@parity/product-sdk-terminal 0.0.0-dev.312.0 → 0.0.0-dev.454.0

package/dist/index.js

@@ -1,27 +1,35 @@
-import {
-  requestResourceAllocation,
-  sendResourceAllocation
-} from "./chunk-YS3GW2XW.js";
-import {
-  createNodeStorageAdapter,
-  sanitizeKey
-} from "./chunk-GHOFKVUG.js";
+import { cacheFilePath, withFileLock, loadJsonCache, saveJsonCache } from './chunk-EORPX5XL.js';
+export { requestResourceAllocation, sendResourceAllocation } from './chunk-EORPX5XL.js';
+import { createNodeStorageAdapter, sanitizeKey } from './chunk-GHOFKVUG.js';
+export { createNodeStorageAdapter } from './chunk-GHOFKVUG.js';
+import { SS_PREVIEW_STAGE_ENDPOINTS, createPappAdapter, AllowanceError } from '@novasamatech/host-papp';
+export { AllowanceError, SS_STABLE_STAGE_ENDPOINTS } from '@novasamatech/host-papp';
+import { createLazyClient, createPapiStatementStoreAdapter, NoAllowanceError } from '@novasamatech/statement-store';
+import { createLogger } from '@parity/product-sdk-logger';
+import { getWsProvider } from '@polkadot-api/ws-provider';
+import { resolveTxExtVersion } from '@parity/product-sdk-host/tx-ext-version';
+import { deriveProductAccountPublicKey } from '@parity/product-sdk-keys';
+import { AllowanceExpiredError } from '@parity/product-sdk-signer/errors';
+export { AllowanceExpiredError, SignerError } from '@parity/product-sdk-signer/errors';
+import { toHex, fromHex } from '@polkadot-api/utils';
+import { gcm } from '@noble/ciphers/aes.js';
+import { blake2b } from '@noble/hashes/blake2.js';
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { Enum, _void, Struct, str, Bytes, Vector } from 'scale-ts';
+import '@noble/hashes/utils.js';
+
+var StatementStoreNetworks = {
+  // host-papp has no constant for this host; its `SS_PASEO_STABLE_STAGE_ENDPOINTS`
+  // still names the pre-rename chain.
+  paseo: ["wss://paseo-people-next-system-rpc.polkadot.io"],
+  previewnet: SS_PREVIEW_STAGE_ENDPOINTS
+};
 
 // src/adapter.ts
-import {
-  createPappAdapter,
-  SS_STABLE_STAGE_ENDPOINTS,
-  SS_PASEO_STABLE_STAGE_ENDPOINTS
-} from "@novasamatech/host-papp";
-import {
-  createLazyClient,
-  createPapiStatementStoreAdapter
-} from "@novasamatech/statement-store";
-import { createLogger } from "@parity/product-sdk-logger";
-import { getWsProvider } from "@polkadot-api/ws-provider";
 var log = createLogger("terminal");
 function createTerminalAdapter(options) {
-  const endpoints = options.endpoints ?? SS_PASEO_STABLE_STAGE_ENDPOINTS;
+  const endpoints = options.endpoints ?? StatementStoreNetworks.paseo;
   const storage = createNodeStorageAdapter(options.appId, options.storageDir);
   const HEARTBEAT_NEVER_MS = 2147483647;
   const rawLazyClient = createLazyClient(
@@ -78,209 +86,98 @@ function wrapLazyClient(inner) {
     }
   };
 }
+function isBenignTeardownError(error) {
+  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+  return /Client destroyed/.test(message);
+}
+function suppressBenignTeardownErrors() {
+  const original = console.error;
+  const wrapper = (...args) => {
+    if (args.some(isBenignTeardownError)) return;
+    original.apply(console, args);
+  };
+  console.error = wrapper;
+  return () => {
+    if (console.error === wrapper) console.error = original;
+  };
+}
 async function teardown(sessions, lazyClient) {
   log.debug("destroying terminal adapter");
   sessions.dispose();
   await lazyClient.awaitPendingUnsubs();
+  const restore = suppressBenignTeardownErrors();
   try {
     lazyClient.disconnect();
   } catch (e) {
     log.warn("lazyClient.disconnect threw during destroy", { error: e });
+  } finally {
+    restore();
   }
 }
-if (void 0) {
-  let fakeLazyClient = function() {
-    let teardownCalls = 0;
-    let disconnectCalls = 0;
-    const fake = {
-      getClient: (() => ({})),
-      getRequestFn: (() => () => Promise.resolve()),
-      getSubscribeFn: () => ((_method, _params, _onMessage, _onError) => {
-        return () => {
-          teardownCalls += 1;
-        };
-      }),
-      disconnect: () => {
-        disconnectCalls += 1;
-      }
-    };
-    return {
-      client: fake,
-      get teardownCalls() {
-        return teardownCalls;
-      },
-      get disconnectCalls() {
-        return disconnectCalls;
-      }
-    };
-  };
-  fakeLazyClient2 = fakeLazyClient;
-  const { describe, test, expect, vi } = void 0;
-  describe("wrapLazyClient", () => {
-    test("passes getClient / getRequestFn / disconnect through unchanged", () => {
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      wrapped.getClient();
-      wrapped.disconnect();
-      expect(fake.disconnectCalls).toBe(1);
-      expect(typeof wrapped.getRequestFn).toBe("function");
-    });
-    test("getSubscribeFn returns a wrapped subscribe whose teardown invokes the inner teardown", () => {
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      const subscribe = wrapped.getSubscribeFn();
-      const teardown2 = subscribe(
-        "statement_subscribeStatement",
-        [],
-        () => {
-        },
-        () => {
-        }
-      );
-      teardown2();
-      expect(fake.teardownCalls).toBe(1);
-    });
-    test("awaitPendingUnsubs resolves after all wrapped teardowns settle", async () => {
