@dynamic-labs-wallet/browser-wallet-client 1.1.40 → 1.1.41

package/index.cjs

@@ -2339,31 +2339,70 @@ const limitKeys = [
     'maxPriorityFeePerGas',
     'maxTotalFee'
 ];
+const isHex = (value)=>typeof value === 'string' && /^0x(?:[0-9a-f]{2})*$/.test(value);
+const isSvmTransactionIntent = (intent)=>intent.operation.kind === 'transaction' && intent.operation.chainName === 'SVM';
+const isEvmTransactionIntent = (intent)=>intent.operation.kind === 'transaction' && intent.operation.chainName === 'EVM';
 const assertMatches = (matches, message)=>{
     if (!matches) throw new Error(message);
 };
-const assertPreparedSigningIntentMatchesRequest = ({ intent, request, preparedPayload })=>{
+const hasLifetime = (lifetime, refreshable)=>{
+    if (refreshable === undefined) return lifetime === undefined;
+    const keys = lifetime && typeof lifetime === 'object' ? Object.keys(lifetime) : [];
+    return keys.length === 1 && lifetime.refreshable === refreshable;
+};
+const hasMatchingMetadata = (intent, request)=>{
     const sameAddress = request.chainName === 'EVM' ? intent.accountAddress.toLowerCase() === request.accountAddress.toLowerCase() : intent.accountAddress === request.accountAddress;
-    assertMatches(Object.values(core.WaasChainEnum).includes(request.chainName) && intent.actionType === 'waasSigningQuorumApprove' && Boolean(intent.intentId) && Number.isFinite(Date.parse(intent.createdAt)) && sameAddress && intent.businessAccountId === request.businessAccountId && intent.initiatorUserId === request.initiatorUserId && intent.completeBy === request.completeBy && intent.operation.chainName === request.chainName && intent.operation.kind === request.kind, 'Prepared signing intent does not match request');
+    return Object.values(core.WaasChainEnum).includes(request.chainName) && intent.actionType === 'waasSigningQuorumApprove' && Boolean(intent.intentId) && Number.isFinite(Date.parse(intent.createdAt)) && sameAddress && intent.businessAccountId === request.businessAccountId && intent.initiatorUserId === request.initiatorUserId && intent.completeBy === request.completeBy && intent.operation.chainName === request.chainName && intent.operation.kind === request.kind;
+};
+const hasValidSvmHeader = (intent)=>{
+    const { header, staticAccountKeys } = intent.operation;
+    return Number.isInteger(header.numRequiredSignatures) && header.numRequiredSignatures >= 1 && header.numRequiredSignatures <= staticAccountKeys.length && Number.isInteger(header.numReadonlySignedAccounts) && header.numReadonlySignedAccounts >= 0 && header.numReadonlySignedAccounts < header.numRequiredSignatures && Number.isInteger(header.numReadonlyUnsignedAccounts) && header.numReadonlyUnsignedAccounts >= 0 && header.numReadonlyUnsignedAccounts <= staticAccountKeys.length - header.numRequiredSignatures;
+};
+const hasValidSvmInstructions = (intent)=>{
+    const { instructions, staticAccountKeys } = intent.operation;
+    const isIndex = (value)=>Number.isInteger(value) && value >= 0 && value < staticAccountKeys.length;
+    return instructions.every((instruction)=>isIndex(instruction.programIdIndex) && instruction.accountKeyIndexes.every(isIndex) && isHex(instruction.data));
+};
+const assertSvmTransactionMatchesRequest = (intent, request)=>{
+    var _request_chainId;
+    const { operation } = intent;
+    const isBase58 = (value)=>/^[1-9A-HJ-NP-Za-km-z]+$/.test(value);
