@meshconnect/uwc-core 1.0.1-snapshot.c7e65ce → 1.0.2

package/dist/observability/instrument-handoff.d.ts

@@ -1,39 +0,0 @@
-import type { ConnectionMode, Namespace, NetworkId } from '@meshconnect/uwc-types';
-import type { EventManager } from '../managers/event-manager';
-import type { UWCOperation } from '../events';
-/** Routing facets known at the moment of a wallet handoff. No address, no payload. */
-export interface HandoffContext {
-    operation: UWCOperation;
-    connectionMode: ConnectionMode;
-    walletId?: string | undefined;
-    namespace?: Namespace | undefined;
-    chainId?: NetworkId | undefined;
-}
-export interface InstrumentHandoffOptions {
-    eventManager: EventManager;
-    /**
-     * Deadline after which `walletTimedOut` fires as a SIDE marker (never rejects).
-     * `0` disables the marker. `tonConnect` is always skipped — TON bounds its own
-     * wallet response internally, so a second observational timer would be noise.
-     */
-    timeoutMs: number;
-    /** Clock injectable for deterministic tests. */
-    now?: () => number;
-}
-/**
- * Instrument one wallet-boundary op so the blind window is measured.
- *
- * Emits `awaitingWallet` immediately (before the await that hands control to the
- * wallet), then exactly one terminal — `walletSucceeded` (success),
- * `walletRejected` (explicit user no), or `walletFailed` (any other error) — all
- * carrying the same `handoffId` and a `durationMs`. An intentional abort emits no
- * terminal (the caller cancelled; it isn't a wallet outcome).
- *
- * A non-cancelling `walletTimedOut` marker fires if the deadline passes while the
- * op is still pending; it is cleared the instant the op settles, so a fast op
- * never false-fires it, and it NEVER rejects/aborts/mutates state — the wrapped
- * promise stays the single terminal source of truth. This is a deliberate
- * deviation from TON's cancelling `withWalletResponseTimeout`.
- */
-export declare function instrumentHandoff<T>(options: InstrumentHandoffOptions, context: HandoffContext, fn: () => Promise<T>): Promise<T>;
-//# sourceMappingURL=instrument-handoff.d.ts.map

package/dist/observability/instrument-handoff.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"instrument-handoff.d.ts","sourceRoot":"","sources":["../../src/observability/instrument-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,SAAS,EACT,SAAS,EACV,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAS7C,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,YAAY,CAAA;IACvB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACjC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAkEZ"}

package/dist/observability/instrument-handoff.js

@@ -1,86 +0,0 @@
-import { generateId } from '../utils/id';
-import { isAbortError, isUserRejection, toWalletError } from '../utils/to-wallet-error';
-import { derivePlatform, deriveWalletFlowType } from './telemetry';
-/**
- * Instrument one wallet-boundary op so the blind window is measured.
- *
- * Emits `awaitingWallet` immediately (before the await that hands control to the
- * wallet), then exactly one terminal — `walletSucceeded` (success),
- * `walletRejected` (explicit user no), or `walletFailed` (any other error) — all
- * carrying the same `handoffId` and a `durationMs`. An intentional abort emits no
- * terminal (the caller cancelled; it isn't a wallet outcome).
- *
- * A non-cancelling `walletTimedOut` marker fires if the deadline passes while the
- * op is still pending; it is cleared the instant the op settles, so a fast op
- * never false-fires it, and it NEVER rejects/aborts/mutates state — the wrapped
- * promise stays the single terminal source of truth. This is a deliberate
- * deviation from TON's cancelling `withWalletResponseTimeout`.
- */
-export async function instrumentHandoff(options, context, fn) {
-    const { eventManager, timeoutMs } = options;
-    const now = options.now ?? Date.now;
-    const handoffId = generateId();
-    const platform = derivePlatform();
-    const start = now();
-    eventManager.emit('awaitingWallet', {
-        operation: context.operation,
-        connectionMode: context.connectionMode,
-        walletId: context.walletId,
-        namespace: context.namespace,
-        chainId: context.chainId,
-        handoffId,
-        walletFlowType: deriveWalletFlowType(context.connectionMode, platform),
-        platform,
-        timestamp: start
-    });
-    const shouldTime = timeoutMs > 0 && context.connectionMode !== 'tonConnect';
-    const timer = shouldTime
-        ? setTimeout(() => {
-            eventManager.emit('walletTimedOut', {
-                handoffId,
-                operation: context.operation,
-                durationMs: now() - start
-            });
-        }, timeoutMs)
-        : undefined;
-    try {
-        const result = await fn();
-        eventManager.emit('walletSucceeded', {
-            handoffId,
-            operation: context.operation,
-            durationMs: now() - start
-        });
-        return result;
-    }
-    catch (error) {
-        // Caller-driven cancellation isn't a wallet outcome — leave it unterminated,
-        // mirroring the façade's `emitError` AbortError skip. Checked BEFORE rejection
-        // is safe: real user rejections surface as WalletConnectorError{rejected} or
-        // EIP-1193 4001 (see isUserRejection), never as an AbortError — within UWC's
-        // dependency surface AbortError is produced only by the caller's AbortSignal.
-        if (isAbortError(error))
-            throw error;
-        const durationMs = now() - start;
-        if (isUserRejection(error)) {
-            eventManager.emit('walletRejected', {
-                handoffId,
-                operation: context.operation,
-                durationMs
-            });
-        }
-        else {
-            eventManager.emit('walletFailed', {
-                handoffId,
-                operation: context.operation,
-                durationMs,
-                error: toWalletError(error)
-            });
-        }
-        throw error;
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
-//# sourceMappingURL=instrument-handoff.js.map