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      const subscribe = wrapped.getSubscribeFn();
-      for (let i = 0; i < 3; i++) {
-        const teardown2 = subscribe(
-          "statement_subscribeStatement",
-          [],
-          () => {
-          },
-          () => {
-          }
-        );
-        teardown2();
-      }
-      await wrapped.awaitPendingUnsubs();
-      expect(fake.teardownCalls).toBe(3);
-    });
-    test("awaitPendingUnsubs with no pending unsubs resolves immediately", async () => {
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      await expect(wrapped.awaitPendingUnsubs()).resolves.toBeUndefined();
-    });
-    test("an unsubscribe whose teardown throws is still tracked and resolved", async () => {
-      const fake = {
-        getClient: (() => ({})),
-        getRequestFn: (() => () => Promise.resolve()),
-        getSubscribeFn: () => ((_method, _params, _onMessage, _onError) => {
-          return () => {
-            throw new Error("teardown boom");
-          };
-        }),
-        disconnect: () => {
-        }
-      };
-      const wrapped = wrapLazyClient(fake);
-      const subscribe = wrapped.getSubscribeFn();
-      const teardown2 = subscribe(
-        "statement_subscribeStatement",
-        [],
-        () => {
-        },
-        () => {
-        }
-      );
-      try {
-        teardown2();
-      } catch {
-      }
-      await expect(wrapped.awaitPendingUnsubs()).resolves.toBeUndefined();
-    });
-  });
-  describe("teardown", () => {
-    test("orders sessions.dispose, drain, then disconnect", async () => {
-      const order = [];
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      const innerDisconnect = wrapped.disconnect.bind(wrapped);
-      wrapped.disconnect = () => {
-        order.push("disconnect");
-        innerDisconnect();
-      };
-      const sessions = {
-        dispose: vi.fn(() => {
-          order.push("dispose");
-          const subscribe = wrapped.getSubscribeFn();
-          subscribe(
-            "statement_subscribeStatement",
-            [],
-            () => {
-            },
-            () => {
-            }
-          )();
-        })
-      };
-      await teardown(sessions, wrapped);
-      expect(order).toEqual(["dispose", "disconnect"]);
-      expect(sessions.dispose).toHaveBeenCalledTimes(1);
-      expect(fake.disconnectCalls).toBe(1);
-    });
-    test("disconnect runs even when there are no pending unsubs", async () => {
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      const sessions = { dispose: vi.fn() };
-      await teardown(sessions, wrapped);
-      expect(fake.disconnectCalls).toBe(1);
-    });
-    test("logs a warning if disconnect throws, doesn't propagate to caller", async () => {
-      const fake = {
-        getClient: (() => ({})),
-        getRequestFn: (() => () => Promise.resolve()),
-        getSubscribeFn: () => ((_method, _params, _onMessage, _onError) => () => {
-        }),
-        disconnect: () => {
-          throw new Error("boom");
-        }
-      };
-      const wrapped = wrapLazyClient(fake);
-      const sessions = { dispose: vi.fn() };
-      await expect(teardown(sessions, wrapped)).resolves.toBeUndefined();
-    });
-    test("awaits pending unsubs before calling disconnect", async () => {
-      const fake = fakeLazyClient();
-      const wrapped = wrapLazyClient(fake.client);
-      let unsubResolved = false;
-      const innerDisconnect = wrapped.disconnect.bind(wrapped);
-      wrapped.disconnect = () => {
-        expect(unsubResolved).toBe(true);
-        innerDisconnect();
-      };
-      const sessions = {
-        dispose: () => {
-          const subscribe = wrapped.getSubscribeFn();
-          subscribe(
-            "statement_subscribeStatement",
-            [],
-            () => {
-            },
-            () => {
-            }
-          )();
-          queueMicrotask(
-            () => queueMicrotask(() => {
-              unsubResolved = true;
-            })
-          );
-        }
-      };
-      await teardown(sessions, wrapped);
-      expect(fake.disconnectCalls).toBe(1);
-    });
+var log2 = createLogger("terminal");
+var CACHE_KIND = "ProductSubtrees";
+var CACHE_VERSION = 1;
+var SUBTREE_KEY_BYTES = 32;
+var memo = /* @__PURE__ */ new Map();
+function entryKey(session, productId) {
+  return `${session.id}::${productId}`;
+}
+async function requestSubtree(session, productId) {
+  const result = await session.getProductSubtree(productId);
+  if (result.isErr()) {
+    throw new Error(`Could not fetch the product subtree key: ${result.error.message}`);
+  }
+  const key = new Uint8Array(result.value);
+  if (key.length !== SUBTREE_KEY_BYTES) {
+    throw new Error(
+      `Product subtree key must be ${SUBTREE_KEY_BYTES} bytes, got ${key.length}`
+    );
+  }
+  return key;
+}
+function getProductSubtreePublicKey(session, productId, options = {}) {
+  const path = cacheFilePath(options.appId ?? productId, CACHE_KIND, options.storageDir);
+  const key = `${path}::${entryKey(session, productId)}`;
+  const inFlight = memo.get(key);
+  if (inFlight) return inFlight;
+  const pending = resolveSubtree(session, productId, path, entryKey(session, productId));
