@defdone/annon 0.0.0-stage → 0.1.0-alpha.1

package/dist/errors.js

@@ -0,0 +1,300 @@
+/** Browser-safe public failures. Upstream diagnostics never cross a public boundary. */
+export const annonErrorCodes = [
+    'invalid_arguments',
+    'invalid_config',
+    'invalid_record',
+    'config_conflict',
+    'agent_policy',
+    'human_only',
+    'confirmation_required',
+    'sale_not_approved',
+    'trust_required',
+    'signer_required',
+    'signer_init_only',
+    'credentials_required',
+    'backup_secret_required',
+    'work_dir_required',
+    'max_price_required',
+    'budget_required',
+    'budget_exceeded',
+    'base_rpc_required',
+    'transport_required',
+    'near_wallet_required',
+    'base_wallet_required',
+    'base_unavailable',
+    'route_unavailable',
+    'file_required',
+    'offer_required',
+    'purchase_required',
+    'origin_required',
+    'origin_asset_required',
+    'origin_not_allowed',
+    'resource_not_allowed',
+    'path_not_allowed',
+    'output_exists',
+    'unknown_file',
+    'already_registered',
+    'taken_down',
+    'sales_stopped',
+    'unknown_moderator',
+    'storage_required',
+    'funding_refused',
+    'file_storage_low',
+    'protocol_fee_above_max',
+    'price_mismatch',
+    'price_above_max',
+    'recipient_mismatch',
+    'file_mismatch',
+    'network_mismatch',
+    'token_mismatch',
+    'method_mismatch',
+    'untrusted_contract',
+    'file_invalid',
+    'bad_requirements',
+    'insufficient_balance',
+    'smart_wallet_unsupported',
+    'bad_signature',
+    'payment_rejected',
+    'purchase_open',
+    'payment_id_conflict',
+    'payment_expired',
+    'payment_not_found',
+    'payment_used',
+    'quote_refused',
+    'quote_expired',
+    'settlement_pending',
+    'transaction_uncertain',
+    'not_sponsored',
+    'not_buyer',
+    'bad_magic',
+    'unsupported_version',
+    'bad_chunk_size',
+    'header_too_large',
+    'bad_header',
+    'bad_stanza',
+    'file_id_mismatch',
+    'cipher_hash_mismatch',
+    'seller_signature_invalid',
+    'bad_body_length',
+    'chunk_hash_mismatch',
+    'no_usable_stanza',
+    'key_unwrap_failed',
+    'header_mac_invalid',
+    'chunk_invalid',
+    'meta_invalid',
+    'preview_invalid',
+    'ckd_failed',
+    'ckd_invalid',
+    'rejected',
+    'wrong_chain',
+    'wrong_identity',
+    'invalid_signature',
+    'missing_method',
+    'invalid_response',
+    'wallet_error',
+    'store_conflict',
+    'lease_busy',
+    'source_changed',
+    'sell_incomplete',
+    'recovery_not_final',
+    'transport',
+    'refused',
+    'bad_request',
+    'bad_deadline',
+    'limited',
+    'duplicate',
+    'in_flight',
+    'unavailable',
+    'disabled',
+    'rate_limited',
+    'budget',
+    'busy',
+    'not_found',
+    'internal',
+    'relayer_unavailable',
+    'relayer_rate_limited',
+    'base_rpc_rate_limited',
+    'near_rpc_rate_limited',
+    'host_payment_failed',
+    'facilitator_busy',
+    'bad_response',
+    'not_authorized',
+    'cancelled',
+    'too_large',
+    'download_limited',
+    'download_in_progress',
+    'file_expired',
+    'upload_expired',
+    'upload_conflict',
+    'upload_incomplete',
+    'host_capacity',
+    'operation_failed',
+];
+const messages = {
+    route_unavailable: 'This file does not support the selected payment route.',
+    host_payment_failed: 'Payment submission failed. Keep the saved purchase and check final status before retrying.',
+    bad_request: 'The request is invalid. Check its fields before retrying.',
+    bad_deadline: 'The authorization deadline is invalid or expired.',
+    invalid_arguments: 'Invalid arguments. Run annon --help.',
+    invalid_record: 'Invalid saved record. Export necessary test evidence and clear development state.',
+    transport: 'The service could not be reached. Keep saved state and retry later.',
+    recovery_not_final: 'The recovery grant is not final. Resume the saved recovery later.',
+    invalid_signature: 'The wallet did not authorize the exact requested message.',
+    operation_failed: 'Operation failed. Check configuration, funding and final purchase status before retrying. Saved encrypted records are retained.',
+    transaction_uncertain: 'Transaction submission is uncertain. Check the saved purchase and transaction hash before retrying.',
+    quote_refused: 'The 1Click quote was refused. Review the source asset and amount before retrying.',
+    base_rpc_rate_limited: 'The Base RPC is rate limiting requests. Configure a Base RPC endpoint with an API key (baseRpc).',
+    near_rpc_rate_limited: 'Configure a NEAR RPC endpoint with an API key (nearRpc).',
+    budget_exceeded: 'The persisted spending budget is exhausted.',
+    download_limited: 'Download limit reached. Wait before downloading again.',
+    download_in_progress: 'Another download is active. Wait before retrying.',
+    rate_limited: 'The host is busy. Wait before retrying.',
