@anywalletkit/extension-kit 0.1.2 → 0.1.4

package/README.md

@@ -33,11 +33,11 @@ pnpm add @anywalletkit/extension-kit @anywalletkit/core @anywalletkit/keyring
 
 | Area | Exports | What |
 | --- | --- | --- |
-| Vault | `Vault`, `chromeLocalVaultStorage`, `memoryVaultStorage`, `VAULT_SCRYPT`, `VAULT_MIN_PASSWORD_LENGTH` | every secret at rest in `chrome.storage.local`, two key layers (a KEK wraps a DEK, the DEK seals each secret); passkey (WebAuthn PRF) unlock as a second wrap of the same DEK |
+| Vault | `Vault`, `chromeLocalVaultStorage`, `memoryVaultStorage`, `VAULT_SCRYPT`, `VAULT_LIMITS`, `VAULT_MIN_PASSWORD_LENGTH` | every secret at rest in `chrome.storage.local`, two key layers (a KEK wraps a DEK, the DEK seals each secret); passkey (WebAuthn PRF) unlock as a second wrap of the same DEK |
 | Session | `Session`, `chromeSessionStorage`, `chromeAlarms`, `SESSION_DEFAULT_AUTOLOCK_MS` | the DEK in `chrome.storage.session` with an expiry and an alarm; `getKey()` re-checks the expiry itself |
 | Keyring adapters | `chromeKeyringStorage`, `vaultSecretStorage` | `@anywalletkit/keyring` metadata as plain JSON, secrets through the vault, one DEK use per call |
 | Relay | `PageRequest` / `RelayRequest` shapes and guards, `stampOrigin`, `checkSenderOrigin`, `RELAY_ERRORS` | page ⇄ content script ⇄ service worker messages; the origin is the browser's (`port.sender`), never the page's |
-| Router | `RequestRouter`, `READ_METHODS`, `SIGNING_METHODS` | what a dApp may call: accounts only for connected origins, chain add / switch through the approval window, reads from the wallet's own RPCs, `eth_sign` never offered, everything else 4200 |
+| Router | `RequestRouter`, `READ_METHODS`, `SIGNING_METHODS`, `toRelayError` | what a dApp may call: accounts only for connected origins, chain add / switch through the approval window, reads from the wallet's own RPCs, `eth_sign` never offered, everything else 4200 |
 | Permissions | `PermissionStore`, `CHAIN_ACCOUNT_KEYS` | per-origin accounts (EVM, Solana, TON, Tron, Bitcoin, NEAR) and chain |
 | Approvals | `ApprovalQueue`, `ReviewDeclined`, `QueueLimitError`, `APPROVALS_MAX_PENDING_PER_ORIGIN` | one approval window at a time, at most 3 pending requests per origin and one pending `connect`; transport notes (`setVia`) for WalletConnect peers |
 | Signing | `classifySignRequest`, `prepareTransaction`, `createSignHandler`, `messageText` | connected-address and chain checks, EIP-7702 delegations from sites refused, nonce / gas / fees from the wallet's RPC |
@@ -57,7 +57,11 @@ pnpm add @anywalletkit/extension-kit @anywalletkit/core @anywalletkit/keyring
   AES-256-GCM wraps a random 32-byte DEK; the DEK seals each secret under AAD
   `forgewallet-vault/secret/<id>` (boxes cannot be swapped). The DEK box's AAD
   binds the exact KDF parameters, so an envelope whose salt or cost was edited
-  on disk fails to open; `unlock` refuses sub-floor costs (`weak-kdf`). v1
+  on disk fails to open; `unlock` refuses sub-floor costs (`weak-kdf`), and
+  costs or sizes above `VAULT_LIMITS` (scrypt N ≤ 2^20, r ≤ 16, p ≤ 4; PBKDF2
+  ≤ 5 000 000 iterations; 1 000 secrets, 32 passkeys, 4 MiB) before any KDF
+  runs (`unsupported-envelope`). Writes to the envelope are serialized (one
+  `Vault` per storage area), so parallel imports keep every secret. v1
   envelopes (PBKDF2-SHA256, ≥ 600 000 iterations) still open and are re-sealed
   as v2. Passwords shorter than 8 characters are refused by the vault itself.
