@parity/product-sdk-terminal 0.0.0-dev.312.0

package/dist/index.js

@@ -0,0 +1,1162 @@
+import {
+  requestResourceAllocation,
+  sendResourceAllocation
+} from "./chunk-YS3GW2XW.js";
+import {
+  createNodeStorageAdapter,
+  sanitizeKey
+} from "./chunk-GHOFKVUG.js";
+
+// src/adapter.ts
+import {
+  createPappAdapter,
+  SS_STABLE_STAGE_ENDPOINTS,
+  SS_PASEO_STABLE_STAGE_ENDPOINTS
+} from "@novasamatech/host-papp";
+import {
+  createLazyClient,
+  createPapiStatementStoreAdapter
+} from "@novasamatech/statement-store";
+import { createLogger } from "@parity/product-sdk-logger";
+import { getWsProvider } from "@polkadot-api/ws-provider";
+var log = createLogger("terminal");
+function createTerminalAdapter(options) {
+  const endpoints = options.endpoints ?? SS_PASEO_STABLE_STAGE_ENDPOINTS;
+  const storage = createNodeStorageAdapter(options.appId, options.storageDir);
+  const HEARTBEAT_NEVER_MS = 2147483647;
+  const rawLazyClient = createLazyClient(
+    getWsProvider(endpoints, { heartbeatTimeout: HEARTBEAT_NEVER_MS })
+  );
+  const trackedLazyClient = wrapLazyClient(rawLazyClient);
+  const statementStore = createPapiStatementStoreAdapter(trackedLazyClient);
+  const adapter = createPappAdapter({
+    appId: options.appId,
+    hostMetadata: options.hostMetadata,
+    adapters: {
+      storage,
+      lazyClient: trackedLazyClient,
+      statementStore
+    }
+  });
+  let destroyPromise = null;
+  return {
+    ...adapter,
+    appId: options.appId,
+    storageDir: options.storageDir,
+    destroy() {
+      if (destroyPromise) return destroyPromise;
+      destroyPromise = teardown(adapter.sessions, trackedLazyClient);
+      return destroyPromise;
+    }
+  };
+}
+function wrapLazyClient(inner) {
+  const pendingUnsubs = /* @__PURE__ */ new Set();
+  const innerGetSubscribeFn = inner.getSubscribeFn.bind(inner);
+  return {
+    ...inner,
+    getClient: inner.getClient.bind(inner),
+    getRequestFn: inner.getRequestFn.bind(inner),
+    disconnect: inner.disconnect.bind(inner),
+    getSubscribeFn() {
+      const innerSubscribe = innerGetSubscribeFn();
+      return ((method, params, onMessage, onError) => {
+        const innerTeardown = innerSubscribe(method, params, onMessage, onError);
+        return () => {
+          const tracked = new Promise((resolve) => {
+            queueMicrotask(() => queueMicrotask(resolve));
+          });
+          pendingUnsubs.add(tracked);
+          void tracked.finally(() => pendingUnsubs.delete(tracked));
+          innerTeardown();
+        };
+      });
+    },
+    async awaitPendingUnsubs() {
+      const snapshot = Array.from(pendingUnsubs);
+      await Promise.allSettled(snapshot);
+    }
+  };
+}
+async function teardown(sessions, lazyClient) {
+  log.debug("destroying terminal adapter");
+  sessions.dispose();
+  await lazyClient.awaitPendingUnsubs();
+  try {
+    lazyClient.disconnect();
+  } catch (e) {
+    log.warn("lazyClient.disconnect threw during destroy", { error: e });
+  }
+}
+if (void 0) {
+  let fakeLazyClient = function() {
+    let teardownCalls = 0;
+    let disconnectCalls = 0;
+    const fake = {
+      getClient: (() => ({})),
+      getRequestFn: (() => () => Promise.resolve()),
+      getSubscribeFn: () => ((_method, _params, _onMessage, _onError) => {
+        return () => {
+          teardownCalls += 1;
+        };
+      }),
+      disconnect: () => {
+        disconnectCalls += 1;
+      }
+    };
+    return {
+      client: fake,
+      get teardownCalls() {
+        return teardownCalls;
+      },
+      get disconnectCalls() {
+        return disconnectCalls;
+      }
+    };
+  };
+  fakeLazyClient2 = fakeLazyClient;
+  const { describe, test, expect, vi } = void 0;
+  describe("wrapLazyClient", () => {
+    test("passes getClient / getRequestFn / disconnect through unchanged", () => {
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      wrapped.getClient();
+      wrapped.disconnect();
+      expect(fake.disconnectCalls).toBe(1);
+      expect(typeof wrapped.getRequestFn).toBe("function");
+    });
+    test("getSubscribeFn returns a wrapped subscribe whose teardown invokes the inner teardown", () => {
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      const subscribe = wrapped.getSubscribeFn();
+      const teardown2 = subscribe(
+        "statement_subscribeStatement",
+        [],
+        () => {
+        },
+        () => {
+        }
+      );
+      teardown2();
+      expect(fake.teardownCalls).toBe(1);
+    });
+    test("awaitPendingUnsubs resolves after all wrapped teardowns settle", async () => {
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      const subscribe = wrapped.getSubscribeFn();
+      for (let i = 0; i < 3; i++) {
+        const teardown2 = subscribe(
+          "statement_subscribeStatement",
+          [],
+          () => {
+          },
+          () => {
+          }
+        );
+        teardown2();
+      }
+      await wrapped.awaitPendingUnsubs();
+      expect(fake.teardownCalls).toBe(3);
+    });
+    test("awaitPendingUnsubs with no pending unsubs resolves immediately", async () => {
