@anywalletkit/wallet-near 0.1.8 → 0.2.0

package/dist/history.js

@@ -9,7 +9,7 @@ import {
   mapRpcTxStatus,
   nearExplorerTxUrl,
   parseJsonPreservingBigInts
-} from "./chunk-MX4CTCHL.js";
+} from "./chunk-ZWMEZA5A.js";
 export {
   HistoryUnavailableError,
   createNearHistory,

package/dist/index.cjs

@@ -47,6 +47,7 @@ __export(src_exports, {
   YOCTO: () => YOCTO,
   actionKey: () => actionKey,
   argsBytes: () => argsBytes,
+  assertWellFormed: () => assertWellFormed,
   base58ToBytes: () => base58ToBytes,
   bytesToBase58: () => bytesToBase58,
   createClient: () => createClient,
@@ -67,6 +68,7 @@ __export(src_exports, {
   implicitAccountId: () => implicitAccountId,
   isDangerous: () => isDangerous,
   isImplicitAccountId: () => isImplicitAccountId,
+  isPlainObject: () => isPlainObject,
   isValidAccountId: () => isValidAccountId,
   mapNearblocksGroup: () => mapNearblocksGroup,
   mapNearblocksTxn: () => mapNearblocksTxn,
@@ -194,7 +196,7 @@ var bytesToBase58 = (b) => import_base.base58.encode(b);
 