   Wrong password and tampering are the same failure (`wrong-password`).
@@ -67,6 +71,11 @@ pnpm add @anywalletkit/extension-kit @anywalletkit/core @anywalletkit/keyring
 - **Unlocked state.** Only the DEK is kept, in `chrome.storage.session`
   (memory-only, trusted contexts), with an expiry enforced on every read and an
   alarm that locks; key buffers this package owns are zeroized after use.
+  `unlock` / `lock` / `touch` / `getKey` run one at a time, so activity racing a
+  lock never brings the key back.
+- **Errors to pages.** `toRelayError(e, { log })` passes the wallet's own refusals
+  (EIP-1193 codes) and a node's JSON-RPC error (code, revert data) with URLs
+  removed; anything else is `-32603 Internal error` on the page and goes to `log`.
 - **Origins.** The service worker answers a relay message only when the
   content script's stamped origin equals `port.sender.origin`. Permissions are
   keyed by that origin, never by a URL a page or a WalletConnect peer claims.

package/dist/index.cjs

@@ -63,6 +63,7 @@ __export(src_exports, {
   TRON_PROVIDERS: () => TRON_PROVIDERS,
   TonConnectError: () => TonConnectError,
   VAULT_DEFAULT_ITERATIONS: () => VAULT_DEFAULT_ITERATIONS,
+  VAULT_LIMITS: () => VAULT_LIMITS,
   VAULT_MIN_ITERATIONS: () => VAULT_MIN_ITERATIONS,
   VAULT_MIN_PASSWORD_LENGTH: () => VAULT_MIN_PASSWORD_LENGTH,
   VAULT_MIN_SCRYPT: () => VAULT_MIN_SCRYPT,
@@ -185,6 +186,22 @@ var VAULT_DEFAULT_ITERATIONS = 6e5;
 var VAULT_SCRYPT = { N: 1 << 17, r: 8, p: 1 };
 var VAULT_MIN_SCRYPT = { N: 1 << 14, r: 8, p: 1 };
 var VAULT_MIN_PASSWORD_LENGTH = 8;
+var VAULT_LIMITS = Object.freeze({
+  /** scrypt cost: 2^20 × 16 = 2 GiB is the most any envelope may ask for. */
+  scrypt: Object.freeze({ N: 1 << 20, r: 16, p: 4 }),
+  /** PBKDF2-SHA256 iterations (v1 envelopes). */
+  iterations: 5e6,
+  /** Sealed secrets in one vault. */
+  secrets: 1e3,
+  /** Registered passkeys. */
+  passkeys: 32,
+  /** Plaintext bytes of one secret (`setSecret`). */
+  secretBytes: 16 * 1024,
+  /** base64 characters of one sealed box (iv or data). */
+  boxChars: 32 * 1024,
+  /** JSON characters of the whole envelope. */
+  envelopeChars: 4 * 1024 * 1024
+});
 var SALT_BYTES = 32;
 var IV_BYTES = 12;
 var DEK_BYTES = 32;
@@ -196,6 +213,8 @@ var aadSecret = (id) => `forgewallet-vault/secret/${id}`;
 var HKDF_INFO = "forgewallet-vault/2/passkey";
 var Vault = class {
   _storage;
+  /** Every read-modify-write of the envelope runs here, one after another (a parallel write would drop the other's change). */
+  _queue = Promise.resolve();
   _kdf;
   _iterations;
   _scrypt;
@@ -208,10 +227,11 @@ var Vault = class {
     this._scrypt = options.scrypt ?? VAULT_SCRYPT;
     this._onProgress = options.onProgress;
     this._crypto = options.crypto ?? globalThis.crypto;
-    if (!Number.isInteger(this._iterations) || this._iterations < VAULT_MIN_ITERATIONS) {
-      throw new VaultError(`PBKDF2 iterations must be an integer \u2265 ${VAULT_MIN_ITERATIONS}`, "invalid-input");
+    if (!Number.isInteger(this._iterations) || this._iterations < VAULT_MIN_ITERATIONS || this._iterations > VAULT_LIMITS.iterations) {
+      throw new VaultError(`PBKDF2 iterations must be an integer from ${VAULT_MIN_ITERATIONS} to ${VAULT_LIMITS.iterations}`, "invalid-input");
     }
     if (!isStrongScrypt(this._scrypt)) throw new VaultError(`scrypt cost must be at least N=${VAULT_MIN_SCRYPT.N} r=${VAULT_MIN_SCRYPT.r} p=${VAULT_MIN_SCRYPT.p} (N a power of two)`, "invalid-input");
+    if (!isBoundedScrypt(this._scrypt)) throw new VaultError(`scrypt cost must be at most N=${VAULT_LIMITS.scrypt.N} r=${VAULT_LIMITS.scrypt.r} p=${VAULT_LIMITS.scrypt.p}`, "invalid-input");
   }
   async exists() {
