feat(credits)!: SDK-only Buy Credits — background recovery + spend-everything MAX

common/src/main/java/org/dash/wallet/common/ui/enter_amount/EnterAmountFragment.kt

@@ -34,6 +34,7 @@ import androidx.core.view.isVisible
 import androidx.fragment.app.Fragment
 import androidx.fragment.app.activityViewModels
 import androidx.lifecycle.lifecycleScope
+import androidx.lifecycle.withStarted
 import dagger.hilt.android.AndroidEntryPoint
 import kotlinx.coroutines.launch
 import org.dash.wallet.common.money.Coin
@@ -173,6 +174,7 @@ class EnterAmountFragment : Fragment(R.layout.fragment_enter_amount) {
 
         binding.keyboardView.onKeyboardActionListener = keyboardActionListener
         binding.continueBtn.setOnClickListener {
+            if (binding.continueProgress.isVisible) return@setOnClickListener
             val dashAmount = binding.amountView.dashAmount
             val fiatAmount = binding.amountView.fiatAmount
             viewModel.onContinueEvent.value = Pair(dashAmount, fiatAmount)
@@ -189,6 +191,7 @@ class EnterAmountFragment : Fragment(R.layout.fragment_enter_amount) {
         }
 
         viewModel.canContinue.observe(viewLifecycleOwner) { canContinue ->
+            if (continueLoading) return@observe
             binding.continueBtn.isEnabled = if (!didAuthorize && requirePinForBalance && !viewModel.blockContinue) {
                 viewModel.amount.value?.isPositive == true
             } else {
@@ -214,6 +217,29 @@ class EnterAmountFragment : Fragment(R.layout.fragment_enter_amount) {
         }
     }
 
+    /**
+     * Show a progress circle on the continue button and DISABLE it — for
+     * hosts whose action runs asynchronously after the tap. The disabled
+     * state is sticky: [canContinue] emissions cannot re-enable the button
+     * while loading (that observer would otherwise flip it back on within
+     * milliseconds).
+     */
+    fun setContinueLoading(loading: Boolean) {
+        continueLoading = loading
+        viewLifecycleOwner.lifecycleScope.launch {
+            viewLifecycleOwner.lifecycle.withStarted {
+                binding.continueProgress.isVisible = loading
+                binding.continueBtn.text = if (loading) "" else getString(R.string.button_continue)
+                // isEnabled alone gives the app's standard disabled look: the
+                // button theme already maps it to `disabledBackgroundColor`.
+                binding.continueBtn.isEnabled = !loading
+            }
+        }
+    }
+
+    /** True while [setContinueLoading] holds the button in its busy state. */
+    private var continueLoading = false
+
     fun applyMaxAmount() {
         lifecycleScope.launchWhenStarted {
             onMaxAmountButtonClick()

common/src/main/res/layout/fragment_enter_amount.xml

@@ -128,14 +128,28 @@
                 android:layout_marginBottom="@dimen/enter_amount_keyboard_spacing"
                 app:nk_decSeparatorEnabled="true" />
 
-            <Button
-                android:id="@+id/continue_btn"
-                style="@style/Button.Primary.Large.Blue"
+            <FrameLayout
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
                 android:layout_marginBottom="25dp"
-                android:layout_marginHorizontal="15dp"
-                android:text="@string/button_continue" />
+                android:layout_marginHorizontal="15dp">
+
+                <Button
+                    android:id="@+id/continue_btn"
+                    style="@style/Button.Primary.Large.Blue"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content"
+                    android:text="@string/button_continue" />
+
+                <ProgressBar
+                    android:id="@+id/continue_progress"
+                    android:layout_width="24dp"
+                    android:layout_height="24dp"
+                    android:layout_gravity="center"
+                    android:elevation="8dp"
+                    android:indeterminateTint="@color/white"
+                    android:visibility="gone" />
+            </FrameLayout>
         </LinearLayout>
     </androidx.cardview.widget.CardView>
 

wallet/res/values/strings-dashpay.xml

@@ -454,6 +454,7 @@
          the asset-lock build can actually select (final, confirmed/InstantSend-
          locked coins) do not. -->
     <string name="buy_credits_funds_settling">You need at least %s spendable Dash for this top-up. Recently received or transferred funds may still be settling.</string>
+    <string name="buy_credits_below_minimum">Enter at least %s to buy credits.</string>
 