package/dist/observability/instrument-handoff.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instrument-handoff.js","sourceRoot":"","sources":["../../src/observability/instrument-handoff.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,YAAY,EACZ,eAAe,EACf,aAAa,EACd,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAuBlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC,EACjC,OAAuB,EACvB,EAAoB;IAEpB,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAEnC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IACjC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;IAEnB,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS;QACT,cAAc,EAAE,oBAAoB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;QACtE,QAAQ;QACR,SAAS,EAAE,KAAK;KACjB,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG,SAAS,GAAG,CAAC,IAAI,OAAO,CAAC,cAAc,KAAK,YAAY,CAAA;IAC3E,MAAM,KAAK,GAA8C,UAAU;QACjE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE;YACd,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAClC,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,GAAG,EAAE,GAAG,KAAK;aAC1B,CAAC,CAAA;QACJ,CAAC,EAAE,SAAS,CAAC;QACf,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAA;QACzB,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE;YACnC,SAAS;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU,EAAE,GAAG,EAAE,GAAG,KAAK;SAC1B,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6EAA6E;QAC7E,+EAA+E;QAC/E,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;QAEpC,MAAM,UAAU,GAAG,GAAG,EAAE,GAAG,KAAK,CAAA;QAChC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAClC,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE;gBAChC,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU;gBACV,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC"}

package/dist/observability/scrub.d.ts

@@ -1,30 +0,0 @@
-/**
- * PII / secret scrubber for data leaving UWC through the observer seam.
- *
- * Security-first: the normalized `UWCTelemetryEvent` excludes signing payloads
- * and addresses by construction — its STRUCTURED fields have no slot for them
- * (§ telemetry.ts). This scrubber is the second line of defence for the two
- * surfaces that CAN still carry free-form data on the observer path: the
- * `WalletError.message` forwarded to `observer.onEvent`, and the `args` forwarded
- * to `observer.onLog`. (The console / custom-logger sink receives raw data — it's
- * local, not egress.)
- *
- * Two detection layers:
- *  - KEY-based redaction of sensitive object keys — substring match (not regex),
- *    avoiding the ReDoS class that Wiz flags on user-input regexes.
- *  - CONTENT-based redaction of secrets embedded in free-form strings (hex blobs,
- *    secret k/v params, bearer tokens) — via linear, single-quantifier regexes
- *    (see SECRET_CONTENT_PATTERNS) that carry no catastrophic-backtracking risk.
- */
-/**
- * Recursively copy `value`, redacting sensitive object-keys, capping long
- * strings, and rendering non-serializable values inert. The returned objects use
- * a null prototype so a malicious `__proto__`/`constructor` key in attacker-shaped
- * input can't pollute `Object.prototype` downstream.
- */
-export declare function scrubValue(value: unknown, depth?: number): unknown;
-/** Scrub a free-form error message (string in → capped string out). */
-export declare function scrubMessage(message: string): string;
-/** Scrub a variadic `args` array before it reaches `observer.onLog`. */
-export declare function scrubArgs(args: unknown[]): unknown[];
-//# sourceMappingURL=scrub.d.ts.map