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      await expect(wrapped.awaitPendingUnsubs()).resolves.toBeUndefined();
+    });
+    test("an unsubscribe whose teardown throws is still tracked and resolved", async () => {
+      const fake = {
+        getClient: (() => ({})),
+        getRequestFn: (() => () => Promise.resolve()),
+        getSubscribeFn: () => ((_method, _params, _onMessage, _onError) => {
+          return () => {
+            throw new Error("teardown boom");
+          };
+        }),
+        disconnect: () => {
+        }
+      };
+      const wrapped = wrapLazyClient(fake);
+      const subscribe = wrapped.getSubscribeFn();
+      const teardown2 = subscribe(
+        "statement_subscribeStatement",
+        [],
+        () => {
+        },
+        () => {
+        }
+      );
+      try {
+        teardown2();
+      } catch {
+      }
+      await expect(wrapped.awaitPendingUnsubs()).resolves.toBeUndefined();
+    });
+  });
+  describe("teardown", () => {
+    test("orders sessions.dispose, drain, then disconnect", async () => {
+      const order = [];
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      const innerDisconnect = wrapped.disconnect.bind(wrapped);
+      wrapped.disconnect = () => {
+        order.push("disconnect");
+        innerDisconnect();
+      };
+      const sessions = {
+        dispose: vi.fn(() => {
+          order.push("dispose");
+          const subscribe = wrapped.getSubscribeFn();
+          subscribe(
+            "statement_subscribeStatement",
+            [],
+            () => {
+            },
+            () => {
+            }
+          )();
+        })
+      };
+      await teardown(sessions, wrapped);
+      expect(order).toEqual(["dispose", "disconnect"]);
+      expect(sessions.dispose).toHaveBeenCalledTimes(1);
+      expect(fake.disconnectCalls).toBe(1);
+    });
+    test("disconnect runs even when there are no pending unsubs", async () => {
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      const sessions = { dispose: vi.fn() };
+      await teardown(sessions, wrapped);
+      expect(fake.disconnectCalls).toBe(1);
+    });
+    test("logs a warning if disconnect throws, doesn't propagate to caller", async () => {
+      const fake = {
+        getClient: (() => ({})),
+        getRequestFn: (() => () => Promise.resolve()),
+        getSubscribeFn: () => ((_method, _params, _onMessage, _onError) => () => {
+        }),
+        disconnect: () => {
+          throw new Error("boom");
+        }
+      };
+      const wrapped = wrapLazyClient(fake);
+      const sessions = { dispose: vi.fn() };
+      await expect(teardown(sessions, wrapped)).resolves.toBeUndefined();
+    });
+    test("awaits pending unsubs before calling disconnect", async () => {
+      const fake = fakeLazyClient();
+      const wrapped = wrapLazyClient(fake.client);
+      let unsubResolved = false;
+      const innerDisconnect = wrapped.disconnect.bind(wrapped);
+      wrapped.disconnect = () => {
+        expect(unsubResolved).toBe(true);
+        innerDisconnect();
+      };
+      const sessions = {
+        dispose: () => {
+          const subscribe = wrapped.getSubscribeFn();
+          subscribe(
+            "statement_subscribeStatement",
+            [],
+            () => {
+            },
+            () => {
+            }
+          )();
+          queueMicrotask(
+            () => queueMicrotask(() => {
+              unsubResolved = true;
+            })
+          );
+        }
+      };
+      await teardown(sessions, wrapped);
+      expect(fake.disconnectCalls).toBe(1);
+    });
+  });
+}
+var fakeLazyClient2;
+
+// src/signer.ts
+import { NoAllowanceError } from "@novasamatech/statement-store";
+import { decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";
+import { deriveProductAccountPublicKey } from "@parity/product-sdk-keys";
+import { AllowanceExpiredError } from "@parity/product-sdk-signer/errors";
+function isNoAllowanceError(error) {
+  for (let current = error, depth = 0; current != null && depth < 8; depth++) {
+    if (current instanceof NoAllowanceError) return true;
+    if (current instanceof Error) {
+      if (current.constructor.name === "NoAllowanceError" || current.message.includes("no allowance set")) {
+        return true;
+      }
+      current = current.cause;
+    } else {
+      break;
+    }
+  }
+  return false;
+}
+function toAllowanceExpiredError(error) {
+  return isNoAllowanceError(error) ? new AllowanceExpiredError("statementStore", error) : null;
+}
+function buildCreateTransactionRequest(productAccountId, callData, signedExtensions, txExtVersion) {
+  const checkGenesis = signedExtensions.CheckGenesis;
+  if (!checkGenesis) {
+    throw new Error(
+      "Cannot build transaction: chain did not provide the CheckGenesis signed extension"
+    );
+  }
+  return {
+    payload: {
+      tag: "v1",
+      value: {
+        signer: productAccountId,
+        // CheckGenesis carries the genesis hash as its additionalSigned (implicit) data.
