features/wallet/swap/swap_controller library

Classes

kSwapDepositFeeAllowanceZat → const int: Conservative NETWORK-FEE allowance the #367 spendable pre-check adds to the OutOfZec deposit before comparing against what is spendable right now. The exact ZIP-317 fee is knowable only at execute-sign (sign-at-execute — there is no swap propose/preview round-trip), so review-time honesty uses a bound: 25 000 zat = five ZIP-317 logical actions, comfortably above the typical 2–4-action shielded→transparent deposit. Direction of error is deliberate: too SMALL lets a doomed execute through to the engine's swallowed sign-time InsufficientFunds (the invisible-parked blast radius — now at least VISIBLE via the durable home, but still a dead end); too large merely refuses a hairline swap the fee might genuinely kill. A fragmented wallet (many dust inputs) can exceed any constant — the engine-side gate stays the backstop; this makes the common case honest.
kSwapNetworkTimeout → const Duration: Host-side backstop timeout for a swap network round-trip (quote/execute). The SDK has its own transport timeouts; this guarantees the UI never hangs on "Getting a quote…" / "Starting…" if a dial stalls on a dead/flaky network — it surfaces the honest "couldn't get a quote, try again" fault (the receive-address timeout precedent). Generous enough for a slow Tor path (a real quote can take ~20s) yet bounded so the spinner can never spin forever.

swapControllerProvider → NotifierProvider<SwapController, SwapFlowState>: The swap flow state machine (D-2b-1 / §3.3b): form → quote → review → execute → deposit → tracking. Drives the swap screen; Rust stays the single source of truth (design invariant 1) — every step forwards straight to the SDK and no swap state is cached here. BOTH directions (SwapFlowDirection): OutOfZec (ZEC → a foreign asset; the wallet sends the §4.4 deposit) and IntoZec (a foreign asset → ZEC; the USER sends the deposit externally, so execute lands on the SwapAwaitingDeposit D7 screen before tracking).
final