package/dist/observability/scrub.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scrub.d.ts","sourceRoot":"","sources":["../../src/observability/scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAyEH;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAmC7D;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAEpD"}

package/dist/observability/scrub.js

@@ -1,135 +0,0 @@
-/**
- * PII / secret scrubber for data leaving UWC through the observer seam.
- *
- * Security-first: the normalized `UWCTelemetryEvent` excludes signing payloads
- * and addresses by construction — its STRUCTURED fields have no slot for them
- * (§ telemetry.ts). This scrubber is the second line of defence for the two
- * surfaces that CAN still carry free-form data on the observer path: the
- * `WalletError.message` forwarded to `observer.onEvent`, and the `args` forwarded
- * to `observer.onLog`. (The console / custom-logger sink receives raw data — it's
- * local, not egress.)
- *
- * Two detection layers:
- *  - KEY-based redaction of sensitive object keys — substring match (not regex),
- *    avoiding the ReDoS class that Wiz flags on user-input regexes.
- *  - CONTENT-based redaction of secrets embedded in free-form strings (hex blobs,
- *    secret k/v params, bearer tokens) — via linear, single-quantifier regexes
- *    (see SECRET_CONTENT_PATTERNS) that carry no catastrophic-backtracking risk.
- */
-/**
- * Separator-free, lower-cased fragments that mark a value as sensitive. Keys are
- * normalized (separators stripped) before matching, so `walletPrivateKey`,
- * `private_key`, `x-api-key`, and `authToken` all hit the same short list. This
- * over-redacts by design (a `security`-first scrubber prefers a false redaction
- * to a leak).
- */
-const SENSITIVE_KEY_FRAGMENTS = [
-    'seed',
-    'mnemonic',
-    'privatekey',
-    'secret',
-    'password',
-    'passphrase',
-    'signature',
-    'message',
-    'payload',
-    'token',
-    'apikey',
-    'authorization',
-    'auth'
-];
-const MAX_STRING_LENGTH = 500;
-const MAX_DEPTH = 4;
-const REDACTED = '[Redacted]';
-function isSensitiveKey(key) {
-    // Strip separators so `private_key` / `x-api-key` normalize to the bare form.
-    const normalized = key.toLowerCase().split('-').join('').split('_').join('');
-    return SENSITIVE_KEY_FRAGMENTS.some(fragment => normalized.includes(fragment));
-}
-// Content patterns for secrets embedded in FREE-FORM strings (error messages,
-// log args) where key-based redaction can't reach. All are linear, anchored,
-// single-quantifier expressions — no nested/overlapping quantifiers — so they
-// carry no catastrophic-backtracking (ReDoS) risk on attacker-controlled input.
-const SECRET_CONTENT_PATTERNS = [
-    // 0x-prefixed hex blobs: EVM addresses (40 nibbles) and longer
-    // signatures/keys/hashes/calldata (64+). Over-redacts public hashes by design.
-    [/0x[a-fA-F0-9]{40,}/g, '0x[redacted-hex]'],
-    // `secret=…` / `token=…` / `key=…` query-string or k/v fragments.
-    [
-        /\b(token|key|secret|auth|sig|signature|password|passphrase|mnemonic|seed|apikey)=[^\s&"']+/gi,
-        '$1=[redacted]'
-    ],
-    // `Bearer <opaque>` / `Basic <opaque>` authorization values.
-    [/\b(bearer|basic)\s+[A-Za-z0-9._~+/-]+=*/gi, '$1 [redacted]']
-];
-/**
- * Redact secrets that live INSIDE a free-form string. Best-effort and
- * deliberately conservative toward over-redaction: a wallet error string can
- * embed an address, a reverted-tx calldata blob, or a URL with a token, none of
- * which key-based redaction sees. Two documented best-effort gaps, both left
- * unmatched to avoid destroying legitimate data:
- *   - Base58 (Solana) / TON `EQ…` addresses — indistinguishable from ordinary
- *     words without false positives.
- *   - BARE (non-`0x`) hex blobs — a raw 64-char hex string is far more often a
- *     legitimate id/hash than a secret, so only `0x`-prefixed hex is redacted.
- * Structured telemetry fields never carry addresses regardless (see telemetry.ts);
- * this pass only hardens the free-form `error.message` / log-arg surface.
- */
-function redactSecretsInString(input) {
-    let out = input;
-    for (const [pattern, replacement] of SECRET_CONTENT_PATTERNS) {
-        out = out.replace(pattern, replacement);
-    }
-    return out;
-}
-/**
- * Recursively copy `value`, redacting sensitive object-keys, capping long
- * strings, and rendering non-serializable values inert. The returned objects use
- * a null prototype so a malicious `__proto__`/`constructor` key in attacker-shaped
- * input can't pollute `Object.prototype` downstream.
- */
-export function scrubValue(value, depth = 0) {
-    if (depth > MAX_DEPTH)
-        return '[Truncated: max depth]';
-    if (value === null || value === undefined)
-        return value;
-    const type = typeof value;
-    if (type === 'string') {
-        // Redact embedded secrets BEFORE capping, so the cap can't slice a pattern
-        // in half and leak its tail.
-        const str = redactSecretsInString(value);
-        return str.length > MAX_STRING_LENGTH
-            ? str.slice(0, MAX_STRING_LENGTH) + '…[truncated]'
-            : str;
-    }
-    if (type === 'number' || type === 'boolean')
-        return value;
-    if (type === 'bigint')
-        return value.toString();
-    if (type === 'function' || type === 'symbol')
-        return `[${type}]`;
-    if (Array.isArray(value)) {
-        return value.map(item => scrubValue(item, depth + 1));
-    }
-    if (type === 'object') {
-        // Error instances carry a useful message but also a stack we don't want.
-        if (value instanceof Error) {
-            return { name: value.name, message: scrubValue(value.message, depth + 1) };
-        }
-        const out = Object.create(null);
-        for (const [key, val] of Object.entries(value)) {
-            out[key] = isSensitiveKey(key) ? REDACTED : scrubValue(val, depth + 1);
-        }
-        return out;
-    }
-    return '[Unserializable]';
-}
-/** Scrub a free-form error message (string in → capped string out). */
-export function scrubMessage(message) {
-    return scrubValue(message);
-}
-/** Scrub a variadic `args` array before it reaches `observer.onLog`. */
-export function scrubArgs(args) {
-    return args.map(arg => scrubValue(arg));
-}
-//# sourceMappingURL=scrub.js.map