+        genesisHash: checkGenesis.additionalSigned,
+        callData,
+        extensions: Object.values(signedExtensions).map(
+          ({ identifier, value, additionalSigned }) => ({
+            id: identifier,
+            extra: value,
+            additionalSigned
+          })
+        ),
+        txExtVersion
+      }
+    }
+  };
+}
+function txExtVersionFromMetadata(metadata) {
+  const decoded = unifyMetadata(decAnyMetadata(metadata));
+  const latestVersion = decoded.extrinsic.version.reduce((max, v) => Math.max(max, v), 0);
+  return latestVersion === 4 ? 0 : latestVersion;
+}
+async function requestSignedTransaction(session, request) {
+  const result = await session.createTransaction(request);
+  if (result.isErr()) {
+    const expired = toAllowanceExpiredError(result.error);
+    if (expired) throw expired;
+    throw new Error(`Mobile transaction signing rejected: ${result.error.message}`);
+  }
+  return result.value;
+}
+function makeTxSignTx(session, productAccountId) {
+  return async (callData, signedExtensions, metadata) => requestSignedTransaction(
+    session,
+    buildCreateTransactionRequest(
+      productAccountId,
+      callData,
+      signedExtensions,
+      txExtVersionFromMetadata(metadata)
+    )
+  );
+}
+function makeRawBytesSignCallback(session, productAccountId) {
+  return async (data) => {
+    const result = await session.signRaw({
+      productAccountId,
+      data: { tag: "Bytes", value: data }
+    });
+    if (result.isErr()) {
+      const expired = toAllowanceExpiredError(result.error);
+      if (expired) throw expired;
+      throw new Error(`Mobile signing rejected: ${result.error.message}`);
+    }
+    return result.value.signature;
+  };
+}
+var INCOMPLETE_SESSION_MESSAGE = 'Stored login session is missing the root account public key. Run "logout" and then "login" to pair again.';
+function sessionRootPublicKey(session) {
+  const rootAccountId = session.rootAccountId;
+  const publicKey = rootAccountId ? new Uint8Array(rootAccountId) : new Uint8Array();
+  if (publicKey.length !== 32) {
+    throw new Error(INCOMPLETE_SESSION_MESSAGE);
+  }
+  return publicKey;
+}
+function deriveProductPublicKey(session, ref) {
+  return deriveProductAccountPublicKey(
+    sessionRootPublicKey(session),
+    ref.productId,
+    ref.derivationIndex
+  );
+}
+function buildSessionSigner(session, ref) {
+  const productAccountId = [ref.productId, ref.derivationIndex];
+  const publicKey = ref.publicKey ?? deriveProductPublicKey(session, ref);
+  return {
+    publicKey,
+    // Transaction signing → host-papp `createTransaction`: the wallet builds
+    // and signs the extrinsic, so it can show a decoded tx (no `<Bytes>`
+    // envelope) and unknown signed extensions (e.g. `AsPgas`) survive.
+    signTx: makeTxSignTx(session, productAccountId),
+    // Arbitrary-byte signing keeps the `Bytes` tag so the wallet applies the
+    // `<Bytes>...</Bytes>` anti-phishing envelope exactly once on its side
+    // (correct for non-extrinsic user data).
+    signBytes: makeRawBytesSignCallback(session, productAccountId)
+  };
+}
+function createSessionSigner(session, adapter, publicKey) {
+  return buildSessionSigner(session, { productId: adapter.appId, derivationIndex: 0, publicKey });
+}
+function createSessionSignerForAccount(session, ref) {
+  return buildSessionSigner(session, ref);
+}
+if (void 0) {
+  let makeSession = function(opts) {
+    const accountIdBytes = opts.accountIdBytes ?? new Array(32).fill(0).map((_, i) => i);
+    const rootAccountId = opts.rootAccountId === void 0 ? Array.from(DEV_ROOT_PUBLIC_KEY) : opts.rootAccountId;
+    return {
+      remoteAccount: { accountId: accountIdBytes },
+      ...rootAccountId === null ? {} : { rootAccountId: new Uint8Array(rootAccountId) },
+      signPayload: vi.fn(
+        opts.signPayload ?? (async () => {
+          throw new Error("signPayload not stubbed in this test");
+        })
+      ),
+      signRaw: vi.fn(
+        opts.signRaw ?? (async () => {
+          throw new Error("signRaw not stubbed in this test");
+        })
+      ),
+      createTransaction: vi.fn(
+        opts.createTransaction ?? (async () => {
+          throw new Error("createTransaction not stubbed in this test");
+        })
+      )
+    };
+  }, ext = function(identifier, value, additionalSigned) {
+    return {
+      identifier,
+      value: new Uint8Array(value),
+      additionalSigned: new Uint8Array(additionalSigned)
+    };
+  }, fakeAdapter = function(appId) {
+    return { appId };
+  };
+  makeSession2 = makeSession, ext2 = ext, fakeAdapter2 = fakeAdapter;
+  const { describe, test, expect, vi } = void 0;
+  const { ok, err } = await null;
+  const { seedToAccount } = await null;
+  const DEV_ROOT_PUBLIC_KEY = seedToAccount(
+    "bottom drive obey lake curtain smoke basket hold race lonely fit walk",
+    ""
+  ).publicKey;
+  describe("createSessionSigner", () => {
+    test("self-derives the product key from the session root when none is passed", () => {
+      const walletBytes = Array.from({ length: 32 }, (_, i) => i);
+      const signer = createSessionSigner(
+        makeSession({
+          accountIdBytes: walletBytes,
+          rootAccountId: Array.from(DEV_ROOT_PUBLIC_KEY)