+  memo.set(key, pending);
+  pending.catch(() => memo.delete(key));
+  return pending;
+}
+async function resolveSubtree(session, productId, path, entry) {
+  return withFileLock(path, async () => {
+    const cache = await loadJsonCache(
+      path,
+      CACHE_VERSION,
+      "product-subtree cache"
+    );
+    const stored = readEntry(cache, entry, path);
+    if (stored) return stored;
+    const fetched = await requestSubtree(session, productId);
+    const entries = typeof cache?.entries === "object" && cache.entries !== null ? cache.entries : {};
+    await saveJsonCache(path, {
+      version: CACHE_VERSION,
+      entries: { ...entries, [entry]: toHex(fetched) }
+    });
+    return fetched;
   });
 }
-var fakeLazyClient2;
+function readEntry(cache, entry, path) {
+  const stored = cache?.entries?.[entry];
+  if (typeof stored !== "string") return null;
+  let bytes;
+  try {
+    bytes = fromHex(stored);
+  } catch {
+    bytes = new Uint8Array();
+  }
+  if (bytes.length === SUBTREE_KEY_BYTES) return bytes;
+  log2.warn("product-subtree cache entry is malformed; refetching", { path });
+  return null;
+}
 
 // src/signer.ts
-import { NoAllowanceError } from "@novasamatech/statement-store";
-import { decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";
-import { deriveProductAccountPublicKey } from "@parity/product-sdk-keys";
-import { AllowanceExpiredError } from "@parity/product-sdk-signer/errors";
 function isNoAllowanceError(error) {
   for (let current = error, depth = 0; current != null && depth < 8; depth++) {
     if (current instanceof NoAllowanceError) return true;
@@ -298,6 +195,9 @@ function isNoAllowanceError(error) {
 function toAllowanceExpiredError(error) {
   return isNoAllowanceError(error) ? new AllowanceExpiredError("statementStore", error) : null;
 }
+function toProductAccountId(ref) {
+  return [ref.productId, { tag: "Index", value: ref.derivationIndex }];
+}
 function buildCreateTransactionRequest(productAccountId, callData, signedExtensions, txExtVersion) {
   const checkGenesis = signedExtensions.CheckGenesis;
   if (!checkGenesis) {
@@ -311,7 +211,8 @@ function buildCreateTransactionRequest(productAccountId, callData, signedExtensi
       value: {
         signer: productAccountId,
         // CheckGenesis carries the genesis hash as its additionalSigned (implicit) data.
-        genesisHash: checkGenesis.additionalSigned,
+        // `toHex` is typed `string`; the codec wants the 0x literal type.
+        genesisHash: toHex(checkGenesis.additionalSigned),
         callData,
         extensions: Object.values(signedExtensions).map(
           ({ identifier, value, additionalSigned }) => ({
@@ -325,11 +226,6 @@ function buildCreateTransactionRequest(productAccountId, callData, signedExtensi
     }
   };
 }
-function txExtVersionFromMetadata(metadata) {
-  const decoded = unifyMetadata(decAnyMetadata(metadata));
-  const latestVersion = decoded.extrinsic.version.reduce((max, v) => Math.max(max, v), 0);
-  return latestVersion === 4 ? 0 : latestVersion;
-}
 async function requestSignedTransaction(session, request) {
   const result = await session.createTransaction(request);
   if (result.isErr()) {
@@ -339,14 +235,14 @@ async function requestSignedTransaction(session, request) {
   }
   return result.value;
 }
-function makeTxSignTx(session, productAccountId) {
+function makeTxSignTx(session, productAccountId, txExtVersion) {
   return async (callData, signedExtensions, metadata) => requestSignedTransaction(
     session,
     buildCreateTransactionRequest(
       productAccountId,
       callData,
       signedExtensions,
-      txExtVersionFromMetadata(metadata)
+      txExtVersion ?? resolveTxExtVersion(metadata, signedExtensions)
     )
   );
 }
@@ -373,390 +269,35 @@ function sessionRootPublicKey(session) {
   }
   return publicKey;
 }
-function deriveProductPublicKey(session, ref) {
-  return deriveProductAccountPublicKey(
-    sessionRootPublicKey(session),
-    ref.productId,
-    ref.derivationIndex
-  );
+async function deriveProductPublicKey(session, ref, options) {
+  const subtree = await getProductSubtreePublicKey(session, ref.productId, options);
+  return deriveProductAccountPublicKey(subtree, { tag: "Index", value: ref.derivationIndex });
 }
-function buildSessionSigner(session, ref) {
-  const productAccountId = [ref.productId, ref.derivationIndex];
-  const publicKey = ref.publicKey ?? deriveProductPublicKey(session, ref);
+async function buildSessionSigner(session, ref, options) {
+  const productAccountId = toProductAccountId(ref);
+  const publicKey = ref.publicKey ?? await deriveProductPublicKey(session, ref, options);
   return {
     publicKey,
     // Transaction signing → host-papp `createTransaction`: the wallet builds
     // and signs the extrinsic, so it can show a decoded tx (no `<Bytes>`
     // envelope) and unknown signed extensions (e.g. `AsPgas`) survive.
-    signTx: makeTxSignTx(session, productAccountId),
+    signTx: makeTxSignTx(session, productAccountId, options?.txExtVersion),
     // Arbitrary-byte signing keeps the `Bytes` tag so the wallet applies the
     // `<Bytes>...</Bytes>` anti-phishing envelope exactly once on its side
     // (correct for non-extrinsic user data).
