@anywalletkit/extension-kit 0.3.6 → 0.4.0

package/dist/index.cjs

@@ -22,6 +22,8 @@ var src_exports = {};
 __export(src_exports, {
   ACTIVE_STATUSES: () => ACTIVE_STATUSES,
   APPROVALS_MAX_PENDING_PER_ORIGIN: () => APPROVALS_MAX_PENDING_PER_ORIGIN,
+  APPROVALS_MAX_PENDING_PER_SITE: () => APPROVALS_MAX_PENDING_PER_SITE,
+  APPROVALS_MAX_PENDING_TOTAL: () => APPROVALS_MAX_PENDING_TOTAL,
   ApprovalQueue: () => ApprovalQueue,
   BTC_CHAIN: () => BTC_CHAIN,
   BTC_ESPLORA: () => BTC_ESPLORA,
@@ -29,9 +31,12 @@ __export(src_exports, {
   DEFAULT_CHAIN: () => DEFAULT_CHAIN,
   DEFAULT_NETWORKS: () => DEFAULT_NETWORKS,
   FLOOR_TOLERANCE_BPS: () => FLOOR_TOLERANCE_BPS,
+  GETLOGS_MAX_SPAN_UNCONNECTED: () => GETLOGS_MAX_SPAN_UNCONNECTED,
   KEYRING_STORAGE_KEY: () => KEYRING_STORAGE_KEY,
   LOOKALIKE_PREFIX: () => LOOKALIKE_PREFIX,
   LOOKALIKE_SUFFIX: () => LOOKALIKE_SUFFIX,
+  MAX_FEE_REASKS: () => MAX_FEE_REASKS,
+  MULTI_LABEL_SUFFIXES: () => MULTI_LABEL_SUFFIXES,
   NEAR_CHAIN: () => NEAR_CHAIN,
   NEAR_PROVIDERS: () => NEAR_PROVIDERS,
   NON_EVM_CHAINS: () => NON_EVM_CHAINS,
@@ -52,8 +57,11 @@ __export(src_exports, {
   RouterError: () => RouterError,
   SESSION_DEFAULT_AUTOLOCK_MS: () => SESSION_DEFAULT_AUTOLOCK_MS,
   SIGNING_METHODS: () => SIGNING_METHODS,
+  SIWE_FORBIDDEN_CHARS: () => SIWE_FORBIDDEN_CHARS,
   SOLANA_CHAIN: () => SOLANA_CHAIN,
   SOLANA_RPCS: () => SOLANA_RPCS,
+  STORAGE_MAC_FIELD: () => STORAGE_MAC_FIELD,
+  STORAGE_VERSION_FIELD: () => STORAGE_VERSION_FIELD,
   Session: () => Session,
   SwapTracker: () => SwapTracker,
   SwapsStore: () => SwapsStore,
@@ -65,6 +73,7 @@ __export(src_exports, {
   TON_ENDPOINTS: () => TON_ENDPOINTS,
   TRON_CHAIN: () => TRON_CHAIN,
   TRON_PROVIDERS: () => TRON_PROVIDERS,
+  TokenBucket: () => TokenBucket,
   TonConnectError: () => import_tonconnect2.TonConnectError,
   VAULT_DEFAULT_ITERATIONS: () => VAULT_DEFAULT_ITERATIONS,
   VAULT_LIMITS: () => VAULT_LIMITS,
@@ -79,6 +88,7 @@ __export(src_exports, {
   ZCASH_CHAIN: () => ZCASH_CHAIN,
   approvalChallenge: () => approvalChallenge,
   caip2FromChainId: () => caip2FromChainId,
+  canonicalJson: () => canonicalJson,
   chainHex: () => chainHex,
   chainTxMatcher: () => chainTxMatcher,
   checkSenderOrigin: () => checkSenderOrigin,
@@ -91,6 +101,7 @@ __export(src_exports, {
   createSignHandler: () => createSignHandler,
   decodedMessage: () => decodedMessage,
   derToRaw: () => derToRaw,
+  deriveStorageMacKey: () => deriveStorageMacKey,
   describeSiwe: () => describeSiwe,
   earnApprovalPayload: () => earnApprovalPayload,
   earnPlanMatchers: () => earnPlanMatchers,
@@ -98,6 +109,7 @@ __export(src_exports, {
   evmCallMatcher: () => evmCallMatcher,
   executionFloor: () => executionFloor,
   fromBase64Url: () => fromBase64Url,
+  gasLimitExcessive: () => gasLimitExcessive,
   hostOf: () => hostOf,
   isCatalogChain: () => isCatalogChain,
   isEnvelopeV1: () => isEnvelopeV1,
@@ -111,6 +123,7 @@ __export(src_exports, {
   isRelayToContent: () => isRelayToContent,
   levenshtein: () => levenshtein,
   lookalikeOf: () => lookalikeOf,
+  macJsonStorage: () => macJsonStorage,
   memoryAlarms: () => memoryAlarms,
   memoryApprovalWindow: () => memoryApprovalWindow,
   memoryJsonStorage: () => memoryJsonStorage,
@@ -135,11 +148,15 @@ __export(src_exports, {
   rank: () => rank,
   rawToDer: () => rawToDer,
   relayError: () => relayError,
+  revealHidden: () => revealHidden,
   reviewEarnPlan: () => reviewEarnPlan,
   reviewSwapPlan: () => reviewSwapPlan,
   sameTonConnectAddress: () => import_tonconnect2.sameTonConnectAddress,
+  siteOf: () => siteOf,
+  siweCrossSite: () => siweCrossSite,
   siweProblems: () => siweProblems,
   stampOrigin: () => stampOrigin,
+  storageVersionLedger: () => storageVersionLedger,
   swapApprovalPayload: () => swapApprovalPayload,
   toBase64Url: () => toBase64Url,
   toRelayError: () => toRelayError,
@@ -291,7 +308,7 @@ var Vault = class {
     if (isEnvelopeV1(envelope)) {
       if (envelope.kdf.iterations < VAULT_MIN_ITERATIONS) throw new VaultError(`The vault's KDF (${envelope.kdf.iterations} iterations) is below the floor this build accepts.`, "weak-kdf");
       const kek2 = await this._derivePbkdf2(password, fromBase64(envelope.kdf.salt), envelope.kdf.iterations);
-      const dek = await this._open(kek2, envelope.dek, aadDekV1(envelope.kdf), "wrong-password");
+      const dek = await this._proveOwn(await this._open(kek2, envelope.dek, aadDekV1(envelope.kdf), "wrong-password"), envelope);
       if (this._kdf === "scrypt") {
         const next = await this._sealEnvelope(password, dek, envelope.secrets, [], envelope.createdAt);
         await this._write(isEnvelopeV2(next) ? { ...next, upgradedAt: Date.now() } : next);
@@ -300,7 +317,24 @@ var Vault = class {
     }
     if (!isStrongScrypt(envelope.kdf)) throw new VaultError(`The vault's scrypt cost (N=${envelope.kdf.N} r=${envelope.kdf.r} p=${envelope.kdf.p}) is below the floor this build accepts.`, "weak-kdf");
     const kek = await this._deriveScrypt(password, fromBase64(envelope.kdf.salt), envelope.kdf);
-    return this._open(kek, envelope.dek, aadDekV2(envelope.kdf), "wrong-password");
+    return this._proveOwn(await this._open(kek, envelope.dek, aadDekV2(envelope.kdf), "wrong-password"), envelope);
+  }
+  /**
+   * A DEK unwrapped from a dek / passkey box must be the key this vault's secrets are sealed under
+   * (audit 2026-11-09 E21): a box spliced in from another vault, under another password or passkey,
+   * opens with that password but holds a foreign key. Proven with the DEK check, or — in an envelope
+   * written before it — the first secret; an old empty envelope has nothing to prove it with. Returns
+   * `dek`; on a mismatch zeroizes it and fails as `wrong-password` (the same failure as tampering).
+   */
+  async _proveOwn(dek, envelope) {
+    if (envelope.dekCheck === void 0 && Object.keys(envelope.secrets).length === 0) return dek;
+    try {
+      await this._requireDek(dek, envelope);
+      return dek;
+    } catch {
+      (0, import_core.zeroize)(dek);
+      throw new VaultError("Wrong password.", "wrong-password");
+    }
   }
   /**
    * Re-wrap the DEK under a new password (fresh salt, current KDF). Secrets and passkeys are untouched —
@@ -332,9 +366,13 @@ var Vault = class {
    *
    * Passkeys are dropped — their boxes hold the old DEK and cannot be re-wrapped without their PRF
    * output — and must be registered again ({@link Vault.addPasskey} with the new DEK).
+   *
+   * With `newPassword` this is also the password change: the new DEK is wrapped under `newPassword`
+   * (at least {@link VAULT_MIN_PASSWORD_LENGTH} characters), and `password` must be the current one.