package/dist/observability/scrub.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../../src/observability/scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG;IAC9B,MAAM;IACN,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,QAAQ;IACR,eAAe;IACf,MAAM;CACP,CAAA;AAED,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAC7B,MAAM,SAAS,GAAG,CAAC,CAAA;AACnB,MAAM,QAAQ,GAAG,YAAY,CAAA;AAE7B,SAAS,cAAc,CAAC,GAAW;IACjC,8EAA8E;IAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,uBAAuB,GAA6C;IACxE,+DAA+D;IAC/D,+EAA+E;IAC/E,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;IAC3C,kEAAkE;IAClE;QACE,8FAA8F;QAC9F,eAAe;KAChB;IACD,6DAA6D;IAC7D,CAAC,2CAA2C,EAAE,eAAe,CAAC;CAC/D,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAA;IACf,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC7D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAClD,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,wBAAwB,CAAA;IAEtD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAEvD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAA;IACzB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAe,CAAC,CAAA;QAClD,OAAO,GAAG,CAAC,MAAM,GAAG,iBAAiB;YACnC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,cAAc;YAClD,CAAC,CAAC,GAAG,CAAA;IACT,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACzD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAQ,KAAgB,CAAC,QAAQ,EAAE,CAAA;IAC1D,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,IAAI,GAAG,CAAA;IAEhE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,yEAAyE;QACzE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;QAC5E,CAAC;QACD,MAAM,GAAG,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QACxE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,OAAO,kBAAkB,CAAA;AAC3B,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAW,CAAA;AACtC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACzC,CAAC"}