     return await this._storage.get() !== null;
@@ -230,10 +250,12 @@ var Vault = class {
    */
   async create(password) {
     requirePassword(password, VAULT_MIN_PASSWORD_LENGTH);
-    if (await this.exists()) throw new VaultError("A vault already exists; unlock it or reset explicitly.", "exists");
-    const dek = this._random(DEK_BYTES);
-    await this._storage.set(await this._sealEnvelope(password, dek, {}, [], Date.now()));
-    return dek;
+    return this._exclusive(async () => {
+      if (await this.exists()) throw new VaultError("A vault already exists; unlock it or reset explicitly.", "exists");
+      const dek = this._random(DEK_BYTES);
+      await this._write(await this._sealEnvelope(password, dek, {}, [], Date.now()));
+      return dek;
+    });
   }
   /**
    * Derive the KEK from `password`, unseal and return the DEK. `wrong-password` on
@@ -242,6 +264,9 @@ var Vault = class {
    */
   async unlock(password) {
     requirePassword(password);
+    return this._exclusive(() => this._unlock(password));
+  }
+  async _unlock(password) {
     const envelope = await this._load();
     if (isEnvelopeV1(envelope)) {
       if (envelope.kdf.iterations < VAULT_MIN_ITERATIONS) throw new VaultError(`The vault's KDF (${envelope.kdf.iterations} iterations) is below the floor this build accepts.`, "weak-kdf");
@@ -249,7 +274,7 @@ var Vault = class {
       const dek = await this._open(kek2, envelope.dek, aadDekV1(envelope.kdf), "wrong-password");
       if (this._kdf === "scrypt") {
         const next = await this._sealEnvelope(password, dek, envelope.secrets, [], envelope.createdAt);
-        await this._storage.set(isEnvelopeV2(next) ? { ...next, upgradedAt: Date.now() } : next);
+        await this._write(isEnvelopeV2(next) ? { ...next, upgradedAt: Date.now() } : next);
       }
       return dek;
     }
@@ -260,15 +285,18 @@ var Vault = class {
   /** Re-wrap the DEK under a new password (fresh salt, current KDF). Secrets and passkeys are untouched. */
   async changePassword(oldPassword, newPassword) {
     requirePassword(newPassword, VAULT_MIN_PASSWORD_LENGTH);
-    const dek = await this.unlock(oldPassword);
-    try {
-      const envelope = await this._load();
-      const passkeys = isEnvelopeV2(envelope) ? envelope.passkeys : [];
-      const next = await this._sealEnvelope(newPassword, dek, envelope.secrets, passkeys, envelope.createdAt);
-      await this._storage.set(isEnvelopeV2(envelope) && envelope.upgradedAt !== void 0 && isEnvelopeV2(next) ? { ...next, upgradedAt: envelope.upgradedAt } : next);
-    } finally {
-      (0, import_core.zeroize)(dek);
-    }
+    requirePassword(oldPassword);
+    return this._exclusive(async () => {
+      const dek = await this._unlock(oldPassword);
+      try {
+        const envelope = await this._load();
+        const passkeys = isEnvelopeV2(envelope) ? envelope.passkeys : [];
+        const next = await this._sealEnvelope(newPassword, dek, envelope.secrets, passkeys, envelope.createdAt);
+        await this._write(isEnvelopeV2(envelope) && envelope.upgradedAt !== void 0 && isEnvelopeV2(next) ? { ...next, upgradedAt: envelope.upgradedAt } : next);
+      } finally {
+        (0, import_core.zeroize)(dek);
+      }
+    });
   }
   // ---- passkeys (v2) ----
   /** Public view of the registered passkeys (ids, labels; whether each can verify assertions). */
@@ -288,27 +316,30 @@ var Vault = class {
    * Register a passkey as a second unlock path: the DEK (from the unlocked session)
    * is sealed under HKDF-SHA256(`prf`, salt = credential id). The password stays
    * the recovery path; `prf` is zeroized here. A v1 envelope must be unlocked (and
-   * thereby upgraded) first.