    */
-  async rotateVaultKey(password) {
+  async rotateVaultKey(password, newPassword) {
     requirePassword(password);
+    if (newPassword !== void 0) requirePassword(newPassword, VAULT_MIN_PASSWORD_LENGTH);
     return this._exclusive(async () => {
       const oldDek = await this._unlock(password);
       const dek = this._random(DEK_BYTES);
@@ -350,7 +388,7 @@ var Vault = class {
             (0, import_core.zeroize)(plaintext);
           }
         }
-        const next = await this._sealEnvelope(password, dek, secrets, [], envelope.createdAt);
+        const next = await this._sealEnvelope(newPassword ?? password, dek, secrets, [], envelope.createdAt);
         const upgradedAt = isEnvelopeV2(envelope) ? envelope.upgradedAt : void 0;
         await this._write(isEnvelopeV2(next) ? { ...next, ...upgradedAt !== void 0 ? { upgradedAt } : {}, rotatedAt: Date.now() } : next);
         return dek;
@@ -414,7 +452,7 @@ var Vault = class {
       const entry = envelope.passkeys.find((p) => p.id === id);
       if (!entry) throw new VaultError("No such passkey on this vault.", "missing");
       const key = await this._derivePasskeyKek(prf, id);
-      return await this._open(key, entry.dek, aadPasskey(id), "wrong-password");
+      return await this._proveOwn(await this._open(key, entry.dek, aadPasskey(id), "wrong-password"), envelope);
     } finally {
       (0, import_core.zeroize)(prf);
     }
@@ -709,7 +747,11 @@ var Session = class {
       return fromBase64(record.key);
     });
   }
-  /** User activity: push the auto-lock out again. No-op when locked. */
+  /**
+   * User activity: push the auto-lock out again. No-op when locked. Call it for explicit user
+   * gestures only (unlock, send, approve / decline, an action in the wallet's own UI) — not for
+   * passive polls, page requests or worker restarts, or the timer never runs out.
+   */
   async touch() {
     return this._serial(async () => {
       const epoch = this._epoch;
@@ -723,11 +765,25 @@ var Session = class {
   get autoLockMs() {
     return this._autoLockMs;
   }
-  /** Change the timer (options page); re-arms from now when unlocked. 0 disables. */
+  /**
+   * Set the timer period (0 disables). Never pushes the deadline out — call this at every worker
+   * start with the stored setting: it re-arms the alarm at the stored deadline (a restart must not
+   * count as activity, audit 2026-11-09 E11), and only brings the deadline forward when the new
+   * period ends sooner. A longer period (or 0) applies from the next {@link Session.touch} /
+   * {@link Session.unlock}; call `touch()` right after when the user changed it explicitly.
+   */
   async setAutoLockMs(ms) {
     if (!Number.isFinite(ms) || ms < 0) throw new VaultError("Auto-lock must be a non-negative number of milliseconds.", "invalid-input");
     this._autoLockMs = ms;
-    await this.touch();
+    return this._serial(async () => {
+      const epoch = this._epoch;
+      const record = await this._read();
+      if (!record || epoch !== this._epoch) return;
+      const cap = this._expiry();
+      const expiresAt = cap !== null && (record.expiresAt === null || cap < record.expiresAt) ? cap : record.expiresAt;
+      if (expiresAt !== record.expiresAt) await this._storage.set(this._key, { ...record, expiresAt });
+      await this._arm(expiresAt);
+    });
   }
   onLock(callback) {
     this._onLock.add(callback);
@@ -997,7 +1053,8 @@ var DEFAULT_NETWORKS = Object.freeze([
   net(4326, "MegaETH", "ETH", ["https://mainnet.megaeth.com/rpc"]),
   net(130, "Unichain", "ETH", ["https://mainnet.unichain.org", "https://unichain-rpc.publicnode.com"], "https://uniscan.xyz"),
   net(143, "Monad", "MON", ["https://rpc.monad.xyz"]),
-  net(9745, "Plasma", "XPL", ["https://rpc.plasma.to"]),
+  // Second operator (Tenderly's public gateway, keyless): rpc.plasma.to alone cannot satisfy a two-operator check.
+  net(9745, "Plasma", "XPL", ["https://rpc.plasma.to", "https://plasma.gateway.tenderly.co"]),
   net(59144, "Linea", "ETH", ["https://rpc.linea.build", "https://linea-rpc.publicnode.com"], "https://lineascan.build"),
   net(100, "Gnosis", "xDAI", ["https://rpc.gnosischain.com", "https://gnosis-rpc.publicnode.com"], "https://gnosisscan.io"),
   net(146, "Sonic", "S", ["https://rpc.soniclabs.com", "https://sonic-rpc.publicnode.com"], "https://sonicscan.org"),
@@ -1015,7 +1072,11 @@ var DEFAULT_NETWORKS = Object.freeze([
   net(5e3, "Mantle", "MNT", ["https://rpc.mantle.xyz", "https://mantle-rpc.publicnode.com"], "https://mantlescan.xyz"),
   net(747474, "Katana", "ETH", ["https://rpc.katana.network"], "https://explorer.katanarpc.com"),
   net(2818, "Morph", "ETH", ["https://rpc.morphl2.io", "https://rpc-quicknode.morphl2.io"], "https://explorer.morphl2.io"),
-  net(14, "Flare", "FLR", ["https://flare-api.flare.network/ext/C/rpc", "https://flare.rpc.thirdweb.com"], "https://flare-explorer.flare.network")
+  net(14, "Flare", "FLR", ["https://flare-api.flare.network/ext/C/rpc", "https://flare.rpc.thirdweb.com"], "https://flare-explorer.flare.network"),
+  // Elysium by Kinetiq (chain 99901, HYPE gas; Arbitrum Orbit on HyperEVM) — public RPC and explorer checked 2026-11-10.
+  // The explorer value is the link base (<root>/tx/<hash>, <root>/address/<a>), not LI.FI's blockExplorerUrls
+  // https://elysium.kinetiq.xyz/explorer/ (the overview page; the bare root is the Elysium site home).
+  net(99901, "Elysium", "HYPE", ["https://rpc.elysium.kinetiq.xyz"], "https://elysium.kinetiq.xyz")
 ]);
 var chainHex = (caip2) => `0x${Number(caip2.split(":")[1]).toString(16)}`;
 function caip2FromChainId(value) {
@@ -1091,6 +1152,17 @@ var NetworksTable = class {
     );
     return this._loading;
   }
+  /**
+   * Forget the cached table: the next read asks storage again. For a storage whose answer changes under
+   * the table — e.g. one that only hands out the user's networks once the wallet is unlocked.
+   */
+  reload() {
+    return this.serialize(async () => {
+      await this._loading?.catch(() => void 0);
+      this._custom = null;
+      this._loading = null;
+    });
+  }
 };
 var isSiteRpcUrl = (u) => typeof u === "string" && u.length <= 2048 && (0, import_url.isPublicHttpsUrl)(u);
 function parseAddChainParams(params, known = isCatalogChain) {
@@ -1204,6 +1276,21 @@ var PermissionStore = class {
       return permission;
     });
   }
+  /**
+   * Add EVM accounts to an origin's grant (per-site grants): the new ones first, the ones it already
+   * holds stay. The chain stays the origin's own when it has one. Used by the router's connect; `connect`
+   * replaces the list instead.
+   */
+  grant(origin, accounts, chain) {
+    return this.serialize(async () => {
+      if (accounts.length === 0) throw new Error("Connect at least one account.");
+      const current = await this.get(origin);
+      const merged = [...accounts, ...(current?.accounts ?? []).filter((a) => !accounts.some((x) => x.toLowerCase() === a.toLowerCase()))];
+      const permission = { ...current ?? {}, origin, accounts: merged, chain: current?.chain ?? chain, connectedAt: current?.connectedAt ?? Date.now() };
+      await this.write(origin, permission);
+      return permission;
+    });
+  }
   /** Connect another chain's accounts to the same origin (one "connected sites" list). */
   connectChain(origin, key, accounts, defaultChain) {
     return this.serialize(async () => {
@@ -1236,6 +1323,11 @@ var PermissionStore = class {
     });
   }
   /**
+   * @deprecated Rewrites every origin's grant to the active account, which shows that account to sites
+   * the user never connected it to (and links accounts across sites). Grants are per site now: the
+   * router shows an origin its granted accounts that are also active, and connecting another account
+   * adds it to that one origin ({@link grant}). Kept for compatibility; nothing in this package calls it.
+   *
    * The active EVM account changed: every origin holding an EVM grant now sees `accounts` (MetaMask behaviour).
    * An origin connected only on another chain (`accounts: []` — Solana/TON/Tron/BTC/NEAR providers, a WalletConnect
    * session without eip155) is skipped: it never passed an EVM connect and must not learn the EVM address (scan F6/F8).