+    unavailable: 'The service is temporarily unavailable. Wait before retrying.',
+    transport_required: 'Configure a trusted relayer before a Base purchase.',
+    relayer_unavailable: 'Base sponsorship checks are unavailable. Retry before paying.',
+    not_sponsored: 'This listing does not qualify for Base sponsorship. Do not pay through this route.',
+    wrong_identity: 'The wallet does not control the required identity.',
+    settlement_pending: 'The purchase is still settling. Wait before retrying the saved purchase.',
+    protocol_fee_above_max: 'The advertised protocol fee exceeds maxProtocolFee. Review the fee in human configuration.',
+    funding_refused: 'File funding was refused. Correct the cause before retrying.',
+    file_storage_low: 'This file needs more purchase storage funding before a NEAR or 1Click payment.',
+    source_changed: 'The source changed between passes. Resume sell with the original plaintext and saved fileId.',
+    quote_expired: 'The 1Click quote expired. Run buy again.',
+    storage_required: 'Prepay storage with storageDeposit before register or reopen, then resume the saved operation.',
+    unknown_file: 'The configured contract has no such file. Check the file ID and deployment.',
+    taken_down: 'The moderator has taken down this file; key release is blocked.',
+    sales_stopped: 'The seller has stopped new sales. Use a saved purchase to open an earlier purchase.',
+    unknown_moderator: "Review this file's moderator and explicitly accept it with the moderator option before buying.",
+    price_above_max: 'The registered price exceeds maxPrice. Review the current terms before buying.',
+    untrusted_contract: 'The offer names a different contract. Review that deployment and configure it explicitly.',
+    network_mismatch: 'The deployment network or USDC asset differs from the configured network. Check the configuration.',
+    store_conflict: 'Another process updated this purchase. Keep the encrypted state and check status before retrying.',
+    file_invalid: 'The file failed SDK verification. Obtain the registered file from its host.',
+    file_mismatch: 'The file or offer differs from its registered commitment. Obtain the correct file or offer.',
+    bad_requirements: 'The host offer failed SDK validation. Obtain an updated Annon offer.',
+    not_authorized: 'The host has not accepted this final grant. Check final purchase status and the resource URL.',
+};
+export function isAnnonErrorCode(code) {
+    return typeof code === 'string' && annonErrorCodes.includes(code);
+}
+export function isTransient(error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : undefined;
+    return (code === 'transport' || code === 'base_rpc_rate_limited' || code === 'near_rpc_rate_limited');
+}
+export class AnnonError extends Error {
+    code;
+    constructor(code, message = messages[code] ?? `${code.replaceAll('_', ' ')}.`, options) {
+        super(message, options);
+        this.code = code;
+        this.name = 'AnnonError';
+    }
+}
+const waiting = new Set([
+    'budget',
+    'settlement_pending',
+    'transaction_uncertain',
+    'transport',
+    'base_rpc_rate_limited',
+    'near_rpc_rate_limited',
+    'relayer_unavailable',
+    'relayer_rate_limited',
+    'download_limited',
+    'download_in_progress',
+    'rate_limited',
+    'unavailable',
+    'in_flight',
+    'busy',
+    'facilitator_busy',
+    'lease_busy',
+    'recovery_not_final',
+    'host_capacity',
+    'limited',
+]);
+const approval = new Set([
+    'agent_policy',
+    'human_only',
+    'confirmation_required',
+    'sale_not_approved',
+    'trust_required',
+]);
+const input = new Set([
+    'invalid_arguments',
+    'invalid_config',
+    'invalid_record',
+    'config_conflict',
+    'agent_policy',
+    'human_only',
+    'confirmation_required',
+    'sale_not_approved',
+    'trust_required',
+    'signer_required',
+    'signer_init_only',
+    'credentials_required',
+    'backup_secret_required',
+    'work_dir_required',
+    'max_price_required',
+    'budget_required',
+    'base_rpc_required',
+    'transport_required',
+    'near_wallet_required',
+    'base_wallet_required',
+    'base_unavailable',
+    'route_unavailable',
+    'file_required',
+    'offer_required',
+    'purchase_required',
+    'origin_required',
+    'origin_asset_required',
+    'origin_not_allowed',
+    'resource_not_allowed',
+    'path_not_allowed',
+    'output_exists',
+    'network_mismatch',
+    'bad_request',
+    'bad_deadline',
+]);
+export function toPublicError(error) {
+    const e = error && typeof error === 'object' ? error : {};
+    if (!isAnnonErrorCode(e.code))
+        return {
+            code: 'operation_failed',
+            message: messages.operation_failed ?? 'Operation failed.',
+            exitCode: 1,
+        };
+    const code = e.code;
+    const adapter = error instanceof AnnonError && error.name === 'AdapterError'