+        }),
+        fakeAdapter("test-app")
+      );
+      const expected = deriveProductAccountPublicKey(DEV_ROOT_PUBLIC_KEY, "test-app", 0);
+      expect(signer.publicKey).toEqual(expected);
+      expect(signer.publicKey).not.toEqual(new Uint8Array(walletBytes));
+    });
+    test("throws on a stale session with no root account key", () => {
+      expect(
+        () => createSessionSigner(makeSession({ rootAccountId: null }), fakeAdapter("test-app"))
+      ).toThrow(INCOMPLETE_SESSION_MESSAGE);
+    });
+    test("uses the host-supplied product-account public key when provided", () => {
+      const walletBytes = Array.from({ length: 32 }, (_, i) => i);
+      const productKey = new Uint8Array(32).fill(171);
+      const signer = createSessionSigner(
+        makeSession({ accountIdBytes: walletBytes }),
+        fakeAdapter("test-app"),
+        productKey
+      );
+      expect(signer.publicKey).toEqual(productKey);
+      expect(signer.publicKey).not.toEqual(new Uint8Array(walletBytes));
+    });
+    test("signBytes routes through session.signRaw with the Bytes tag", async () => {
+      const sig = new Uint8Array([9, 8, 7, 6, 5, 4, 3, 2, 1]);
+      const captured = [];
+      const session = makeSession({
+        signRaw: async (req2) => {
+          captured.push(req2);
+          return ok({ signature: sig });
+        }
+      });
+      const signer = createSessionSigner(session, fakeAdapter("test-app"));
+      const out = await signer.signBytes(new Uint8Array([1, 2, 3]));
+      expect(out).toEqual(sig);
+      expect(captured).toHaveLength(1);
+      const req = captured[0];
+      expect(req.productAccountId).toEqual(["test-app", 0]);
+      expect(req.data.tag).toBe("Bytes");
+      expect(req.data.value).toEqual(new Uint8Array([1, 2, 3]));
+    });
+    test("signBytes never calls session.signPayload (legacy-path regression guard)", async () => {
+      const session = makeSession({
+        signRaw: async () => ok({ signature: new Uint8Array([1]) })
+      });
+      const signer = createSessionSigner(session, fakeAdapter("test-app"));
+      await signer.signBytes(new Uint8Array([1, 2, 3]));
+      const sessionWithSpies = session;
+      expect(sessionWithSpies.signPayload.mock.calls).toHaveLength(0);
+      expect(sessionWithSpies.signRaw.mock.calls).toHaveLength(1);
+    });
+    test("signBytes throws with a clear error when the mobile rejects", async () => {
+      const session = makeSession({
+        signRaw: async () => err({ message: "user declined" })
+      });
+      const signer = createSessionSigner(session, fakeAdapter("test-app"));
+      await expect(signer.signBytes(new Uint8Array([1]))).rejects.toThrow(
+        "Mobile signing rejected: user declined"
+      );
+    });
+  });
+  describe("buildCreateTransactionRequest \u2014 tx payload (the AsPgas fix)", () => {
+    const checkGenesis = ext("CheckGenesis", [], [17, 34, 51]);
+    test("wraps the payload as v1 with signer, callData, and txExtVersion", () => {
+      const callData = new Uint8Array([202, 17]);
+      const req = buildCreateTransactionRequest(
+        ["my-app", 3],
+        callData,
+        { CheckGenesis: checkGenesis },
+        5
+      );
+      expect(req.payload.tag).toBe("v1");
+      expect(req.payload.value.signer).toEqual(["my-app", 3]);
+      expect(req.payload.value.callData).toEqual(callData);
+      expect(req.payload.value.txExtVersion).toBe(5);
+    });
+    test("takes the genesis hash from CheckGenesis.additionalSigned", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis },
+        0
+      );
+      expect(req.payload.value.genesisHash).toEqual(new Uint8Array([17, 34, 51]));
+    });
+    test("maps every signed extension to { id, extra, additionalSigned }", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis, CheckNonce: ext("CheckNonce", [7], []) },
+        0
+      );
+      expect(req.payload.value.extensions).toEqual([
+        {
+          id: "CheckGenesis",
+          extra: new Uint8Array([]),
+          additionalSigned: new Uint8Array([17, 34, 51])
+        },
+        {
+          id: "CheckNonce",
+          extra: new Uint8Array([7]),
+          additionalSigned: new Uint8Array([])
+        }
+      ]);
+    });
+    test("preserves an unknown signed extension verbatim (e.g. AsPgas)", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis, AsPgas: ext("AsPgas", [222, 173], [190, 239]) },
+        0
+      );
+      expect(req.payload.value.extensions).toContainEqual({
+        id: "AsPgas",
+        extra: new Uint8Array([222, 173]),
+        additionalSigned: new Uint8Array([190, 239])
+      });
+    });
+    test("throws a clear error when CheckGenesis is absent", () => {
+      expect(
+        () => buildCreateTransactionRequest(["my-app", 0], new Uint8Array([0]), {}, 0)
+      ).toThrow(/CheckGenesis/);
+    });
+  });
+  describe("requestSignedTransaction \u2014 SSO round-trip", () => {
+    const request = buildCreateTransactionRequest(
+      ["my-app", 0],
+      new Uint8Array([0]),
+      { CheckGenesis: ext("CheckGenesis", [], [1]) },
+      0
+    );
+    test("returns the signed extrinsic bytes from the mobile response", async () => {
+      const signed = new Uint8Array([171, 205, 239]);
