@defdone/annon 0.1.0-alpha.1 → 0.1.0-alpha.3

package/dist/browser/login-view.js

@@ -0,0 +1,227 @@
+import { BASE_USDC, NEAR_USDC } from '../settle-near/terms.js';
+import { formatUnits, nonceHex, record, secondsTime, text } from './login-format.js';
+import { describeTerms } from './login-terms.js';
+/** The whole request as JSON, with a NEP-413 nonce as hex instead of 32 numbers. */
+export function technicalDetails(q) {
+    const payload = record(q.payload);
+    return JSON.stringify(q.operation === 'near.nep413' && 'nonce' in payload
+        ? { ...q, payload: { ...payload, nonce: nonceHex(payload.nonce) } }
+        : q, null, 2);
+}
+const NETWORKS = {
+    'near:mainnet': 'NEAR mainnet',
+    'near:testnet': 'NEAR testnet',
+    'near:sandbox': 'NEAR sandbox',
+    'eip155:8453': 'Base',
+};
+export const networkName = (chain) => NETWORKS[chain] ? `${NETWORKS[chain]} (${chain})` : chain;
+/** Signed texts the SDK and CLI produce, by their first line. */
+const TEXTS = [
+    ['Annon: list a file for sale', 'Sign the listing terms'],
+    ['Annon: publish a file', 'Publish a file'],
+    ['Annon: reserve encrypted file hosting', 'Reserve file hosting'],
+    ['Annon: verify purchase recovery', 'Prove you can recover a purchase'],
+    ['Annon: open a purchased file again', 'Open a purchased file again'],
+    ['Annon: open a file again', 'Open a listed file again'],
+    ['Annon: stop selling a file', 'Stop selling a file'],
+    ['Annon: request sponsored file storage', 'Request sponsored file storage'],
+];
+const LOGIN = 'Annon login: ';
+const OFF_CHAIN = 'Your wallet signs exactly this text. Annon uses the signature only as your approval of what it says. Signing sends no transaction from your wallet.';
+/** Characters that hide or reorder text: controls other than tab and newline, bidi overrides, zero-width marks. */
+const HIDDEN = [
+    [0x00, 0x08],
+    [0x0b, 0x1f],
+    [0x7f, 0x9f],
+    [0x200b, 0x200f],
+    [0x202a, 0x202e],
+    [0x2066, 0x2069],
+    [0xfeff, 0xfeff],
+];
+const hasHidden = (s) => [...s].some((c) => {
+    const n = c.codePointAt(0) ?? 0;
+    return HIDDEN.some(([from, to]) => n >= from && n <= to);
+});
+const hiddenWarning = (s) => hasHidden(s)
+    ? [
+        'The text contains invisible or direction-changing characters. Check it in Technical details.',
+    ]
+    : [];
+function signedText(q, kind, extra) {
+    const message = text(record(q.payload).message);
+    const login = message.startsWith(LOGIN);
+    const known = TEXTS.find(([prefix]) => message === prefix || message.startsWith(`${prefix}\n`));
+    const near = q.operation === 'near.nep413';
+    return {
+        title: login
+            ? `Sign in with your ${near ? 'NEAR' : 'EVM'} wallet`
+            : (known?.[1] ?? 'Sign a message'),
+        rows: [
+            { label: 'Action', value: kind },
+            { label: 'Network', value: networkName(q.chain) },
+            {
+                label: near ? 'Account' : 'Address',
+                value: q.account || 'Chosen in your wallet',
+                mono: !!q.account,
+            },
+            ...extra,
+        ],
+        message: { label: 'Text to sign', text: message },
+        note: login
+            ? `This proves you control the ${near ? 'account' : 'address'}. It adds no key and sends no transaction.`
+            : known?.[0] === 'Annon: verify purchase recovery'
+                ? 'This proves you control the recovery identity named in the text. It sends no transaction and moves no funds.'