+   * thereby upgraded) first, and the vault must hold a secret (it proves the DEK).
    */
   async addPasskey(dek, passkey) {
     try {
       requireId(passkey.id);
       if (passkey.prf.length !== PRF_BYTES) throw new VaultError(`A PRF output is ${PRF_BYTES} bytes.`, "invalid-input");
-      const envelope = await this._load();
-      if (!isEnvelopeV2(envelope)) throw new VaultError("Unlock with the password once so the vault is upgraded before adding a passkey.", "unsupported-envelope");
-      if (envelope.passkeys.some((p) => p.id === passkey.id)) throw new VaultError("This passkey is already registered.", "exists");
-      await this._requireDek(dek, envelope);
-      const key = await this._derivePasskeyKek(passkey.prf, passkey.id);
-      const entry = { id: passkey.id, label: passkey.label.slice(0, 64), createdAt: Date.now(), dek: await this._seal(key, dek, aadPasskey(passkey.id)) };
-      if (passkey.publicKey && passkey.alg !== void 0) {
-        entry.publicKey = passkey.publicKey;
-        entry.alg = passkey.alg;
-      }
-      await this._storage.set({ ...envelope, passkeys: [...envelope.passkeys, entry] });
+      await this._exclusive(() => this._addPasskey(dek, passkey));
     } finally {
       (0, import_core.zeroize)(passkey.prf);
     }
   }
+  async _addPasskey(dek, passkey) {
+    const envelope = await this._load();
+    if (!isEnvelopeV2(envelope)) throw new VaultError("Unlock with the password once so the vault is upgraded before adding a passkey.", "unsupported-envelope");
+    if (envelope.passkeys.some((p) => p.id === passkey.id)) throw new VaultError("This passkey is already registered.", "exists");
+    await this._requireDek(dek, envelope);
+    const key = await this._derivePasskeyKek(passkey.prf, passkey.id);
+    const entry = { id: passkey.id, label: passkey.label.slice(0, 64), createdAt: Date.now(), dek: await this._seal(key, dek, aadPasskey(passkey.id)) };
+    if (passkey.publicKey && passkey.alg !== void 0) {
+      entry.publicKey = passkey.publicKey;
+      entry.alg = passkey.alg;
+    }
+    await this._write({ ...envelope, passkeys: [...envelope.passkeys, entry] });
+  }
   /** Unseal the DEK with a passkey's PRF output. `wrong-password` when the box does not open, `missing` when the id is unknown. */
   async unlockWithPasskey(id, prf) {
     try {
@@ -326,9 +357,11 @@ var Vault = class {
   }
   async removePasskey(id) {
     requireId(id);
-    const envelope = await this._load();
-    if (!isEnvelopeV2(envelope)) return;
-    await this._storage.set({ ...envelope, passkeys: envelope.passkeys.filter((p) => p.id !== id) });
+    return this._exclusive(async () => {
+      const envelope = await this._load();
+      if (!isEnvelopeV2(envelope)) return;
+      await this._write({ ...envelope, passkeys: envelope.passkeys.filter((p) => p.id !== id) });
+    });
   }
   // ---- secrets ----
   async listSecretIds() {
@@ -338,10 +371,16 @@ var Vault = class {
   /** Seal `secret` under the DEK as `sourceId` (overwrites an entry with the same id). */