+      const session = makeSession({ createTransaction: async () => ok(signed) });
+      const out = await requestSignedTransaction(session, request);
+      expect(out).toBe(signed);
+    });
+    test("calls session.createTransaction \u2014 never signRaw/signPayload \u2014 with the request", async () => {
+      const captured = [];
+      const session = makeSession({
+        createTransaction: async (req) => {
+          captured.push(req);
+          return ok(new Uint8Array([1]));
+        }
+      });
+      await requestSignedTransaction(session, request);
+      expect(captured).toEqual([request]);
+      const spies = session;
+      expect(spies.createTransaction.mock.calls).toHaveLength(1);
+      expect(spies.signPayload.mock.calls).toHaveLength(0);
+      expect(spies.signRaw.mock.calls).toHaveLength(0);
+    });
+    test("throws a clear error when the mobile rejects", async () => {
+      const session = makeSession({
+        createTransaction: async () => err({ message: "user declined" })
+      });
+      await expect(requestSignedTransaction(session, request)).rejects.toThrow(
+        "Mobile transaction signing rejected: user declined"
+      );
+    });
+    test("throws AllowanceExpiredError when the failure is a NoAllowanceError", async () => {
+      const underlying = new NoAllowanceError();
+      const session = makeSession({
+        createTransaction: async () => err(underlying)
+      });
+      await expect(requestSignedTransaction(session, request)).rejects.toBeInstanceOf(
+        AllowanceExpiredError
+      );
+      await expect(requestSignedTransaction(session, request)).rejects.toMatchObject({
+        name: "AllowanceExpiredError",
+        resource: "statementStore",
+        cause: underlying
+      });
+    });
+    test("throws AllowanceExpiredError for a wire-serialized failure (message match only)", async () => {
+      expect(new NoAllowanceError().message).toBe(
+        "Submit failed, no allowance set for account"
+      );
+      const serialized = new Error("Submit failed, no allowance set for account");
+      const session = makeSession({
+        createTransaction: async () => err(serialized)
+      });
+      await expect(requestSignedTransaction(session, request)).rejects.toBeInstanceOf(
+        AllowanceExpiredError
+      );
+    });
+    test("throws AllowanceExpiredError when the NoAllowanceError is wrapped as a cause", async () => {
+      const wrapped = new Error("submitRequest failed", { cause: new NoAllowanceError() });
+      const session = makeSession({
+        createTransaction: async () => err(wrapped)
+      });
+      await expect(requestSignedTransaction(session, request)).rejects.toBeInstanceOf(
+        AllowanceExpiredError
+      );
+    });
+    test("a non-allowance Error still surfaces as the generic rejection", async () => {
+      const session = makeSession({
+        createTransaction: async () => err(new Error("transport exploded"))
+      });
+      await expect(requestSignedTransaction(session, request)).rejects.toThrow(
+        "Mobile transaction signing rejected: transport exploded"
+      );
+    });
+  });
+  describe("makeRawBytesSignCallback", () => {
+    test("forwards data verbatim under the Bytes tag with the right productAccountId", async () => {
+      const captured = [];
+      const session = makeSession({
+        signRaw: async (req2) => {
+          captured.push(req2);
+          return ok({ signature: new Uint8Array([255]) });
+        }
+      });
+      const callback = makeRawBytesSignCallback(session, ["my-app", 5]);
+      await callback(new Uint8Array([222, 173, 190, 239]));
+      expect(captured).toHaveLength(1);
+      const req = captured[0];
+      expect(req.productAccountId).toEqual(["my-app", 5]);
+      expect(req.data.tag).toBe("Bytes");
+      expect(Array.from(req.data.value)).toEqual([222, 173, 190, 239]);
+    });
+    test("returns the raw signature bytes from the mobile response", async () => {
+      const sig = new Uint8Array([66]);
+      const session = makeSession({
+        signRaw: async () => ok({ signature: sig })
+      });
+      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
+      const out = await callback(new Uint8Array([0]));
+      expect(out).toBe(sig);
+    });
+    test("throws AllowanceExpiredError when the failure is a NoAllowanceError", async () => {
+      const underlying = new NoAllowanceError();
+      const session = makeSession({
+        signRaw: async () => err(underlying)
+      });
+      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
+      await expect(callback(new Uint8Array([1]))).rejects.toBeInstanceOf(
+        AllowanceExpiredError
+      );
+      await expect(callback(new Uint8Array([1]))).rejects.toMatchObject({
+        resource: "statementStore",
+        cause: underlying
+      });
+    });
+    test("a non-allowance failure still surfaces as the generic rejection", async () => {
+      const session = makeSession({
+        signRaw: async () => err(new Error("user declined"))
+      });
+      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
+      await expect(callback(new Uint8Array([1]))).rejects.toThrow(
+        "Mobile signing rejected: user declined"
+      );
+    });
+  });
