@anywalletkit/wallet-ton 0.3.1 → 0.5.0

package/dist/index.cjs

@@ -41,6 +41,7 @@ __export(src_exports, {
   WalletAccountReadOnlyTon: () => WalletAccountReadOnlyTon,
   WalletAccountTon: () => WalletAccountTon,
   WalletManagerTon: () => WalletManagerTon,
+  canonicalBocCell: () => canonicalBocCell,
   commentCell: () => commentCell,
   createTonClient: () => createTonRpc,
   createTonHistory: () => createTonHistory,
@@ -58,6 +59,7 @@ __export(src_exports, {
   mapTonapiActions: () => mapActions,
   mapTonapiEvent: () => mapTonapiEvent,
   mapToncenterTransaction: () => mapToncenterTransaction,
+  messageBody: () => messageBody,
   parseEmulation: () => parseEmulation,
   parseTonapiConsequences: () => parseTonapiConsequences,
   parseTonapiRisk: () => parseTonapiRisk,
@@ -623,6 +625,7 @@ function parseV5R1Body(body) {
 }
 
 // src/describe.ts
+var import_buffer4 = require("buffer");
 var import_core6 = require("@ton/core");
 var JETTON_TRANSFER_OP = 260734629;
 var LARGE_FORWARD_NANOTON = 500000000n;
@@ -682,11 +685,67 @@ function parseTo(to) {
   const a = import_core6.Address.parse(to);
   return { to: a.toRawString(), bounceable: true, workchain: a.workChain };
 }
-function bodyOf(tx) {
+function canonicalBocCell(b64, what = "bodyBoc") {
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(b64)) throw new UnsafeTransactionError("non-canonical-boc", `${what} is not a base64 string.`);
+  const bytes = import_buffer4.Buffer.from(b64, "base64");
+  const layout = plainBocLayout(bytes);
+  if (layout !== null) throw new UnsafeTransactionError("non-canonical-boc", `${what} is not a plain single-root BoC (${layout}), so what was reviewed may not be what is signed.`);
+  let roots;
+  try {
+    roots = import_core6.Cell.fromBoc(bytes);
+  } catch {
+    throw new UnsafeTransactionError("non-canonical-boc", `${what} is not a valid BoC.`);
+  }
+  if (roots.length !== 1) throw new UnsafeTransactionError("non-canonical-boc", `${what} has ${roots.length} roots.`);
+  return roots[0];
+}
+function plainBocLayout(b) {
+  if (b.length < 6 || b[0] !== 181 || b[1] !== 238 || b[2] !== 156 || b[3] !== 114) return "not the generic BoC magic";
+  const flags = b[4];
+  const size = flags & 7;
+  const offBytes = b[5];
+  if (size < 1 || size > 4 || offBytes < 1 || offBytes > 8) return "bad size fields";
+  let i = 6;
+  const int = (n) => {
+    if (i + n > b.length) throw new RangeError("truncated");
+    let v = 0;
+    for (let k = 0; k < n; k++) v = v * 256 + b[i++];
+    return v;
+  };
+  try {
+    const cells = int(size);
+    const roots = int(size);
+    const absent = int(size);
+    int(offBytes);
+    if (roots !== 1) return `${roots} roots`;
+    if (absent !== 0) return "absent cells";
+    i += roots * size;
+    if (flags & 128) i += cells * offBytes;
+    for (let c = 0; c < cells; c++) {
+      if (i + 2 > b.length) return "truncated";
+      const d1 = b[i++];
+      const d2 = b[i++];
+      if (d1 & 16) return "a cell stores its hashes";
+      if (d1 >> 5 !== 0) return "a cell has a level mask";
+      if (d1 & 8) return "an exotic cell";
+      if ((d1 & 7) > 4) return "a cell with more than 4 refs";
+      i += Math.ceil(d2 / 2) + (d1 & 7) * size;
+    }
+    if (i + (flags & 64 ? 4 : 0) !== b.length) return "trailing or missing bytes";
+  } catch {
+    return "truncated";
+  }
+  return null;
+}
+function messageBody(tx) {
   if (tx.body instanceof import_core6.Cell) return tx.body;
   if (typeof tx.body === "string") return tx.body === "" ? void 0 : commentCell(tx.body);
