@defdone/annon 0.1.0-alpha.0 → 0.1.0-alpha.1

package/dist/node/adapter.js

@@ -56,7 +56,6 @@ export function createAdapter(env = process.env, d = {}) {
                         message: challenge,
                         recipient: c.contractId || 'annon-cli',
                         nonce: [...crypto.getRandomValues(new Uint8Array(32))],
-                        callbackUrl: new URL('/callback', s.url).href,
                     });
                 let identity;
                 await s.request(q, async (r) => {

package/dist/node/browser-login.d.ts

@@ -1,3 +1,10 @@
+/**
+ * The approval page talks only to this loopback server, the NEAR RPC its Wallet Selector uses
+ * (fixed per network in browser/login.ts, independent of the CLI's configured RPC) and HOT
+ * Wallet's relay; it frames only the HOT widget. EVM wallets are reached through the injected
+ * provider, which needs no connection from the page.
+ */
+export declare const LOGIN_PAGE_CSP = "default-src 'none'; script-src 'self'; connect-src 'self' https://free.rpc.fastnear.com https://test.rpc.fastnear.com https://h4n.app; frame-src https://hot-labs.org; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
 export interface BrowserSession {
     url: string;
     pairingCode: string;

package/dist/node/browser-login.js

@@ -4,6 +4,13 @@ import { readFile } from 'node:fs/promises';
 import { createServer } from 'node:http';
 import { TransactionUncertain } from '../wallet/uncertain.js';
 const equal = (a, b) => Buffer.byteLength(a) === Buffer.byteLength(b) && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+/**
+ * The approval page talks only to this loopback server, the NEAR RPC its Wallet Selector uses
+ * (fixed per network in browser/login.ts, independent of the CLI's configured RPC) and HOT
+ * Wallet's relay; it frames only the HOT widget. EVM wallets are reached through the injected
+ * provider, which needs no connection from the page.
+ */
+export const LOGIN_PAGE_CSP = "default-src 'none'; script-src 'self'; connect-src 'self' https://free.rpc.fastnear.com https://test.rpc.fastnear.com https://h4n.app; frame-src https://hot-labs.org; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
 export async function startBrowserSession(o) {
     let asset = o.asset;
     if (asset === undefined) {
@@ -41,7 +48,7 @@ export async function startBrowserSession(o) {
                 'cache-control': 'no-store',
                 'referrer-policy': 'no-referrer',
                 'x-content-type-options': 'nosniff',
-                'content-security-policy': "default-src 'none'; script-src 'self'; connect-src 'self' https:; style-src 'self'; img-src 'self' data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
+                'content-security-policy': LOGIN_PAGE_CSP,
             };
             const send = (status, body, type = 'application/json') => res.writeHead(status, { ...headers, 'content-type': type }).end(body);
             if (closed || req.headers.host !== new URL(origin).host)
@@ -118,7 +125,7 @@ export async function startBrowserSession(o) {
             if (path === '/app.js')
                 return void send(200, asset, 'text/javascript');
             if (path === '/' || path === '/callback')
-                return void send(200, '<!doctype html><html><head><meta charset="utf-8"><title>Annon wallet approval</title><script src="/app.js" defer></script></head><body><h1>Annon wallet approval</h1><p id="pair"></p><pre id="action"></pre><button id="approve">Review in wallet</button><p id="status"></p></body></html>', 'text/html; charset=utf-8');
+                return void send(200, '<!doctype html><html><head><meta charset="utf-8"><title>Annon wallet approval</title><script src="/app.js" defer></script></head><body><h1>Annon wallet approval</h1><p id="pair"></p><pre id="action"></pre><p><label for="near-wallet">NEAR wallet</label> <select id="near-wallet"><option value="meteor-wallet">Meteor Wallet</option><option id="near-wallet-hot" value="hot-wallet">HOT Wallet (mainnet)</option></select></p><button id="approve">Review in wallet</button><p id="status"></p></body></html>', 'text/html; charset=utf-8');
             send(404, '{}');
         })().catch(() => {
             if (!res.headersSent)

package/dist/node/signer-wallet.js

@@ -139,7 +139,9 @@ export async function configuredWallet(s, c, o, env, keychain, browser, terms) {
                 throw error;
             }
         },
-    }, id.id, (text, context) => proveNearControl(id.id, text, { ...context, ...(session ? { callbackUrl: new URL('/callback', session.url).href } : {}) }, signMessage));
+    }, id.id, 
+    // Browser NEAR wallets return NEP-413 signatures in the page, so the payload has no callbackUrl.
+    (text, context) => proveNearControl(id.id, text, context, signMessage));
     return {
         ...wallet,
         signUpload: (intent) => signNearUpload({ getAccounts: async () => [{ accountId: id.id }], signMessage }, intent, c.nearRpc),