+  describe("createSessionSignerForAccount", () => {
+    test("forwards productAccountId from the explicit ref", async () => {
+      const captured = [];
+      const session = makeSession({
+        signRaw: async (req2) => {
+          captured.push(req2);
+          return ok({ signature: new Uint8Array([42]) });
+        }
+      });
+      const signer = createSessionSignerForAccount(session, {
+        productId: "my-app",
+        derivationIndex: 7
+      });
+      await signer.signBytes(new Uint8Array([10, 20, 30]));
+      expect(captured).toHaveLength(1);
+      const req = captured[0];
+      expect(req.productAccountId).toEqual(["my-app", 7]);
+      expect(req.data.tag).toBe("Bytes");
+      expect(req.data.value).toBeInstanceOf(Uint8Array);
+    });
+    test("supports a productId different from any adapter's appId", async () => {
+      const captured = [];
+      const session = makeSession({
+        signRaw: async (req2) => {
+          captured.push(req2);
+          return ok({ signature: new Uint8Array([0]) });
+        }
+      });
+      const signer = createSessionSignerForAccount(session, {
+        productId: "external-product",
+        derivationIndex: 0
+      });
+      await signer.signBytes(new Uint8Array([1]));
+      const req = captured[0];
+      expect(req.productAccountId).toEqual(["external-product", 0]);
+    });
+  });
+}
+var makeSession2;
+var ext2;
+var fakeAdapter2;
+
+// src/index.ts
+import { AllowanceExpiredError as AllowanceExpiredError2, SignerError } from "@parity/product-sdk-signer/errors";
+
+// src/allowance.ts
+import { AllowanceError } from "@novasamatech/host-papp";
+
+// src/allowance-cache.ts
+import { gcm } from "@noble/ciphers/aes.js";
+import { blake2b } from "@noble/hashes/blake2.js";
+import { fromHex, toHex } from "@polkadot-api/utils";
+import { readFile, writeFile } from "fs/promises";
+import { join } from "path";
+import { Bytes, Enum, Struct, Vector, _void, str } from "scale-ts";
+var AllowanceResourceKindCodec = Enum({
+  bulletin: _void,
+  statementStore: _void
+});
+var StoredAllowanceEntryCodec = Struct({
+  productId: str,
+  resource: AllowanceResourceKindCodec,
+  slotAccountKey: Bytes()
+});
+var StoredAllowancesCodec = Vector(StoredAllowanceEntryCodec);
+function getAes(appId) {
+  const key = blake2b(new TextEncoder().encode(appId), { dkLen: 16 });
+  const nonce = blake2b(new TextEncoder().encode("nonce"), { dkLen: 32 });
+  return gcm(key, nonce);
+}
+function allowanceFilePath(storageDir, appId, sessionId) {
+  return join(storageDir, `${sanitizeKey(appId, `AllowanceKeys_${sessionId}`)}.json`);
+}
+async function readStoredAllowances(storageDir, appId, sessionId) {
+  let hex;
+  try {
+    hex = await readFile(allowanceFilePath(storageDir, appId, sessionId), "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return [];
+    }
+    throw err;
+  }
+  const decrypted = getAes(appId).decrypt(fromHex(hex));
+  return StoredAllowancesCodec.dec(decrypted);
+}
+
+// src/allowance.ts
+function resolveSessionId(adapter, sessionId) {
+  if (sessionId) return sessionId;
+  const sessions = adapter.sessions.sessions.read();
+  if (sessions.length === 0) {
+    throw new AllowanceError("NoSession", "No paired session \u2014 pair a phone first.");
+  }
+  if (sessions.length > 1) {
+    throw new AllowanceError(
+      "NoSession",
+      `Multiple paired sessions (${sessions.length}) \u2014 pass an explicit sessionId.`
+    );
+  }
+  return sessions[0].id;
+}
+async function getBulletinSigner(adapter, productId, sessionId) {
+  const resolvedSessionId = resolveSessionId(adapter, sessionId);
+  return adapter.allowance.getBulletinSigner(resolvedSessionId, productId).match(
+    (signer) => signer,
+    (err) => {
+      throw err;
+    }
+  );
+}
+async function getStatementStoreProver(adapter, productId, sessionId) {
+  const resolvedSessionId = resolveSessionId(adapter, sessionId);
+  return adapter.allowance.getStatementStoreProver(resolvedSessionId, productId).match(
+    (prover) => prover,
+    (err) => {
+      throw err;
+    }
+  );
+}
+async function hasAllowanceForResource(adapter, productId, resource, sessionId) {
+  const resolvedSessionId = resolveSessionId(adapter, sessionId);
+  if (adapter.storageDir === void 0) {
+    return false;
+  }
+  const entries = await readStoredAllowances(
+    adapter.storageDir,
+    adapter.appId,
+    resolvedSessionId
+  );
+  return entries.some(
+    (entry) => entry.productId === productId && entry.resource.tag === resource
+  );
+}
+async function hasBulletinAllowance(adapter, productId, sessionId) {
+  return hasAllowanceForResource(adapter, productId, "bulletin", sessionId);
+}
+async function hasStatementStoreAllowance(adapter, productId, sessionId) {
+  return hasAllowanceForResource(adapter, productId, "statementStore", sessionId);
+}
+if (void 0) {
+  let makeAdapter = function(opts) {
+    return {
+      sessions: {
+        sessions: {
+          read: () => opts.sessions
+        }
+      },
+      allowance: {
+        getBulletinSigner: opts.getBulletinSigner ?? vi.fn(() => ok({})),
+        getStatementStoreProver: opts.getStatementStoreProver ?? vi.fn(() => ok({}))
+      }
+      // The convenience never touches the rest of the adapter; leave it unstubbed.