-  if (tx.bodyBoc) return import_core6.Cell.fromBase64(tx.bodyBoc);
-  return void 0;
+  if (tx.body !== void 0) throw new UnsafeTransactionError("body", "A message body must be a Cell or a string (a text comment).");
+  if (tx.bodyBoc !== void 0 && typeof tx.bodyBoc !== "string") throw new UnsafeTransactionError("body", "bodyBoc must be a base64 string.");
+  return tx.bodyBoc ? canonicalBocCell(tx.bodyBoc) : void 0;
+}
+function bodyOf(tx) {
+  return messageBody(tx);
 }
 function commentCell(text) {
   return (0, import_core6.beginCell)().storeUint(0, 32).storeStringTail(text).endCell();
@@ -792,6 +851,8 @@ var import_ed25519 = require("@noble/curves/ed25519.js");
 var import_core8 = require("@ton/core");
 var JETTON_TRANSFER_OP2 = 260734629;
 var DEFAULT_JETTON_ATTACHED = 50000000n;
+var DEFAULT_MAX_JETTON_ATTACHED = 1000000000n;
+var RAW_ADDRESS = /^-?\d+:[0-9a-fA-F]{64}$/;
 var DEFAULT_INDEXER = "https://toncenter.com/api/v3";
 var DEFAULT_VALID_SECONDS = 60;
 var MAX_VALID_SECONDS = 600;
@@ -893,13 +954,15 @@ var WalletAccountReadOnlyTon = class {
     let address;
     let bounceable = true;
     let testOnly;
-    if (import_core8.Address.isFriendly(to)) {
+    if (typeof to === "string" && import_core8.Address.isFriendly(to)) {
       const f = import_core8.Address.parseFriendly(to);
       address = f.address;
       bounceable = f.isBounceable;
       testOnly = f.isTestOnly;
-    } else {
+    } else if (typeof to === "string" && RAW_ADDRESS.test(to)) {
       address = import_core8.Address.parse(to);
+    } else {
+      throw new UnsafeTransactionError("address", `${JSON.stringify(to)} is not a TON address in a strict form (raw wc:hex, or a friendly address with its checksum).`);
     }
     if (address.workChain !== 0 && address.workChain !== -1) throw new UnsafeTransactionError("exotic-workchain", `Refusing to send to workchain ${address.workChain}.`);
     const testnet = this._config.network === "testnet";
@@ -912,7 +975,7 @@ var WalletAccountReadOnlyTon = class {
     const value = big(tx.value);
     if (value <= 0n) throw new UnsafeTransactionError("zero-value", "TON message value must be positive.");
     const { address, bounceable } = this.checkedAddress(tx.to);
-    const body = tx.body instanceof import_core8.Cell ? tx.body : typeof tx.body === "string" ? tx.body === "" ? void 0 : commentCell(tx.body) : tx.bodyBoc ? import_core8.Cell.fromBase64(tx.bodyBoc) : void 0;
+    const body = messageBody(tx);
     const init = this.stateInitOf(tx.stateInit);
     const message = (0, import_core8.internal)({ to: address, value, bounce: tx.bounceable ?? bounceable, ...body ? { body } : {}, ...init ? { init } : {} });
     return { message, ...tx.sendMode !== void 0 ? { mode: tx.sendMode } : {} };
@@ -922,14 +985,22 @@ var WalletAccountReadOnlyTon = class {
     if (amount <= 0n) throw new UnsafeTransactionError("zero-value", "Jetton amount must be positive.");
     const recipient = this.checkedAddress(o.recipient).address;
     const response = o.responseDestination ? this.checkedAddress(o.responseDestination).address : void 0;
+    if (response && !response.equals(this._address) && o.allowForeignResponseDestination !== true) {
+      throw new UnsafeTransactionError("foreign-response-destination", `The excess TON of this jetton transfer would go to ${response.toString()}, not to this wallet; pass allowForeignResponseDestination to allow it.`);
+    }
+    const forwardTon = o.forwardTonAmount !== void 0 ? big(o.forwardTonAmount) : 1n;