+                : OFF_CHAIN,
+        terms: [],
+        warnings: hiddenWarning(message),
+    };
+}
+function typedData(q) {
+    const p = record(q.payload);
+    const domain = record(p.domain);
+    const m = record(p.message);
+    const contract = text(domain.verifyingContract);
+    const chain = `eip155:${text(domain.chainId)}`;
+    const usdc = p.primaryType === 'TransferWithAuthorization' &&
+        contract.toLowerCase() === BASE_USDC &&
+        chain === 'eip155:8453';
+    const warnings = chain === q.chain ? [] : [`The typed data names ${chain}, not ${q.chain}.`];
+    if (p.primaryType !== 'TransferWithAuthorization' || !usdc)
+        return {
+            title: 'Sign typed data',
+            rows: [
+                { label: 'Action', value: `Sign EIP-712 data (${text(p.primaryType)})` },
+                { label: 'Network', value: networkName(q.chain) },
+                { label: 'Address', value: q.account || 'Chosen in your wallet', mono: !!q.account },
+                { label: 'Contract', value: contract, mono: true },
+            ],
+            message: { label: 'Data to sign', text: JSON.stringify(m, null, 2) },
+            note: 'Your wallet signs this data. Signing sends no transaction from your wallet.',
+            terms: [],
+            warnings: [...warnings, 'This is not a USDC transfer the page recognises. Read the data.'],
+        };
+    const amount = `${formatUnits(m.value, 6)} USDC`;
+    return {
+        title: 'Approve a payment',
+        amount,
+        rows: [
+            { label: 'Action', value: 'Authorize a USDC transfer (EIP-3009)' },
+            { label: 'Network', value: networkName(q.chain) },
+            { label: 'Amount', value: amount },
+            { label: 'To', value: text(m.to), mono: true },
+            { label: 'From', value: text(m.from) || q.account, mono: true },
+            { label: 'Token', value: `USDC ${contract}`, mono: true },
+            { label: 'Valid until', value: secondsTime(m.validBefore) },
+            { label: 'Authorization nonce', value: text(m.nonce), mono: true },
+        ],
+        note: 'Signing sends no transaction and costs no gas. It authorizes this exact USDC transfer, which can be submitted on Base once, until the time shown. After that it is void.',
+        terms: [],
+        warnings: [
+            ...warnings,
+            ...(q.account && text(m.from).toLowerCase() !== q.account.toLowerCase()
+                ? [`The transfer is from ${text(m.from)}, not the requested ${q.account}.`]
+                : []),
+        ],
+    };
+}
+const gas = (v) => {
+    const raw = text(v);
+    return /^[0-9]+$/.test(raw) ? `${formatUnits(raw, 12)} Tgas` : raw;
+};
+const yocto = (v) => {
+    const raw = text(v);
+    return !/^[0-9]+$/.test(raw)
+        ? raw
+        : raw === '0'
+            ? 'None'
+            : raw.length < 19
+                ? `${raw} yoctoNEAR`
+                : `${formatUnits(raw, 24)} NEAR`;
+};
+function transaction(q) {
+    const p = record(q.payload);
+    const args = record(p.args);
+    const receiver = text(p.receiverId);
+    const from = { label: 'From account', value: q.account || 'Chosen in your wallet', mono: true };
+    const sends = 'Your wallet sends this transaction from your account and pays its gas in NEAR.';
+    if (p.method !== 'ft_transfer_call')
+        return {
+            title: 'Approve a NEAR transaction',
+            rows: [
+                { label: 'Action', value: `Call ${text(p.method)}` },
+                { label: 'Network', value: networkName(q.chain) },
+                from,
+                { label: 'Contract', value: receiver, mono: true },
+                { label: 'Deposit', value: yocto(p.deposit) },
+                { label: 'Gas limit', value: gas(p.gas) },
+            ],
+            message: { label: 'Arguments', text: JSON.stringify(p.args ?? {}, null, 2) },
+            note: `${sends} ${p.deposit === '0' ? 'It attaches no deposit.' : 'It attaches the deposit shown.'}`,
+            terms: [],