@@ -1281,6 +1373,179 @@ var PermissionStore = class {
 };
 var sameList = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
 
+// src/site.ts
+var MULTI_LABEL_SUFFIXES = /* @__PURE__ */ new Set([
+  // country second-level registries
+  "co.uk",
+  "org.uk",
+  "me.uk",
+  "ltd.uk",
+  "plc.uk",
+  "net.uk",
+  "ac.uk",
+  "gov.uk",
+  "com.au",
+  "net.au",
+  "org.au",
+  "edu.au",
+  "gov.au",
+  "id.au",
+  "co.nz",
+  "org.nz",
+  "net.nz",
+  "co.jp",
+  "ne.jp",
+  "or.jp",
+  "ac.jp",
+  "go.jp",
+  "co.kr",
+  "or.kr",
+  "ne.kr",
+  "com.br",
+  "net.br",
+  "org.br",
+  "com.cn",
+  "net.cn",
+  "org.cn",
+  "com.hk",
+  "com.tw",
+  "com.sg",
+  "com.my",
+  "co.in",
+  "net.in",
+  "org.in",
+  "co.id",
+  "co.il",
+  "co.th",
+  "co.za",
+  "com.mx",
+  "com.ar",
+  "com.co",
+  "com.tr",
+  "com.ua",
+  "com.pl",
+  "com.ru",
+  "com.vn",
+  "com.ph",
+  "com.pk",
+  "com.ng",
+  "com.eg",
+  "com.sa",
+  "co.ke",
+  // hosting platforms: every customer gets its own subdomain
+  "github.io",
+  "gitlab.io",
+  "vercel.app",
+  "now.sh",
+  "pages.dev",
+  "workers.dev",
+  "r2.dev",
+  "netlify.app",
+  "netlify.com",
+  "herokuapp.com",
+  "web.app",
+  "firebaseapp.com",
+  "appspot.com",
+  "azurewebsites.net",
+  "azurestaticapps.net",
+  "cloudfront.net",
+  "amplifyapp.com",
+  "onrender.com",
+  "fly.dev",
+  "railway.app",
+  "up.railway.app",
+  "deno.dev",
+  "glitch.me",
+  "repl.co",
+  "replit.app",
+  "replit.dev",
+  "surge.sh",
+  "webflow.io",
+  "framer.app",
+  "framer.website",
+  "wixsite.com",
+  "blogspot.com",
+  "myshopify.com",
+  "notion.site",
+  "carrd.co",
+  "gitbook.io",
+  "readthedocs.io",
+  "ngrok.io",
+  "ngrok-free.app",
+  "loca.lt",
+  "trycloudflare.com",
+  // ENS / IPFS gateways: every name or CID is its own site
+  "eth.limo",
+  "eth.link",
+  "ipfs.dweb.link",
+  "ipns.dweb.link",
+  "ipfs.w3s.link",
+  "ipfs.cf-ipfs.com"
+]);
+var IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
+function siteOf(origin) {
+  let host;
+  try {
+    const url = new URL(origin);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return origin;
+    host = url.hostname.toLowerCase().replace(/\.$/, "");
+  } catch {
+    return origin;
+  }
+  if (!host || host.startsWith("[") || host.includes(":") || IPV4.test(host)) return host || origin;
+  const labels = host.split(".");
+  if (labels.length <= 2) return host;
+  for (const size of [3, 2]) {
+    if (labels.length <= size) continue;
+    if (MULTI_LABEL_SUFFIXES.has(labels.slice(-size).join("."))) return labels.slice(-(size + 1)).join(".");
+  }
+  return labels.slice(-2).join(".");
+}
+var TokenBucket = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  buckets = /* @__PURE__ */ new Map();
+  take(key, cost = 1) {
+    const now = (this.options.now ?? Date.now)();
+    const b = this.refill(key, now);
+    if (b.tokens < cost) return false;
+    b.tokens -= cost;
+    return true;
+  }
+  /** Tokens `key` holds right now (full for an unknown key). */
+  available(key) {
+    return this.refill(key, (this.options.now ?? Date.now)()).tokens;
+  }
+  refill(key, now) {
+    let b = this.buckets.get(key);
+    if (!b) {
+      if (this.buckets.size >= (this.options.maxKeys ?? 2e3)) this.prune(now);
+      b = { tokens: this.options.capacity, at: now };
+      this.buckets.set(key, b);
+      return b;
+    }
+    const elapsed = Math.max(0, now - b.at) / 1e3;
+    b.tokens = Math.min(this.options.capacity, b.tokens + elapsed * this.options.refillPerSecond);
+    b.at = now;
+    return b;
+  }
+  /** Drop buckets that are full again (they carry no state); the oldest half when every one is in use. */
+  prune(now) {
+    for (const [k, b] of this.buckets) {
+      if (b.tokens + Math.max(0, now - b.at) / 1e3 * this.options.refillPerSecond >= this.options.capacity) this.buckets.delete(k);
+    }
+    if (this.buckets.size >= (this.options.maxKeys ?? 2e3)) {
+      let drop = Math.ceil(this.buckets.size / 2);
+      for (const k of this.buckets.keys()) {
+        if (drop-- <= 0) break;
+        this.buckets.delete(k);
+      }
+    }
+  }
+};
+
 // src/approvals.ts
 var ReviewDeclined = class extends Error {
   code = RELAY_ERRORS.userRejected;
@@ -1305,7 +1570,11 @@ var OriginRefused = class extends Error {
   }
 };
 var APPROVALS_MAX_PENDING_PER_ORIGIN = 3;
-var ApprovalQueue = class {
+var APPROVALS_MAX_PENDING_PER_SITE = 5;
+var APPROVALS_MAX_PENDING_TOTAL = 20;
+var FOLLOW_UP_CREDITS_MAX = 8;
+var FOLLOW_UP_KEYS_MAX = 256;
+var ApprovalQueue = class _ApprovalQueue {
   constructor(window, newId = () => crypto.randomUUID(), options = {}) {
     this.window = window;
     this.newId = newId;
@@ -1313,6 +1582,8 @@ var ApprovalQueue = class {
     window.onClosed((id) => {
       if (this._current?.request.id === id) this.decline(id);
     });
+    const rate = options.openRate === false ? null : options.openRate ?? {};
+    this._rate = rate ? new TokenBucket({ capacity: rate.burst ?? 10, refillPerSecond: rate.refillPerSecond ?? 1 / 6, ...options.now ? { now: options.now } : {} }) : null;
   }
   window;
   newId;
@@ -1321,8 +1592,62 @@ var ApprovalQueue = class {
   _waiting = [];
   _listeners = /* @__PURE__ */ new Set();
   _via = /* @__PURE__ */ new Map();
+  _rate;
+  /** Per site: cooldown end and strikes (how many times the bucket ran dry recently). */
+  _cooldown = /* @__PURE__ */ new Map();
+  /** Per origin + kind + chain: approvals that have not been followed up (see {@link ApprovalRequestOptions.followUp}). */
+  _approved = /* @__PURE__ */ new Map();
+  site(origin) {
+    try {
+      return (this.options.siteOf ?? siteOf)(origin);
+    } catch {
+      return origin;
+    }
+  }
+  get all() {
+    return [...this._current ? [this._current] : [], ...this._waiting];
+  }
+  /** The per-site rate: a reason to refuse, or null (and one token spent). */
+  rateRefusal(site) {
+    if (!this._rate) return null;
+    const rate = this.options.openRate || {};
+    const now = (this.options.now ?? Date.now)();
+    const max = rate.maxBackoffMs ?? 6e5;
+    const c = this._cooldown.get(site);
+    if (c && now < c.until) return `This site opened too many requests; try again in ${Math.ceil((c.until - now) / 1e3)} s.`;
+    if (this._rate.take(site)) return null;
+    const strikes = c && now - c.last < max ? c.strikes + 1 : 1;
+    const wait = Math.min(max, (rate.backoffMs ?? 3e4) * 2 ** (strikes - 1));
+    this._cooldown.set(site, { until: now + wait, strikes, last: now });
+    if (this._cooldown.size > 1e3) {
+      for (const [k, v] of this._cooldown) if (now - v.last >= max) this._cooldown.delete(k);
+    }
+    return `This site opened too many requests; try again in ${Math.ceil(wait / 1e3)} s.`;
+  }
+  static followUpKey(r) {
+    return `${r.origin}
+${r.kind}
+${r.chain}`;
+  }
+  /** The user approved `r`: it may be followed up once. */
+  approved(r) {
+    const key = _ApprovalQueue.followUpKey(r);
+    const n = Math.min((this._approved.get(key) ?? 0) + 1, FOLLOW_UP_CREDITS_MAX);
+    this._approved.delete(key);
+    this._approved.set(key, n);
+    if (this._approved.size > FOLLOW_UP_KEYS_MAX) this._approved.delete(this._approved.keys().next().value);
+  }
+  /** Spends one approval of the same origin, kind and chain; false when there is none. */
+  spendApproval(r) {
+    const key = _ApprovalQueue.followUpKey(r);
+    const n = this._approved.get(key) ?? 0;
+    if (n <= 0) return false;
+    if (n === 1) this._approved.delete(key);
+    else this._approved.set(key, n - 1);
+    return true;
+  }
   /** Enqueue and wait for the user's answer. Refuses (never queues) past the per-origin limits. */
-  request(input) {
+  request(input, opts = {}) {
     let refused;
     try {
       refused = this.options.refuse?.(input.origin);
@@ -1330,19 +1655,41 @@ var ApprovalQueue = class {
       refused = `The wallet could not check this site (${e instanceof Error ? e.message : String(e)}).`;
     }
     if (refused) return Promise.reject(new OriginRefused(refused));
-    const sameOrigin = [...this._current ? [this._current] : [], ...this._waiting].filter((p) => p.request.origin === input.origin);
-    if (input.kind === "connect" && sameOrigin.some((p) => p.request.kind === "connect")) {
-      return Promise.reject(new QueueLimitError(RELAY_ERRORS.resourceUnavailable, "A connect request from this site is already waiting for your answer."));
+    let exempt = false;
+    try {
+      exempt = this.options.exempt?.(input.origin) === true;
+    } catch {
+      exempt = false;
     }
-    const max = this.options.maxPendingPerOrigin ?? APPROVALS_MAX_PENDING_PER_ORIGIN;
-    if (sameOrigin.length >= max) {
-      return Promise.reject(new QueueLimitError(RELAY_ERRORS.limitExceeded, `This site already has ${max} requests waiting for you; answer or close them first.`));
+    const followUp = opts.followUp === true && this.spendApproval(input);
+    if (!exempt && !followUp) {
+      const all = this.all;
+      const sameOrigin = all.filter((p) => p.request.origin === input.origin);
+      if (input.kind === "connect" && sameOrigin.some((p) => p.request.kind === "connect")) {