+    const attached = o.attachedValue !== void 0 ? big(o.attachedValue) : (this._config.jettonAttachedValue !== void 0 ? big(this._config.jettonAttachedValue) : DEFAULT_JETTON_ATTACHED) + forwardTon;
+    const maxAttached = this._config.maxJettonAttachedValue !== void 0 ? big(this._config.maxJettonAttachedValue) : DEFAULT_MAX_JETTON_ATTACHED;
+    if (attached > maxAttached || forwardTon > attached) {
+      throw new UnsafeTransactionError("attached-value", `A jetton transfer may attach at most ${maxAttached} nanotons, forwardTonAmount included (asked: ${attached}, forward ${forwardTon}); raise config.maxJettonAttachedValue if this is intended.`);
+    }
     const jw = await this.getJettonWalletAddress(o.token);
     await this.jettonWalletData(o.token, jw);
-    const forwardTonAmount = o.forwardTonAmount !== void 0 ? big(o.forwardTonAmount) : 1n;
+    const forwardTonAmount = forwardTon;
     if (o.memo !== void 0 && o.forwardPayload !== void 0) throw new UnsafeTransactionError("memo-and-payload", "Pass either memo or forwardPayload, not both: a jetton transfer carries one forward payload.");
     const payload = o.forwardPayload ?? o.memo;
     const forwardPayload = payload === void 0 ? null : typeof payload === "string" ? commentCell(payload) : payload;
     const body = (0, import_core8.beginCell)().storeUint(JETTON_TRANSFER_OP2, 32).storeUint(o.queryId !== void 0 ? BigInt(o.queryId) : randomQueryId(), 64).storeCoins(amount).storeAddress(recipient).storeAddress(response ?? this._address).storeMaybeRef(o.customPayload ?? null).storeCoins(forwardTonAmount).storeMaybeRef(forwardPayload).endCell();
-    const attached = o.attachedValue !== void 0 ? big(o.attachedValue) : (this._config.jettonAttachedValue !== void 0 ? big(this._config.jettonAttachedValue) : DEFAULT_JETTON_ATTACHED) + forwardTonAmount;
     return { message: (0, import_core8.internal)({ to: jw, value: attached, bounce: true, body }) };
   }
   toMessages(tx) {
@@ -1046,12 +1117,12 @@ function randomQueryId() {
 
 // src/account.ts
 var import_core9 = require("@anywalletkit/core");
-var import_buffer5 = require("buffer");
+var import_buffer6 = require("buffer");
 var import_core10 = require("@ton/core");
 
 // src/tonconnect.ts
 var import_sha2 = require("@noble/hashes/sha2.js");
-var import_buffer4 = require("buffer");
+var import_buffer5 = require("buffer");
 var utf82 = (s) => new TextEncoder().encode(s);
 var int32BE = (n) => {
   const b = new Uint8Array(4);
@@ -1086,7 +1157,7 @@ function checkCommon(address, domain, timestamp) {
 function base64Bytes(raw) {
   const s = raw.replace(/[\t\n\f\r ]/g, "");
   if (!/^[A-Za-z0-9+/]*={0,2}$/.test(s) || s.replace(/=+$/, "").length % 4 === 1) throw new TypeError("signData binary payload must be base64.");
-  return new Uint8Array(import_buffer4.Buffer.from(s, "base64"));
+  return new Uint8Array(import_buffer5.Buffer.from(s, "base64"));
 }
 function tonProofDigest(address, request) {
   checkCommon(address, request.domain, request.timestamp);
@@ -1120,13 +1191,20 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   needsNetwork = true;
   /** Derivation path, `ton-mnemonic`, or `external`. */
   path;
-  /** The signer that holds the key. */
-  signer;
+  /**
+   * The signer that holds the key, in a private field: not a property of the account, so no code
+   * the account is handed to (a protocol module, a logger) can reach it and sign around the
+   * account's checks (audit 2026-10-29 A1).