+            warnings: [],
+        };
+    let msg = {};
+    try {
+        msg = record(JSON.parse(text(args.msg)));
+    }
+    catch { }
+    const usdc = receiver === NEAR_USDC || (msg.route === 'near-usdc' && text(msg.asset) === receiver);
+    const amount = usdc
+        ? `${formatUnits(args.amount, 6)} USDC`
+        : `${text(args.amount)} base units of ${receiver}`;
+    return {
+        title: 'Approve a payment',
+        amount,
+        rows: [
+            { label: 'Action', value: 'Send a token transfer (ft_transfer_call)' },
+            { label: 'Network', value: networkName(q.chain) },
+            { label: 'Amount', value: amount },
+            { label: 'To', value: text(args.receiver_id), mono: true },
+            from,
+            { label: 'Token', value: `${usdc ? 'USDC ' : ''}${receiver}`, mono: true },
+            ...(msg.file_id ? [{ label: 'File', value: text(msg.file_id), mono: true }] : []),
+            ...(msg.expires_at
+                ? [{ label: 'Purchase valid until', value: secondsTime(msg.expires_at) }]
+                : []),
+            { label: 'Deposit', value: yocto(p.deposit) },
+            { label: 'Gas limit', value: gas(p.gas) },
+        ],
+        message: { label: 'Transfer message', text: text(args.msg) },
+        note: `${sends} It moves the amount above to ${text(args.receiver_id)} and attaches ${p.deposit === '1' ? '1 yoctoNEAR, which NEAR token transfers require' : `a deposit of ${yocto(p.deposit)}`}.`,
+        terms: [],
+        warnings: usdc
+            ? []
+            : ['The page does not recognise this token. The amount is in its base units.'],
+    };
+}
+/** The summary of one signing request. Unknown operations are described as such, never guessed. */
+export function describeRequest(q) {
+    const s = q.operation === 'near.nep413'
+        ? signedText(q, 'Sign a message (NEP-413)', [
+            { label: 'Recipient', value: text(record(q.payload).recipient), mono: true },
+        ])
+        : q.operation === 'evm.personalSign'
+            ? signedText(q, 'Sign a message (personal_sign)', [])
+            : q.operation === 'evm.signTypedData'
+                ? typedData(q)
+                : q.operation === 'near.signTransaction'
+                    ? transaction(q)
+                    : {
+                        title: 'Unsupported request',
+                        rows: [{ label: 'Operation', value: text(q.operation) }],
+                        note: 'The page cannot sign this request.',
+                        terms: [],
+                        warnings: ['Unknown operation. Do not approve it.'],
+                    };
+    const terms = describeTerms(q.terms, s.amount ? signedPrice(q) : undefined);
+    return { ...s, terms: terms.rows, warnings: [...s.warnings, ...terms.warnings] };
+}
+/** The base-unit amount a payment request signs, for comparison with the CLI's terms. */
+function signedPrice(q) {
+    const p = record(q.payload);
+    return q.operation === 'evm.signTypedData'
+        ? text(record(p.message).value)
+        : q.operation === 'near.signTransaction'
+            ? text(record(p.args).amount)
+            : undefined;
+}

package/dist/browser/login-wallet.d.ts

@@ -0,0 +1,28 @@
+import type { SigningRequest, SigningResult } from '../node/signing.js';
+export type Outcome = {
+    kind: 'result';
+    result: SigningResult;
+}
+/** A redirect wallet returns a NEP-413 result through /callback. */
+ | {
+    kind: 'redirect';
+}
+/** The account-only sign-in for a transaction finished; the next click sends it. */
+ | {
+    kind: 'connected';
+    account: string;
+};
+export declare function pageWallets(callbacks: {
+    /** Remember which request a redirect wallet's opaque `state` belongs to. */
+    expect(state: string, id: string): void;
+    forget(state: string): void;
+    /**
+     * Called just before the wallet's send for request `id`: marks it sent for good and resolves
+     * only once the CLI acknowledged it. A rejection means the wallet is never called.