package/dist/observability/telemetry.d.ts

@@ -1,77 +0,0 @@
-import type { ConnectionMode, WalletError, WalletFlowType, Platform, LogLevel, Namespace, NetworkId } from '@meshconnect/uwc-types';
-import type { UWCEventName, UWCEventMap, UWCOperation } from '../events';
-/**
- * A normalized, PII-safe telemetry record derived from a `UWCEventMap` event.
- *
- * This is the ONLY shape that reaches `observer.onEvent`. It is the PII boundary:
- * it has no field for a signing payload, signature, raw transaction, or wallet
- * address — leaking those is structurally impossible, not merely discouraged.
- */
-export interface UWCTelemetryEvent {
-    /** The originating event name. */
-    name: UWCEventName;
-    /** Per-connector-instance correlation id (stamped on every event). */
-    sdkSessionId: string;
-    /** ms since epoch when the record was produced. */
-    timestamp: number;
-    /** Wallet-boundary op, when the event relates to one. */
-    operation?: UWCOperation | undefined;
-    connectionMode?: ConnectionMode | undefined;
-    /** CAIP namespace (eip155 | solana | tron | tvm …) — never an address. */
-    namespace?: Namespace | undefined;
-    /** CAIP chain id (e.g. `eip155:1`) — never an address. */
-    chainId?: NetworkId | undefined;
-    /** Catalog wallet id — never an address. */
-    walletId?: string | undefined;
-    /** Correlates a handoff start with its terminal. */
-    handoffId?: string | undefined;
-    durationMs?: number | undefined;
-    walletFlowType?: WalletFlowType | undefined;
-    platform?: Platform | undefined;
-    /** Present on failure events. `message` is scrubbed before egress. */
-    error?: WalletError | undefined;
-    /** Log level, present only for `name === 'log'`. */
-    level?: LogLevel | undefined;
-}
-/**
- * Vendor-agnostic telemetry sink. Consumers implement; UWC ships no vendor SDK.
- * Both methods are optional and called best-effort (throws are swallowed upstream).
- *
- * CONTRACT — both methods are invoked **synchronously on the wallet-operation
- * path**. A terminal event (e.g. `walletSucceeded`) fires between the wallet
- * returning a result and that result reaching the caller, so a slow handler adds
- * latency to connect / sign / sendTransaction. Keep handlers **non-blocking**:
- * hand off to a queue-backed sink (Datadog `addAction`, Segment `track`, etc. are
- * already non-blocking) or defer heavy work yourself — e.g.
- * `onEvent: e => queueMicrotask(() => doHeavyWork(e))`. Do not perform synchronous
- * network/IO or expensive serialization inline.
- */
-export interface UWCObserver {
-    /** A normalized, PII-safe event. Forward to Datadog / Amplitude / Segment / … (non-blocking). */
-    onEvent?(event: UWCTelemetryEvent): void;
-    /** A log line (all levels). `args` is already scrubbed. Keep non-blocking. */
-    onLog?(level: LogLevel, message: string, args: unknown[]): void;
-}
-/**
- * Best-effort coarse runtime surface. HEURISTIC — user agents lie and in-app
- * browsers are hard to detect; treat `webview` as a hint, not a guarantee.
- * Never returns the raw UA (PII / high-cardinality).
- */
-export declare function derivePlatform(): Platform;
-/**
- * Derive the flow taxonomy from connection mode + surface. HEURISTIC — UWC does
- * not always know whether a WalletConnect handoff used a deeplink vs a QR scan;
- * we infer from the platform (mobile ⇒ deeplink, desktop ⇒ QR), matching link-v2's
- * historical intent. Consumers with better context may override downstream.
- */
-export declare function deriveWalletFlowType(connectionMode: ConnectionMode, platform: Platform): WalletFlowType;
-/**
- * Map a raw `UWCEventMap` event to its PII-safe `UWCTelemetryEvent`.
- *
- * Per-event allow-listing: only known-safe fields are copied. Payloads carrying a
- * `Session`/`Network` (which include the wallet address) are reduced to
- * `namespace` + `chainId` + `walletId`. Unknown/noisy payloads collapse to just
- * the name. `error.message` is scrubbed.
- */
-export declare function normalizeEvent<K extends UWCEventName>(name: K, data: UWCEventMap[K], sdkSessionId: string, now: number): UWCTelemetryEvent;
-//# sourceMappingURL=telemetry.d.ts.map