+   */
+  #signer;
+  /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+  signerKind;
   _readOnly;
   /** `publicKey` is the signer's 32-byte ed25519 key; the V5R1 address derives from it synchronously. */
   constructor(signer, publicKey, path, config = {}) {
     super(publicKey, config);
-    this.signer = (0, import_core9.requireCurve)(signer, "ed25519");
+    this.#signer = (0, import_core9.requireCurve)(signer, "ed25519");
+    this.signerKind = this.#signer.kind;
     this.path = path;
   }
   /** Back-compat: wrap a raw derived key in a {@link LocalSigner} (the account takes ownership; it cannot derive). */
@@ -1149,7 +1227,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   async sign(message) {
     const bytes = typeof message === "string" ? new TextEncoder().encode(message) : message;
     if (bytes.length === 32 || carriesKey(bytes, this.publicKey)) throw new MessageIsTransactionError();
-    return toHex(await this.signer.sign(bytes, { scheme: "ed25519", context: "ton-message" }));
+    return toHex(await this.#signer.sign(bytes, { scheme: "ed25519", context: "ton-message" }));
   }
   /**
    * TON Connect `ton_proof` for this wallet's address: the `proof` object of the connect reply. The
@@ -1158,20 +1236,20 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
    */
   async signTonProof(request) {
     const digest = tonProofDigest(this._address, request);
-    const signature = await this.signer.sign(digest, { scheme: "ed25519", context: "ton-proof" });
+    const signature = await this.#signer.sign(digest, { scheme: "ed25519", context: "ton-proof" });
     return {
       timestamp: request.timestamp,
       domain: { lengthBytes: new TextEncoder().encode(request.domain).length, value: request.domain },
       payload: request.payload,
-      signature: import_buffer5.Buffer.from(signature).toString("base64")
+      signature: import_buffer6.Buffer.from(signature).toString("base64")
     };
   }
   /** TON Connect `signData` (text / binary) for this wallet's address: the reply the dApp gets. */
   async signTonConnectData(request) {
     const digest = tonSignDataDigest(this._address, request);
-    const signature = await this.signer.sign(digest, { scheme: "ed25519", context: "ton-sign-data" });
+    const signature = await this.#signer.sign(digest, { scheme: "ed25519", context: "ton-sign-data" });
     return {
-      signature: import_buffer5.Buffer.from(signature).toString("base64"),
+      signature: import_buffer6.Buffer.from(signature).toString("base64"),
       address: this._address.toRawString(),
       timestamp: request.timestamp,
       domain: request.domain,
@@ -1199,7 +1277,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   bodyModes(body) {
     return parseV5R1Body(body)?.messages.map((m) => m.mode) ?? [];
   }
-  async signMessages(messages, limit, op) {
+  async #signMessages(messages, limit, op) {
     this.assertNoDrain(messages.map((m) => sendModeOf(m.mode)));
     const want = messages.reduce((sum, m) => sum + (m.message.info.type === "internal" ? m.message.info.value.coins : 0n), 0n);
     if (want > 0n) {
@@ -1208,7 +1286,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
     }
     const { signing } = await this.signingCell(messages);
     const fee = await this.preflight(v5r1PackUnsigned(signing), limit, op, want);
-    const signature = await this.signer.sign(new Uint8Array(signing.hash()), { scheme: "ed25519", context: "ton-external" });
+    const signature = await this.#signer.sign(new Uint8Array(signing.hash()), { scheme: "ed25519", context: "ton-external" });
     return { body: v5r1PackSigned(signing, signature), fee };
   }
   async preflight(body, limit, op, expectedTonOut) {
@@ -1236,7 +1314,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