     <string name="request_username_username_voting_message">+ what is username voting?</string>
     <string name="request_username_character_requirement">Letters, numbers and hyphens only</string>

wallet/src/de/schildbach/wallet/payments/SendCoinsTaskRunner.kt

@@ -1129,26 +1129,6 @@ class SendCoinsTaskRunner @Inject constructor(
         return sendRequest
     }
 
-    fun createAssetLockSendRequest(
-        mayEditAmount: Boolean,
-        paymentIntent: PaymentIntent,
-        signInputs: Boolean,
-        forceEnsureMinRequiredFee: Boolean,
-        topUpKey: ECKey
-    ): SendRequest {
-        val wallet = walletData.wallet ?: throw RuntimeException(WALLET_EXCEPTION_MESSAGE)
-        Context.propagate(wallet.context)
-        val sendRequest = SendRequest.assetLock(wallet.params, topUpKey, paymentIntent.amount.toDashjCoin())
-        sendRequest.coinSelector = getCoinSelector()
-        sendRequest.useInstantSend = false
-        sendRequest.feePerKb = Constants.ECONOMIC_FEE.toDashjCoin()
-        sendRequest.ensureMinRequiredFee = forceEnsureMinRequiredFee
-        sendRequest.signInputs = signInputs
-        val walletBalance = wallet.getBalance(getMaxOutputCoinSelector())
-        sendRequest.emptyWallet = mayEditAmount && walletBalance.value == paymentIntent.amount?.value
-
-        return sendRequest
-    }
 
     @VisibleForTesting
     fun createSendRequest(

wallet/src/de/schildbach/wallet/service/platform/TopUpRepository.kt

@@ -31,7 +31,8 @@ import de.schildbach.wallet.database.entity.DashPayProfile
 import de.schildbach.wallet.database.entity.Invitation
 import de.schildbach.wallet.database.entity.TopUp
 import de.schildbach.wallet.service.DashSystemService
-import de.schildbach.wallet.service.platform.work.TopupIdentityWorker
+import de.schildbach.wallet.service.platform.sdk.SdkTopUpRecoveryService
+import de.schildbach.wallet.service.platform.work.ResumeTopUpsOperation
 import de.schildbach.wallet.ui.dashpay.PlatformRepo
 import de.schildbach.wallet_test.BuildConfig
 import org.bitcoinj.core.Coin
@@ -83,7 +84,7 @@ import androidx.core.net.toUri
 /**
  * contains topup related functions that are used by:
  * 1. [CreateIdentityService] to create an identity
- * 2. [TopupIdentityWorker] to topup an identity
+ * 2. [checkTopUps] to retry/complete legacy top-ups
  * 3. [SendInviteWorker] to create Invitations (dynamic link)
  */
 interface TopUpRepository {
@@ -174,7 +175,8 @@ class TopUpRepositoryImpl @Inject constructor(
     private val dashPayProfileDao: DashPayProfileDao,
     private val invitationsDao: InvitationsDao,
     private val dashPayConfig: DashPayConfig,
-    private val dashSystemService: DashSystemService
+    private val dashSystemService: DashSystemService,
+    private val sdkTopUpRecoveryService: SdkTopUpRecoveryService
 ) : TopUpRepository {
     companion object {
         private val log = LoggerFactory.getLogger(TopUpRepositoryImpl::class.java)
@@ -528,38 +530,24 @@ class TopUpRepositoryImpl @Inject constructor(
         }
     }
 