+        ? error
+        : undefined;
+    const id = (v) => typeof v === 'string' && /^0x[0-9a-f]{64}$/.test(v);
+    const seconds = typeof e.retryAfterSeconds === 'number' && e.retryAfterSeconds >= 0
+        ? Math.ceil(e.retryAfterSeconds)
+        : NaN;
+    const retryAfterSeconds = Number.isSafeInteger(seconds)
+        ? seconds
+        : code === 'settlement_pending'
+            ? 30
+            : undefined;
+    return {
+        code,
+        message: (code === 'route_unavailable' ? messages.route_unavailable : adapter?.message) ??
+            (messages[code] ?? `${code.replaceAll('_', ' ')}.`) +
+                (error instanceof AnnonError && error.name === 'SellError' && code !== 'source_changed'
+                    ? ' Resume sell with the original plaintext and saved fileId.'
+                    : ''),
+        exitCode: (code === 'route_unavailable' ? 2 : adapter?.exitCode) ??
+            (waiting.has(code) ? 4 : approval.has(code) ? 3 : input.has(code) ? 2 : 1),
+        ...(id(e.fileId) ? { fileId: e.fileId } : {}),
+        ...(id(e.purchaseId) ? { purchaseId: e.purchaseId } : {}),
+        ...(typeof e.txHash === 'string' ? { txHash: e.txHash } : {}),
+        ...(typeof e.minimumAmountUsdc === 'string' &&
+            /^(0|[1-9][0-9]*)(\.[0-9]+)?$/.test(e.minimumAmountUsdc)
+            ? { minimumAmountUsdc: e.minimumAmountUsdc }
+            : {}),
+        ...(retryAfterSeconds !== undefined ? { retryAfterSeconds } : {}),
+    };
+}
+export function present(value, code = 'invalid_record') {
+    if (value === null || value === undefined)
+        throw new AnnonError(code);
+    return value;
+}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+export { Annon, type AnnonOptions, type Bought, type BuyOptions, type BuyRoute, SellError, type SellOptions, } from './api/annon.js';
+export type { HostedCheckpoint, Shared, ShareHosting, ShareOptions, ShareQuote, ShareStep, } from './api/sharing.js';
+export { PurchaseLeaseBusy } from './browser/purchases.js';
+export { BrowserWalletError, type BrowserWalletErrorCode } from './browser/wallets.js';
+export { DownloadError, type DownloadErrorCode } from './download/download.js';
+export { type UploadAuth, type UploadAuthorization, type UploadBaseSplit, type UploadBaseSplitResult, UploadClient, type UploadIntent, type UploadManifest, type UploadMetadata, type UploadPublished, type UploadStatus, uploadText, } from './download/upload.js';
+export { Pay2Error, type Pay2ErrorCode } from './envelope/pay2.js';
+export { blobSource, type ReplayableSource, type Spool } from './envelope/replay.js';
+export { SourceChangedError } from './envelope/stream.js';
+export { AnnonError, type AnnonErrorCode, isTransient, type PublicError, toPublicError, } from './errors.js';
+export { CkdError, type CkdErrorCode } from './keys/near-ckd.js';
+export { HTTP_RETRY_MAX_WAIT_SECONDS, MAX_PAY2_BYTES, MAX_PLAINTEXT_BYTES } from './limits.js';
+export { type FileStorageBalance, fileStorageBalance, NearError, type NearErrorCode, NearRpcRateLimited, } from './near/rpc.js';
+export { type FileFundingArgs, fileFundingText } from './near/texts.js';
+export { type Deposit, OneClick, type OneClickQuote, OneClickQuoteExpired, OneClickRefused, type Origin, originFromToken, type PollCheckpoint, type PollOptions, type QuotePreview, type SwapStatus, type Token, validateRefundAddress, } from './oneclick/oneclick.js';
+export { type EncryptedRecord, encryptedPurchaseStore, encryptedRecoveryStore, exportPurchase, exportRecovery, exportSell, exportSellerKey, importPurchase, importRecovery, importSell, importSellerKey, newBackupSecret, type RecoveryRecord, type SellerKeyRecord, type SellRecord, } from './pay/backup.js';
+export { BaseRpcRateLimited, PayError, type PayErrorCode } from './pay/base.js';
+export type { PurchaseRecord } from './pay/purchase.js';
+export { BASE_ELIGIBILITY_MAX_AGE_SECONDS, type BaseSponsorship, type BaseSponsorshipOptions, checkBaseSponsorship, validBaseSponsorship, } from './relay/capabilities.js';
+export { DEFAULT_MAX_PROTOCOL_FEE, type ProtocolFee } from './relay/fees.js';
+export { type Authorization, type Identity, identityText, parseIdentity, verifyAuthorization, } from './settle-near/identity.js';
+export { type BaseTerms, type NearTerms, type SettlementAssets, type Terms, termsHash, } from './settle-near/terms.js';
+export { type CatalogEntry, type CatalogQuery, type ConfiguredShop, canonicalManifestUrl, catalog, type DiscoveryConfig, type DiscoveryPage, type DiscoveryQuery, listShops, type Shop, type ShopFailure, type ShopManifest, type ShopProfile, type ShopRules, } from './shops/discovery.js';
+export { TransactionUncertain } from './wallet/uncertain.js';
+export { type EvmWallet, evmWallet, FileFundingRefused, fundFileStorage, type IdentityWallet, type NearWallet, nearKeyPairWallet, nearSelectorWallet, solanaWallet, storageDeposit, } from './wallet/wallet.js';