       await this.preflight(tx, (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
       return tx.toBoc().toString("base64");
     }
-    const { body } = await this.signMessages(this.toMessages(tx), (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
+    const { body } = await this.#signMessages(this.toMessages(tx), (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
     return body.toBoc().toString("base64");
   }
   async broadcast(body) {
@@ -1255,14 +1333,14 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   async sendTransaction(tx, options = {}) {
     this.requireRpc("send transactions");
     if (tx instanceof import_core10.Cell) this.assertNoDrain(this.bodyModes(tx));
-    const { body, fee } = tx instanceof import_core10.Cell ? { body: tx, fee: await this.preflight(tx, (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction") } : await this.signMessages(this.toMessages(tx), (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
+    const { body, fee } = tx instanceof import_core10.Cell ? { body: tx, fee: await this.preflight(tx, (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction") } : await this.#signMessages(this.toMessages(tx), (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
     return { hash: await this.broadcast(body), fee };
   }
   /** TON (no `token`) or jetton transfer. */
   async transfer(o, writeOptions = {}) {
     this.requireRpc("transfer tokens");
     const message = o.token ? await this.jettonTransferMessage(o) : this.transactionMessage({ to: o.recipient, value: o.amount, ...o.memo !== void 0 ? { body: o.memo } : {} });
-    const { body, fee } = await this.signMessages([message], (0, import_core9.feeLimit)(this._config.transferMaxFee, writeOptions), "transfer");
+    const { body, fee } = await this.#signMessages([message], (0, import_core9.feeLimit)(this._config.transferMaxFee, writeOptions), "transfer");
     return { hash: await this.broadcast(body), fee };
   }
   /** The same wallet as a {@link WalletAccountReadOnlyTon}. */
@@ -1272,7 +1350,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   }
   /** Disposes the signer: a local key is zeroized, an external one is released. */
   dispose() {
-    this.signer.dispose();
+    this.#signer.dispose();
   }
 };
 
@@ -1359,7 +1437,7 @@ var WalletManagerTon = class _WalletManagerTon extends import_core11.WalletManag
 
 // src/history.ts
 var import_core12 = require("@ton/core");
-var import_buffer6 = require("buffer");
+var import_buffer7 = require("buffer");
 var HistoryUnavailableError = class extends Error {
   chain;
   reason;
@@ -1376,12 +1454,12 @@ var DEFAULT_LIMIT = 25;
 var MAX_LIMIT = 100;
 var DEFAULT_TIMEOUT_MS3 = 15e3;
 function encodeCursor(c) {
-  return import_buffer6.Buffer.from(JSON.stringify(c), "utf8").toString("base64");
+  return import_buffer7.Buffer.from(JSON.stringify(c), "utf8").toString("base64");
 }
 function decodeCursor(s) {
   let parsed;
   try {
-    parsed = JSON.parse(import_buffer6.Buffer.from(s, "base64").toString("utf8"));
+    parsed = JSON.parse(import_buffer7.Buffer.from(s, "base64").toString("utf8"));
   } catch {
     throw new Error("@anywalletkit/wallet-ton: malformed history cursor");
   }
@@ -1633,7 +1711,7 @@ function mapTonapiEvent(chain, address, own, event, valueFlow) {
 var TEXT_COMMENT_OP = "0x00000000";
 function mapToncenterTransaction(chain, address, row) {
   const own = row.account.toLowerCase();
-  const hash = import_buffer6.Buffer.from(row.hash, "base64").toString("hex");
+  const hash = import_buffer7.Buffer.from(row.hash, "base64").toString("hex");
   const d = row.description;
   const failed = d?.aborted === true || d?.compute_ph?.skipped !== true && d?.compute_ph?.success === false || d?.action?.success === false;
   const transfers = [];