     signBytes: makeRawBytesSignCallback(session, productAccountId)
   };
 }
-function createSessionSigner(session, adapter, publicKey) {
-  return buildSessionSigner(session, { productId: adapter.appId, derivationIndex: 0, publicKey });
+function createSessionSigner(session, adapter, publicKey, options) {
+  return buildSessionSigner(
+    session,
+    { productId: adapter.appId, derivationIndex: 0, publicKey },
+    { appId: adapter.appId, ...options }
+  );
 }
-function createSessionSignerForAccount(session, ref) {
-  return buildSessionSigner(session, ref);
+function createSessionSignerForAccount(session, ref, options) {
+  return buildSessionSigner(session, ref, options);
 }
-if (void 0) {
-  let makeSession = function(opts) {
-    const accountIdBytes = opts.accountIdBytes ?? new Array(32).fill(0).map((_, i) => i);
-    const rootAccountId = opts.rootAccountId === void 0 ? Array.from(DEV_ROOT_PUBLIC_KEY) : opts.rootAccountId;
-    return {
-      remoteAccount: { accountId: accountIdBytes },
-      ...rootAccountId === null ? {} : { rootAccountId: new Uint8Array(rootAccountId) },
-      signPayload: vi.fn(
-        opts.signPayload ?? (async () => {
-          throw new Error("signPayload not stubbed in this test");
-        })
-      ),
-      signRaw: vi.fn(
-        opts.signRaw ?? (async () => {
-          throw new Error("signRaw not stubbed in this test");
-        })
-      ),
-      createTransaction: vi.fn(
-        opts.createTransaction ?? (async () => {
-          throw new Error("createTransaction not stubbed in this test");
-        })
-      )
-    };
-  }, ext = function(identifier, value, additionalSigned) {
-    return {
-      identifier,
-      value: new Uint8Array(value),
-      additionalSigned: new Uint8Array(additionalSigned)
-    };
-  }, fakeAdapter = function(appId) {
-    return { appId };
-  };
-  makeSession2 = makeSession, ext2 = ext, fakeAdapter2 = fakeAdapter;
-  const { describe, test, expect, vi } = void 0;
-  const { ok, err } = await null;
-  const { seedToAccount } = await null;
-  const DEV_ROOT_PUBLIC_KEY = seedToAccount(
-    "bottom drive obey lake curtain smoke basket hold race lonely fit walk",
-    ""
-  ).publicKey;
-  describe("createSessionSigner", () => {
-    test("self-derives the product key from the session root when none is passed", () => {
-      const walletBytes = Array.from({ length: 32 }, (_, i) => i);
-      const signer = createSessionSigner(
-        makeSession({
-          accountIdBytes: walletBytes,
-          rootAccountId: Array.from(DEV_ROOT_PUBLIC_KEY)
-        }),
-        fakeAdapter("test-app")
-      );
-      const expected = deriveProductAccountPublicKey(DEV_ROOT_PUBLIC_KEY, "test-app", 0);
-      expect(signer.publicKey).toEqual(expected);
-      expect(signer.publicKey).not.toEqual(new Uint8Array(walletBytes));
-    });
-    test("throws on a stale session with no root account key", () => {
-      expect(
-        () => createSessionSigner(makeSession({ rootAccountId: null }), fakeAdapter("test-app"))
-      ).toThrow(INCOMPLETE_SESSION_MESSAGE);
-    });
-    test("uses the host-supplied product-account public key when provided", () => {
-      const walletBytes = Array.from({ length: 32 }, (_, i) => i);
-      const productKey = new Uint8Array(32).fill(171);
-      const signer = createSessionSigner(
-        makeSession({ accountIdBytes: walletBytes }),
-        fakeAdapter("test-app"),
-        productKey
-      );
-      expect(signer.publicKey).toEqual(productKey);
-      expect(signer.publicKey).not.toEqual(new Uint8Array(walletBytes));
-    });
-    test("signBytes routes through session.signRaw with the Bytes tag", async () => {
-      const sig = new Uint8Array([9, 8, 7, 6, 5, 4, 3, 2, 1]);
-      const captured = [];
-      const session = makeSession({
-        signRaw: async (req2) => {
-          captured.push(req2);
-          return ok({ signature: sig });
-        }
-      });
-      const signer = createSessionSigner(session, fakeAdapter("test-app"));
-      const out = await signer.signBytes(new Uint8Array([1, 2, 3]));
-      expect(out).toEqual(sig);
-      expect(captured).toHaveLength(1);
-      const req = captured[0];
-      expect(req.productAccountId).toEqual(["test-app", 0]);
-      expect(req.data.tag).toBe("Bytes");
-      expect(req.data.value).toEqual(new Uint8Array([1, 2, 3]));
-    });
-    test("signBytes never calls session.signPayload (legacy-path regression guard)", async () => {
-      const session = makeSession({
-        signRaw: async () => ok({ signature: new Uint8Array([1]) })
-      });
-      const signer = createSessionSigner(session, fakeAdapter("test-app"));
-      await signer.signBytes(new Uint8Array([1, 2, 3]));
-      const sessionWithSpies = session;
-      expect(sessionWithSpies.signPayload.mock.calls).toHaveLength(0);
-      expect(sessionWithSpies.signRaw.mock.calls).toHaveLength(1);
-    });
-    test("signBytes throws with a clear error when the mobile rejects", async () => {
-      const session = makeSession({
-        signRaw: async () => err({ message: "user declined" })
-      });
-      const signer = createSessionSigner(session, fakeAdapter("test-app"));
-      await expect(signer.signBytes(new Uint8Array([1]))).rejects.toThrow(
-        "Mobile signing rejected: user declined"
-      );
-    });
-  });
-  describe("buildCreateTransactionRequest \u2014 tx payload (the AsPgas fix)", () => {
-    const checkGenesis = ext("CheckGenesis", [], [17, 34, 51]);
-    test("wraps the payload as v1 with signer, callData, and txExtVersion", () => {
-      const callData = new Uint8Array([202, 17]);
-      const req = buildCreateTransactionRequest(
-        ["my-app", 3],
-        callData,
-        { CheckGenesis: checkGenesis },
-        5
-      );
-      expect(req.payload.tag).toBe("v1");