+    assertMatches(request.chainName === 'SVM' && Boolean(request.chainId) && ((_request_chainId = request.chainId) == null ? void 0 : _request_chainId.trim()) === request.chainId && operation.chainId === request.chainId && request.refreshLimits === undefined && !request.refreshableNonce && intent.limits === undefined && hasLifetime(intent.lifetime, 'blockhash') && (operation.messageVersion === 'legacy' || operation.messageVersion === 'v0') && operation.staticAccountKeys.length > 0 && operation.staticAccountKeys.every(isBase58) && operation.feePayer === request.accountAddress && operation.feePayer === operation.staticAccountKeys[0] && hasValidSvmHeader(intent) && hasValidSvmInstructions(intent), 'Prepared SVM transaction signing intent is malformed');
+};
+const assertEvmTransactionMatchesRequest = (intent, request)=>{
+    if (request.chainName !== 'EVM') throw new Error('Unsupported transaction signing intent');
+    const { operation, limits } = intent;
+    if (!limits) throw new Error('Prepared transaction signing intent is malformed');
+    assertMatches(hasLifetime(intent.lifetime, request.refreshableNonce ? 'nonce' : undefined), 'Transaction lifetime does not match request');
+    assertMatches(operation.from === intent.accountAddress.toLowerCase(), 'Transaction signer does not match request');
+    assertMatches(!request.chainId || operation.chainId === request.chainId, 'Transaction chain does not match request');
+    assertMatches(!request.refreshLimits || limitKeys.every((key)=>{
+        var _request_refreshLimits;
+        return limits[key] === ((_request_refreshLimits = request.refreshLimits) == null ? void 0 : _request_refreshLimits[key]);
+    }), 'Transaction signing limits do not match request');
+// Wallet-service parses the transaction it signs and rejects any mismatch with
+// the approved operation, so the transaction fields are not re-derived here.
+};
+const assertPreparedSigningIntentMatchesRequest = ({ intent, request, preparedPayload })=>{
+    assertMatches(hasMatchingMetadata(intent, request), 'Prepared signing intent does not match request');
     if (intent.operation.kind === 'transaction') {
-        if (request.kind !== 'transaction' || request.chainName !== 'EVM' || intent.operation.chainName !== 'EVM') {
+        if (request.kind !== 'transaction') {
+            throw new Error('Unsupported transaction signing intent');
+        }
+        if (isSvmTransactionIntent(intent)) {
+            assertSvmTransactionMatchesRequest(intent, request);
+            return;
+        }
+        if (!isEvmTransactionIntent(intent)) {
             throw new Error('Unsupported transaction signing intent');
         }
-        const { operation, limits } = intent;
-        if (!limits) throw new Error('Prepared transaction signing intent is malformed');
-        assertMatches(operation.from === intent.accountAddress.toLowerCase(), 'Transaction signer does not match request');
-        assertMatches(!request.chainId || operation.chainId === request.chainId, 'Transaction chain does not match request');
-        assertMatches(!request.refreshLimits || limitKeys.every((key)=>{
-            var _request_refreshLimits;
-            return limits[key] === ((_request_refreshLimits = request.refreshLimits) == null ? void 0 : _request_refreshLimits[key]);
-        }), 'Transaction signing limits do not match request');
-        // Wallet-service parses the transaction it signs and rejects any mismatch with
-        // the approved operation, so the transaction fields are not re-derived here.
