@0xio/sdk 2.6.0 → 2.7.1

package/CHANGELOG.md

@@ -2,6 +2,81 @@
 
 All notable changes to the 0xio Wallet SDK will be documented in this file.
 
+## [2.7.1] - 2026-05-27
+
+### Security
+
+- **LOW (re-assessed from HIGH):** Removed `this.config.networkId` silent fallback in `connect()` and `getConnectionStatus()`. If neither `networkInfo` nor `networkId` can be resolved from the response, `connect()` now throws `NETWORK_ERROR` and `getConnectionStatus()` returns cached state. The current extension always returns valid `networkInfo`; this hardens against malformed responses from custom or future adapters.
+- **MED-1:** Added `SDKConfig.trustedParentOrigins` — when set, only listed origins (+ `tauri://`) are trusted as parent iframe bridges; implicit localhost trust is disabled. Omitting the field keeps existing dev-friendly behavior.
+- **LOW-2:** `validateNetworkInfo()` now rejects `http://` `rpcUrl` values on non-testnet networks. Testnet networks (`isTestnet: true`) and localhost are unaffected. Prevents a malicious bridge from injecting an insecure RPC endpoint.
+- **LOW-19:** `encryptBalance()`, `decryptBalance()`, `sendPrivateTransfer()`, and `callContract()` now throw `INVALID_AMOUNT` when a numeric amount cannot be represented exactly in micro-OCT (6 decimal places). Pass a string (e.g. `"0.300000"`) for exact control.
+- **LOW-28 (docs):** `ContractCallData.amount` JSDoc corrected — field is OCT, not micro-units. No behavior change.
+
+### Added
+
+- **`OctraProviderAdapter`** (`src/supports/octra-provider.ts`): RFC-O-1 compliant transport adapter that uses `window.octra.request()` instead of the postMessage bridge. Detects any wallet exposing `window.octra.isOctra === true`. Translates SDK method names to RFC-O-1 method names (`send_transaction` → `octra_sendTransaction`, etc.) and maps events back to SDK vocabulary. Registered second in the adapter registry — existing DApps using the postMessage bridge are unaffected.
+- **`listenForReady`** in `OctraProviderAdapter` now also listens for `octra#initialized` CustomEvent (dispatched by 0xio extension v2.4.3+) in addition to `octraWalletReady`, ensuring the provider is detected immediately on page load.
+
+### Fixed
+
+- Mainnet RPC URL in docs updated to `https://octra.network` (was stale `http://46.101.86.250:8080`)
+
+### Compatibility
+
+- No breaking changes — `ZeroXIOAdapter` (postMessage bridge) remains the default and takes priority when `window.wallet0xio` is present
+- Old DApps work unchanged; new DApps can opt into `OctraProviderAdapter` explicitly or via `detectWalletAdapter()`
+- Requires 0xio Wallet Extension v2.4.3+ for `octra#initialized` event; falls back to `octraWalletReady` on older versions
+
+## [2.7.0] - 2026-05-16
+
+### Security (post-audit remediation)
+
+**Transport hardening:**
+- Session nonce validation on all bridge responses — blocks same-origin impersonation
+- Removed wildcard `'*'` postMessage fallback — parent only addressed once origin established
+- Removed `Math.random()` fallback for request IDs — throws if `crypto` unavailable
+- `requestTimestamps` capped to prevent unbounded growth in idle tabs
+- Removed legacy `octraWalletReady` listeners and `createOctraWallet` alias
+
+### Added
+
+- **Pluggable wallet adapter system** (`src/adapter.ts`, `src/supports/`):
+  - `WalletTransportAdapter` interface — add support for any wallet without touching core SDK
+  - `src/supports/0xio.ts` — built-in adapter with session nonce + iframe bridge support
+  - `src/supports/template.ts` — starter template for new adapters
+  - `detectWalletAdapter()` auto-detect helper
+  - Exported: `WalletTransportAdapter`, `AdapterRequest`, `AdapterIncomingMessage`, `ZeroXIOAdapter`, `createZeroXIOAdapter`, `detectWalletAdapter`, `getAllAdapters`
+
+### Changed
+
+- `ExtensionCommunicator` delegates to adapter for detect, postMessage, listen, and ready events
+- Session nonce handling moved from communicator to adapter
+- Requires Chrome 111+ when using the 0xio browser extension
+- No breaking changes to `ZeroXIOWallet` public API
+
+**SDK fixes:**
+- Session versioning — `_sessionVersion` counter prevents stale writes from in-flight requests after disconnect/account switch
+- Debug log scrubbing — only non-sensitive fields logged (`{ to }`, `{ contract, method }`, `{ public }`)
+- Removed `retry()` and `withTimeout()` from public API export
+- Per-method payload size limits — method names ≤ 200 chars, params ≤ 64 KB, memos ≤ 1,000 chars
+- Input validation at all mutating method entry points (`isValidAddress()`, `isValidAmount()`)
+- Added `signAuthMessage(service, nonce)` — domain-separated auth signing with origin binding
+- Amount types accept `string | number` — eliminates JS precision loss for large values
+- Added `deriveOctraAddress(publicKeyBase64)` — `connect()` and `getConnectionStatus()` verify pubkey→addr binding
+- `encrypt/decryptBalance()` return full `TransactionResult` (was boolean)
+- `contractCallView` no longer leaks connected address as default caller
+- `balanceChanged` emits on public/private split change (not just total)
+- `once()` removes listener before invoke — throwing listeners no longer re-fire
+- `extensionLocked`/`extensionUnlocked` events emitted (were suppressed)
+- Permissions stored in `ConnectionInfo` and survive session restore
+- `connectedAt` preserved across `getConnectionStatus()` polls
+- `connect` event only emits on disconnected→connected transition
+- `NETWORKS` frozen + `getNetworkConfig()` returns frozen copies
+- `validateBalance()` uses `Number()` not `parseFloat()` — rejects partial numerics
+- `validateNetworkInfo()` rejects empty rpcUrl (except custom network)
+- `switchNetwork()` requires active connection
+- `checkSDKCompatibility()` no longer falsely flags non-Chrome transports
+
 ## [2.6.0] - 2026-05-13
 
 ### Added

package/README.md

@@ -1,9 +1,21 @@
 # 0xio Wallet SDK
 
-**Version:** 2.6.0
+**Version:** 2.7.1
 
 Official TypeScript SDK for integrating DApps with 0xio Wallet on Octra Network.
 