-      expect(req.payload.value.signer).toEqual(["my-app", 3]);
-      expect(req.payload.value.callData).toEqual(callData);
-      expect(req.payload.value.txExtVersion).toBe(5);
-    });
-    test("takes the genesis hash from CheckGenesis.additionalSigned", () => {
-      const req = buildCreateTransactionRequest(
-        ["my-app", 0],
-        new Uint8Array([0]),
-        { CheckGenesis: checkGenesis },
-        0
-      );
-      expect(req.payload.value.genesisHash).toEqual(new Uint8Array([17, 34, 51]));
-    });
-    test("maps every signed extension to { id, extra, additionalSigned }", () => {
-      const req = buildCreateTransactionRequest(
-        ["my-app", 0],
-        new Uint8Array([0]),
-        { CheckGenesis: checkGenesis, CheckNonce: ext("CheckNonce", [7], []) },
-        0
-      );
-      expect(req.payload.value.extensions).toEqual([
-        {
-          id: "CheckGenesis",
-          extra: new Uint8Array([]),
-          additionalSigned: new Uint8Array([17, 34, 51])
-        },
-        {
-          id: "CheckNonce",
-          extra: new Uint8Array([7]),
-          additionalSigned: new Uint8Array([])
-        }
-      ]);
-    });
-    test("preserves an unknown signed extension verbatim (e.g. AsPgas)", () => {
-      const req = buildCreateTransactionRequest(
-        ["my-app", 0],
-        new Uint8Array([0]),
-        { CheckGenesis: checkGenesis, AsPgas: ext("AsPgas", [222, 173], [190, 239]) },
-        0
-      );
-      expect(req.payload.value.extensions).toContainEqual({
-        id: "AsPgas",
-        extra: new Uint8Array([222, 173]),
-        additionalSigned: new Uint8Array([190, 239])
-      });
-    });
-    test("throws a clear error when CheckGenesis is absent", () => {
-      expect(
-        () => buildCreateTransactionRequest(["my-app", 0], new Uint8Array([0]), {}, 0)
-      ).toThrow(/CheckGenesis/);
-    });
-  });
-  describe("requestSignedTransaction \u2014 SSO round-trip", () => {
-    const request = buildCreateTransactionRequest(
-      ["my-app", 0],
-      new Uint8Array([0]),
-      { CheckGenesis: ext("CheckGenesis", [], [1]) },
-      0
-    );
-    test("returns the signed extrinsic bytes from the mobile response", async () => {
-      const signed = new Uint8Array([171, 205, 239]);
-      const session = makeSession({ createTransaction: async () => ok(signed) });
-      const out = await requestSignedTransaction(session, request);
-      expect(out).toBe(signed);
-    });
-    test("calls session.createTransaction \u2014 never signRaw/signPayload \u2014 with the request", async () => {
-      const captured = [];
-      const session = makeSession({
-        createTransaction: async (req) => {
-          captured.push(req);
-          return ok(new Uint8Array([1]));
-        }
-      });
-      await requestSignedTransaction(session, request);
-      expect(captured).toEqual([request]);
-      const spies = session;
-      expect(spies.createTransaction.mock.calls).toHaveLength(1);
-      expect(spies.signPayload.mock.calls).toHaveLength(0);
-      expect(spies.signRaw.mock.calls).toHaveLength(0);
-    });
-    test("throws a clear error when the mobile rejects", async () => {
-      const session = makeSession({
-        createTransaction: async () => err({ message: "user declined" })
-      });
-      await expect(requestSignedTransaction(session, request)).rejects.toThrow(
-        "Mobile transaction signing rejected: user declined"
-      );
-    });
-    test("throws AllowanceExpiredError when the failure is a NoAllowanceError", async () => {
-      const underlying = new NoAllowanceError();
-      const session = makeSession({
-        createTransaction: async () => err(underlying)
-      });
-      await expect(requestSignedTransaction(session, request)).rejects.toBeInstanceOf(
-        AllowanceExpiredError
-      );
-      await expect(requestSignedTransaction(session, request)).rejects.toMatchObject({
-        name: "AllowanceExpiredError",
-        resource: "statementStore",
-        cause: underlying
-      });
-    });
-    test("throws AllowanceExpiredError for a wire-serialized failure (message match only)", async () => {
-      expect(new NoAllowanceError().message).toBe(
-        "Submit failed, no allowance set for account"
-      );
-      const serialized = new Error("Submit failed, no allowance set for account");
-      const session = makeSession({
-        createTransaction: async () => err(serialized)
-      });
-      await expect(requestSignedTransaction(session, request)).rejects.toBeInstanceOf(
-        AllowanceExpiredError
-      );
-    });
-    test("throws AllowanceExpiredError when the NoAllowanceError is wrapped as a cause", async () => {
-      const wrapped = new Error("submitRequest failed", { cause: new NoAllowanceError() });
-      const session = makeSession({
-        createTransaction: async () => err(wrapped)
-      });
-      await expect(requestSignedTransaction(session, request)).rejects.toBeInstanceOf(
-        AllowanceExpiredError
-      );
-    });
-    test("a non-allowance Error still surfaces as the generic rejection", async () => {
-      const session = makeSession({
-        createTransaction: async () => err(new Error("transport exploded"))
-      });
-      await expect(requestSignedTransaction(session, request)).rejects.toThrow(
-        "Mobile transaction signing rejected: transport exploded"
-      );
-    });
-  });
-  describe("makeRawBytesSignCallback", () => {
-    test("forwards data verbatim under the Bytes tag with the right productAccountId", async () => {
-      const captured = [];
-      const session = makeSession({
-        signRaw: async (req2) => {
-          captured.push(req2);
-          return ok({ signature: new Uint8Array([255]) });
-        }
-      });
-      const callback = makeRawBytesSignCallback(session, ["my-app", 5]);
