdk::BytesN<32>,
output: MandateOutput,
fill_deadline: u32,
) -> Result, soroban_sdk::Error> Renew each concatenated 128-byte same-chain proof tuple to the full proof TTL, plus
instance/code TTL. Permissionless. Malformed for a partial tuple; Unproven if any
tuple is absent or expired (an expired proof is re-created by set_attestation
while its fill record lives). A failure rolls back every renewal.
fn maintain(
env: soroban_sdk::Env,
proofs: soroban_sdk::Bytes,
) -> Result<(), soroban_sdk::Error>InputOracle::is_proven over proofs recorded by set_attestation.
Returns false for unknown or expired tuples. No data TTL renewal.
fn is_proven(
env: soroban_sdk::Env,
chain: soroban_sdk::U256,
oracle: soroban_sdk::BytesN<32>,
application: soroban_sdk::BytesN<32>,
data_hash: soroban_sdk::BytesN<32>,
) -> ResultReturn whether every payload has a matching fill record or a valid non-fill.
oracle is an explicit raw namespace: export adapters must pass their own contract
ID and authenticate the remote chain/application. Accepts 0–4 exact canonical
payloads of at most 684 bytes; an empty query returns true. Fill proofs compare
stored solver/timestamp; non-fills require no fill and
committed deadline < now <= committed deadline + NOT_FILLED_WINDOW. Outside that
window a non-fill is false: the fill record may have expired.
Oversized callback/context fields within a bounded proof are answered truthfully:
no such fill can exist, while non-fill follows the deadline. This differs from
fill/emit_not_filled admission. No authorization or data TTL renewal occurs;
instance/code TTL is maintained. Malformed proofs, unknown proof prefixes, or bounds errors
abort rather than returning false.
fn has_attested(
env: soroban_sdk::Env,
oracle: soroban_sdk::BytesN<32>,
payloads: soroban_sdk::Vec,
) -> Result Bind the immutable OIF destination chain_id and expected Stellar network_id.
Returns WrongNetwork if the network differs from the host ledger. Stores
configuration in instance storage and renews instance/code TTL. There is no
administrator or mutable deployment configuration.
fn __constructor(
env: soroban_sdk::Env,
chain_id: soroban_sdk::U256,
network_id: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>Emit and return a canonical non-fill proof when
fill_deadline < now <= fill_deadline + NOT_FILLED_WINDOW and unfilled.
Permissionless. Validates chain, settler and output byte bounds; it does not execute
or validate callback/context semantics. Emits OutputNotFilled, storing no marker.
An early caller-supplied deadline cannot block fills. Consumers must reconstruct
the proof using their committed deadline; a recorded fill even after that deadline
blocks emission. Maintains instance/code TTL, not fill TTL.
DeadlineNotPassed, NotFilledWindowElapsed, AlreadyFilled,
domain/configuration or resource-bound errors.
fn emit_not_filled(
env: soroban_sdk::Env,
order_id: soroban_sdk::BytesN<32>,
output: MandateOutput,
fill_deadline: u32,
) -> ResultRead the record for order_id and keccak256(full packed MandateOutput).
Returns None for an unknown pair, and once the temporary record has expired after
fill_deadline + NOT_FILLED_WINDOW; a known record commits solver and timestamp.
Permissionless; maintains instance/code TTL but not fill TTL. Configuration
errors abort.
fn get_fill_record(
env: soroban_sdk::Env,
order_id: soroban_sdk::BytesN<32>,
output_hash: soroban_sdk::BytesN<32>,
) -> Result>, soroban_sdk::Error> Record a local input-oracle proof for an existing fill of output.
Permissionless, as on EVM setAttestation. output.oracle must be this settler.
The stored fill record must equal keccak256(solver || timestamp:u32); the proof
is then keccak(proof_tuple(output, keccak(fill payload))), a temporary entry
living TTL_TARGET ledgers. Repeat calls are idempotent and restore the full
proof TTL, re-creating an expired proof while the fill record lives. No event is
emitted: OutputFilled already carries the payload. Only fills are attestable;
unfilled same-chain orders refund through the escrow's refund after expires.
WrongChain, WrongSettler, ResourceLimit, WrongOracle, InvalidAttestation,
WireLimit or configuration errors.
fn set_attestation(
env: soroban_sdk::Env,
order_id: soroban_sdk::BytesN<32>,
solver: soroban_sdk::BytesN<32>,
timestamp: u32,
output: MandateOutput,
) -> Result<(), soroban_sdk::Error>Decode the native destination a fill of output would pay.
Applies the fill's chain, settler, byte-bound, callback and context-shape rules. The result is a G, C or M address according to the context's recipient tag. It does not predict token, trustline, pricing-time or authorization outcomes.
WrongChain, WrongSettler, ResourceLimit, CallbackUnsupported,
InvalidContext, or configuration errors.
fn resolve_recipient(
env: soroban_sdk::Env,
output: MandateOutput,
) -> ResultAtomically fill 1–4 outputs of this settler for one order with the same filler and proposed solver.
The filler authorizes this call and grants token allowances as for fill.
The first output's record must equal this call's keccak256(solver || now:u32):
a previous fill even by the same solver at another second loses competition.
Later filled outputs skip payment after validation. New outputs emit OutputFilled;
all writes/transfers roll back on failure. Fills and retries extend records to
the fill horizon, as for fill.
EmptyCollection, ResourceLimit, AlreadyFilled for first-output competition,
or any domain, deadline, FillHorizon, context, token or authorization failure
from fill.
fn fill_order_outputs(
env: soroban_sdk::Env,
filler: soroban_sdk::Address,
solver: soroban_sdk::BytesN<32>,
order_id: soroban_sdk::BytesN<32>,
outputs: soroban_sdk::Vec,
fill_deadline: u32,
) -> Result<(), soroban_sdk::Error> InputOracle::efficient_require_proven over proofs recorded by set_attestation.
Empty input succeeds. No data TTL renewal.
Malformed for a partial 128-byte tuple, Unproven for any missing or expired proof.
fn efficient_require_proven(
env: soroban_sdk::Env,
proofs: soroban_sdk::Bytes,
) -> Result<(), soroban_sdk::Error>