@anywalletkit/wallet-ton 0.4.0 → 0.7.0

package/dist/index.d.cts

@@ -65,6 +65,12 @@ interface TonConfig {
     simulate?: boolean;
     /** Seconds a signed external stays valid (default 60, max 600). */
     validUntilSeconds?: number;
+    /**
+     * Most milliseconds a send waits for this account's previous transfer to move the wallet's seqno
+     * before signing the next one (default 60 000). A transfer signed at the same seqno would never
+     * execute; past this wait the send throws instead.
+     */
+    pendingSeqnoTimeoutMs?: number;
     /** Nanotons attached to a jetton transfer on top of `forwardTonAmount` (default 0.05 TON). */
     jettonAttachedValue?: bigint | number | string;
     /**
@@ -267,7 +273,7 @@ declare function tonCenterEndpoint(endpoint: TonEndpoint, opts?: {
     fetch?: typeof fetch;
     timeoutMs?: number;
 }): TonRpc;
-/** An endpoint answered with a refusal (`ok: false`): nothing was taken. A thrown fetch, a timeout or a non-JSON body may have been. */
+/** An endpoint answered with a node refusal (toncenter's `ok: false` envelope): nothing was taken. A thrown fetch, a timeout, a non-JSON body or a gateway error may have been. */
 declare function isAnsweredRefusal(e: unknown): boolean;
 /** One RPC, or a failover RPC walking the configured list (`retries` extra rounds after the first full pass). */
 declare function createTonRpc(config: TonConfig): TonRpc | undefined;
@@ -638,7 +644,7 @@ declare class WalletAccountReadOnlyTon implements IWalletAccountReadOnly {
     protected toMessages(tx: TonTransaction | TonTransaction[]): V5R1Message[];
     protected validUntil(): number;
     /** The cell to sign for `messages` at the CURRENT seqno (fetched fresh every time). */
-    protected signingCell(messages: V5R1Message[]): Promise<{
+    protected signingCell(messages: V5R1Message[], knownSeqno?: number): Promise<{
         signing: Cell;
         seqno: number;
         validUntil: number;
@@ -749,9 +755,17 @@ declare class WalletAccountTon extends WalletAccountReadOnlyTon implements IWall
     readonly needsNetwork = true;
     /** Derivation path, `ton-mnemonic`, or `external`. */
     readonly path: string;
-    /** The signer that holds the key. */
-    readonly signer: Signer;
+    /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+    readonly signerKind: Signer['kind'];
     private _readOnly;
+    /**
+     * The last external this account broadcast (accepted, or maybe sent) and when it expires. Until
+     * the wallet's seqno moves past it, a new message signed at the chain seqno would carry the same
+     * seqno and silently never execute, so the next send waits for it first.
+     */
+    private _inFlight;
+    /** Tail of this account's send queue: seqno → sign → broadcast runs one send at a time. */
+    private _sendTail;
     /** `publicKey` is the signer's 32-byte ed25519 key; the V5R1 address derives from it synchronously. */
     constructor(signer: Signer, publicKey: Uint8Array, path: string, config?: TonConfig);
     /** Back-compat: wrap a raw derived key in a {@link LocalSigner} (the account takes ownership; it cannot derive). */