package/dist/pay/base.js

@@ -298,32 +298,44 @@ async function lastBlock(url, from, validBefore, now) {
             return at;
     }
 }
-/** The block of an `AuthorizationCanceled` for this nonce in `[from, to]`, searched in chunks. */
-async function canceledAfter(url, e, from, to) {
-    // Note: 10,000 blocks per query, the common RPC limit; a long-expired purchase takes several.
-    for (let at = from; at <= to; at += 10_000) {
-        const end = Math.min(to, at + 9_999);
-        const topics = [
-            TOPICS.authorizationCanceled,
-            toHex(addressWord(e.from)),
-            e.nonce.toLowerCase(),
-        ];
+/** Note: blocks per eth_getLogs, the common RPC limit (QuickNode refuses a wider range). */
+const LOG_RANGE = 10_000;
+/**
+ * USDC's logs for `topics` (a list in a position matches any of it) in `[from, to]`, read in
+ * chunks of `LOG_RANGE` blocks, earliest first. Each chunk's logs must answer that chunk's query.
+ * Stops after the first chunk with a log `enough` accepts; an empty range reads nothing.
+ */
+async function usdcLogs(url, usdc, topics, from, to, enough) {
+    const all = [];
+    for (let at = from; at <= to; at += LOG_RANGE) {
+        const end = Math.min(to, at + LOG_RANGE - 1);
         const found = await ask(url, 'eth_getLogs', [
-            { address: e.usdc, fromBlock: qty(at), toBlock: qty(end), topics },
+            { address: usdc, fromBlock: qty(at), toBlock: qty(end), topics },
         ]);
         if (!Array.isArray(found))
             return malformed('eth_getLogs result');
-        for (const l of found.map(evmLog).filter((l) => !l.removed)) {
-            if (l.address !== strip(e.usdc) ||
-                l.topics.join() !== topics.map(strip).join() ||
+        const logs = found.map(evmLog).filter((l) => !l.removed);
+        // Every log must answer the query; anything else is an RPC that can't be believed.
+        for (const l of logs) {
+            if (l.address !== strip(usdc) ||
+                l.topics.length !== topics.length ||
+                !topics.every((t, i) => [t].flat().some((x) => strip(x) === l.topics[i])) ||
                 l.block_number < at ||
                 l.block_number > end) {
                 return malformed('eth_getLogs returned a log the query did not ask for');
             }
-            return l.block_number;
         }
+        all.push(...logs);
+        if (logs.some(enough))
+            break;
     }
-    return null;
+    return all;
+}
+/** The block of an `AuthorizationCanceled` for this nonce in `[from, to]`. */
+async function canceledAfter(url, e, from, to) {
+    const topics = [TOPICS.authorizationCanceled, toHex(addressWord(e.from)), e.nonce.toLowerCase()];
+    const [first] = await usdcLogs(url, e.usdc, topics, from, to, () => true);
+    return first ? first.block_number : null;
 }
 /**
  * Where a signed purchase stands, found by its nonce alone, so a lost transaction hash loses
@@ -338,33 +350,14 @@ export async function paymentStatus(url, e) {
     const final = await block(url, 'finalized');
     const now = await head(url);
     const last = await lastBlock(url, e.block, e.validBefore, now);
-    const query = {
-        address: e.usdc,
-        fromBlock: qty(e.block),
-        toBlock: qty(last),
-        topics: [
-            [TOPICS.authorizationUsed, TOPICS.authorizationCanceled],
-            toHex(addressWord(e.from)),
-            e.nonce.toLowerCase(),
-        ],
-    };
-    const found = await ask(url, 'eth_getLogs', [query]);
-    if (!Array.isArray(found))
-        return malformed('eth_getLogs result');
-    const logs = found.map(evmLog).filter((l) => !l.removed);
-    // Every log must answer the query; anything else is an RPC that can't be believed.
-    for (const l of logs) {
-        if (l.address !== strip(e.usdc) ||
-            l.topics.length !== 3 ||
-            !query.topics[0].some((t) => strip(t) === l.topics[0]) ||
-            l.topics[1] !== topicOf(e.from) ||
-            l.topics[2] !== strip(e.nonce) ||
-            l.block_number < e.block ||
-            l.block_number > last) {
-            return malformed('eth_getLogs returned a log the query did not ask for');
-        }
-    }
-    const used = logs.find((l) => l.topics[0] === strip(TOPICS.authorizationUsed));
+    // A used authorization in any chunk wins over a cancellation, so only that ends the search.
+    const usedTopic = strip(TOPICS.authorizationUsed);
+    const logs = await usdcLogs(url, e.usdc, [
+        [TOPICS.authorizationUsed, TOPICS.authorizationCanceled],
+        toHex(addressWord(e.from)),
+        e.nonce.toLowerCase(),
+    ], e.block, last, (l) => l.topics[0] === usedTopic);
+    const used = logs.find((l) => l.topics[0] === usedTopic);
     if (used) {
         const receipt = await ask(url, 'eth_getTransactionReceipt', [`0x${used.transaction_hash}`]);
         const paid = paymentLogs(receipt, e);

package/dist/wallet/account-only.d.ts

@@ -1,4 +1,4 @@
-/** Never supply contractId/methodNames: MyNearWallet otherwise generates a local secret. */
+/** Never supply contractId/methodNames: a wallet would otherwise add a function-call key for them. */
 export declare function signInAccountOnly(wallet: {
     signOut?: () => Promise<void>;
     signIn(params: {

package/dist/wallet/account-only.js

@@ -1,4 +1,4 @@
-/** Never supply contractId/methodNames: MyNearWallet otherwise generates a local secret. */
+/** Never supply contractId/methodNames: a wallet would otherwise add a function-call key for them. */
 export async function signInAccountOnly(wallet) {
     // A reused loopback origin may contain older connector authority. Never let it sign silently.
     await wallet.signOut?.();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defdone/annon",
-  "version": "0.1.0-alpha.0",
+  "version": "0.1.0-alpha.1",
   "description": "Files only the buyer can open: encrypted on the client, the key released by NEAR once the payment is verified.",
   "license": "Apache-2.0",
   "homepage": "https://annon.dev",
@@ -115,7 +115,8 @@
   ],
   "devDependencies": {
     "@near-wallet-selector/core": "10.1.4",
-    "@near-wallet-selector/my-near-wallet": "10.1.4",
+    "@near-wallet-selector/hot-wallet": "10.1.4",
+    "@near-wallet-selector/meteor-wallet": "10.1.4",
     "@types/node": "26.6.5",
     "buffer": "6.0.3",
     "esbuild": "0.28.2",