+     */
+    sending(id: string): Promise<void>;
+}): {
+    /** True when the next click on this request only connects the wallet. */
+    needsConnect(q: SigningRequest, id: string): boolean;
+    run(q: SigningRequest, id: string): Promise<Outcome>;
+};

package/dist/browser/login-wallet.js

@@ -0,0 +1,179 @@
+/**
+ * The wallet side of the approval page: one user click runs at most one wallet window, so a
+ * popup is never opened after an earlier popup has used up the click's user activation.
+ *
+ * - NEP-413 messages: `signMessage` directly, with the account chosen in the wallet. No sign-in.
+ * - NEAR transactions: one click connects (account-only sign-in), the next click sends.
+ * - EVM: the injected provider, which needs no popup from the page.
+ */
+import { Buffer } from 'buffer';
+import { signInAccountOnly } from '../wallet/account-only.js';
+import { evmWallet } from '../wallet/wallet.js';
+import { Refusal, SendUncertain } from './login-status.js';
+/** Signing-request chains the page can bind a NEAR wallet to. Anything else is refused. */
+const NEAR_NETWORKS = new Map([
+    ['near:mainnet', 'mainnet'],
+    ['near:testnet', 'testnet'],
+]);
+/** The selector's only RPC per network. The page CSP allows exactly these (browser-login.ts). */
+const NEAR_RPC = {
+    mainnet: 'https://free.rpc.fastnear.com',
+    testnet: 'https://test.rpc.fastnear.com',
+};
+/**
+ * NEAR wallets offered on this page and the networks each is bound to. MyNearWallet is retired
+ * and no longer connects to apps. HOT's selector module sends no network with its requests, so
+ * it is offered for mainnet only and never loaded for another network.
+ */
+const NEAR_WALLETS = new Map([
+    ['meteor-wallet', { name: 'Meteor Wallet', networks: ['mainnet', 'testnet'] }],
+    ['hot-wallet', { name: 'HOT Wallet', networks: ['mainnet'] }],
+]);
+/** The NEAR network and wallet a request may use, or a refusal before any wallet code loads. */
+function nearTarget(q, id) {
+    const networkId = NEAR_NETWORKS.get(q.chain);
+    if (!networkId)
+        throw new Refusal(`Browser NEAR wallets support near:mainnet and near:testnet, not ${q.chain}.`);
+    const offered = NEAR_WALLETS.get(id);
+    if (!offered)
+        throw new Refusal('Unknown NEAR wallet');
+    if (!offered.networks.includes(networkId))
+        throw new Refusal(`${offered.name} is offered for near:mainnet only. Pick Meteor Wallet.`);
+    return { networkId, key: `${id}:${networkId}` };
+}
+async function evmSign(q) {
+    const provider = window.ethereum;
+    if (!provider)
+        throw new Refusal('Install an injected EVM wallet.');
+    const accounts = (await provider.request({ method: 'eth_requestAccounts' }));
+    const address = q.account || accounts[0];
+    if (!address)
+        throw new Refusal('No account');
+    const chain = await provider.request({ method: 'eth_chainId' });
+    if (`eip155:${BigInt(String(chain))}` !== q.chain)
+        throw new Refusal(`Select ${q.chain} in your wallet.`);
+    const wallet = evmWallet(provider, address.toLowerCase());
+    return q.operation === 'evm.personalSign'
+        ? {
+            signature: (await wallet.authorize(q.payload.message))?.sig ?? '',
+            account: wallet.identity.id,
+        }
+        : { signature: await wallet.signTypedData(q.payload) };
+}
+export function pageWallets(callbacks) {
+    /** Wallets this page has loaded and signed out of any older connection, per wallet and network. */
+    const loaded = new Map();
+    /** Accounts from this page's own account-only sign-in, per wallet and network. */
+    const connected = new Map();
+    async function load(id, networkId, key) {
+        const cached = loaded.get(key);
+        if (cached)
+            return cached;
+        // Only the chosen wallet is loaded, on first use: the page starts without wallet code
+        // touching storage or listeners, and a refused wallet never runs.