   async setSecret(dek, sourceId, secret) {
     requireId(sourceId);
-    const envelope = await this._load();
+    if (secret.length > VAULT_LIMITS.secretBytes) throw new VaultError(`A secret is at most ${VAULT_LIMITS.secretBytes} bytes.`, "invalid-input");
     const key = await this._importDek(dek);
-    const box = await this._seal(key, secret, aadSecret(sourceId));
-    await this._storage.set({ ...envelope, secrets: { ...envelope.secrets, [sourceId]: box } });
+    return this._exclusive(async () => {
+      const envelope = await this._load();
+      if (!(sourceId in envelope.secrets) && Object.keys(envelope.secrets).length >= VAULT_LIMITS.secrets) {
+        throw new VaultError(`A vault holds at most ${VAULT_LIMITS.secrets} secrets.`, "invalid-input");
+      }
+      const box = await this._seal(key, secret, aadSecret(sourceId));
+      await this._write({ ...envelope, secrets: { ...envelope.secrets, [sourceId]: box } });
+    });
   }
   /** Unseal one secret. `null` when the id is unknown; the caller zeroizes the result after use. */
   async getSecret(dek, sourceId) {
@@ -354,15 +393,29 @@ var Vault = class {
   }
   async deleteSecret(sourceId) {
     requireId(sourceId);
-    const envelope = await this._load();
-    if (!(sourceId in envelope.secrets)) return;
-    const secrets = { ...envelope.secrets };
-    delete secrets[sourceId];
-    await this._storage.set({ ...envelope, secrets });
+    return this._exclusive(async () => {
+      const envelope = await this._load();
+      if (!(sourceId in envelope.secrets)) return;
+      const secrets = { ...envelope.secrets };
+      delete secrets[sourceId];
+      await this._write({ ...envelope, secrets });
+    });
   }
   /** Remove the whole vault. The explicit destructive flow only (back up → wipe → create). */
   async destroy() {
-    await this._storage.clear();
+    return this._exclusive(() => this._storage.clear());
+  }
+  // ---- serialized writes ----
+  _exclusive(fn) {
+    const run = this._queue.then(fn);
+    this._queue = run.catch(() => void 0);
+    return run;
+  }
+  /** Store an envelope this build will open again (bounds checked before it is written). */
+  async _write(envelope) {
+    const problem = envelopeProblem(envelope);
+    if (problem) throw new VaultError(`The vault would exceed its limits (${problem}); nothing was written.`, "invalid-input");
+    await this._storage.set(envelope);
   }
   // ---- crypto ----
   _random(n) {
@@ -380,11 +433,14 @@ var Vault = class {
     const kek = await this._deriveScrypt(password, salt, kdf);
     return { v: 2, kdf, dek: await this._seal(kek, dek, aadDekV2(kdf)), secrets, passkeys, createdAt };
   }
-  /** The caller's DEK must open this envelope's secrets — it is the key the password protects, not any 32 bytes. */
+  /**
+   * The caller's DEK must open this envelope's secrets — it is the key the password protects, not
+   * any 32 bytes. An empty vault has nothing to prove it with, so it is refused rather than trusted.