package/dist/index.js

@@ -0,0 +1,23 @@
+export { Annon, SellError, } from './api/annon.js';
+export { PurchaseLeaseBusy } from './browser/purchases.js';
+export { BrowserWalletError } from './browser/wallets.js';
+export { DownloadError } from './download/download.js';
+export { UploadClient, uploadText, } from './download/upload.js';
+export { Pay2Error } from './envelope/pay2.js';
+export { blobSource } from './envelope/replay.js';
+export { SourceChangedError } from './envelope/stream.js';
+export { AnnonError, isTransient, toPublicError, } from './errors.js';
+export { CkdError } from './keys/near-ckd.js';
+export { HTTP_RETRY_MAX_WAIT_SECONDS, MAX_PAY2_BYTES, MAX_PLAINTEXT_BYTES } from './limits.js';
+export { fileStorageBalance, NearError, NearRpcRateLimited, } from './near/rpc.js';
+export { fileFundingText } from './near/texts.js';
+export { OneClick, OneClickQuoteExpired, OneClickRefused, originFromToken, validateRefundAddress, } from './oneclick/oneclick.js';
+export { encryptedPurchaseStore, encryptedRecoveryStore, exportPurchase, exportRecovery, exportSell, exportSellerKey, importPurchase, importRecovery, importSell, importSellerKey, newBackupSecret, } from './pay/backup.js';
+export { BaseRpcRateLimited, PayError } from './pay/base.js';
+export { BASE_ELIGIBILITY_MAX_AGE_SECONDS, checkBaseSponsorship, validBaseSponsorship, } from './relay/capabilities.js';
+export { DEFAULT_MAX_PROTOCOL_FEE } from './relay/fees.js';
+export { identityText, parseIdentity, verifyAuthorization, } from './settle-near/identity.js';
+export { termsHash, } from './settle-near/terms.js';
+export { canonicalManifestUrl, catalog, listShops, } from './shops/discovery.js';
+export { TransactionUncertain } from './wallet/uncertain.js';
+export { evmWallet, FileFundingRefused, fundFileStorage, nearKeyPairWallet, nearSelectorWallet, solanaWallet, storageDeposit, } from './wallet/wallet.js';