+        const [{ setupWalletSelector }, module] = await Promise.all([
+            import('@near-wallet-selector/core'),
+            id === 'hot-wallet'
+                ? import('@near-wallet-selector/hot-wallet').then((m) => m.setupHotWallet())
+                : import('@near-wallet-selector/meteor-wallet').then((m) => m.setupMeteorWallet()),
+        ]);
+        const selector = await setupWalletSelector({
+            network: networkId,
+            fallbackRpcUrls: [NEAR_RPC[networkId]],
+            modules: [module],
+        });
+        const wallet = await selector.wallet(id);
+        // A reused loopback origin may hold an older connection. Never let it sign silently.
+        await wallet.signOut();
+        loaded.set(key, wallet);
+        return wallet;
+    }
+    async function nearSign(q, id) {
+        const { networkId, key } = nearTarget(q, id);
+        const wallet = await load(id, networkId, key);
+        if (q.operation === 'near.nep413') {
+            if (!wallet.signMessage)
+                throw new Refusal('This wallet cannot sign NEP-413 messages.');
+            const p = q.payload;
+            const state = crypto.randomUUID();
+            callbacks.expect(state, q.id);
+            let signed;
+            try {
+                signed = await wallet.signMessage({ ...p, nonce: Buffer.from(p.nonce), state });
+            }
+            catch (error) {
+                callbacks.forget(state);
+                throw error;
+            }
+            if (!signed)
+                return { kind: 'redirect' }; // /callback forwards the fragment
+            callbacks.forget(state);
+            if (q.account && signed.accountId !== q.account)
+                throw new Refusal(`The wallet signed as ${signed.accountId}. Sign with ${q.account}.`);
+            return { kind: 'result', result: signed };
+        }
+        let accounts = connected.get(key);
+        if (!accounts) {
+            accounts = await signInAccountOnly(wallet);
+            const account = q.account || accounts[0]?.accountId;
+            if (!account || !accounts.some((a) => a.accountId === account))
+                throw new Refusal('Select the requested NEAR account.');
+            connected.set(key, accounts);
+            return { kind: 'connected', account };
+        }
+        const account = q.account || accounts[0]?.accountId;
+        if (!account || !accounts.some((a) => a.accountId === account)) {
+            connected.delete(key);
+            throw new Refusal('Select the requested NEAR account.');
+        }
+        const p = q.payload;
+        const actions = [
+            {
+                // Selector v10 passes Borsh Action structs through to its transaction encoder.
+                functionCall: {
+                    methodName: p.method,
+                    args: Buffer.from(JSON.stringify(p.args)),
+                    gas: BigInt(p.gas),
+                    deposit: BigInt(p.deposit),
+                },
+            },
+        ];
+        // From here on the wallet may broadcast: any failure is uncertain and this request is never
+        // tried again from the page. The CLI must know before the wallet is called.
+        try {
+            await callbacks.sending(q.id);
+        }
+        catch {
+            throw new Refusal('This page did not call the wallet, because the CLI did not accept the send. Another page may already have sent it: check the terminal before paying.');
+        }
+        let hash;
+        try {
+            const outcome = await wallet.signAndSendTransaction({
+                signerId: account,
+                receiverId: p.receiverId,
+                actions,
+            });
+            hash = outcome?.transaction?.hash;
+        }
+        catch (error) {
+            throw new SendUncertain('wallet send failed', { cause: error });
+        }
+        if (typeof hash !== 'string' || !hash)
+            throw new SendUncertain('no transaction hash');
+        return { kind: 'result', result: { txHash: hash } };
+    }
+    return {
+        /** True when the next click on this request only connects the wallet. */
+        needsConnect(q, id) {
+            const networkId = NEAR_NETWORKS.get(q.chain);
+            return (q.operation === 'near.signTransaction' &&
+                networkId !== undefined &&
+                !connected.has(`${id}:${networkId}`));
+        },
+        async run(q, id) {
+            if (q.operation.startsWith('evm.'))
+                return { kind: 'result', result: await evmSign(q) };
+            return nearSign(q, id);
+        },
+    };
+}