-    private var checkedPreviousTopUps = false
 
+    /**
+     * Phase 2/3 (MO-998): the legacy dashj retry loops are DELETED — the
+     * SDK's tracked-lock queue is the only top-up retry system. Uncredited
+     * dashj-era top-ups from before the migration are NOT retried by the
+     * app anymore; they become recoverable again when the SDK gains
+     * chain rediscovery of asset locks (the pending platform change), at
+     * which point they surface on the recovery queue below like any
+     * interrupted SDK top-up. Funds are never lost in the interim — the
+     * locks sit on chain, claimable by this wallet's keys.
+     */
     override suspend fun checkTopUps(aesKeyParameter: KeyParameter?) {
-        val topUps = topUpsDao.getUnused()
-        topUps.forEach { topUp ->
-            try {
-                val tx = walletDataProvider.wallet!!.getTransaction(topUp.txId)
-                val assetLockTx = authExtension.getAssetLockTransaction(tx)
-                topUpIdentity(assetLockTx, aesKeyParameter)
-                topUpsDao.insert(topUp.copy(creditedAt = System.currentTimeMillis()))
-            } catch (e: Exception) {
-                // swallow
-            }
-        }
-        // only check once per app start
-        if (!checkedPreviousTopUps) {
-            log.info("checking all topup transactions")
-            authExtension.topupFundingTransactions.forEach { assetLockTx ->
-                val topUp = topUpsDao.getByTxId(assetLockTx.txId)
-                if (topUp == null || topUp.notUsed()) {
-                    val identity = topUp?.toUserId ?: identityRepository.blockchainIdentity!!.uniqueIdentifier.toString()
-                    if (topUp == null) {
-                        topUpsDao.insert(TopUp(assetLockTx.txId, identity))
-                    }
-                    try {
-                        topUpIdentity(assetLockTx, platformRepo.getWalletEncryptionKey()!!)
-                    } catch (e: Exception) {
-                        log.info("problem executing topup for ${assetLockTx.txId}", e)
-                    }
-                }
+        try {
+            if (sdkTopUpRecoveryService.hasPendingTopUpLocks()) {
+                ResumeTopUpsOperation(walletApplication).enqueue()
             }
-            checkedPreviousTopUps = true
+        } catch (e: Exception) {
+            log.warn("failed to check/enqueue the SDK top-up drain", e)
         }
     }
 

wallet/src/de/schildbach/wallet/service/platform/sdk/SdkAssetLockFundingPreflight.kt

@@ -210,6 +210,31 @@ data class AssetLockFundingEvidence(
     val unclassifiedDuffs: Long
 )
 
+/**
+ * COUNT twin of [ELIGIBLE_ASSET_LOCK_DUFFS_SQL] — the number of UTXOs a
+ * fresh asset-lock build can select. Sizes the fee reserve a MAX
+ * ("spend everything") top-up withholds on its one adjusted retry: the fee
+ * is ~148 bytes per INPUT, and this is the exact input population, from the
+ * engine that will do the selecting. (dashj's spendableUtxoCount() is the
+ * wrong ruler here: it counts coins the asset lock can never select —
+ * CoinJoin, other accounts, non-final — and post-cutover it can be stale.)
+ */
+internal val ELIGIBLE_ASSET_LOCK_UTXO_COUNT_SQL = eligibleAssetLockUtxoCountSql(lockCount = 0)
+
+/**
+ * The COUNT with the SAME [lockCount]-parameterized finality term and spine
+ * as [eligibleAssetLockDuffsSql] (args: walletId, then the wire-order txid
+ * blobs) — the two queries must count/sum the SAME population, or the MAX
+ * fee reserve gets sized from a different UTXO set than the one the sum
+ * (and the engine's selection) sees.
+ */
+internal fun eligibleAssetLockUtxoCountSql(lockCount: Int): String =
+    "SELECT COUNT(*) $ASSET_LOCK_TXO_JOINS " +
+        "WHERE t.walletId = ? " +
+        "AND $UNSPENT_SELECTABLE_TERMS " +
+        "AND ${mirrorFinalTermSql(lockCount)} " +
+        "AND $BIP44_ACCOUNT_0_TERM"
+
 /**
  * Pure coverage predicate for the preflight (host-JVM testable): can
  * [eligibleDuffs] of asset-lock-eligible funds cover a lock of
@@ -359,7 +384,13 @@ class SdkAssetLockFundingPreflight internal constructor(
      * `null` when unavailable. Production wiring runs the two SQL passes
      * against the SDK's Room database.
      */
-    private val evidenceQuery: suspend () -> AssetLockFundingEvidence?
+    private val evidenceQuery: suspend () -> AssetLockFundingEvidence?,
+    /**
+     * COUNT twin of [evidenceQuery]'s eligible sum: the eligible-UTXO
+     * population, for sizing a MAX top-up's fee reserve. `null` when
+     * unavailable.
+     */
+    private val eligibleUtxoCountQuery: suspend () -> Int? = { null }
 ) {
     @Inject
     constructor(
@@ -386,6 +417,21 @@ class SdkAssetLockFundingPreflight internal constructor(
                     emptyList()
                 }
             )
+        },
+        eligibleUtxoCountQuery = {
+            queryEligibleAssetLockUtxoCount(
+                sdkService.databaseOrNull(),
+                sdkService.walletManagerOrNull()?.wallets?.value?.keys?.singleOrNull(),
+                // Same lock evidence as evidenceQuery, so the count's
+                // population cannot diverge from the sum's.
+                persistedLockTxidsHex = try {
+                    instantSendLockDao.getMostRecentTxIds(MAX_PREFLIGHT_LOCK_TXIDS)
+                } catch (t: Throwable) {
+                    if (t is CancellationException) throw t
+                    log.warn("persisted IS-lock read failed; UTXO count evaluates without lock evidence", t)
+                    emptyList()
+                }
+            )
         }
     )
 