-      await callback(new Uint8Array([222, 173, 190, 239]));
-      expect(captured).toHaveLength(1);
-      const req = captured[0];
-      expect(req.productAccountId).toEqual(["my-app", 5]);
-      expect(req.data.tag).toBe("Bytes");
-      expect(Array.from(req.data.value)).toEqual([222, 173, 190, 239]);
-    });
-    test("returns the raw signature bytes from the mobile response", async () => {
-      const sig = new Uint8Array([66]);
-      const session = makeSession({
-        signRaw: async () => ok({ signature: sig })
-      });
-      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
-      const out = await callback(new Uint8Array([0]));
-      expect(out).toBe(sig);
-    });
-    test("throws AllowanceExpiredError when the failure is a NoAllowanceError", async () => {
-      const underlying = new NoAllowanceError();
-      const session = makeSession({
-        signRaw: async () => err(underlying)
-      });
-      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
-      await expect(callback(new Uint8Array([1]))).rejects.toBeInstanceOf(
-        AllowanceExpiredError
-      );
-      await expect(callback(new Uint8Array([1]))).rejects.toMatchObject({
-        resource: "statementStore",
-        cause: underlying
-      });
-    });
-    test("a non-allowance failure still surfaces as the generic rejection", async () => {
-      const session = makeSession({
-        signRaw: async () => err(new Error("user declined"))
-      });
-      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
-      await expect(callback(new Uint8Array([1]))).rejects.toThrow(
-        "Mobile signing rejected: user declined"
-      );
-    });
-  });
-  describe("createSessionSignerForAccount", () => {
-    test("forwards productAccountId from the explicit ref", async () => {
-      const captured = [];
-      const session = makeSession({
-        signRaw: async (req2) => {
-          captured.push(req2);
-          return ok({ signature: new Uint8Array([42]) });
-        }
-      });
-      const signer = createSessionSignerForAccount(session, {
-        productId: "my-app",
-        derivationIndex: 7
-      });
-      await signer.signBytes(new Uint8Array([10, 20, 30]));
-      expect(captured).toHaveLength(1);
-      const req = captured[0];
-      expect(req.productAccountId).toEqual(["my-app", 7]);
-      expect(req.data.tag).toBe("Bytes");
-      expect(req.data.value).toBeInstanceOf(Uint8Array);
-    });
-    test("supports a productId different from any adapter's appId", async () => {
-      const captured = [];
-      const session = makeSession({
-        signRaw: async (req2) => {
-          captured.push(req2);
-          return ok({ signature: new Uint8Array([0]) });
-        }
-      });
-      const signer = createSessionSignerForAccount(session, {
-        productId: "external-product",
-        derivationIndex: 0
-      });
-      await signer.signBytes(new Uint8Array([1]));
-      const req = captured[0];
-      expect(req.productAccountId).toEqual(["external-product", 0]);
-    });
-  });
-}
-var makeSession2;
-var ext2;
-var fakeAdapter2;
-
-// src/index.ts
-import { AllowanceExpiredError as AllowanceExpiredError2, SignerError } from "@parity/product-sdk-signer/errors";
-
-// src/allowance.ts
-import { AllowanceError } from "@novasamatech/host-papp";
-
-// src/allowance-cache.ts
-import { gcm } from "@noble/ciphers/aes.js";
-import { blake2b } from "@noble/hashes/blake2.js";
-import { fromHex, toHex } from "@polkadot-api/utils";
-import { readFile, writeFile } from "fs/promises";
-import { join } from "path";
-import { Bytes, Enum, Struct, Vector, _void, str } from "scale-ts";
 var AllowanceResourceKindCodec = Enum({
   bulletin: _void,
   statementStore: _void
@@ -842,154 +383,6 @@ async function hasBulletinAllowance(adapter, productId, sessionId) {
 async function hasStatementStoreAllowance(adapter, productId, sessionId) {
   return hasAllowanceForResource(adapter, productId, "statementStore", sessionId);
 }
-if (void 0) {
-  let makeAdapter = function(opts) {
-    return {
-      sessions: {
-        sessions: {
-          read: () => opts.sessions
-        }
-      },
-      allowance: {
-        getBulletinSigner: opts.getBulletinSigner ?? vi.fn(() => ok({})),
-        getStatementStoreProver: opts.getStatementStoreProver ?? vi.fn(() => ok({}))
-      }
-      // The convenience never touches the rest of the adapter; leave it unstubbed.
-    };
-  };
-  makeAdapter2 = makeAdapter;
-  const { describe, test, expect, vi } = void 0;
-  const { ok, err } = await null;
-  describe("getBulletinSigner \u2014 sessionId defaulting", () => {
-    test("uses the only paired session when sessionId is omitted", async () => {
-      const fakeSigner = { _tag: "signer" };
-      const getBulletinSignerFn = vi.fn(() => ok(fakeSigner));
-      const adapter = makeAdapter({
-        sessions: [{ id: "sess-only" }],
-        getBulletinSigner: getBulletinSignerFn
-      });
-      const result = await getBulletinSigner(adapter, "my-app.dot");
-      expect(result).toBe(fakeSigner);
-      expect(getBulletinSignerFn).toHaveBeenCalledWith("sess-only", "my-app.dot");
-    });
-    test("uses the explicit sessionId when supplied", async () => {
-      const fakeSigner = { _tag: "signer" };
-      const getBulletinSignerFn = vi.fn(() => ok(fakeSigner));
-      const adapter = makeAdapter({
-        sessions: [{ id: "sess-a" }, { id: "sess-b" }],
-        getBulletinSigner: getBulletinSignerFn
-      });
-      await getBulletinSigner(adapter, "my-app.dot", "sess-b");
-      expect(getBulletinSignerFn).toHaveBeenCalledWith("sess-b", "my-app.dot");
-    });
-    test("throws AllowanceError('NoSession') when zero sessions and no id", async () => {
-      const adapter = makeAdapter({ sessions: [] });