package/dist/index.d.ts

@@ -65,6 +65,12 @@ interface TonConfig {
     simulate?: boolean;
     /** Seconds a signed external stays valid (default 60, max 600). */
     validUntilSeconds?: number;
+    /**
+     * Most milliseconds a send waits for this account's previous transfer to move the wallet's seqno
+     * before signing the next one (default 60 000). A transfer signed at the same seqno would never
+     * execute; past this wait the send throws instead.
+     */
+    pendingSeqnoTimeoutMs?: number;
     /** Nanotons attached to a jetton transfer on top of `forwardTonAmount` (default 0.05 TON). */
     jettonAttachedValue?: bigint | number | string;
     /**
@@ -267,7 +273,7 @@ declare function tonCenterEndpoint(endpoint: TonEndpoint, opts?: {
     fetch?: typeof fetch;
     timeoutMs?: number;
 }): TonRpc;
-/** An endpoint answered with a refusal (`ok: false`): nothing was taken. A thrown fetch, a timeout or a non-JSON body may have been. */
+/** An endpoint answered with a node refusal (toncenter's `ok: false` envelope): nothing was taken. A thrown fetch, a timeout, a non-JSON body or a gateway error may have been. */
 declare function isAnsweredRefusal(e: unknown): boolean;
 /** One RPC, or a failover RPC walking the configured list (`retries` extra rounds after the first full pass). */
 declare function createTonRpc(config: TonConfig): TonRpc | undefined;
@@ -638,7 +644,7 @@ declare class WalletAccountReadOnlyTon implements IWalletAccountReadOnly {
     protected toMessages(tx: TonTransaction | TonTransaction[]): V5R1Message[];
     protected validUntil(): number;
     /** The cell to sign for `messages` at the CURRENT seqno (fetched fresh every time). */
-    protected signingCell(messages: V5R1Message[]): Promise<{
+    protected signingCell(messages: V5R1Message[], knownSeqno?: number): Promise<{
         signing: Cell;
         seqno: number;
         validUntil: number;
@@ -749,9 +755,17 @@ declare class WalletAccountTon extends WalletAccountReadOnlyTon implements IWall
     readonly needsNetwork = true;
     /** Derivation path, `ton-mnemonic`, or `external`. */
     readonly path: string;
-    /** The signer that holds the key. */
-    readonly signer: Signer;
+    /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+    readonly signerKind: Signer['kind'];
     private _readOnly;
+    /**
+     * The last external this account broadcast (accepted, or maybe sent) and when it expires. Until
+     * the wallet's seqno moves past it, a new message signed at the chain seqno would carry the same
+     * seqno and silently never execute, so the next send waits for it first.
+     */
+    private _inFlight;
+    /** Tail of this account's send queue: seqno → sign → broadcast runs one send at a time. */
+    private _sendTail;
     /** `publicKey` is the signer's 32-byte ed25519 key; the V5R1 address derives from it synchronously. */
     constructor(signer: Signer, publicKey: Uint8Array, path: string, config?: TonConfig);
     /** Back-compat: wrap a raw derived key in a {@link LocalSigner} (the account takes ownership; it cannot derive). */

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   rawTonAddress,
   tonExplorerTxUrl,
   valueFlowTransfers
-} from "./chunk-ZFENRKRW.js";
+} from "./chunk-WU4RNRQJ.js";
 
 // src/buffer-global.ts
 import { Buffer } from "buffer";
@@ -95,12 +95,19 @@ function tonCenterEndpoint(endpoint, opts = {}) {
       }
       if (!res.ok || json.ok !== true) {
         const detail = typeof json.error === "string" ? json.error : JSON.stringify(json.error ?? json);
-        throw Object.assign(new NetworkError(`${method}: ${detail} (HTTP ${res.status})`, { provider: url }), { answered: true });
+        const err = new NetworkError(`${method}: ${detail} (HTTP ${res.status})`, { provider: url });
+        throw isNodeRefusal(res.status, json) ? Object.assign(err, { answered: true }) : err;
       }
       return json.result;
     }
   };
 }
+var UNKNOWN_STATUS = /* @__PURE__ */ new Set([408, 502, 503, 504]);
+function isNodeRefusal(status, json) {
+  if (UNKNOWN_STATUS.has(status)) return false;
+  if (json.ok !== false || typeof json.error !== "string" || json.error.trim() === "") return false;
+  return !/time[ds]? ?out|timed out|deadline/i.test(json.error);
+}
 function isAnsweredRefusal(e) {
   return e?.answered === true;
 }
@@ -950,8 +957,8 @@ var WalletAccountReadOnlyTon = class {
     return Math.floor(Date.now() / 1e3) + seconds;
   }
   /** The cell to sign for `messages` at the CURRENT seqno (fetched fresh every time). */
-  async signingCell(messages) {
-    const seqno = await this.getSeqno();
+  async signingCell(messages, knownSeqno) {
+    const seqno = knownSeqno ?? await this.getSeqno();
     const validUntil = this.validUntil();
     return { signing: v5r1SigningMessage({ walletId: this._walletId, validUntil, seqno, messages }), seqno, validUntil };
   }
@@ -1112,6 +1119,8 @@ function tonSignDataDigest(address, request) {
 }
 