+        assertEvmTransactionMatchesRequest(intent, request);
         return;
     }
     const { operation } = intent;
     assertMatches(preparedPayload !== undefined && operation.payload === preparedPayload, 'Prepared signing intent payload does not match request');
     assertMatches(intent.limits === undefined, 'Exact signing intent cannot include refresh limits');
+    assertMatches(hasLifetime(intent.lifetime, undefined), 'Exact signing intent cannot include a lifetime');
     if (operation.kind === 'message') {
         assertMatches(request.kind === 'message' && request.chainName !== 'TRON' && operation.message === request.message, 'Prepared signing intent message does not match request');
         return;

package/index.esm.js

@@ -2338,31 +2338,70 @@ const limitKeys = [
     'maxPriorityFeePerGas',
     'maxTotalFee'
 ];
+const isHex = (value)=>typeof value === 'string' && /^0x(?:[0-9a-f]{2})*$/.test(value);
+const isSvmTransactionIntent = (intent)=>intent.operation.kind === 'transaction' && intent.operation.chainName === 'SVM';
+const isEvmTransactionIntent = (intent)=>intent.operation.kind === 'transaction' && intent.operation.chainName === 'EVM';
 const assertMatches = (matches, message)=>{
     if (!matches) throw new Error(message);
 };
-const assertPreparedSigningIntentMatchesRequest = ({ intent, request, preparedPayload })=>{
+const hasLifetime = (lifetime, refreshable)=>{
+    if (refreshable === undefined) return lifetime === undefined;
+    const keys = lifetime && typeof lifetime === 'object' ? Object.keys(lifetime) : [];
+    return keys.length === 1 && lifetime.refreshable === refreshable;
+};
+const hasMatchingMetadata = (intent, request)=>{
     const sameAddress = request.chainName === 'EVM' ? intent.accountAddress.toLowerCase() === request.accountAddress.toLowerCase() : intent.accountAddress === request.accountAddress;
-    assertMatches(Object.values(WaasChainEnum).includes(request.chainName) && intent.actionType === 'waasSigningQuorumApprove' && Boolean(intent.intentId) && Number.isFinite(Date.parse(intent.createdAt)) && sameAddress && intent.businessAccountId === request.businessAccountId && intent.initiatorUserId === request.initiatorUserId && intent.completeBy === request.completeBy && intent.operation.chainName === request.chainName && intent.operation.kind === request.kind, 'Prepared signing intent does not match request');
+    return Object.values(WaasChainEnum).includes(request.chainName) && intent.actionType === 'waasSigningQuorumApprove' && Boolean(intent.intentId) && Number.isFinite(Date.parse(intent.createdAt)) && sameAddress && intent.businessAccountId === request.businessAccountId && intent.initiatorUserId === request.initiatorUserId && intent.completeBy === request.completeBy && intent.operation.chainName === request.chainName && intent.operation.kind === request.kind;
+};
+const hasValidSvmHeader = (intent)=>{
+    const { header, staticAccountKeys } = intent.operation;
+    return Number.isInteger(header.numRequiredSignatures) && header.numRequiredSignatures >= 1 && header.numRequiredSignatures <= staticAccountKeys.length && Number.isInteger(header.numReadonlySignedAccounts) && header.numReadonlySignedAccounts >= 0 && header.numReadonlySignedAccounts < header.numRequiredSignatures && Number.isInteger(header.numReadonlyUnsignedAccounts) && header.numReadonlyUnsignedAccounts >= 0 && header.numReadonlyUnsignedAccounts <= staticAccountKeys.length - header.numRequiredSignatures;
+};
+const hasValidSvmInstructions = (intent)=>{
+    const { instructions, staticAccountKeys } = intent.operation;
+    const isIndex = (value)=>Number.isInteger(value) && value >= 0 && value < staticAccountKeys.length;
+    return instructions.every((instruction)=>isIndex(instruction.programIdIndex) && instruction.accountKeyIndexes.every(isIndex) && isHex(instruction.data));
+};
+const assertSvmTransactionMatchesRequest = (intent, request)=>{
+    var _request_chainId;
+    const { operation } = intent;
+    const isBase58 = (value)=>/^[1-9A-HJ-NP-Za-km-z]+$/.test(value);
+    assertMatches(request.chainName === 'SVM' && Boolean(request.chainId) && ((_request_chainId = request.chainId) == null ? void 0 : _request_chainId.trim()) === request.chainId && operation.chainId === request.chainId && request.refreshLimits === undefined && !request.refreshableNonce && intent.limits === undefined && hasLifetime(intent.lifetime, 'blockhash') && (operation.messageVersion === 'legacy' || operation.messageVersion === 'v0') && operation.staticAccountKeys.length > 0 && operation.staticAccountKeys.every(isBase58) && operation.feePayer === request.accountAddress && operation.feePayer === operation.staticAccountKeys[0] && hasValidSvmHeader(intent) && hasValidSvmInstructions(intent), 'Prepared SVM transaction signing intent is malformed');
+};
+const assertEvmTransactionMatchesRequest = (intent, request)=>{
+    if (request.chainName !== 'EVM') throw new Error('Unsupported transaction signing intent');
+    const { operation, limits } = intent;
+    if (!limits) throw new Error('Prepared transaction signing intent is malformed');
+    assertMatches(hasLifetime(intent.lifetime, request.refreshableNonce ? 'nonce' : undefined), 'Transaction lifetime does not match request');
+    assertMatches(operation.from === intent.accountAddress.toLowerCase(), 'Transaction signer does not match request');
+    assertMatches(!request.chainId || operation.chainId === request.chainId, 'Transaction chain does not match request');
+    assertMatches(!request.refreshLimits || limitKeys.every((key)=>{
+        var _request_refreshLimits;
+        return limits[key] === ((_request_refreshLimits = request.refreshLimits) == null ? void 0 : _request_refreshLimits[key]);
+    }), 'Transaction signing limits do not match request');
+// Wallet-service parses the transaction it signs and rejects any mismatch with
+// the approved operation, so the transaction fields are not re-derived here.