-      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toBeInstanceOf(
-        AllowanceError
-      );
-      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toMatchObject({
-        reason: "NoSession"
-      });
-    });
-    test("throws AllowanceError('NoSession') when multiple sessions and no id", async () => {
-      const adapter = makeAdapter({ sessions: [{ id: "a" }, { id: "b" }] });
-      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toBeInstanceOf(
-        AllowanceError
-      );
-      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toMatchObject({
-        reason: "NoSession"
-      });
-    });
-  });
-  describe("getBulletinSigner \u2014 error unwrapping", () => {
-    test("rethrows the AllowanceError from the underlying service as a thrown exception", async () => {
-      const underlyingErr = new AllowanceError("Rejected", "user said no");
-      const adapter = makeAdapter({
-        sessions: [{ id: "s" }],
-        getBulletinSigner: vi.fn(() => err(underlyingErr))
-      });
-      await expect(getBulletinSigner(adapter, "p")).rejects.toBe(underlyingErr);
-    });
-  });
-  describe("getStatementStoreProver \u2014 same defaulting", () => {
-    test("uses the only paired session when sessionId is omitted", async () => {
-      const fakeProver = { _tag: "prover" };
-      const getStatementStoreProverFn = vi.fn(() => ok(fakeProver));
-      const adapter = makeAdapter({
-        sessions: [{ id: "sess-only" }],
-        getStatementStoreProver: getStatementStoreProverFn
-      });
-      const result = await getStatementStoreProver(adapter, "my-app.dot");
-      expect(result).toBe(fakeProver);
-      expect(getStatementStoreProverFn).toHaveBeenCalledWith("sess-only", "my-app.dot");
-    });
-    test("uses the explicit sessionId when supplied", async () => {
-      const fakeProver = { _tag: "prover" };
-      const getStatementStoreProverFn = vi.fn(() => ok(fakeProver));
-      const adapter = makeAdapter({
-        sessions: [{ id: "sess-a" }, { id: "sess-b" }],
-        getStatementStoreProver: getStatementStoreProverFn
-      });
-      await getStatementStoreProver(adapter, "my-app.dot", "sess-b");
-      expect(getStatementStoreProverFn).toHaveBeenCalledWith("sess-b", "my-app.dot");
-    });
-    test("throws AllowanceError('NoSession') when zero sessions and no id", async () => {
-      const adapter = makeAdapter({ sessions: [] });
-      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toBeInstanceOf(
-        AllowanceError
-      );
-      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toMatchObject({
-        reason: "NoSession"
-      });
-    });
-    test("throws AllowanceError('NoSession') when multiple sessions and no id", async () => {
-      const adapter = makeAdapter({ sessions: [{ id: "a" }, { id: "b" }] });
-      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toBeInstanceOf(
-        AllowanceError
-      );
-      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toMatchObject({
-        reason: "NoSession"
-      });
-    });
-  });
-  describe("getStatementStoreProver \u2014 error unwrapping", () => {
-    test("rethrows the AllowanceError from the underlying service as a thrown exception", async () => {
-      const underlyingErr = new AllowanceError("Rejected", "user said no");
-      const adapter = makeAdapter({
-        sessions: [{ id: "s" }],
-        getStatementStoreProver: vi.fn(() => err(underlyingErr))
-      });
-      await expect(getStatementStoreProver(adapter, "p")).rejects.toBe(underlyingErr);
-    });
-  });
-  describe("has*Allowance \u2014 sessionId defaulting + storageDir fallback", () => {
-    test("hasBulletinAllowance throws AllowanceError('NoSession') when zero sessions and no id", async () => {
-      const adapter = makeAdapter({ sessions: [] });
-      await expect(hasBulletinAllowance(adapter, "p")).rejects.toBeInstanceOf(AllowanceError);
-      await expect(hasBulletinAllowance(adapter, "p")).rejects.toMatchObject({
-        reason: "NoSession"
-      });
-    });
-    test("hasBulletinAllowance returns false (conservative) when storageDir is undefined", async () => {
-      const adapter = makeAdapter({ sessions: [{ id: "sess-only" }] });
-      expect(await hasBulletinAllowance(adapter, "p")).toBe(false);
-    });
-    test("hasStatementStoreAllowance throws AllowanceError('NoSession') when zero sessions and no id", async () => {
-      const adapter = makeAdapter({ sessions: [] });
-      await expect(hasStatementStoreAllowance(adapter, "p")).rejects.toBeInstanceOf(
-        AllowanceError
-      );
-    });
-    test("hasStatementStoreAllowance returns false (conservative) when storageDir is undefined", async () => {
-      const adapter = makeAdapter({ sessions: [{ id: "sess-only" }] });
-      expect(await hasStatementStoreAllowance(adapter, "p")).toBe(false);
-    });
-  });
-}
-var makeAdapter2;
-
-// src/index.ts
-import { AllowanceError as AllowanceError2 } from "@novasamatech/host-papp";
 
 // src/sessions.ts
 function waitForSessions(adapter, timeoutMs = 3e3) {
@@ -1011,108 +404,37 @@ function waitForSessions(adapter, timeoutMs = 3e3) {
     });
   });
 }
-if (void 0) {
-  let fakeAdapter = function() {
-    const subscribers = /* @__PURE__ */ new Set();
-    const adapter = {
-      sessions: {
-        sessions: {
-          subscribe(cb) {
-            subscribers.add(cb);
-            return () => {
-              subscribers.delete(cb);
-            };
-          }
-        }
-      }
-    };
-    return {
-      adapter,
-      emit: (sessions) => {
-        for (const cb of subscribers) cb(sessions);
-      },
-      subscriberCount: () => subscribers.size
-    };
-  };
-  fakeAdapter2 = fakeAdapter;
-  const { describe, test, expect, vi } = void 0;
-  describe("waitForSessions", () => {