 // src/account.ts
+var PENDING_SEQNO_TIMEOUT_MS = 6e4;
+var PENDING_SEQNO_POLL_MS = 1500;
 var toHex = (u8) => Array.from(u8, (b) => b.toString(16).padStart(2, "0")).join("");
 var carriesKey = (bytes, key) => {
   outer: for (let i = 0; i + key.length <= bytes.length; i++) {
@@ -1125,13 +1134,28 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   needsNetwork = true;
   /** Derivation path, `ton-mnemonic`, or `external`. */
   path;
-  /** The signer that holds the key. */
-  signer;
+  /**
+   * The signer that holds the key, in a private field: not a property of the account, so no code
+   * the account is handed to (a protocol module, a logger) can reach it and sign around the
+   * account's checks (audit 2026-10-29 A1).
+   */
+  #signer;
+  /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+  signerKind;
   _readOnly;
+  /**
+   * The last external this account broadcast (accepted, or maybe sent) and when it expires. Until
+   * the wallet's seqno moves past it, a new message signed at the chain seqno would carry the same
+   * seqno and silently never execute, so the next send waits for it first.
+   */
+  _inFlight;
+  /** Tail of this account's send queue: seqno → sign → broadcast runs one send at a time. */
+  _sendTail = Promise.resolve();
   /** `publicKey` is the signer's 32-byte ed25519 key; the V5R1 address derives from it synchronously. */
   constructor(signer, publicKey, path, config = {}) {
     super(publicKey, config);
-    this.signer = requireCurve(signer, "ed25519");
+    this.#signer = requireCurve(signer, "ed25519");
+    this.signerKind = this.#signer.kind;
     this.path = path;
   }
   /** Back-compat: wrap a raw derived key in a {@link LocalSigner} (the account takes ownership; it cannot derive). */
@@ -1154,7 +1178,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   async sign(message) {
     const bytes = typeof message === "string" ? new TextEncoder().encode(message) : message;
     if (bytes.length === 32 || carriesKey(bytes, this.publicKey)) throw new MessageIsTransactionError();
-    return toHex(await this.signer.sign(bytes, { scheme: "ed25519", context: "ton-message" }));
+    return toHex(await this.#signer.sign(bytes, { scheme: "ed25519", context: "ton-message" }));
   }
   /**
    * TON Connect `ton_proof` for this wallet's address: the `proof` object of the connect reply. The
@@ -1163,7 +1187,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
    */
   async signTonProof(request) {
     const digest = tonProofDigest(this._address, request);
-    const signature = await this.signer.sign(digest, { scheme: "ed25519", context: "ton-proof" });
+    const signature = await this.#signer.sign(digest, { scheme: "ed25519", context: "ton-proof" });
     return {
       timestamp: request.timestamp,
       domain: { lengthBytes: new TextEncoder().encode(request.domain).length, value: request.domain },
@@ -1174,7 +1198,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   /** TON Connect `signData` (text / binary) for this wallet's address: the reply the dApp gets. */
   async signTonConnectData(request) {
     const digest = tonSignDataDigest(this._address, request);
-    const signature = await this.signer.sign(digest, { scheme: "ed25519", context: "ton-sign-data" });
+    const signature = await this.#signer.sign(digest, { scheme: "ed25519", context: "ton-sign-data" });
     return {
       signature: Buffer6.from(signature).toString("base64"),
       address: this._address.toRawString(),
@@ -1204,16 +1228,35 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   bodyModes(body) {
     return parseV5R1Body(body)?.messages.map((m) => m.mode) ?? [];
   }
-  async #signMessages(messages, limit, op) {
+  /**
+   * The seqno to sign the next send at: the chain's, once it has moved past this account's last
+   * broadcast. While that external can still land (before its valid_until) the seqno is polled, up
+   * to `pendingSeqnoTimeoutMs`; an expired one that never landed is forgotten.
+   */
+  async #nextSendSeqno() {
+    const timeout = this._config.pendingSeqnoTimeoutMs ?? PENDING_SEQNO_TIMEOUT_MS;
+    const deadline = Date.now() + timeout;
+    for (; ; ) {
+      const chain = await this.getSeqno();
+      const prev = this._inFlight;
+      if (!prev || chain > prev.seqno || Date.now() / 1e3 > prev.validUntil) {
+        this._inFlight = void 0;
+        return chain;
+      }
+      if (Date.now() >= deadline) throw new Error(`The previous transfer is still pending (seqno ${prev.seqno} has not moved): wait for it to land, then send again.`);