+        return Promise.reject(new QueueLimitError(RELAY_ERRORS.resourceUnavailable, "A connect request from this site is already waiting for your answer."));
+      }
+      const max = this.options.maxPendingPerOrigin ?? APPROVALS_MAX_PENDING_PER_ORIGIN;
+      if (sameOrigin.length >= max) {
+        return Promise.reject(new QueueLimitError(RELAY_ERRORS.limitExceeded, `This site already has ${max} requests waiting for you; answer or close them first.`));
+      }
+      const site = this.site(input.origin);
+      const maxSite = this.options.maxPendingPerSite ?? APPROVALS_MAX_PENDING_PER_SITE;
+      if (all.filter((p) => this.site(p.request.origin) === site).length >= maxSite) {
+        return Promise.reject(new QueueLimitError(RELAY_ERRORS.limitExceeded, `This site already has ${maxSite} requests waiting for you across its subdomains; answer or close them first.`));
+      }
+      const maxTotal = this.options.maxPendingTotal ?? APPROVALS_MAX_PENDING_TOTAL;
+      if (all.filter((p) => !this.isExempt(p.request.origin)).length >= maxTotal) {
+        return Promise.reject(new QueueLimitError(RELAY_ERRORS.limitExceeded, `The wallet already has ${maxTotal} requests waiting for you; answer or close them first.`));
+      }
+      const slow = this.rateRefusal(site);
+      if (slow) return Promise.reject(new QueueLimitError(RELAY_ERRORS.limitExceeded, slow));
     }
     return new Promise((resolve, reject) => {
       const warnings = this.options.annotate?.(input.origin) ?? [];
       const via = this._via.get(input.origin);
       const pending = { request: { ...input, id: this.newId(), createdAt: Date.now(), ...warnings.length ? { originWarnings: warnings } : {}, ...via ? { via } : {} }, resolve, reject };
-      this._waiting.push(pending);
+      if (followUp) this._waiting.unshift(pending);
+      else this._waiting.push(pending);
       void this.next();
     });
   }
@@ -1355,9 +1702,37 @@ var ApprovalQueue = class {
   viaFor(origin) {
     return this._via.get(origin);
   }
+  isExempt(origin) {
+    try {
+      return this.options.exempt?.(origin) === true;
+    } catch {
+      return false;
+    }
+  }
   /** Requests waiting for `origin` (current + queued). */
   pendingFor(origin) {
-    return [...this._current ? [this._current] : [], ...this._waiting].filter((p) => p.request.origin === origin).length;
+    return this.all.filter((p) => p.request.origin === origin).length;
+  }
+  /** Requests waiting for any origin of `site` (current + queued). */
+  pendingForSite(site) {
+    return this.all.filter((p) => this.site(p.request.origin) === site).length;
+  }
+  /** The site (registrable domain) the queue's limits put `origin` under. */
+  siteFor(origin) {
+    return this.site(origin);
+  }
+  /** Decline everything waiting for `origin` (its last page closed). Returns how many requests were declined. */
+  declineOrigin(origin, error = new ReviewDeclined("The page was closed \u2014 nothing was signed.")) {
+    return this.declineWhere((p) => p.request.origin === origin, error);
+  }
+  /** "Decline all from this site": everything waiting for any origin of `site` (see {@link siteFor}). */
+  declineSite(site, error = new ReviewDeclined()) {
+    return this.declineWhere((p) => this.site(p.request.origin) === site, error);
+  }
+  declineWhere(match, error) {
+    const ids = [...this._waiting.filter(match), ...this._current && match(this._current) ? [this._current] : []].map((p) => p.request.id);
+    for (const id of ids) this.decline(id, error);
+    return ids.length;
   }
   /** The request currently shown (the window asks for it by id on load). */
   get current() {
@@ -1367,7 +1742,10 @@ var ApprovalQueue = class {
     return this._waiting.length;
   }
   resolve(requestId, value) {
-    return this.settle(requestId, (p) => p.resolve(value));
+    return this.settle(requestId, (p) => {
+      this.approved(p.request);
+      p.resolve(value);
+    });
   }
   decline(requestId, error = new ReviewDeclined()) {
     return this.settle(requestId, (p) => p.reject(error));
@@ -1375,6 +1753,7 @@ var ApprovalQueue = class {
   /** Lock, disconnect, shutdown: everything pending is declined. */
   declineAll(error = new ReviewDeclined("The wallet was locked.")) {
     const all = [...this._current ? [this._current] : [], ...this._waiting.splice(0)];
+    this._approved.clear();
     for (const p of all) p.reject(error);
     if (this._current) void this.window.close(this._current.request.id);
     this._current = null;
@@ -1506,6 +1885,7 @@ var READ_METHODS = /* @__PURE__ */ new Set([
   "eth_getTransactionReceipt",
   "eth_maxPriorityFeePerGas"
 ]);
+var GETLOGS_MAX_SPAN_UNCONNECTED = 1e3;
 var SIGNING_METHODS = /* @__PURE__ */ new Set(["personal_sign", "eth_signTypedData_v4", "eth_signTypedData_v3", "eth_signTypedData", "eth_sendTransaction"]);
 var RequestRouter = class {
   constructor(deps) {
@@ -1535,8 +1915,10 @@ var RequestRouter = class {
         return this.visibleAccounts(permission);
       case "eth_requestAccounts":
         return this.connect(origin, network);
-      case "wallet_getPermissions":
-        return permission && permission.accounts.length > 0 ? [permissionDescriptor(origin, permission.accounts)] : [];
+      case "wallet_getPermissions": {
+        const visible = await this.visibleAccounts(permission);
+        return visible.length > 0 ? [permissionDescriptor(origin, visible)] : [];
+      }
       case "wallet_requestPermissions": {
         const accounts = await this.connect(origin, network);
         return [permissionDescriptor(origin, accounts)];
@@ -1577,11 +1959,20 @@ var RequestRouter = class {
       case "eth_signTransaction":
         throw new RouterError(RELAY_ERRORS.unsupportedMethod, `${method} (blind signing) is never offered by this wallet.`);
     }
-    if (READ_METHODS.has(method)) return this.deps.rpc(network, method, params);
+    if (READ_METHODS.has(method)) {
+      if (method === "eth_getLogs" && !(permission && permission.accounts.length > 0)) await this.boundLogs(network, params);
+      return this.deps.rpc(network, method, params);
+    }
     if (SIGNING_METHODS.has(method)) {
       if (!this.deps.sign) throw new RouterError(RELAY_ERRORS.unsupportedMethod, `${method} is not available yet.`);
-      if (!permission) throw new RouterError(RELAY_ERRORS.unauthorized, "Connect the wallet first (eth_requestAccounts).");
-      return this.deps.sign({ origin, network, method, params, accounts: permission.accounts });
+      if (!permission || permission.accounts.length === 0) throw new RouterError(RELAY_ERRORS.unauthorized, "Connect the wallet first (eth_requestAccounts).");
+      const visible = await this.visibleAccounts(permission);
+      const named = namedAccount(method, params);
+      const inactive = named !== void 0 && permission.accounts.some((a) => a.toLowerCase() === named.toLowerCase()) && !visible.some((a) => a.toLowerCase() === named.toLowerCase());
+      if (visible.length === 0 || inactive) {
+        throw new RouterError(RELAY_ERRORS.unauthorized, "The account this site asks for is not the wallet's active account (or the wallet is locked). Switch to it in the wallet, or connect the active account (eth_requestAccounts).");
+      }
+      return this.deps.sign({ origin, network, method, params, accounts: visible });
     }
     throw new RouterError(RELAY_ERRORS.unsupportedMethod, `This wallet does not support ${method}.`);
   }
@@ -1591,9 +1982,31 @@ var RequestRouter = class {
     const available = await this.deps.accounts();
     return permission.accounts.filter((a) => available.includes(a));
   }
+  /** An unconnected origin's `eth_getLogs`: a block hash, or a range of at most {@link GETLOGS_MAX_SPAN_UNCONNECTED} blocks. */
+  async boundLogs(network, params) {
+    const filter = params[0] ?? {};
+    if (typeof filter !== "object" || filter === null) throw new RouterError(RELAY_ERRORS.invalidParams, "eth_getLogs expects a filter object.");
+    if (filter.blockHash !== void 0 && filter.blockHash !== null) return;
+    let head;
+    const block = async (tag) => {
+      if (tag === void 0 || tag === null || tag === "latest" || tag === "pending" || tag === "safe" || tag === "finalized") {
+        head ??= BigInt(String(await this.deps.rpc(network, "eth_blockNumber", [])));
+        return head;
+      }
+      if (tag === "earliest") return 0n;
+      if (typeof tag === "string" && /^0x[0-9a-fA-F]{1,16}$/.test(tag)) return BigInt(tag);
+      throw new RouterError(RELAY_ERRORS.invalidParams, "eth_getLogs: fromBlock / toBlock must be a block tag or a hex block number.");
+    };
+    const from = await block(filter.fromBlock);
+    const to = await block(filter.toBlock);
+    if (to - from > BigInt(GETLOGS_MAX_SPAN_UNCONNECTED)) {
+      throw new RouterError(RELAY_ERRORS.limitExceeded, `eth_getLogs over more than ${GETLOGS_MAX_SPAN_UNCONNECTED} blocks is answered for connected sites only; narrow the range or connect the wallet.`);
+    }
+  }
   /**
    * Connected and unlocked → the accounts; otherwise the approval window (which
-   * unlocks first when needed) picks them. Emits `connect` + `accountsChanged`.