-    test("resolves with sessions on first non-empty emission", async () => {
-      const { adapter, emit } = fakeAdapter();
-      const promise = waitForSessions(adapter, 1e3);
-      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
-      emit([session]);
-      await expect(promise).resolves.toEqual([session]);
-    });
-    test("ignores empty emissions and waits for a non-empty one", async () => {
-      const { adapter, emit } = fakeAdapter();
-      const promise = waitForSessions(adapter, 1e3);
-      emit([]);
-      emit([]);
-      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
-      emit([session]);
-      await expect(promise).resolves.toEqual([session]);
-    });
-    test("resolves with [] after timeout when nothing is emitted", async () => {
-      vi.useFakeTimers();
-      try {
-        const { adapter } = fakeAdapter();
-        const promise = waitForSessions(adapter, 50);
-        vi.advanceTimersByTime(50);
-        await expect(promise).resolves.toEqual([]);
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-    test("unsubscribes after resolving", async () => {
-      const { adapter, emit, subscriberCount } = fakeAdapter();
-      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
-      const promise = waitForSessions(adapter, 1e3);
-      emit([session]);
-      await promise;
-      await Promise.resolve();
-      expect(subscriberCount()).toBe(0);
-    });
-    test("uses default 3000ms timeout when none is passed", async () => {
-      vi.useFakeTimers();
-      try {
-        const { adapter } = fakeAdapter();
-        const promise = waitForSessions(adapter);
-        vi.advanceTimersByTime(2999);
-        let settled = false;
-        promise.then(() => {
-          settled = true;
-        });
-        await Promise.resolve();
-        expect(settled).toBe(false);
-        vi.advanceTimersByTime(1);
-        await expect(promise).resolves.toEqual([]);
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-    test("handles synchronous initial emission", async () => {
-      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
-      const adapter = {
-        sessions: {
-          sessions: {
-            subscribe(cb) {
-              cb([session]);
-              return () => {
-              };
-            }
-          }
-        }
-      };
-      await expect(waitForSessions(adapter, 1e3)).resolves.toEqual([session]);
-    });
-  });
+var ROOT_ENTROPY_SOURCE_LEN = 32;
+var MAX_KEY_LEN = 32;
+var textEncoder = new TextEncoder();
+var b2 = (message, key) => key ? blake2b(message, { dkLen: 32, key }) : blake2b(message, { dkLen: 32 });
+function deriveEntropy(session, productId, key) {
+  const rootEntropySource = session.rootEntropySource;
+  if (!rootEntropySource) {
+    throw new Error(
+      'deriveEntropy: stored login session is missing rootEntropySource. Run "logout" and then "login" to pair again with an RFC-0007 host.'
+    );
+  }
+  if (rootEntropySource.length !== ROOT_ENTROPY_SOURCE_LEN) {
+    throw new Error(
+      `deriveEntropy: rootEntropySource must be ${ROOT_ENTROPY_SOURCE_LEN} bytes, got ${rootEntropySource.length}. The session is corrupt or the host emitted a non-conforming width; re-pairing will not help if the host is at fault.`
+    );
+  }
+  if (typeof productId !== "string" || productId.length === 0) {
+    throw new Error(
+      `deriveEntropy: productId must be a non-empty string, got ${typeof productId === "string" ? "an empty string" : String(productId)}`
+    );
+  }
+  if (key.length === 0 || key.length > MAX_KEY_LEN) {
+    throw new Error(`deriveEntropy: key must be 1..${MAX_KEY_LEN} bytes, got ${key.length}`);
+  }
+  const perProduct = b2(rootEntropySource, b2(textEncoder.encode(productId)));
+  return b2(perProduct, key);
 }
-var fakeAdapter2;
 
 // src/qr-encode.ts
 async function renderQrCode(data, options) {
-  const QRCode = await import("qrcode");
+  const QRCode = await import('qrcode');
   const result = await QRCode.toString(data, {
     type: "utf8",
     errorCorrectionLevel: options?.errorCorrectionLevel ?? "M",
@@ -1120,43 +442,7 @@ async function renderQrCode(data, options) {
   });
   return result;
 }
-if (void 0) {
-  const { test, expect } = void 0;
-  test("renderQrCode produces non-empty output", async () => {
-    const result = await renderQrCode("https://example.com");
-    expect(result.length).toBeGreaterThan(0);
-    expect(result).toContain("\n");
-  });
-  test("renderQrCode contains Unicode block characters", async () => {
-    const result = await renderQrCode("test");
-    expect(/[▀▄█]/.test(result)).toBe(true);
-  });
-  test("different inputs produce different QR codes", async () => {
-    const a = await renderQrCode("hello");
-    const b = await renderQrCode("world");
-    expect(a).not.toBe(b);
-  });
-}
-export {
-  AllowanceError2 as AllowanceError,
-  AllowanceExpiredError2 as AllowanceExpiredError,
-  INCOMPLETE_SESSION_MESSAGE,
-  SS_PASEO_STABLE_STAGE_ENDPOINTS,
-  SS_STABLE_STAGE_ENDPOINTS,
-  SignerError,
-  createNodeStorageAdapter,
-  createSessionSigner,
-  createSessionSignerForAccount,
-  createTerminalAdapter,
-  deriveProductPublicKey,
-  getBulletinSigner,
-  getStatementStoreProver,
-  hasBulletinAllowance,
-  hasStatementStoreAllowance,
-  renderQrCode,
-  requestResourceAllocation,
-  sendResourceAllocation,
-  sessionRootPublicKey,
-  waitForSessions
-};
+
+export { INCOMPLETE_SESSION_MESSAGE, StatementStoreNetworks, createSessionSigner, createSessionSignerForAccount, createTerminalAdapter, deriveEntropy, deriveProductPublicKey, getBulletinSigner, getProductSubtreePublicKey, getStatementStoreProver, hasBulletinAllowance, hasStatementStoreAllowance, isBenignTeardownError, renderQrCode, sessionRootPublicKey, waitForSessions };
+//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map