+   */
   async _requireDek(dek, envelope) {
     const ids = Object.keys(envelope.secrets);
     const key = await this._importDek(dek);
-    if (ids.length === 0) return;
+    if (ids.length === 0) throw new VaultError("Add a secret to the vault before a passkey: an empty vault cannot prove the key is its own.", "invalid-input");
     const probe = await this._open(key, envelope.secrets[ids[0]], aadSecret(ids[0]), "locked");
     (0, import_core.zeroize)(probe);
   }
@@ -438,6 +494,8 @@ var Vault = class {
     const envelope = await this._storage.get();
     if (!envelope) throw new VaultError("No vault in this storage area.", "missing");
     if (!isEnvelopeV1(envelope) && !isEnvelopeV2(envelope)) throw new VaultError("Unsupported vault envelope.", "unsupported-envelope");
+    const problem = envelopeProblem(envelope);
+    if (problem) throw new VaultError(`The vault envelope is outside the limits this build opens (${problem}).`, "unsupported-envelope");
     return envelope;
   }
 };
@@ -456,6 +514,22 @@ function isEnvelopeV2(x) {
 function isBox(x) {
   return typeof x === "object" && x !== null && typeof x.iv === "string" && typeof x.data === "string";
 }
+function isBoundedScrypt(c) {
+  return c.N <= VAULT_LIMITS.scrypt.N && c.r <= VAULT_LIMITS.scrypt.r && c.p <= VAULT_LIMITS.scrypt.p;
+}
+function envelopeProblem(e) {
+  if (e.v === 1 && e.kdf.iterations > VAULT_LIMITS.iterations) return `PBKDF2 iterations ${e.kdf.iterations} > ${VAULT_LIMITS.iterations}`;
+  if (e.v === 2 && !isBoundedScrypt(e.kdf)) return `scrypt N=${e.kdf.N} r=${e.kdf.r} p=${e.kdf.p} above N=${VAULT_LIMITS.scrypt.N} r=${VAULT_LIMITS.scrypt.r} p=${VAULT_LIMITS.scrypt.p}`;
+  const secrets = Object.values(e.secrets);
+  if (secrets.length > VAULT_LIMITS.secrets) return `${secrets.length} secrets > ${VAULT_LIMITS.secrets}`;
+  const passkeys = e.v === 2 ? e.passkeys : [];
+  if (passkeys.length > VAULT_LIMITS.passkeys) return `${passkeys.length} passkeys > ${VAULT_LIMITS.passkeys}`;
+  for (const box of [e.dek, ...secrets, ...passkeys.map((p) => p.dek)]) {
+    if (box.iv.length > VAULT_LIMITS.boxChars || box.data.length > VAULT_LIMITS.boxChars) return `a sealed box above ${VAULT_LIMITS.boxChars} characters`;
+  }
+  if (JSON.stringify(e).length > VAULT_LIMITS.envelopeChars) return `envelope above ${VAULT_LIMITS.envelopeChars} characters`;
+  return null;
+}
 function isStrongScrypt(c) {
   return Number.isInteger(c.N) && c.N >= VAULT_MIN_SCRYPT.N && (c.N & c.N - 1) === 0 && Number.isInteger(c.r) && c.r >= VAULT_MIN_SCRYPT.r && Number.isInteger(c.p) && c.p >= VAULT_MIN_SCRYPT.p;
 }
@@ -500,6 +574,13 @@ var Session = class {
   _alarm;
   _now;
   _onLock = /* @__PURE__ */ new Set();
+  /**
+   * Every operation on the stored record runs here, one after another: a `touch` that read the
+   * record before a `lock` removed it would otherwise write it back and undo the lock.
+   */
+  _queue = Promise.resolve();
+  /** Bumped by every lock; a `touch` writes only when no lock happened since it read the record. */
+  _epoch = 0;
   constructor(options) {
     this._storage = options.storage;
     this._alarms = options.alarms;
@@ -515,20 +596,19 @@ var Session = class {
   /** Store the DEK and arm the auto-lock. The caller's copy is zeroized. */
   async unlock(dek) {
     if (dek.length !== 32) throw new VaultError("Vault key must be 32 bytes.", "invalid-input");
-    const expiresAt = this._expiry();
-    await this._storage.set(this._key, { key: toBase64(dek), expiresAt });
-    (0, import_core2.zeroize)(dek);
-    await this._arm(expiresAt);
+    return this._serial(async () => {
+      const expiresAt = this._expiry();
+      await this._storage.set(this._key, { key: toBase64(dek), expiresAt });
+      (0, import_core2.zeroize)(dek);
+      await this._arm(expiresAt);
+    });
   }
   /** Forget the DEK and cancel the alarm. Safe to call when already locked. */
   async lock() {
-    const was = await this._storage.get(this._key);
-    await this._storage.remove(this._key);
-    await this._alarms.clear(this._alarm);
-    if (was !== void 0 && was !== null) for (const cb of this._onLock) cb();
+    return this._serial(() => this._lockNow());
   }
   async isUnlocked() {
-    return await this._read() !== null;
+    return this._serial(async () => await this._read() !== null);
   }
   /**
    * The DEK for one operation (zeroize it after). `locked` when there is none or the
@@ -536,17 +616,22 @@ var Session = class {
    * a missed alarm cannot keep the key alive.