+   * unlocks first when needed) picks them, and they are ADDED to this origin's
+   * grant (other origins are untouched). Emits `connect` + `accountsChanged`.
    */
   async connect(origin, network) {
     const existing = await this.visibleAccounts(await this.deps.permissions.get(origin));
@@ -1602,7 +2015,7 @@ var RequestRouter = class {
     const available = await this.deps.accounts();
     const accounts = Array.isArray(chosen) ? chosen.filter((a) => typeof a === "string" && available.includes(a)) : [];
     if (accounts.length === 0) throw new ReviewDeclined("No account was selected.");
-    await this.deps.permissions.connect(origin, accounts, network.caip2);
+    await this.deps.permissions.grant(origin, accounts, network.caip2);
     this.deps.emit(origin, "connect", { chainId: chainHex(network.caip2) });
     this.deps.emit(origin, "accountsChanged", accounts);
     return accounts;
@@ -1622,6 +2035,12 @@ var RequestRouter = class {
     this.deps.emit(origin, "chainChanged", chainHex(to.caip2));
   }
 };
+function namedAccount(method, params) {
+  const addr = (x) => typeof x === "string" && /^0x[0-9a-fA-F]{40}$/.test(x) ? x : void 0;
+  if (method === "personal_sign") return addr(params[1]) ?? addr(params[0]);
+  if (method === "eth_sendTransaction") return addr(params[0]?.from);
+  return addr(params[0]);
+}
 var permissionDescriptor = (origin, accounts) => ({
   id: crypto.randomUUID(),
   parentCapability: "eth_accounts",
@@ -1631,6 +2050,7 @@ var permissionDescriptor = (origin, accounts) => ({
 });
 
 // src/siwe.ts
+var SIWE_FORBIDDEN_CHARS = /[\u061c\u200b-\u200f\u202a-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/;
 var HEADER_LINE = /^(?<domain>[^\n]+?) wants you to sign in with your Ethereum account:(?:\n|$)/;
 var ADDRESS_LINE = /^0x[0-9a-fA-F]{40}$/;
 var FIELD = /^([A-Za-z ]+): (.*)$/;
@@ -1734,12 +2154,20 @@ function siweProblems(m, ctx) {
   }
   return out;
 }
+function siweCrossSite(m, ctx) {
+  const site = originWhere(ctx.origin) ?? (ctx.via?.verify === "VALID" && !ctx.via.scam ? whereOf(ctx.via.url) : null);
+  if (!site) return null;
+  const domain = whereOf(m.domain);
+  return !domain || domain.host !== site.host ? { domain: m.domain, origin: `${site.scheme}://${site.host}` } : null;
+}
 function describeSiwe(text, ctx) {
   const p = parseLoose(text);
   if (!p) return null;
   const problems = siweProblems(p.message, ctx);
-  if (p.missing.length === 0) return { message: p.message, problems };
-  return { message: p.message, problems: [`This is a malformed sign-in message (EIP-4361): ${p.missing.join(", ")} missing or unreadable \u2014 check the site before signing.`, ...problems], malformed: true };
+  const cross = siweCrossSite(p.message, ctx);
+  const crossSite = cross ? { crossSite: cross } : {};
+  if (p.missing.length === 0) return { message: p.message, problems, ...crossSite };
+  return { message: p.message, problems: [`This is a malformed sign-in message (EIP-4361): ${p.missing.join(", ")} missing or unreadable \u2014 check the site before signing.`, ...problems], malformed: true, ...crossSite };
 }
 
 // src/signing.ts
@@ -1747,18 +2175,31 @@ var safeNonce = (n) => {
   if (n < 0n || n > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`The RPC returned an impossible nonce (${n}).`);
   return Number(n.toString());
 };
+var MAX_FEE_REASKS = 3;
 var ADDRESS = /^0x[0-9a-fA-F]{40}$/;
 var HEX = /^0x([0-9a-fA-F]{2})*$/;
 var lc = (s) => s.toLowerCase();
+var INVISIBLE = /[\p{Cf}\u2028\u2029\u115f\u1160\u3164\uffa0\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/gu;
+function revealHidden(text) {
+  let hidden = false;
+  const out = text.replace(INVISIBLE, (c) => {
+    hidden = true;
+    return `\u27E8U+${c.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}\u27E9`;
+  });
+  return { text: out, hidden };
+}
 function messageText(value) {
-  if (typeof value !== "string") return "";
-  if (!HEX.test(value)) return value;
+  return shownMessage(value).text;
+}
+function shownMessage(value) {
+  if (typeof value !== "string") return { text: "", hidden: false };
+  if (!HEX.test(value)) return revealHidden(value);
   try {
     const bytes = Uint8Array.from(value.slice(2).match(/../g) ?? [], (b) => Number.parseInt(b, 16));
     const s = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-    return /^[\x09\x0a\x0d\x20-\x7e -￿]*$/.test(s) ? s : value;
+    return /^[\x09\x0a\x0d\x20-\x7e\u00a0-\uffff]*$/.test(s) ? revealHidden(s) : { text: value, hidden: false };
   } catch {
-    return value;
+    return { text: value, hidden: false };
   }
 }
 function decodedMessage(value) {
@@ -1772,6 +2213,7 @@ function decodedMessage(value) {
 }
 var HIDDEN_CONTROL = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/;
 var err = (code, message) => ({ code, message });
+var BLIND_HASH = /^0x[0-9a-fA-F]{64}$/;
 function classifySignRequest(input) {
   const { method, params } = input;
   const owned = new Set(input.accounts.map(lc));
@@ -1782,11 +2224,15 @@ function classifySignRequest(input) {
     if (ours(msg) && !ours(addr)) [msg, addr] = [addr, msg];
     if (!ours(addr)) return err(RELAY_ERRORS.unauthorized, "personal_sign for an address this wallet does not hold.");
     if (typeof msg !== "string") return err(RELAY_ERRORS.invalidParams, "personal_sign expects a message string.");
-    const text = messageText(msg);
+    const blindHash = BLIND_HASH.test(msg);
+    if (blindHash && !input.allowBlindHash) return err(RELAY_ERRORS.unsupportedMethod, 'This site asks you to sign a raw 32-byte hash (blind signing). It can be a swap order or a transfer (e.g. CoW Protocol) paying someone else, so this wallet refuses it. "Allow blind hash signatures" in Options turns on a review for such requests.');
+    const shown = shownMessage(msg);
+    const text = shown.text;
     const signed = decodedMessage(msg) ?? text;
     const siwe = input.origin ? describeSiwe(signed, { origin: input.origin, account: checksum(addr), chainId: input.network.chainId, ...input.via ? { via: input.via } : {}, ...input.now !== void 0 ? { now: input.now } : {} }) : null;
     if (siwe && HIDDEN_CONTROL.test(signed)) return err(RELAY_ERRORS.invalidParams, "This sign-in message contains hidden control characters \u2014 refused.");
-    return { kind: "sign-message", method, account: checksum(addr), text, raw: msg, ...siwe ? { siwe } : {} };
+    if (siwe && SIWE_FORBIDDEN_CHARS.test(signed)) return err(RELAY_ERRORS.invalidParams, "This sign-in message contains invisible or text-direction characters \u2014 refused.");
+    return { kind: "sign-message", method, account: checksum(addr), text, raw: msg, ...siwe ? { siwe } : {}, ...shown.hidden ? { hiddenChars: true } : {}, ...blindHash ? { blindHash: true } : {} };
   }
   if (method === "eth_signTypedData_v4" || method === "eth_signTypedData_v3" || method === "eth_signTypedData") {
     const [addr, data] = params;
@@ -1804,7 +2250,8 @@ function classifySignRequest(input) {
     if (cid !== void 0 && cid !== null && Number(cid) !== input.network.chainId) {
       return err(RELAY_ERRORS.chainDisconnected, `Typed data is for chain ${String(cid)}; this site is on ${input.network.name} (${input.network.chainId}).`);
     }
-    return { kind: "sign-typed-data", method, account: checksum(addr), text: JSON.stringify(parsed, bigintSafe, 2), typedData: parsed };
+    const shown = revealHidden(JSON.stringify(parsed, bigintSafe, 2));
+    return { kind: "sign-typed-data", method, account: checksum(addr), text: shown.text, typedData: parsed, ...shown.hidden ? { hiddenChars: true } : {} };
   }
   if (method === "eth_sendTransaction") {
     const tx = params[0] ?? {};
@@ -1853,16 +2300,33 @@ function overpriced(shown, fresh) {
   if (shown.maxFeePerGas !== void 0 && fresh.maxFeePerGas !== void 0) return big(shown.maxFeePerGas) > STALE_FEE_FACTOR * big(fresh.maxFeePerGas);
   return false;
 }
+function gasLimitExcessive(limit, estimate) {
+  const a = estimate * 3n / 2n;
+  const b = estimate + 50000n;
+  return limit > (a > b ? a : b);
+}
 async function prepareTransaction(deps, network, from, tx) {