+      await new Promise((resolve) => setTimeout(resolve, Math.min(PENDING_SEQNO_POLL_MS, Math.max(0, deadline - Date.now()))));
+    }
+  }
+  async #signMessages(messages, limit, op, forSend = false) {
     this.assertNoDrain(messages.map((m) => sendModeOf(m.mode)));
     const want = messages.reduce((sum, m) => sum + (m.message.info.type === "internal" ? m.message.info.value.coins : 0n), 0n);
     if (want > 0n) {
       const balance = await this.getBalance();
       if (balance < want) throw new UnsafeTransactionError("insufficient-balance", `Insufficient TON balance: the messages carry ${want} nanotons, the wallet holds ${balance} (fees come on top).`);
     }
-    const { signing } = await this.signingCell(messages);
+    const { signing } = await this.signingCell(messages, forSend ? await this.#nextSendSeqno() : void 0);
     const fee = await this.preflight(v5r1PackUnsigned(signing), limit, op, want);
-    const signature = await this.signer.sign(new Uint8Array(signing.hash()), { scheme: "ed25519", context: "ton-external" });
+    const signature = await this.#signer.sign(new Uint8Array(signing.hash()), { scheme: "ed25519", context: "ton-external" });
     return { body: v5r1PackSigned(signing, signature), fee };
   }
   async preflight(body, limit, op, expectedTonOut) {
@@ -1248,26 +1291,47 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
     const rpc = this.requireRpc("send transactions");
     const init = await this.initIfNeeded();
     const hash = body.hash().toString("hex");
+    const parsed = parseV5R1Body(body);
+    const sent = () => {
+      if (parsed) this._inFlight = { seqno: parsed.seqno, validUntil: parsed.validUntil };
+    };
     try {
       await rpc.sendBoc(v5r1ExternalMessage(this._address, body, init));
     } catch (e) {
       if (isAnsweredRefusal(e)) throw e;
+      sent();
       throw new BroadcastUnknownError(hash, e);
     }
+    sent();
     return hash;
   }
+  /**
+   * One send at a time per account: two sends started together would read the same seqno before
+   * either is broadcast. A failed send does not block the next.
+   */
+  #serial(run) {
+    const next = this._sendTail.then(run);
+    this._sendTail = next.then(() => void 0, () => void 0);
+    return next;
+  }
   /** Sign and broadcast; `hash` is the body hash (hex) — resolve it with getTransactionReceipt. */
-  async sendTransaction(tx, options = {}) {
+  sendTransaction(tx, options = {}) {
+    return this.#serial(() => this.#sendTransactionNow(tx, options));
+  }
+  async #sendTransactionNow(tx, options) {
     this.requireRpc("send transactions");
     if (tx instanceof Cell5) this.assertNoDrain(this.bodyModes(tx));
-    const { body, fee } = tx instanceof Cell5 ? { body: tx, fee: await this.preflight(tx, feeLimit(this._config.transactionMaxFee, options), "transaction") } : await this.#signMessages(this.toMessages(tx), feeLimit(this._config.transactionMaxFee, options), "transaction");
+    const { body, fee } = tx instanceof Cell5 ? { body: tx, fee: await this.preflight(tx, feeLimit(this._config.transactionMaxFee, options), "transaction") } : await this.#signMessages(this.toMessages(tx), feeLimit(this._config.transactionMaxFee, options), "transaction", true);
     return { hash: await this.broadcast(body), fee };
   }
   /** TON (no `token`) or jetton transfer. */
-  async transfer(o, writeOptions = {}) {
+  transfer(o, writeOptions = {}) {
+    return this.#serial(() => this.#transferNow(o, writeOptions));
+  }
+  async #transferNow(o, writeOptions) {
     this.requireRpc("transfer tokens");
     const message = o.token ? await this.jettonTransferMessage(o) : this.transactionMessage({ to: o.recipient, value: o.amount, ...o.memo !== void 0 ? { body: o.memo } : {} });
-    const { body, fee } = await this.#signMessages([message], feeLimit(this._config.transferMaxFee, writeOptions), "transfer");
+    const { body, fee } = await this.#signMessages([message], feeLimit(this._config.transferMaxFee, writeOptions), "transfer", true);
     return { hash: await this.broadcast(body), fee };
   }
   /** The same wallet as a {@link WalletAccountReadOnlyTon}. */
@@ -1277,7 +1341,7 @@ var WalletAccountTon = class _WalletAccountTon extends WalletAccountReadOnlyTon
   }
   /** Disposes the signer: a local key is zeroized, an external one is released. */
   dispose() {
-    this.signer.dispose();
+    this.#signer.dispose();
   }
 };