+    };
+  };
+  makeAdapter2 = makeAdapter;
+  const { describe, test, expect, vi } = void 0;
+  const { ok, err } = await null;
+  describe("getBulletinSigner \u2014 sessionId defaulting", () => {
+    test("uses the only paired session when sessionId is omitted", async () => {
+      const fakeSigner = { _tag: "signer" };
+      const getBulletinSignerFn = vi.fn(() => ok(fakeSigner));
+      const adapter = makeAdapter({
+        sessions: [{ id: "sess-only" }],
+        getBulletinSigner: getBulletinSignerFn
+      });
+      const result = await getBulletinSigner(adapter, "my-app.dot");
+      expect(result).toBe(fakeSigner);
+      expect(getBulletinSignerFn).toHaveBeenCalledWith("sess-only", "my-app.dot");
+    });
+    test("uses the explicit sessionId when supplied", async () => {
+      const fakeSigner = { _tag: "signer" };
+      const getBulletinSignerFn = vi.fn(() => ok(fakeSigner));
+      const adapter = makeAdapter({
+        sessions: [{ id: "sess-a" }, { id: "sess-b" }],
+        getBulletinSigner: getBulletinSignerFn
+      });
+      await getBulletinSigner(adapter, "my-app.dot", "sess-b");
+      expect(getBulletinSignerFn).toHaveBeenCalledWith("sess-b", "my-app.dot");
+    });
+    test("throws AllowanceError('NoSession') when zero sessions and no id", async () => {
+      const adapter = makeAdapter({ sessions: [] });
+      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toBeInstanceOf(
+        AllowanceError
+      );
+      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toMatchObject({
+        reason: "NoSession"
+      });
+    });
+    test("throws AllowanceError('NoSession') when multiple sessions and no id", async () => {
+      const adapter = makeAdapter({ sessions: [{ id: "a" }, { id: "b" }] });
+      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toBeInstanceOf(
+        AllowanceError
+      );
+      await expect(getBulletinSigner(adapter, "my-app.dot")).rejects.toMatchObject({
+        reason: "NoSession"
+      });
+    });
+  });
+  describe("getBulletinSigner \u2014 error unwrapping", () => {
+    test("rethrows the AllowanceError from the underlying service as a thrown exception", async () => {
+      const underlyingErr = new AllowanceError("Rejected", "user said no");
+      const adapter = makeAdapter({
+        sessions: [{ id: "s" }],
+        getBulletinSigner: vi.fn(() => err(underlyingErr))
+      });
+      await expect(getBulletinSigner(adapter, "p")).rejects.toBe(underlyingErr);
+    });
+  });
+  describe("getStatementStoreProver \u2014 same defaulting", () => {
+    test("uses the only paired session when sessionId is omitted", async () => {
+      const fakeProver = { _tag: "prover" };
+      const getStatementStoreProverFn = vi.fn(() => ok(fakeProver));
+      const adapter = makeAdapter({
+        sessions: [{ id: "sess-only" }],
+        getStatementStoreProver: getStatementStoreProverFn
+      });
+      const result = await getStatementStoreProver(adapter, "my-app.dot");
+      expect(result).toBe(fakeProver);
+      expect(getStatementStoreProverFn).toHaveBeenCalledWith("sess-only", "my-app.dot");
+    });
+    test("uses the explicit sessionId when supplied", async () => {
+      const fakeProver = { _tag: "prover" };
+      const getStatementStoreProverFn = vi.fn(() => ok(fakeProver));
+      const adapter = makeAdapter({
+        sessions: [{ id: "sess-a" }, { id: "sess-b" }],
+        getStatementStoreProver: getStatementStoreProverFn
+      });
+      await getStatementStoreProver(adapter, "my-app.dot", "sess-b");
+      expect(getStatementStoreProverFn).toHaveBeenCalledWith("sess-b", "my-app.dot");
+    });
+    test("throws AllowanceError('NoSession') when zero sessions and no id", async () => {
+      const adapter = makeAdapter({ sessions: [] });
+      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toBeInstanceOf(
+        AllowanceError
+      );
+      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toMatchObject({
+        reason: "NoSession"
+      });
+    });
+    test("throws AllowanceError('NoSession') when multiple sessions and no id", async () => {
+      const adapter = makeAdapter({ sessions: [{ id: "a" }, { id: "b" }] });
+      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toBeInstanceOf(
+        AllowanceError
+      );
+      await expect(getStatementStoreProver(adapter, "my-app.dot")).rejects.toMatchObject({
+        reason: "NoSession"
+      });
+    });
+  });
+  describe("getStatementStoreProver \u2014 error unwrapping", () => {
+    test("rethrows the AllowanceError from the underlying service as a thrown exception", async () => {
+      const underlyingErr = new AllowanceError("Rejected", "user said no");
+      const adapter = makeAdapter({
+        sessions: [{ id: "s" }],
+        getStatementStoreProver: vi.fn(() => err(underlyingErr))
+      });
+      await expect(getStatementStoreProver(adapter, "p")).rejects.toBe(underlyingErr);
+    });
+  });
+  describe("has*Allowance \u2014 sessionId defaulting + storageDir fallback", () => {
+    test("hasBulletinAllowance throws AllowanceError('NoSession') when zero sessions and no id", async () => {
+      const adapter = makeAdapter({ sessions: [] });
+      await expect(hasBulletinAllowance(adapter, "p")).rejects.toBeInstanceOf(AllowanceError);
+      await expect(hasBulletinAllowance(adapter, "p")).rejects.toMatchObject({
+        reason: "NoSession"
+      });
+    });
+    test("hasBulletinAllowance returns false (conservative) when storageDir is undefined", async () => {
+      const adapter = makeAdapter({ sessions: [{ id: "sess-only" }] });
+      expect(await hasBulletinAllowance(adapter, "p")).toBe(false);
+    });
+    test("hasStatementStoreAllowance throws AllowanceError('NoSession') when zero sessions and no id", async () => {