 // src/borsh.ts
 var utf8 = new TextEncoder();
-var utf8d = new TextDecoder();
+var utf8d = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 var BorshWriter = class {
   _buf = new Uint8Array(256);
   _len = 0;
@@ -296,7 +298,10 @@ var BorshReader = class {
     return utf8d.decode(this.vecU8());
   }
   option(read) {
-    return this.u8() === 0 ? void 0 : read();
+    const tag = this.u8();
+    if (tag === 0) return void 0;
+    if (tag !== 1) throw new RangeError(`borsh: option tag ${tag}`);
+    return read();
   }
   done() {
     if (this.remaining !== 0) throw new RangeError(`borsh: ${this.remaining} trailing bytes`);
@@ -339,13 +344,21 @@ var ACTION_TAG = {
   useGlobalContract: 10
 };
 function actionKey(a) {
-  const k = Object.keys(a)[0];
-  if (!k || !(k in ACTION_TAG)) throw new RangeError(`unknown action ${k}`);
+  const keys = typeof a === "object" && a !== null ? Object.keys(a) : [];
+  if (keys.length !== 1) throw new RangeError(`an action must have exactly one key (has: ${keys.join(", ") || "none"})`);
+  const k = keys[0];
+  if (!Object.prototype.hasOwnProperty.call(ACTION_TAG, k)) throw new RangeError(`unknown action ${k}`);
   return k;
 }
+function isPlainObject(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v)) return false;
+  const proto = Object.getPrototypeOf(v);
+  return proto === Object.prototype || proto === null;
+}
 function argsBytes(args) {
   if (args instanceof Uint8Array) return args;
   if (typeof args === "string") return utf8.encode(args);
+  if (!isPlainObject(args)) throw new TypeError("function-call args must be bytes, a string or a plain object");
   return utf8.encode(JSON.stringify(args));
 }
 function writeAccessKey(w, k) {
@@ -403,6 +416,8 @@ function writeAction(w, a) {
       return;
     case "functionCall": {
       const f = a.functionCall;
+      if (typeof f.methodName !== "string") throw new TypeError("functionCall.methodName must be a string");
+      if (f.gas !== void 0 && typeof f.gas !== "bigint" || f.deposit !== void 0 && typeof f.deposit !== "bigint") throw new TypeError("functionCall gas and deposit must be bigints");
       w.string(f.methodName).vecU8(argsBytes(f.args)).u64(f.gas ?? 30n * 10n ** 12n).u128(f.deposit ?? 0n);
       return;
     }
@@ -449,6 +464,11 @@ function writeAction(w, a) {
     }
   }
 }
+function mode(r) {
+  const m = r.u8();
+  if (m !== 0 && m !== 1) throw new RangeError(`borsh: unknown global-contract mode ${m}`);
+  return m;
+}
 function readAction(r) {
   const tag = r.u8();
   switch (tag) {
@@ -483,11 +503,11 @@ function readAction(r) {
     }
     case 9: {
       const code = r.vecU8();
-      const m = r.u8();
+      const m = mode(r);
       return { deployGlobalContract: { code, deployMode: m === 0 ? "codeHash" : "accountId" } };
     }
     case 10: {
-      const m = r.u8();
+      const m = mode(r);
       return { useGlobalContract: m === 0 ? { codeHash: r.bytes(32) } : { accountId: r.string() } };
     }
     default:
@@ -958,7 +978,8 @@ var WalletAccountReadOnlyNear = class _WalletAccountReadOnlyNear {
   }
   /** Fill `signerId` / `publicKey` / `nonce` / `blockHash` (the last two from the node when missing). */
   async buildTransaction(tx) {
-    if (typeof tx === "string") return decodeAnyTransaction(fromBase64(tx)).transaction;
+    if (typeof tx === "string") return canonicalTransaction(tx);
+    assertWellFormed(tx);
     const signerId = tx.signerId ?? this.address;
     const publicKey = tx.publicKey ?? this.publicKey;
     let nonce = tx.nonce;
@@ -1072,6 +1093,7 @@ var WalletAccountReadOnlyNear = class _WalletAccountReadOnlyNear {
     if (tx.publicKey.keyType !== this.publicKey.keyType || !equalBytes(tx.publicKey.data, this.publicKey.data)) throw new UnsafeTransactionError("public-key-mismatch", "The transaction public key is not this account's key.");
     if (!tx.actions.length) throw new UnsafeTransactionError("no-actions", "The transaction has no actions.");
     if (!isValidAccountId(tx.receiverId)) throw new UnsafeTransactionError("invalid-account", `"${tx.receiverId}" is not a valid NEAR account id.`);
+    assertWellFormed(tx);
     if (tx.blockHash.length !== 32) throw new UnsafeTransactionError("missing-block-hash", "The transaction has no 32-byte block hash.");
     if (tx.nonce <= 0n) throw new UnsafeTransactionError("missing-nonce", "The transaction nonce must be positive.");
     if (!this._config.allowDangerousActions) {
@@ -1127,6 +1149,64 @@ function parseSignature(signature) {
   }
   return base58ToBytes(s, 64);
 }
+var METHOD_NAME = /^[A-Za-z0-9_]{1,256}$/;
+function assertWellFormed(tx) {
+  if (!Array.isArray(tx.actions)) throw new UnsafeTransactionError("malformed-action", "actions must be an array.");
+  assertShape(tx.actions);
+  assertNames(tx.actions);
+}
+function assertShape(actions, depth = 0) {
+  for (const a of actions) {
+    const keys = typeof a === "object" && a !== null ? Object.keys(a) : [];