package/dist/keys/near-ckd.d.ts

@@ -0,0 +1,47 @@
+import { AnnonError } from '../errors.js';
+declare const G1: import("@noble/curves/abstract/weierstrass.js").WeierstrassPointCons<bigint>;
+declare const G2: import("@noble/curves/abstract/weierstrass.js").WeierstrassPointCons<import("@noble/curves/abstract/tower.js").Fp2>;
+export type CkdErrorCode = 
+/** MPC didn't answer; the purchase stands and `reopen` gets the key. */
+'ckd_failed'
+/** An answer that isn't a valid key for this file and this one-time key. */
+ | 'ckd_invalid';
+export declare class CkdError extends AnnonError {
+    readonly code: CkdErrorCode;
+    constructor(code: CkdErrorCode, message?: string);
+}
+interface OneTimeKey {
+    /** The scalar `a`, 32 bytes big-endian. Persist only in an encrypted purchase or recovery record. */
+    secret: Uint8Array;
+    /** `A = a·G1` as the contract takes it: `bls12381g1:<base58 of 48 bytes>`. */
+    publicKey: string;
+    /** The same 48 bytes, for the payment nonce. */
+    publicKeyBytes: Uint8Array;
+}
+/** A fresh one-time key pair. */
+export declare function oneTimeKey(): OneTimeKey;
+/** @internal The key pair for a known scalar (tests, recovery from a stored job). */
+export declare function keyFromSecret(secret: Uint8Array): OneTimeKey;
+/** NEAR's `derive_app_id`: sha3-256 of `"near-mpc v0.1.0 app_id derivation:" + account + "," + path`. */
+export declare const appId: (account: string, path: string) => Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
+/** The app id of a file: the contract asks CKD for `file/<fileId, lowercase hex>`. */
+export declare const fileAppId: (contractId: string, fileId: Uint8Array) => Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
+interface OpenAnswerOptions {
+    /** The one-time secret whose public key went with the request. */
+    secret: Uint8Array;
+    /** `fileAppId(contractId, fileId)` for an Annon file. */
+    appId: Uint8Array;
+    /** `bls12381g2:…` read from the trusted contract's MPC account and CKD domain. */
+    mpcKey: string;
+}
+/**
+ * Turns the contract's return value into the file's CKD secret: the 48-byte G1 point the envelope
+ * takes as `ckdSecret`. Decrypts `big_c − a·big_y`, then checks it is MPC's BLS signature on this
+ * app id, `e(H(pk ‖ appId), pk) = e(sig, G2)`, so a wrong or forged answer never reaches the file.
+ */
+export declare function openAnswer(answer: unknown, opts: OpenAnswerOptions): Uint8Array;
+/** @internal The scheme on decoded points, as NEAR's vectors state it. */
+export declare function decrypt(a: bigint, Y: InstanceType<typeof G1>, C: InstanceType<typeof G1>, pk: InstanceType<typeof G2>, id: Uint8Array): import("@noble/curves/abstract/weierstrass.js").WeierstrassPoint<bigint>;
+/** @internal `H(pk, app_id)`: RFC 9380 hash to G1 over `pk_compressed (96 B) ‖ app_id`. */
+export declare const hashPoint: (pk: InstanceType<typeof G2>, id: Uint8Array) => import("@noble/curves/abstract/weierstrass.js").WeierstrassPoint<bigint>;
+export {};