   const call = { from, to: tx.to, value: hex(BigInt(tx.value)), ...tx.data ? { data: tx.data } : {} };
+  const estimate = () => deps.rpc(network, "eth_estimateGas", [call]);
   const [nonceHex, block, gasHex] = await Promise.all([
     deps.rpc(network, "eth_getTransactionCount", [from, "pending"]),
     deps.rpc(network, "eth_getBlockByNumber", ["latest", false]),
-    tx.gas ? Promise.resolve(tx.gas) : deps.rpc(network, "eth_estimateGas", [call])
+    tx.gas ? estimate().then((v) => v, () => null) : estimate()
   ]);
-  const estimated = big(gasHex);
-  const gasLimit = tx.gas ? estimated : (estimated * 120n + 99n) / 100n;
-  return withFees(network.chainId, safeNonce(big(nonceHex)), gasLimit, await readFees(deps, network, block));
+  const nonce = safeNonce(big(nonceHex));
+  if (!tx.gas) {
+    const estimated = big(gasHex);
+    return withFees(network.chainId, nonce, (estimated * 120n + 99n) / 100n, await readFees(deps, network, block));
+  }
+  const limit = big(tx.gas);
+  const prepared = withFees(network.chainId, nonce, limit, await readFees(deps, network, block));
+  let est = null;
+  try {
+    est = typeof gasHex === "string" ? big(gasHex) : null;
+  } catch {
+    est = null;
+  }
+  return est !== null && est > 0n ? { ...prepared, gasCheck: { estimate: hex(est), excessive: gasLimitExcessive(limit, est) } } : prepared;
 }
 function createSignHandler(deps) {
   const tails = /* @__PURE__ */ new Map();
@@ -1878,7 +2342,8 @@ function createSignHandler(deps) {
   };
   return async ({ origin, network, method, params, accounts }) => {
     const via = deps.approvals.viaFor(origin);
-    const info = classifySignRequest({ network, method, params, accounts, origin, ...via ? { via } : {} });
+    const allowBlindHash = method === "personal_sign" && deps.allowBlindHash ? await deps.allowBlindHash() : false;
+    const info = classifySignRequest({ network, method, params, accounts, origin, ...via ? { via } : {}, ...allowBlindHash ? { allowBlindHash: true } : {} });
     if ("code" in info) throw RouterError.from(info);
     const prepared = info.kind === "send-transaction" ? await prepareTransaction(deps, network, info.account, info.tx) : void 0;
     const preview = deps.preview ? await deps.preview({ network, request: info, accounts }).catch(() => null) : null;
@@ -1888,14 +2353,20 @@ function createSignHandler(deps) {
       const key = `${network.caip2}|${lc(info.account)}`;
       return serial(key, async () => {
         let shown = prepared;
+        let reasks = 0;
         for (; ; ) {
           const [nonceHex, fees] = await Promise.all([deps.rpc(network, "eth_getTransactionCount", [info.account, "pending"]), readFees(deps, network)]);
           const local = nextNonce.get(key) ?? 0;
           const nodeNonce = safeNonce(big(nonceHex));
           const nonce = nodeNonce > local ? nodeNonce : local;
           if (outgrown(shown, fees)) {
-            shown = withFees(network.chainId, nonce, big(shown.gasLimit), fees);
-            await deps.approvals.request({ origin, chain: network.caip2, kind: info.kind, payload: { ...payload, prepared: shown, repriced: true } });
+            const next = withFees(network.chainId, nonce, big(shown.gasLimit), fees);
+            const ceiling = deps.feeCeiling?.(network);
+            if (ceiling !== void 0 && BigInt(next.maxFee) > ceiling) throw new RouterError(RELAY_ERRORS.internal, `The network fee rose above the wallet's limit for ${network.name}; nothing was signed.`);
+            if (reasks >= MAX_FEE_REASKS) throw new RouterError(RELAY_ERRORS.internal, "The network fee kept rising while you were reviewing; nothing was signed. Try again later.");
+            reasks++;
+            await deps.approvals.request({ origin, chain: network.caip2, kind: info.kind, payload: { ...payload, prepared: next, repriced: true, repricedFrom: shown.maxFee } }, { followUp: true });
+            shown = next;
             continue;
           }
           const fresh = withFees(network.chainId, nonce, big(shown.gasLimit), fees);
@@ -2017,7 +2488,14 @@ async function quoteRoutes(providers, params, options = {}) {
     candidates.push(p);
   }
   const pending = new Set(candidates.map((p) => p.name));
-  const view = () => ({ routes: rank(Object.values(quotes)), pending: [...pending], refusals: { ...refusals }, quotes: { ...quotes } });
+  const depositAddressRoute = options.depositAddressRoute;
+  const rankOptions = {
+    ...params.slippageBps !== void 0 ? { slippageBps: params.slippageBps } : {},
+    ...options.depositAddressProviders ? { depositAddressProviders: options.depositAddressProviders } : {},
+    ...depositAddressRoute ? { depositAddressRoute: (q) => depositAddressRoute(q, params) } : {}
+  };
+  const { slippageBps: _slippage, ...shapeParams } = params;
+  const view = () => ({ routes: rank(Object.values(quotes), rankOptions), pending: [...pending], refusals: { ...refusals }, quotes: { ...quotes } });
   const emit = () => options.onUpdate?.(view());
   emit();
   await Promise.all(
@@ -2032,7 +2510,7 @@ async function quoteRoutes(providers, params, options = {}) {
         const q = await Promise.race([p.getQuote({ ...params, dry: true, onRefusal: (r) => {
           refusal = r;
         } }, ctrl.signal), aborted]);
-        if (q && (0, import_protocol_swap2_core.validQuote)(q, { ...params, dry: true }, p.name)) quotes[p.name] = q;
+        if (q && (0, import_protocol_swap2_core.validQuote)(q, { ...shapeParams, dry: true }, p.name)) quotes[p.name] = q;
         else refusals[p.name] = refusal ?? (q ? "returned an invalid quote" : "no route for this pair right now");
       } catch (e) {
         refusals[p.name] = ctrl.signal.aborted ? String(ctrl.signal.reason instanceof Error ? ctrl.signal.reason.message : ctrl.signal.reason ?? "cancelled") : e instanceof Error ? e.message : String(e);
@@ -2046,16 +2524,50 @@ async function quoteRoutes(providers, params, options = {}) {
   );
   return view();
 }
-function rank(quotes) {
+function gapBps(dest, min) {
+  if (dest <= 0n || min >= dest) return 0;
+  return Number((((dest - min) * 10000n + dest - 1n) / dest).toString());
+}
+function rank(quotes, options = {}) {
   const sorted = [...quotes].sort((a, b) => BigInt(b.destAmount) > BigInt(a.destAmount) ? 1 : BigInt(b.destAmount) < BigInt(a.destAmount) ? -1 : a.feeUsd - b.feeUsd || a.etaSeconds - b.etaSeconds);
   const fastest = sorted.length ? sorted.reduce((f, q) => q.etaSeconds < f.etaSeconds ? q : f) : null;
-  return sorted.map((q, i) => {
+  const depositProviders = new Set(options.depositAddressProviders ?? []);
+  const paysAssignedAddress = (q) => {
+    if (depositProviders.has(q.provider)) return true;
+    if (!options.depositAddressRoute) return false;
+    try {
+      return options.depositAddressRoute(q) === true;
+    } catch {
+      return true;
+    }
+  };
+  const assigned = new Map(sorted.map((q) => [q, paysAssignedAddress(q)]));
+  const s = options.slippageBps;
+  const warningsOf = (q) => {
+    const w = [];
+    if (s !== void 0 && Number.isInteger(s) && s >= 0 && s < 1e4) {
+      const dest = BigInt(q.destAmount);
+      const min = BigInt(q.minDestAmount);
+      if (min < (0, import_protocol_swap2_core.slippageFloor)(dest, s)) w.push({ kind: "min-below-slippage", slippageBps: s, minGapBps: gapBps(dest, min) });
+    }
+    if (assigned.get(q)) w.push({ kind: "deposit-address" });
+    return w;
+  };
+  const warned = new Map(sorted.map((q) => [q, warningsOf(q)]));
+  const verifiableExists = sorted.some((q) => !assigned.get(q));
+  const best = sorted.find((q) => {
+    const w = warned.get(q);
+    return !w.some((x) => x.kind === "min-below-slippage") && !(w.some((x) => x.kind === "deposit-address") && verifiableExists);
+  });
+  const ordered = best ? [best, ...sorted.filter((q) => q !== best)] : sorted;
+  return ordered.map((q) => {
     const poolFee = q.providerData?.poolFee;
     const feeNote = typeof poolFee === "string" && poolFee && q.feeUsd === 0 ? poolFee === "pools" ? "pool fees in price" : `pool ${poolFee} in price` : void 0;
     const tags = [];