+};
+const assertPreparedSigningIntentMatchesRequest = ({ intent, request, preparedPayload })=>{
+    assertMatches(hasMatchingMetadata(intent, request), 'Prepared signing intent does not match request');
     if (intent.operation.kind === 'transaction') {
-        if (request.kind !== 'transaction' || request.chainName !== 'EVM' || intent.operation.chainName !== 'EVM') {
+        if (request.kind !== 'transaction') {
+            throw new Error('Unsupported transaction signing intent');
+        }
+        if (isSvmTransactionIntent(intent)) {
+            assertSvmTransactionMatchesRequest(intent, request);
+            return;
+        }
+        if (!isEvmTransactionIntent(intent)) {
             throw new Error('Unsupported transaction signing intent');
         }
-        const { operation, limits } = intent;
-        if (!limits) throw new Error('Prepared transaction signing intent is malformed');
-        assertMatches(operation.from === intent.accountAddress.toLowerCase(), 'Transaction signer does not match request');
-        assertMatches(!request.chainId || operation.chainId === request.chainId, 'Transaction chain does not match request');
-        assertMatches(!request.refreshLimits || limitKeys.every((key)=>{
-            var _request_refreshLimits;
-            return limits[key] === ((_request_refreshLimits = request.refreshLimits) == null ? void 0 : _request_refreshLimits[key]);
-        }), 'Transaction signing limits do not match request');
-        // Wallet-service parses the transaction it signs and rejects any mismatch with
-        // the approved operation, so the transaction fields are not re-derived here.
+        assertEvmTransactionMatchesRequest(intent, request);
         return;
     }
     const { operation } = intent;
     assertMatches(preparedPayload !== undefined && operation.payload === preparedPayload, 'Prepared signing intent payload does not match request');
     assertMatches(intent.limits === undefined, 'Exact signing intent cannot include refresh limits');
+    assertMatches(hasLifetime(intent.lifetime, undefined), 'Exact signing intent cannot include a lifetime');
     if (operation.kind === 'message') {
         assertMatches(request.kind === 'message' && request.chainName !== 'TRON' && operation.message === request.message, 'Prepared signing intent message does not match request');
         return;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@dynamic-labs-wallet/browser-wallet-client",
-  "version": "1.1.40",
+  "version": "1.1.41",
   "license": "MIT",
   "type": "module",
   "dependencies": {
-    "@dynamic-labs-wallet/core": "1.1.40",
+    "@dynamic-labs-wallet/core": "1.1.41",
     "@dynamic-labs/logger": "^5.9.4",
     "@dynamic-labs/message-transport": "^5.9.1"
   },

package/src/assertPreparedSigningIntentMatchesRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assertPreparedSigningIntentMatchesRequest.d.ts","sourceRoot":"","sources":["../../packages/src/assertPreparedSigningIntentMatchesRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,2BAA2B,EAAE,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAQhH,eAAO,MAAM,yCAAyC,0CAInD;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,2BAA2B,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,IAiFH,CAAC"}
+{"version":3,"file":"assertPreparedSigningIntentMatchesRequest.d.ts","sourceRoot":"","sources":["../../packages/src/assertPreparedSigningIntentMatchesRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,2BAA2B,EAAE,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAiHhH,eAAO,MAAM,yCAAyC,0CAInD;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,2BAA2B,CAAC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,KAAG,IA6DH,CAAC"}