package/dist/keys/near-ckd.js

@@ -0,0 +1,96 @@
+/**
+ * NEAR CKD on the client (`specs/pay2.md`, section 5.1): the one-time key a seller or buyer sends
+ * with `register`, `unlock` or `reopen`, and the checks that the secret NEAR MPC sends back is the
+ * right one before the envelope uses it. Same scheme as NEAR's own test vectors
+ * (`specs/vectors/ckd-near-mpc.json`).
+ */
+import { bls12_381 as bls } from '@noble/curves/bls12-381.js';
+import { sha3_256 } from '@noble/hashes/sha3.js';
+import { base58 } from '@scure/base';
+import { AnnonError } from '../errors.js';
+const G1 = bls.G1.Point;
+const G2 = bls.G2.Point;
+const Fr = bls.fields.Fr;
+const DST = 'NEAR BLS12381G1_XMD:SHA-256_SSWU_RO_';
+export class CkdError extends AnnonError {
+    code;
+    constructor(code, message = code) {
+        super(code, message);
+        this.code = code;
+        this.name = 'CkdError';
+    }
+}
+const fail = (code, message) => {
+    throw new CkdError(code, message);
+};
+/** A fresh one-time key pair. */
+export function oneTimeKey() {
+    const a = toScalar(bls.utils.randomSecretKey()) % Fr.ORDER;
+    return keyFromSecret(fromScalar(a === 0n ? 1n : a));
+}
+/** @internal The key pair for a known scalar (tests, recovery from a stored job). */
+export function keyFromSecret(secret) {
+    const A = G1.BASE.multiply(scalar(secret)).toBytes(true);
+    return { secret, publicKey: `bls12381g1:${base58.encode(A)}`, publicKeyBytes: A };
+}
+/** NEAR's `derive_app_id`: sha3-256 of `"near-mpc v0.1.0 app_id derivation:" + account + "," + path`. */
+export const appId = (account, path) => sha3_256(new TextEncoder().encode(`near-mpc v0.1.0 app_id derivation:${account},${path}`));
+/** The app id of a file: the contract asks CKD for `file/<fileId, lowercase hex>`. */
+export const fileAppId = (contractId, fileId) => appId(contractId, `file/${Array.from(fileId, (x) => x.toString(16).padStart(2, '0')).join('')}`);
+/**
+ * Turns the contract's return value into the file's CKD secret: the 48-byte G1 point the envelope
+ * takes as `ckdSecret`. Decrypts `big_c − a·big_y`, then checks it is MPC's BLS signature on this
+ * app id, `e(H(pk ‖ appId), pk) = e(sig, G2)`, so a wrong or forged answer never reaches the file.
+ */
+export function openAnswer(answer, opts) {
+    const a = answer;
+    if (a && typeof a.error === 'string')
+        fail('ckd_failed', a.error);
+    const Y = point(G1, a?.big_y, 'bls12381g1:', 48);
+    const C = point(G1, a?.big_c, 'bls12381g1:', 48);
+    const pk = point(G2, opts.mpcKey, 'bls12381g2:', 96);
+    return decrypt(scalar(opts.secret), Y, C, pk, opts.appId).toBytes(true);
+}
+/** @internal The scheme on decoded points, as NEAR's vectors state it. */
+export function decrypt(a, Y, C, pk, id) {
+    const sig = C.subtract(Y.multiply(a));
+    const H = hashPoint(pk, id);
+    let ok = false;
+    try {
+        // noble refuses to pair the identity point; that answer is invalid all the same.
+        ok = !sig.is0() && bls.fields.Fp12.eql(bls.pairing(H, pk), bls.pairing(sig, G2.BASE));
+    }
+    catch { }
+    if (!ok)
+        fail('ckd_invalid', 'the answer is not the key for this file and this one-time key');
+    return sig;
+}
+/** @internal `H(pk, app_id)`: RFC 9380 hash to G1 over `pk_compressed (96 B) ‖ app_id`. */
+export const hashPoint = (pk, id) => bls.shortSignatures.hash(new Uint8Array([...pk.toBytes(true), ...id]), DST);
+// Scalars are 32 bytes big-endian, as in NEAR's vectors.
+const toScalar = (b) => BigInt(`0x${Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('') || '0'}`);
+const fromScalar = (a) => Uint8Array.from(a.toString(16).padStart(64, '0').match(/../g) ?? [], (x) => Number.parseInt(x, 16));
+function scalar(secret) {
+    if (secret.length !== 32)
+        throw new TypeError('the one-time secret is 32 bytes');
+    const a = toScalar(secret);
+    if (a === 0n || a >= Fr.ORDER)
+        throw new TypeError('the one-time secret is not a valid scalar');
+    return a;
+}
+/** Decodes `prefix` + base58 into a point of the prime subgroup. */
+function point(group, s, prefix, len) {
+    if (typeof s !== 'string' || !s.startsWith(prefix))
+        return fail('ckd_invalid', 'bad point');
+    try {
+        const bytes = base58.decode(s.slice(prefix.length));
+        if (bytes.length !== len)
+            throw new Error('length');
+        // fromBytes rejects points off the curve or outside the prime subgroup (tested); a zero or
+        // otherwise wrong point fails the pairing check.
+        return group.fromBytes(bytes);
+    }
+    catch {
+        return fail('ckd_invalid', 'bad point');
+    }
+}