package/dist/observability/telemetry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/observability/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,SAAS,EACV,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAGxE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,IAAI,EAAE,YAAY,CAAA;IAClB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAA;IACpB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAA;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;IACpC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IAC3C,0EAA0E;IAC1E,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IACjC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IAC3C,QAAQ,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;IAC/B,sEAAsE;IACtE,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IAC/B,oDAAoD;IACpD,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,iGAAiG;IACjG,OAAO,CAAC,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACxC,8EAA8E;IAC9E,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;CAChE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAWzC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,QAAQ,GACjB,cAAc,CAehB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,YAAY,EACnD,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EACpB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,GACV,iBAAiB,CAuFnB"}

package/dist/observability/telemetry.js

@@ -1,138 +0,0 @@
-import { scrubMessage } from './scrub';
-/**
- * Best-effort coarse runtime surface. HEURISTIC — user agents lie and in-app
- * browsers are hard to detect; treat `webview` as a hint, not a guarantee.
- * Never returns the raw UA (PII / high-cardinality).
- */
-export function derivePlatform() {
-    if (typeof navigator === 'undefined' || !navigator.userAgent)
-        return 'unknown';
-    const ua = navigator.userAgent;
-    const isIOS = /iPhone|iPad|iPod/i.test(ua);
-    const isAndroid = /Android/i.test(ua);
-    // Android in-app browsers tag the UA with `; wv`; iOS WKWebViews lack `Safari`.
-    const isWebview = (isAndroid && /; wv\)/i.test(ua)) || (isIOS && !/Safari/i.test(ua));
-    if (isWebview)
-        return 'webview';
-    if (isIOS || isAndroid)
-        return 'mobile';
-    return 'desktop';
-}
-/**
- * Derive the flow taxonomy from connection mode + surface. HEURISTIC — UWC does
- * not always know whether a WalletConnect handoff used a deeplink vs a QR scan;
- * we infer from the platform (mobile ⇒ deeplink, desktop ⇒ QR), matching link-v2's
- * historical intent. Consumers with better context may override downstream.
- */
-export function deriveWalletFlowType(connectionMode, platform) {
-    const isDesktop = platform === 'desktop';
-    switch (connectionMode) {
-        case 'injected':
-            // Injected on a phone almost always means we're inside a wallet's browser.
-            return isDesktop ? 'browser_extension_flow' : 'in_wallet_browser_flow';
-        case 'walletConnect':
-            return isDesktop
-                ? 'wallet_connect_qr_flow'
-                : 'wallet_connect_deep_link_flow';
-        case 'tonConnect':
-            return isDesktop ? 'ton_connect_qr_flow' : 'ton_connect_deep_link_flow';
-        default:
-            return 'unknown';
-    }
-}
-/**
- * Map a raw `UWCEventMap` event to its PII-safe `UWCTelemetryEvent`.
- *
- * Per-event allow-listing: only known-safe fields are copied. Payloads carrying a
- * `Session`/`Network` (which include the wallet address) are reduced to
- * `namespace` + `chainId` + `walletId`. Unknown/noisy payloads collapse to just
- * the name. `error.message` is scrubbed.
- */
-export function normalizeEvent(name, data, sdkSessionId, now) {
-    const base = { name, sdkSessionId, timestamp: now };
-    switch (name) {
-        case 'connecting': {
-            const d = data;
-            return {
-                ...base,
-                operation: 'connect',
-                connectionMode: d.connectionMode,
-                walletId: d.walletId
-            };
-        }
-        case 'connected':
-        case 'sessionChanged': {
-            const d = data;
-            const session = d.session;
-            return {
-                ...base,
-                connectionMode: session.connectionMode ?? undefined,
-                namespace: session.activeNetwork?.namespace,
-                chainId: session.activeNetwork?.id,
-                walletId: session.activeWallet?.id
-            };
-        }
-        case 'networkSwitched': {
-            const d = data;
-            return {
-                ...base,
-                operation: 'switchNetwork',
-                namespace: d.network.namespace,
-                chainId: d.network.id
-            };
-        }
-        case 'connectionUri': {
-            // Carry the mode but NEVER the URI itself (a relay/pairing string).
-            const d = data;
-            return { ...base, connectionMode: d.connectionMode };
-        }
-        case 'error': {
-            const d = data;
-            return {
-                ...base,
-                operation: d.operation,
-                error: { type: d.error.type, message: scrubMessage(d.error.message) }
-            };
-        }
-        case 'awaitingWallet': {
-            const d = data;
-            return {
-                ...base,
-                operation: d.operation,
-                connectionMode: d.connectionMode,
-                walletId: d.walletId,
-                namespace: d.namespace,
-                chainId: d.chainId,
-                handoffId: d.handoffId,
-                walletFlowType: d.walletFlowType,
-                platform: d.platform
-            };
-        }
-        case 'walletSucceeded':
-        case 'walletRejected':
-        case 'walletTimedOut': {
-            const d = data;
-            return {
-                ...base,
-                operation: d.operation,
-                handoffId: d.handoffId,
-                durationMs: d.durationMs
-            };
-        }
-        case 'walletFailed': {
-            const d = data;
-            return {
-                ...base,
-                operation: d.operation,
-                handoffId: d.handoffId,
-                durationMs: d.durationMs,
-                error: { type: d.error.type, message: scrubMessage(d.error.message) }
-            };
-        }
-        default:
-            // ready / walletsDetected / disconnected / networkSwitching /
-            // capabilitiesUpdated / change / log — name only (log goes via onLog).
-            return base;
-    }
-}
-//# sourceMappingURL=telemetry.js.map