    */
   async getKey() {
-    const record = await this._read();
-    if (!record) throw new VaultError("Wallet is locked.", "locked");
-    return fromBase64(record.key);
+    return this._serial(async () => {
+      const record = await this._read();
+      if (!record) throw new VaultError("Wallet is locked.", "locked");
+      return fromBase64(record.key);
+    });
   }
   /** User activity: push the auto-lock out again. No-op when locked. */
   async touch() {
-    const record = await this._read();
-    if (!record) return;
-    const expiresAt = this._expiry();
-    await this._storage.set(this._key, { ...record, expiresAt });
-    await this._arm(expiresAt);
+    return this._serial(async () => {
+      const epoch = this._epoch;
+      const record = await this._read();
+      if (!record || epoch !== this._epoch) return;
+      const expiresAt = this._expiry();
+      await this._storage.set(this._key, { ...record, expiresAt });
+      await this._arm(expiresAt);
+    });
   }
   get autoLockMs() {
     return this._autoLockMs;
@@ -561,6 +646,19 @@ var Session = class {
     this._onLock.add(callback);
     return () => this._onLock.delete(callback);
   }
+  _serial(fn) {
+    const run = this._queue.then(fn);
+    this._queue = run.catch(() => void 0);
+    return run;
+  }
+  /** The lock itself; callers are already in the queue. */
+  async _lockNow() {
+    this._epoch++;
+    const was = await this._storage.get(this._key);
+    await this._storage.remove(this._key);
+    await this._alarms.clear(this._alarm);
+    if (was !== void 0 && was !== null) for (const cb of this._onLock) cb();
+  }
   _expiry() {
     return this._autoLockMs > 0 ? this._now() + this._autoLockMs : Number.POSITIVE_INFINITY;
   }
@@ -572,7 +670,7 @@ var Session = class {
     const raw = await this._storage.get(this._key);
     if (!raw || typeof raw.key !== "string" || typeof raw.expiresAt !== "number") return null;
     if (raw.expiresAt <= this._now()) {
-      await this.lock();
+      await this._lockNow();
       return null;
     }
     return raw;
@@ -1219,6 +1317,7 @@ function memoryApprovalWindow() {
 }
 
 // src/router.ts
+var import_core4 = require("@anywalletkit/core");
 var RouterError = class _RouterError extends Error {
   code;
   data;
@@ -1232,11 +1331,35 @@ var RouterError = class _RouterError extends Error {
     return new _RouterError(e.code, e.message, e.data);
   }
 };
-function toRelayError(e) {
-  if (e instanceof RouterError) return e.data === void 0 ? { code: e.code, message: e.message } : { code: e.code, message: e.message, data: e.data };
-  if (e instanceof ReviewDeclined) return { code: e.code, message: e.message };
-  const code = typeof e?.code === "number" ? e.code : RELAY_ERRORS.internal;
-  return { code, message: e instanceof Error ? e.message : String(e) };
+var PROVIDER_CODES = /* @__PURE__ */ new Set([4001, 4100, 4200, 4900, 4901, 4902]);
+var isNodeCode = (code) => typeof code === "number" && Number.isInteger(code) && (code === 3 || code >= -32768 && code <= -32e3);
+var URL_RE = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>()]+/gi;
+var pageText = (text) => text.replace(URL_RE, "[url]").split("\n")[0].slice(0, 300);
+var isHexData = (v) => typeof v === "string" && /^0x[0-9a-fA-F]*$/.test(v) && v.length <= 2 + 2 * 8192;