+## What's New in v2.7.0
+
+Security hardening release (post-audit remediation):
+- **MessageChannel transport** (H-2 fix): Extension now uses a private `MessageChannel` port instead of `window.postMessage`, preventing page scripts from intercepting or injecting wallet messages. SDK validates a per-session nonce on every response.
+- **Pluggable wallet adapters**: New `src/supports/` system — implement `WalletTransportAdapter` and drop a file in `supports/` to add any wallet without touching core SDK code. See `src/supports/template.ts` for the starting point.
+- Fixed wildcard postMessage target leaking request payloads to any origin (HIGH)
+- Removed `Math.random()` fallback for request IDs — throws if `crypto` unavailable (MEDIUM)
+- Fixed `requestTimestamps` unbounded memory growth in idle tabs (LOW)
+- Removed all `octraWalletReady` legacy event listeners and `createOctraWallet` alias (LOW)
+- Extension fixes: balance/network events now delivered end-to-end; `accountChanged` on wallet switch; exact hostname tab matching; approval listener spoofing from content scripts blocked
+- All 17 post-audit findings resolved. See `AUDIT_REMEDIATION.md` for full details.
+
 ## What's New in v2.6.0
 
 - **`sendPrivateTransfer(to, amount)`**: Send encrypted (stealth) transfers — amount is hidden from everyone except sender and recipient. Uses PVAC-HFHE for ciphertext subtraction + zero-knowledge proofs. The node re-encrypts under the recipient's key.
@@ -260,7 +272,7 @@ console.log(devnet.isTestnet);        // true
 
 // Get mainnet config
 const mainnet = getNetworkConfig('mainnet');
-console.log(mainnet.rpcUrl);          // http://46.101.86.250:8080
+console.log(mainnet.rpcUrl);          // https://octra.network
 console.log(mainnet.supportsPrivacy); // true
 ```
 
@@ -295,6 +307,69 @@ The SDK automatically detects when your DApp is running inside:
 
 No code changes are needed for DApp developers. Just use the SDK as normal and it will auto-detect the environment and choose the correct transport.
 
+## Wallet Adapters
+
+The SDK ships with a pluggable adapter system so multiple wallets can be supported without changing core code.
+
+### Auto-detect
+
+```typescript
+import { detectWalletAdapter, ZeroXIOWallet } from '@0xio/sdk';
+
+const adapter = detectWalletAdapter();
+if (!adapter) throw new Error('No supported wallet found');
+
+const wallet = new ZeroXIOWallet({ appName: 'My DApp', adapter });
+```
+
+### Pass an adapter explicitly
+
+```typescript
+import { ZeroXIOWallet, ZeroXIOAdapter } from '@0xio/sdk';
+
+const wallet = new ZeroXIOWallet({ appName: 'My DApp', adapter: ZeroXIOAdapter });
+```
+
+### Add support for another wallet
+
+1. Copy `src/supports/template.ts` → `src/supports/my-wallet.ts`
+2. Fill in the four constants (`REQUEST_SOURCE`, `RESPONSE_SOURCE`, `WINDOW_KEY`, `READY_EVENT`) and the message-shape mapping
+3. Register it in `src/supports/index.ts` `REGISTERED_ADAPTERS`
+4. Export it from `src/index.ts` if you want it in the public API
+
+See `DOCUMENTATION.md → Wallet Adapter System` for the full interface spec.
+
+## RFC-O-1 Provider Interface (`window.octra`)
+
+The 0xio extension exposes a standard `window.octra` provider per the RFC-O-1 spec in addition to the legacy `window.wallet0xio` bridge. The SDK supports both automatically.
+
+```typescript
+// window.octra shape (injected by the extension)
+window.octra.isOctra  // true — standard wallet detection
+window.octra.request({ method: 'octra_requestAccounts', params: [{}] })
+window.octra.on('accountsChanged', handler)
+window.octra.removeListener('accountsChanged', handler)
+```
+
+### How adapter priority works
+
+When the SDK initializes, `detectWalletAdapter()` runs detection in order:
+
+1. **`ZeroXIOAdapter`** — detected via `window.wallet0xio` / `window.ZeroXIOWallet` (postMessage bridge). Priority when the 0xio extension is installed — existing DApps are unaffected.
+2. **`OctraProviderAdapter`** — detected via `window.octra.isOctra === true`. Used when only the RFC-O-1 provider is present (third-party RFC-O-1 wallets, or DApps that explicitly request it).
+
+Old DApps using the postMessage bridge continue to work unchanged. New DApps can opt into `OctraProviderAdapter` directly:
+
+```typescript
+import { ZeroXIOWallet, OctraProviderAdapter } from '@0xio/sdk';
+
+// Explicitly use the RFC-O-1 window.octra provider
+const wallet = new ZeroXIOWallet({
+  appName: 'My DApp',
+  adapter: OctraProviderAdapter,
+});
+```
+
 ## Requirements
 
 - 0xio Wallet Extension v2.0.1 or higher (Mainnet Alpha)