+      const adapter = makeAdapter({ sessions: [] });
+      await expect(hasStatementStoreAllowance(adapter, "p")).rejects.toBeInstanceOf(
+        AllowanceError
+      );
+    });
+    test("hasStatementStoreAllowance returns false (conservative) when storageDir is undefined", async () => {
+      const adapter = makeAdapter({ sessions: [{ id: "sess-only" }] });
+      expect(await hasStatementStoreAllowance(adapter, "p")).toBe(false);
+    });
+  });
+}
+var makeAdapter2;
+
+// src/index.ts
+import { AllowanceError as AllowanceError2 } from "@novasamatech/host-papp";
+
+// src/sessions.ts
+function waitForSessions(adapter, timeoutMs = 3e3) {
+  return new Promise((resolve) => {
+    let resolved = false;
+    let unsub = null;
+    const finish = (sessions) => {
+      if (resolved) return;
+      resolved = true;
+      queueMicrotask(() => unsub?.());
+      resolve(sessions);
+    };
+    const timer = setTimeout(() => finish([]), timeoutMs);
+    unsub = adapter.sessions.sessions.subscribe((sessions) => {
+      if (sessions.length > 0) {
+        clearTimeout(timer);
+        finish(sessions);
+      }
+    });
+  });
+}
+if (void 0) {
+  let fakeAdapter = function() {
+    const subscribers = /* @__PURE__ */ new Set();
+    const adapter = {
+      sessions: {
+        sessions: {
+          subscribe(cb) {
+            subscribers.add(cb);
+            return () => {
+              subscribers.delete(cb);
+            };
+          }
+        }
+      }
+    };
+    return {
+      adapter,
+      emit: (sessions) => {
+        for (const cb of subscribers) cb(sessions);
+      },
+      subscriberCount: () => subscribers.size
+    };
+  };
+  fakeAdapter2 = fakeAdapter;
+  const { describe, test, expect, vi } = void 0;
+  describe("waitForSessions", () => {
+    test("resolves with sessions on first non-empty emission", async () => {
+      const { adapter, emit } = fakeAdapter();
+      const promise = waitForSessions(adapter, 1e3);
+      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
+      emit([session]);
+      await expect(promise).resolves.toEqual([session]);
+    });
+    test("ignores empty emissions and waits for a non-empty one", async () => {
+      const { adapter, emit } = fakeAdapter();
+      const promise = waitForSessions(adapter, 1e3);
+      emit([]);
+      emit([]);
+      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
+      emit([session]);
+      await expect(promise).resolves.toEqual([session]);
+    });
+    test("resolves with [] after timeout when nothing is emitted", async () => {
+      vi.useFakeTimers();
+      try {
+        const { adapter } = fakeAdapter();
+        const promise = waitForSessions(adapter, 50);
+        vi.advanceTimersByTime(50);
+        await expect(promise).resolves.toEqual([]);
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+    test("unsubscribes after resolving", async () => {
+      const { adapter, emit, subscriberCount } = fakeAdapter();
+      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
+      const promise = waitForSessions(adapter, 1e3);
+      emit([session]);
+      await promise;
+      await Promise.resolve();
+      expect(subscriberCount()).toBe(0);
+    });
+    test("uses default 3000ms timeout when none is passed", async () => {
+      vi.useFakeTimers();
+      try {
+        const { adapter } = fakeAdapter();
+        const promise = waitForSessions(adapter);
+        vi.advanceTimersByTime(2999);
+        let settled = false;
+        promise.then(() => {
+          settled = true;
+        });
+        await Promise.resolve();
+        expect(settled).toBe(false);
+        vi.advanceTimersByTime(1);
+        await expect(promise).resolves.toEqual([]);
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+    test("handles synchronous initial emission", async () => {
+      const session = { remoteAccount: { accountId: new Uint8Array(32) } };
+      const adapter = {
+        sessions: {
+          sessions: {
+            subscribe(cb) {
+              cb([session]);
+              return () => {
+              };
+            }
+          }
+        }
+      };
+      await expect(waitForSessions(adapter, 1e3)).resolves.toEqual([session]);
+    });
+  });
+}
+var fakeAdapter2;
+
+// src/qr-encode.ts
+async function renderQrCode(data, options) {
+  const QRCode = await import("qrcode");
+  const result = await QRCode.toString(data, {
+    type: "utf8",
+    errorCorrectionLevel: options?.errorCorrectionLevel ?? "M",
+    margin: options?.margin ?? 2
+  });
+  return result;
+}
+if (void 0) {
+  const { test, expect } = void 0;
+  test("renderQrCode produces non-empty output", async () => {
+    const result = await renderQrCode("https://example.com");
+    expect(result.length).toBeGreaterThan(0);
+    expect(result).toContain("\n");
+  });
+  test("renderQrCode contains Unicode block characters", async () => {
+    const result = await renderQrCode("test");
+    expect(/[▀▄█]/.test(result)).toBe(true);
+  });
+  test("different inputs produce different QR codes", async () => {
+    const a = await renderQrCode("hello");
+    const b = await renderQrCode("world");
+    expect(a).not.toBe(b);
+  });
+}
+export {
+  AllowanceError2 as AllowanceError,
+  AllowanceExpiredError2 as AllowanceExpiredError,
+  INCOMPLETE_SESSION_MESSAGE,
+  SS_PASEO_STABLE_STAGE_ENDPOINTS,
+  SS_STABLE_STAGE_ENDPOINTS,
+  SignerError,
+  createNodeStorageAdapter,
+  createSessionSigner,
+  createSessionSignerForAccount,
+  createTerminalAdapter,
+  deriveProductPublicKey,
+  getBulletinSigner,
+  getStatementStoreProver,
+  hasBulletinAllowance,
+  hasStatementStoreAllowance,
+  renderQrCode,
+  requestResourceAllocation,
+  sendResourceAllocation,
+  sessionRootPublicKey,
+  waitForSessions
+};
+//# sourceMappingURL=index.js.map