package/dist/observability/telemetry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/observability/telemetry.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAwDtC;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,SAAS,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,OAAO,SAAS,CAAA;IAC9E,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAA;IAC9B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACrC,gFAAgF;IAChF,MAAM,SAAS,GACb,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IACrE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAA;IACvC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,cAA8B,EAC9B,QAAkB;IAElB,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,CAAA;IACxC,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,2EAA2E;YAC3E,OAAO,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,wBAAwB,CAAA;QACxE,KAAK,eAAe;YAClB,OAAO,SAAS;gBACd,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,+BAA+B,CAAA;QACrC,KAAK,YAAY;YACf,OAAO,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,4BAA4B,CAAA;QACzE;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAO,EACP,IAAoB,EACpB,YAAoB,EACpB,GAAW;IAEX,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;IAEtE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,IAAiC,CAAA;YAC3C,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,SAAS;gBACpB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAA;QACH,CAAC;QACD,KAAK,WAAW,CAAC;QACjB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,IAAgC,CAAA;YAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACzB,OAAO;gBACL,GAAG,IAAI;gBACP,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;gBACnD,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,SAAS;gBAC3C,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE;gBAClC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE;aACnC,CAAA;QACH,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,CAAC,GAAG,IAAsC,CAAA;YAChD,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS;gBAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;aACtB,CAAA;QACH,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,oEAAoE;YACpE,MAAM,CAAC,GAAG,IAAoC,CAAA;YAC9C,OAAO,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAA;QACtD,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,IAA4B,CAAA;YACtC,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;aACtE,CAAA;QACH,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,IAAqC,CAAA;YAC/C,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAA;QACH,CAAC;QACD,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,IAAsC,CAAA;YAChD,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAA;QACH,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,IAAmC,CAAA;YAC7C,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;aACtE,CAAA;QACH,CAAC;QACD;YACE,8DAA8D;YAC9D,uEAAuE;YACvE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC"}

package/dist/utils/id.d.ts

@@ -1,2 +0,0 @@
-export declare function generateId(): string;
-//# sourceMappingURL=id.d.ts.map