@@ -418,6 +464,30 @@ class SdkAssetLockFundingPreflight internal constructor(
      * `null` = no evidence either way — treat as fundable (fail open).
      * A `false` is logged with the figures for on-device forensics.
      */
+    /**
+     * The number of UTXOs a fresh asset-lock build can select — the input
+     * population whose per-input bytes dominate the L1 fee. `null` = no
+     * evidence (pre-cutover, SDK unavailable, read failure); callers fall
+     * back to not adjusting rather than guessing.
+     */
+    suspend fun eligibleAssetLockUtxoCountOrNull(): Int? {
+        val committed = try {
+            cutoverCommitted()
+        } catch (t: Throwable) {
+            if (t is CancellationException) throw t
+            log.warn("asset-lock funding preflight: cutover state read failed; no UTXO count", t)
+            return null
+        }
+        if (!committed) return null
+        return try {
+            eligibleUtxoCountQuery()
+        } catch (t: Throwable) {
+            if (t is CancellationException) throw t
+            log.warn("asset-lock funding preflight: UTXO count read failed", t)
+            null
+        }
+    }
+
     suspend fun canFundAssetLockDuffs(requiredDuffs: Long): Boolean? {
         val evidence = assetLockFundingEvidenceOrNull() ?: return null
         val verdict = assetLockFundingVerdict(evidence, requiredDuffs)
@@ -458,6 +528,36 @@ class SdkAssetLockFundingPreflight internal constructor(
          * rule, coinbase rows are excluded outright (conservative — can
          * only under-count, never over-count).
          */
+        /**
+         * COUNT twin of [queryAssetLockFundingEvidence]'s eligible sum — how
+         * many UTXOs the asset-lock coin selection can draw on, counted over
+         * the SAME spine and the SAME persisted-IS-lock finality evidence so
+         * the population cannot diverge from the sum's. `null` when the SDK
+         * database or wallet binding is unavailable.
+         */
+        internal suspend fun queryEligibleAssetLockUtxoCount(
+            database: org.dashfoundation.dashsdk.persistence.DashDatabase?,
+            walletIdHex: String?,
+            persistedLockTxidsHex: List<String> = emptyList()
+        ): Int? {
+            val db = database ?: return null
+            val walletId = walletIdHex?.let { walletIdFromHex(it) } ?: return null
+            val lockBlobs = persistedLockTxidsHex
+                .take(MAX_PREFLIGHT_LOCK_TXIDS)
+                .mapNotNull { hexToBytesOrNull(it.lowercase())?.takeIf { b -> b.size == 32 }?.reversedArray() }
+            return withContext(Dispatchers.IO) {
+                val args = ArrayList<Any?>(1 + lockBlobs.size)
+                args.add(walletId)
+                args.addAll(lockBlobs)
+                db.openHelper.readableDatabase.query(
+                    androidx.sqlite.db.SimpleSQLiteQuery(
+                        eligibleAssetLockUtxoCountSql(lockBlobs.size),
+                        args.toTypedArray()
+                    )
+                ).use { cursor -> if (cursor.moveToFirst()) cursor.getInt(0) else 0 }
+            }
+        }
+
         internal suspend fun queryAssetLockFundingEvidence(
             database: org.dashfoundation.dashsdk.persistence.DashDatabase?,
             walletIdHex: String?,