+    if (keys.length !== 1 || !Object.prototype.hasOwnProperty.call(ACTION_TAG, keys[0])) {
+      throw new UnsafeTransactionError("malformed-action", `An action must have exactly one known key (has: ${keys.join(", ") || "none"}).`);
+    }
+    if ("functionCall" in a) {
+      const f = a.functionCall;
+      if (!(f.args instanceof Uint8Array) && typeof f.args !== "string" && !isPlainObject(f.args)) throw new UnsafeTransactionError("malformed-action", "Function-call args must be bytes, a string or a plain object.");
+      if (f.gas !== void 0 && typeof f.gas !== "bigint" || f.deposit !== void 0 && typeof f.deposit !== "bigint") throw new UnsafeTransactionError("malformed-action", "Function-call gas and deposit must be bigints.");
+    }
+    if ("signedDelegate" in a && depth === 0) assertShape(a.signedDelegate.delegateAction.actions, depth + 1);
+  }
+}
+function assertNames(actions, depth = 0) {
+  const account = (id) => {
+    if (typeof id !== "string" || !isValidAccountId(id)) throw new UnsafeTransactionError("invalid-account", `${JSON.stringify(id)} is not a valid NEAR account id.`);
+  };
+  const method = (name) => {
+    if (typeof name !== "string" || !METHOD_NAME.test(name)) throw new UnsafeTransactionError("invalid-method", `${JSON.stringify(name)} is not a method name this wallet signs (ASCII letters, digits, '_').`);
+  };
+  for (const a of actions) {
+    if ("functionCall" in a) method(a.functionCall.methodName);
+    else if ("deleteAccount" in a) account(a.deleteAccount.beneficiaryId);
+    else if ("addKey" in a && "functionCall" in a.addKey.accessKey.permission) {
+      const p = a.addKey.accessKey.permission.functionCall;
+      account(p.receiverId);
+      for (const m of p.methodNames) method(m);
+    } else if ("useGlobalContract" in a && "accountId" in a.useGlobalContract) account(a.useGlobalContract.accountId);
+    else if ("signedDelegate" in a) {
+      const d = a.signedDelegate.delegateAction;
+      account(d.senderId);
+      account(d.receiverId);
+      if (depth > 0) throw new UnsafeTransactionError("unknown-action", "A delegated action inside a delegated action is not signed.");
+      assertNames(d.actions, depth + 1);
+    }
+  }
+}
+function canonicalTransaction(b64) {
+  const bytes = fromBase64(b64);
+  let decoded;
+  try {
+    decoded = decodeAnyTransaction(bytes);
+  } catch (e) {
+    throw new UnsafeTransactionError("non-canonical", `Not a borsh NEAR transaction: ${e.message}`);
+  }
+  const again = decoded.signature ? encodeSignedTransaction({ transaction: decoded.transaction, signature: decoded.signature }) : encodeTransaction(decoded.transaction);
+  if (!equalBytes(again, bytes)) throw new UnsafeTransactionError("non-canonical", "This borsh transaction does not re-encode to the same bytes, so what was reviewed may not be what gets signed.");
+  if (!isValidAccountId(decoded.transaction.signerId) || !isValidAccountId(decoded.transaction.receiverId)) throw new UnsafeTransactionError("invalid-account", "The transaction names an invalid NEAR account id.");
+  assertWellFormed(decoded.transaction);
+  return decoded.transaction;
+}
 function equalBytes(a, b) {
   if (a.length !== b.length) return false;
   let diff = 0;
@@ -1173,7 +1253,7 @@ var WalletAccountNear = class _WalletAccountNear extends WalletAccountReadOnlyNe
   key() {
     if (this._disposed) throw new import_core4.SignerError("This account has been disposed.");
   }
-  async signBytes(bytes, context) {
+  async #signBytes(bytes, context) {
     this.key();
     return this.signer.sign(bytes, { scheme: "ed25519", context });
   }
@@ -1188,16 +1268,17 @@ var WalletAccountNear = class _WalletAccountNear extends WalletAccountReadOnlyNe
   async sign(message) {
     const bytes = typeof message === "string" ? new TextEncoder().encode(message) : message;
     if (bytes.length === 32 || carriesKey(bytes, this.publicKey.data)) throw new MessageIsTransactionError();
-    return `ed25519:${bytesToBase58(await this.signBytes(bytes, "near-message"))}`;
+    return `ed25519:${bytesToBase58(await this.#signBytes(bytes, "near-message"))}`;
   }
   /** NEP-413 off-chain message (what NEAR Intents and dApps ask wallets to sign). */
   async signNep413(payload) {
-    const sig = await this.signBytes(nep413Hash(payload), "near-nep413");
+    const sig = await this.#signBytes(nep413Hash(payload), "near-nep413");
     return { signature: toBase64(sig), publicKey: publicKeyToString(this.publicKey), accountId: this.address };
   }
   /** Sign a fully built transaction. No checks — see `signTransaction`. */
   async signBuilt(tx) {
-    const sig = await this.signBytes(WalletAccountReadOnlyNear.hashOf(tx), "near-tx");
+    assertWellFormed(tx);
+    const sig = await this.#signBytes(WalletAccountReadOnlyNear.hashOf(tx), "near-tx");
     return { transaction: tx, signature: { keyType: "ed25519", data: sig } };
   }
   /** Build → hard checks → preflight → fee cap. Shared by sign / send / transfer. */