+function nodeError(e) {
+  for (let cur = e, depth = 0; cur && typeof cur === "object" && depth < 8; cur = cur.cause, depth++) {
+    const o = cur;
+    if (o.name === "RpcRequestError" && isNodeCode(o.code)) {
+      const text = typeof o.details === "string" && o.details ? o.details : typeof o.shortMessage === "string" ? o.shortMessage : "RPC error";
+      return { code: o.code, message: pageText(text), ...isHexData(o.data) ? { data: o.data } : {} };
+    }
+  }
+  if (!(e instanceof Error) && typeof e === "object" && e !== null) {
+    const o = e;
+    if (isNodeCode(o.code) && typeof o.message === "string") return { code: o.code, message: pageText(o.message), ...isHexData(o.data) ? { data: o.data } : {} };
+  }
+  return void 0;
+}
+function toRelayError(e, options = {}) {
+  if (e instanceof RouterError) return e.data === void 0 ? { code: e.code, message: pageText(e.message) } : { code: e.code, message: pageText(e.message), data: e.data };
+  if (e instanceof ReviewDeclined) return { code: e.code, message: pageText(e.message) };
+  if (e instanceof import_core4.UserRejectedError) return { code: RELAY_ERRORS.userRejected, message: pageText(e.message) };
+  const node = nodeError(e);
+  if (node) return node;
+  const code = e?.code;
+  if (e instanceof Error && typeof code === "number" && PROVIDER_CODES.has(code)) return { code, message: pageText(e.message) };
+  options.log?.(e);
+  return { code: RELAY_ERRORS.internal, message: "Internal error" };
 }
 var READ_METHODS = /* @__PURE__ */ new Set([
   "eth_blockNumber",
@@ -1489,6 +1612,10 @@ function describeSiwe(text, ctx) {
 }
 
 // src/signing.ts
+var safeNonce = (n) => {
+  if (n < 0n || n > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`The RPC returned an impossible nonce (${n}).`);
+  return Number(n.toString());
+};
 var ADDRESS = /^0x[0-9a-fA-F]{40}$/;
 var HEX = /^0x([0-9a-fA-F]{2})*$/;
 var lc = (s) => s.toLowerCase();
@@ -1584,13 +1711,13 @@ async function prepareTransaction(deps, network, from, tx) {
   const base = block?.baseFeePerGas != null ? big(block.baseFeePerGas) : null;
   if (base === null) {
     const gasPrice = big(await deps.rpc(network, "eth_gasPrice", []));
-    return { chainId: network.chainId, nonce: Number(big(nonceHex)), gasLimit: hex(gasLimit), gasPrice: hex(gasPrice), maxFee: (gasLimit * gasPrice).toString() };
+    return { chainId: network.chainId, nonce: safeNonce(big(nonceHex)), gasLimit: hex(gasLimit), gasPrice: hex(gasPrice), maxFee: (gasLimit * gasPrice).toString() };
   }
   const floor = deps.tipFloor?.(network.chainId) ?? MIN_TIP_WEI;
   const nodeTip = await deps.rpc(network, "eth_maxPriorityFeePerGas", []).then(big).catch(() => 0n);
   const tip = nodeTip > floor ? nodeTip : floor;
   const maxFeePerGas = base * 2n + tip;
-  return { chainId: network.chainId, nonce: Number(big(nonceHex)), gasLimit: hex(gasLimit), maxFeePerGas: hex(maxFeePerGas), maxPriorityFeePerGas: hex(tip), maxFee: (gasLimit * maxFeePerGas).toString() };
+  return { chainId: network.chainId, nonce: safeNonce(big(nonceHex)), gasLimit: hex(gasLimit), maxFeePerGas: hex(maxFeePerGas), maxPriorityFeePerGas: hex(tip), maxFee: (gasLimit * maxFeePerGas).toString() };
 }
 function createSignHandler(deps) {
   return async ({ origin, network, method, params, accounts }) => {