-    if (i === 0) tags.push("best");
+    if (q === best) tags.push("best");
     if (fastest && q.provider === fastest.provider) tags.push("fastest");
-    return { provider: q.provider, destAmount: q.destAmount, minDestAmount: q.minDestAmount, feeUsd: q.feeUsd, etaSeconds: q.etaSeconds, validUntilMs: q.validUntilMs, tags, ...feeNote ? { feeNote } : {} };
+    const warnings = warned.get(q);
+    return { provider: q.provider, destAmount: q.destAmount, minDestAmount: q.minDestAmount, feeUsd: q.feeUsd, etaSeconds: q.etaSeconds, validUntilMs: q.validUntilMs, tags, ...feeNote ? { feeNote } : {}, ...warnings.length ? { warnings } : {} };
   });
 }
 var FLOOR_TOLERANCE_BPS = 50n;
@@ -2074,18 +2586,21 @@ function depositOf(s, approvals) {
   if (!s.data.startsWith(TRANSFER_SELECTOR) || s.data.length < 10 + 64) return void 0;
   return `0x${s.data.slice(10 + 24, 10 + 64)}`;
 }
+var pct = (bps) => `${Number((bps / 100).toFixed(2))}%`;
 function swapApprovalPayload(plan, meta) {
   const isOwn = meta.own.some((a) => lc3(a) === lc3(plan.recipient));
+  const assigned = meta.depositAddressAssignedByProvider === true;
   const checks = [{ status: "ok", label: `Built by the ${meta.providerLabel} module` }];
+  const depositCheck = assigned ? { status: "warn", label: `Deposit address assigned by the ${meta.providerLabel} server \u2014 funds go to an address the wallet cannot verify` } : { status: "ok", label: `Deposit address from the ${meta.providerLabel} quote` };
   const s = plan.source;
   let source;
   if (s.kind === "call") {
     const deposit = depositOf(s, plan.approvals.length);
     source = { kind: "call", to: s.to, ...s.data ? { data: s.data } : {}, value: s.value.toString(), ...deposit ? { deposit } : {} };
-    checks.push(deposit ? { status: "ok", label: `Deposit address from the ${meta.providerLabel} quote` } : { status: "ok", label: `Calls the ${meta.providerLabel} contract` });
+    checks.push(deposit || assigned ? depositCheck : { status: "ok", label: `Calls the ${meta.providerLabel} contract` });
   } else if (s.kind === "token-transfer") {
     source = { kind: "token-transfer", token: s.token, recipient: s.recipient, amount: s.amount.toString(), ...s.memo ? { memo: s.memo } : {} };
-    checks.push({ status: "ok", label: `Deposit address from the ${meta.providerLabel} quote` });
+    checks.push(depositCheck);
   } else if (s.kind === "serialized") {
     source = { kind: "serialized" };
     checks.push({ status: "ok", label: "Balance changes are proven before signing (SDK guard)" });
@@ -2096,7 +2611,14 @@ function swapApprovalPayload(plan, meta) {
   }
   for (const a of plan.approvals) checks.push(a.amount > plan.sourceAmount ? { status: "warn", label: "Approval is larger than this swap needs" } : { status: "ok", label: "Approval is exactly the amount needed" });
   if (plan.approvals.length > 1) checks.push({ status: "ok", label: `${plan.approvals.length} approvals (reset to 0 first)` });
-  checks.push(isOwn ? { status: "ok", label: "Funds arrive at your address" } : { status: "warn", label: `Funds arrive at ${plan.recipient.slice(0, 6)}\u2026${plan.recipient.slice(-4)}, not your address` });
+  checks.push(!isOwn ? { status: "warn", label: `Funds arrive at ${plan.recipient.slice(0, 6)}\u2026${plan.recipient.slice(-4)}, not your address` } : assigned ? { status: "unknown", label: `Delivery to your address is the ${meta.providerLabel} server\u2019s promise \u2014 this transaction does not enforce it` } : { status: "ok", label: "Funds arrive at your address" });
+  let slippage;
+  const sb = meta.slippageBps;
+  if (sb !== void 0 && Number.isInteger(sb) && sb >= 0 && sb < 1e4) {
+    const below = plan.minDestAmount < (0, import_protocol_swap2_core.slippageFloor)(plan.destAmount, sb);
+    slippage = { bps: sb, minGapBps: gapBps(plan.destAmount, plan.minDestAmount), below };
+    checks.push(below ? { status: "warn", label: `Minimum is ${pct(slippage.minGapBps)} under the quote \u2014 more than your ${pct(sb)} slippage` } : { status: "ok", label: `Minimum within your ${pct(sb)} slippage` });
+  }
   return {
     provider: plan.provider,
     providerLabel: meta.providerLabel,
@@ -2113,7 +2635,9 @@ function swapApprovalPayload(plan, meta) {
     validUntilMs: plan.validUntilMs,
     approvals: plan.approvals.map((a) => ({ token: a.token, spender: a.spender, amount: a.amount.toString() })),
     source,
-    checks
+    checks,
+    ...slippage ? { slippage } : {},
+    ...assigned ? { depositAssignedByProvider: true } : {}
   };
 }
 function parseTypedOrder(json) {
@@ -2564,6 +3088,10 @@ var RecipientBook = class {
     await this.storage.set(s);
     this._state = s;
   }
+  /** Forget the cached book: the next read asks storage again (e.g. a storage that only answers once the wallet is unlocked). */
+  reload() {
+    this._state = null;
+  }
   /** `known` → the address is one the user paid before; `lookalike` → it imitates one. */
   async check(namespace, address) {
     const list = await this.list(namespace);
@@ -2571,4 +3099,236 @@ var RecipientBook = class {
     return { known, lookalike: known ? null : lookalikeOf(address, list) };
   }
 };
+
+// src/mac-storage.ts
+var import_core5 = require("@anywalletkit/core");
+var STORAGE_MAC_FIELD = "anywalletkit.mac/1";
+var STORAGE_VERSION_FIELD = "anywalletkit.ver/1";
+var HKDF_INFO2 = "anywalletkit/storage-mac/1";
+var KEY_BYTES = 32;
+async function deriveStorageMacKey(dek, crypto2 = globalThis.crypto) {
+  if (dek.length !== 32) throw new VaultError("Vault key must be 32 bytes.", "invalid-input");
+  const ikm = await withSecretBuffer(dek, (b) => crypto2.subtle.importKey("raw", b, "HKDF", false, ["deriveBits"]));
+  const bits = await crypto2.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: new ArrayBuffer(0), info: toArrayBuffer(utf8.encode(HKDF_INFO2)) }, ikm, KEY_BYTES * 8);
+  return new Uint8Array(bits);
+}
+function macJsonStorage(inner, options) {
+  const { label, versions } = options;
+  if (versions && label.includes("\n")) throw new VaultError("A versioned store label has no line break.", "invalid-input");
+  const readWithoutKey = options.readWithoutKey ?? "unverified";
+  const writeWithoutKey = options.writeWithoutKey ?? "unsigned";
+  const withKey = async (given, fn) => {
+    const key = given ? Uint8Array.from(given) : await options.key();
+    try {
+      return await fn(key);
+    } finally {
+      if (key) (0, import_core5.zeroize)(key);
+    }
+  };
+  const stored = async (key) => {
+    const raw = await inner.get();
+    if (raw === null || raw === void 0) return { state: "empty", value: null };
+    const envelope = isStored(raw);
+    const value = envelope ? raw.value : raw;
+    if (!envelope || raw[STORAGE_MAC_FIELD] === null) return { state: "unsigned", value };
+    if (!key) return { state: "no-key", value };
+    if (!versions) return { state: await verify(key, label, value, raw[STORAGE_MAC_FIELD]) ? "ok" : "invalid", value };
+    const version = STORAGE_VERSION_FIELD in raw ? raw[STORAGE_VERSION_FIELD] : 0;
+    if (version !== 0 && !isVersion(version)) return { state: "invalid", value };
+    if (!await verify(key, label, value, raw[STORAGE_MAC_FIELD], version || void 0)) return { state: "invalid", value };
+    return { state: "ok", value, version };
+  };
+  const put = async (key, value, version) => {
+    const mac = await sign(key, label, value, version);
+    await inner.set(version === void 0 ? { [STORAGE_MAC_FIELD]: mac, value } : { [STORAGE_MAC_FIELD]: mac, [STORAGE_VERSION_FIELD]: version, value });
+  };
+  const seen = async (key) => {
+    const r = await stored(key);
+    return r.state === "ok" ? r.version ?? 0 : 0;
+  };
+  const read = (given) => withKey(given, async (key) => {
+    if (!versions || !key) return stored(key);
+    return versions.exclusive(async (ledger) => {
+      const r = await stored(key);
+      if (r.state === "empty") return await ledger.check(label, null, key) === "ok" ? r : { state: "stale", value: null };
+      if (r.state !== "ok") return r;