package/dist/limits.d.ts

@@ -0,0 +1,4 @@
+/** Decimal byte limits shared by every client transport. */
+export declare const MAX_PLAINTEXT_BYTES = 50000000;
+export declare const MAX_PAY2_BYTES = 50086016;
+export declare const HTTP_RETRY_MAX_WAIT_SECONDS = 60;

package/dist/limits.js

@@ -0,0 +1,4 @@
+/** Decimal byte limits shared by every client transport. */
+export const MAX_PLAINTEXT_BYTES = 50_000_000;
+export const MAX_PAY2_BYTES = 50_086_016;
+export const HTTP_RETRY_MAX_WAIT_SECONDS = 60;

package/dist/near/nep413.d.ts

@@ -0,0 +1,22 @@
+export interface NearMessage {
+    message: string;
+    recipient: string;
+    nonce: Uint8Array;
+    callbackUrl?: string;
+    state?: string;
+}
+export interface NearSignedMessage {
+    accountId: string;
+    publicKey: string;
+    signature: string;
+}
+export interface RecoveryProofContext {
+    contractId: string;
+    nearRpc: string;
+    callbackUrl?: string;
+}
+/** u32 tag (2^31+413), Borsh message, fixed nonce, recipient, Option<string> callbackUrl. */
+export declare function nep413Hash(p: NearMessage): Uint8Array;
+export declare function proveNearControl(accountId: string, text: string, context: RecoveryProofContext, signMessage: (p: NearMessage) => Promise<NearSignedMessage | undefined>): Promise<void>;
+/** Verify exact NEP-413 payload and finalized full-access membership. */
+export declare function verifyNearMessage(accountId: string, payload: NearMessage, result: NearSignedMessage | undefined, nearRpc: string): Promise<void>;

package/dist/near/nep413.js

@@ -0,0 +1,39 @@
+/** NEP-413: https://github.com/near/NEPs/blob/master/neps/nep-0413.md */
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { base58, base64 } from '@scure/base';
+import { AnnonError } from '../errors.js';
+import { account, concat, le, str } from '../settle-near/codec.js';
+import { isFullAccessKey } from './rpc.js';
+/** u32 tag (2^31+413), Borsh message, fixed nonce, recipient, Option<string> callbackUrl. */
+export function nep413Hash(p) {
+    if (p.nonce.length !== 32)
+        throw new TypeError('NEP-413 nonce must be 32 bytes');
+    return sha256(concat(le(2147484061, 4), str(p.message), p.nonce, str(p.recipient), p.callbackUrl === undefined ? le(0, 1) : concat(le(1, 1), str(p.callbackUrl))));
+}
+export async function proveNearControl(accountId, text, context, signMessage) {
+    account(accountId);
+    account(context.contractId);
+    const payload = {
+        ...(context.callbackUrl === undefined ? {} : { callbackUrl: context.callbackUrl }),
+        message: text,
+        recipient: context.contractId,
+        nonce: crypto.getRandomValues(new Uint8Array(32)),
+    };
+    const result = await signMessage({ ...payload, nonce: payload.nonce.slice() });
+    await verifyNearMessage(accountId, payload, result, context.nearRpc);
+}
+/** Verify exact NEP-413 payload and finalized full-access membership. */
+export async function verifyNearMessage(accountId, payload, result, nearRpc) {
+    const hash = nep413Hash(payload);
+    if (!result || result.accountId !== accountId || !result.publicKey.startsWith('ed25519:'))
+        throw new AnnonError('invalid_signature', 'NEP-413 proof belongs to another account or key type');
+    const key = base58.decode(result.publicKey.slice(8));
+    const signature = base64.decode(result.signature);
+    if (key.length !== 32 ||
+        signature.length !== 64 ||
+        !ed25519.verify(signature, hash, key, { zip215: false }))
+        throw new AnnonError('invalid_signature', 'invalid NEP-413 recovery signature');
+    if (!(await isFullAccessKey(nearRpc, accountId, result.publicKey)))
+        throw new AnnonError('invalid_signature', 'NEP-413 recovery requires a full-access key');
+}