package/dist/utils/id.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAgBA,wBAAgB,UAAU,IAAI,MAAM,CA+BnC"}

package/dist/utils/id.js

@@ -1,41 +0,0 @@
-/**
- * Generate a correlation id (RFC-4122 v4 when available).
- *
- * Used for the per-instance `sdkSessionId` and per-handoff `handoffId` — both are
- * opaque correlation tokens, never derived from wallet data (no address, no key).
- * Prefers the native `crypto.randomUUID()` (browsers + Node ≥ 16); falls back to a
- * `crypto.getRandomValues`-backed v4, and finally to a timestamp + monotonic
- * counter only in environments that expose neither. Correlation ids need to be
- * collision-resistant enough to pair a start event with its terminal — NOT
- * cryptographically unpredictable — so the last-resort branch uses no PRNG.
- */
-// Monotonic counter for the no-crypto fallback: guarantees per-process uniqueness
-// without any pseudo-random generator (correlation ids need uniqueness, not
-// unpredictability — and a counter is strictly more collision-resistant here).
-let fallbackCounter = 0;
-export function generateId() {
-    const c = typeof globalThis !== 'undefined' ? globalThis.crypto : undefined;
-    if (c?.randomUUID) {
-        return c.randomUUID();
-    }
-    if (c?.getRandomValues) {
-        const bytes = c.getRandomValues(new Uint8Array(16));
-        // Set the version (4) and variant (10xx) bits per RFC 4122 §4.4.
-        bytes[6] = (bytes[6] & 0x0f) | 0x40;
-        bytes[8] = (bytes[8] & 0x3f) | 0x80;
-        const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0'));
-        return (hex.slice(0, 4).join('') +
-            '-' +
-            hex.slice(4, 6).join('') +
-            '-' +
-            hex.slice(6, 8).join('') +
-            '-' +
-            hex.slice(8, 10).join('') +
-            '-' +
-            hex.slice(10, 16).join(''));
-    }
-    // Last-resort fallback (no Web Crypto). Timestamp + monotonic counter keeps
-    // ids unique within the process without a PRNG. Sufficient for correlation.
-    return ('uwc-' + Date.now().toString(36) + '-' + (fallbackCounter++).toString(36));
-}
-//# sourceMappingURL=id.js.map

package/dist/utils/id.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"id.js","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,kFAAkF;AAClF,4EAA4E;AAC5E,+EAA+E;AAC/E,IAAI,eAAe,GAAG,CAAC,CAAA;AAEvB,MAAM,UAAU,UAAU;IACxB,MAAM,CAAC,GAAG,OAAO,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAE3E,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,UAAU,EAAE,CAAA;IACvB,CAAC;IAED,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACnD,iEAAiE;QACjE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAA;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QACnE,OAAO,CACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG;YACH,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG;YACH,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG;YACH,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,GAAG;YACH,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC3B,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,OAAO,CACL,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC1E,CAAA;AACH,CAAC"}

package/dist/utils/to-wallet-error.d.ts

@@ -1,16 +0,0 @@
-import { type WalletError } from '@meshconnect/uwc-types';
-/** Normalize any thrown value into the PII-light `WalletError` shape. */
-export declare function toWalletError(error: unknown): WalletError;
-/**
- * Whether a thrown value is an explicit user rejection. Connectors usually wrap
- * these as `WalletConnectorError{type:'rejected'}`, but a raw EIP-1193 reject
- * (code `4001`) or ethers' `ACTION_REJECTED` can also reach the façade.
- */
-export declare function isUserRejection(error: unknown): boolean;
-/**
- * Whether a thrown value is an intentional cancellation (AbortSignal / fetch
- * abort). Matched by `name` rather than `instanceof Error` because a real abort is
- * a `DOMException`, which is not an `Error` subclass in every runtime.
- */
-export declare function isAbortError(error: unknown): boolean;
-//# sourceMappingURL=to-wallet-error.d.ts.map

package/dist/utils/to-wallet-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"to-wallet-error.d.ts","sourceRoot":"","sources":["../../src/utils/to-wallet-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAE/E,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAQzD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIvD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMpD"}