+      return await ledger.check(label, r.version ?? 0, key) === "ok" ? r : { ...r, state: "stale" };
+    });
+  });
+  const write = (value, given) => withKey(given, async (key) => {
+    if (!key) throw new VaultError("The wallet is locked: unlock it to change this.", "locked");
+    if (!versions) return put(key, value);
+    await versions.exclusive((ledger) => ledger.advance(label, key, () => seen(key), (version) => put(key, value, version)));
+  });
+  return {
+    read,
+    write,
+    async get() {
+      const r = await read();
+      if (r.state === "ok") return r.value;
+      if (r.state === "no-key" && readWithoutKey === "unverified") return r.value;
+      return null;
+    },
+    async set(value) {
+      await withKey(void 0, async (key) => {
+        if (key) return write(value, key);
+        if (writeWithoutKey === "refuse") throw new VaultError("The wallet is locked: unlock it to change this.", "locked");
+        await inner.set({ [STORAGE_MAC_FIELD]: null, value });
+      });
+    },
+    async rekey(oldKey, newKey) {
+      if (!versions) {
+        const r = await read(oldKey);
+        if (r.state === "ok") await write(r.value, newKey);
+        return r.state;
+      }
+      return versions.exclusive(async (ledger) => {
+        const r = await stored(oldKey);
+        if (r.state === "empty") return await ledger.check(label, null, newKey) === "ok" ? "empty" : "stale";
+        if (r.state !== "ok") return r.state;
+        const version = r.version ?? 0;
+        if (await ledger.check(label, version, newKey) !== "ok") return "stale";
+        if (version > 0) await put(newKey, r.value, version);
+        else await ledger.advance(label, newKey, async () => 0, (v) => put(newKey, r.value, v));
+        return "ok";
+      });
+    }
+  };
+}
+function isStored(raw) {
+  if (typeof raw !== "object" || raw === null || !(STORAGE_MAC_FIELD in raw) || !("value" in raw)) return false;
+  const mac = raw[STORAGE_MAC_FIELD];
+  return mac === null || typeof mac === "string";
+}
+async function hmacKey(key, usage) {
+  if (key.length !== KEY_BYTES) throw new VaultError("A storage MAC key is 32 bytes.", "invalid-input");
+  return withSecretBuffer(key, (b) => globalThis.crypto.subtle.importKey("raw", b, { name: "HMAC", hash: "SHA-256" }, false, [usage]));
+}
+function macInput(label, value, version) {
+  return toArrayBuffer(utf8.encode(version === void 0 ? `${label}
+${canonicalJson(value)}` : `${label}
+${version}
+${canonicalJson(value)}`));
+}
+async function sign(key, label, value, version) {
+  return toBase64(new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", await hmacKey(key, "sign"), macInput(label, value, version))));
+}
+async function verify(key, label, value, mac, version) {
+  let bytes;
+  try {
+    bytes = fromBase64(mac);
+  } catch {
+    return false;
+  }
+  return globalThis.crypto.subtle.verify("HMAC", await hmacKey(key, "verify"), toArrayBuffer(bytes), macInput(label, value, version));
+}
+var isVersion = (x) => typeof x === "number" && Number.isSafeInteger(x) && x > 0;
+function canonicalJson(value) {
+  return JSON.stringify(sortKeys(JSON.parse(JSON.stringify(value ?? null))));
+}
+function sortKeys(x) {
+  if (Array.isArray(x)) return x.map(sortKeys);
+  if (x === null || typeof x !== "object") return x;
+  const out = {};
+  for (const k of Object.keys(x).sort()) out[k] = sortKeys(x[k]);
+  return out;
+}
+var LEDGER_LABEL = "anywalletkit/storage-versions/1";
+function storageVersionLedger(options) {
+  const label = options.label ?? LEDGER_LABEL;
+  const acceptUnversioned = options.acceptUnversioned ?? false;
+  const now = options.now ?? Date.now;
+  let tail = Promise.resolve();
+  const queue = (fn) => {
+    const run = tail.then(fn, fn);
+    tail = run.then(() => void 0, () => void 0);
+    return run;
+  };
+  const high = async () => {
+    const v = await options.mark.get();
+    return isVersion(v) ? v : 0;
+  };
+  const parse = async (raw, key) => {
+    if (!isStored(raw) || raw[STORAGE_MAC_FIELD] === null) return null;
+    const epoch = raw[STORAGE_VERSION_FIELD];
+    const v = raw.value;
+    if (!isVersion(epoch) || typeof v !== "object" || v === null || !isVersion(v.base) || typeof v.sealed !== "boolean") return null;
+    if (typeof v.versions !== "object" || v.versions === null || !Object.values(v.versions).every(isVersion)) return null;
+    if (!await verify(key, label, v, raw[STORAGE_MAC_FIELD], epoch)) return null;
+    return { epoch, base: v.base, sealed: v.sealed, versions: { ...v.versions } };
+  };
+  const load = async (key) => {
+    const mark = await high();
+    const raw = await options.manifest.get();
+    if (raw === null || raw === void 0) return { state: mark > 0 ? "stale" : "empty" };
+    const manifest = await parse(raw, key);
+    if (!manifest) return { state: "invalid" };
+    if (manifest.epoch < mark) return { state: "stale", manifest };
+    if (manifest.epoch > mark) await options.mark.set(manifest.epoch);
+    return { state: "ok", manifest };
+  };
+  const store = async (m, key) => {
+    const value = { base: m.base, sealed: m.sealed, versions: m.versions };
+    await options.manifest.set({ [STORAGE_MAC_FIELD]: await sign(key, label, value, m.epoch), [STORAGE_VERSION_FIELD]: m.epoch, value });
+    if (m.epoch > await high()) await options.mark.set(m.epoch);
+  };
+  const fresh = async (sealed, prior, key) => {
+    const floor = Math.max(await high(), Math.floor(now()), prior ? Math.max(prior.epoch, prior.base, ...Object.values(prior.versions)) : 0);
+    if (!Number.isSafeInteger(floor + 2)) throw new VaultError("Storage version out of range.", "invalid-input");
+    const m = { epoch: floor + 1, base: floor + 1, sealed, versions: {} };
+    await store(m, key);
+    return m;
+  };
+  const record = (m, name, version, key) => store({ ...m, epoch: m.epoch + 1, versions: { ...m.versions, [name]: version } }, key);
+  const named = (name) => {
+    if (name === label || name.includes("\n")) throw new VaultError("Not a store label.", "invalid-input");
+  };
+  const ops = {
+    async check(name, version, key) {
+      named(name);
+      const l = await load(key);
+      if (l.state === "empty") return version === null || version === 0 && acceptUnversioned ? "ok" : "stale";
+      if (l.state !== "ok") return "stale";
+      const m = l.manifest;
+      const listed = m.versions[name];
+      if (listed === void 0 && version === null) return m.sealed ? "stale" : "ok";
+      if (listed === void 0 && version === 0) return !m.sealed && acceptUnversioned ? "ok" : "stale";
+      if (version === null || version === 0) return "stale";
+      if (version === listed) return "ok";
+      if (version !== (listed ?? m.base) + 1) return "stale";
+      await record(m, name, version, key).catch(() => void 0);
+      return "ok";
+    },
+    async advance(name, key, seen, write) {
+      named(name);
+      const l = await load(key);
+      const before = await seen();
+      const m = l.state === "ok" ? l.manifest : await fresh(l.state !== "empty" || before > 0, l.manifest, key);
+      const version = Math.max(m.versions[name] ?? m.base, before) + 1;
+      if (!Number.isSafeInteger(version)) throw new VaultError("Storage version out of range.", "invalid-input");
+      await write(version);
+      await record(m, name, version, key);
+      return version;
+    }
+  };
+  return {
+    exclusive: (fn) => queue(() => fn(ops)),
+    condemn: (key) => queue(async () => {
+      await fresh(true, (await load(key)).manifest, key);
+    }),
+    rekey: (oldKey, newKey) => queue(async () => {
+      const l = await load(oldKey);
+      if (l.state === "ok") await store({ ...l.manifest, epoch: l.manifest.epoch + 1 }, newKey);
+      return l.state;
+    }),
+    read: (key) => queue(async () => {
+      const l = await load(key);
+      return { state: l.state, ...l.manifest ?? { epoch: 0, base: 0, sealed: false, versions: {} } };
+    }),
+    reset: () => queue(async () => {
+      await options.manifest.set(null);
+      await options.mark.set(null);
+    })
+  };
+}
 //# sourceMappingURL=index.cjs.map