@parity/product-sdk-terminal 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   createNodeStorageAdapter
-} from "./chunk-5MCLSFKQ.js";
+} from "./chunk-GHOFKVUG.js";
 
 // src/adapter.ts
 import {
@@ -26,7 +26,6 @@ function createTerminalAdapter(options) {
   const statementStore = createPapiStatementStoreAdapter(trackedLazyClient);
   const adapter = createPappAdapter({
     appId: options.appId,
-    metadata: options.metadataUrl,
     hostMetadata: options.hostMetadata,
     adapters: {
       storage,
@@ -38,6 +37,7 @@ function createTerminalAdapter(options) {
   return {
     ...adapter,
     appId: options.appId,
+    storageDir: options.storageDir,
     destroy() {
       if (destroyPromise) return destroyPromise;
       destroyPromise = teardown(adapter.sessions, trackedLazyClient);
@@ -272,71 +272,86 @@ if (void 0) {
 var fakeLazyClient2;
 
 // src/signer.ts
-import { getPolkadotSignerFromPjs } from "polkadot-api/pjs-signer";
-import { fromHex, toHex } from "@polkadot-api/utils";
-function asHex(v) {
-  return v.startsWith("0x") ? v : `0x${v}`;
-}
-function makeSignPayloadCallback(session, productAccountId) {
-  return async (payload) => {
-    const result = await session.signPayload({
-      productAccountId,
-      blockHash: asHex(payload.blockHash),
-      blockNumber: asHex(payload.blockNumber),
-      era: asHex(payload.era),
-      genesisHash: asHex(payload.genesisHash),
-      method: asHex(payload.method),
-      nonce: asHex(payload.nonce),
-      specVersion: asHex(payload.specVersion),
-      tip: asHex(payload.tip),
-      transactionVersion: asHex(payload.transactionVersion),
-      signedExtensions: payload.signedExtensions,
-      version: payload.version,
-      // PJS types `assetId` as `number | object`. In practice the
-      // ChargeAssetTxPayment mapper always emits a hex string when
-      // present — we trust the mapper rather than runtime-checking,
-      // matching the reference in `@novasamatech/product-sdk`.
-      assetId: payload.assetId !== void 0 ? payload.assetId : void 0,
-      metadataHash: payload.metadataHash ? asHex(payload.metadataHash) : void 0,
-      mode: payload.mode,
-      withSignedTransaction: payload.withSignedTransaction
-    });
-    if (result.isErr()) {
-      throw new Error(`Mobile signing rejected: ${result.error.message}`);
+import { decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";
+function buildCreateTransactionRequest(productAccountId, callData, signedExtensions, txExtVersion) {
+  const checkGenesis = signedExtensions.CheckGenesis;
+  if (!checkGenesis) {
+    throw new Error(
+      "Cannot build transaction: chain did not provide the CheckGenesis signed extension"
+    );
+  }
+  return {
+    payload: {
+      tag: "v1",
+      value: {
+        signer: productAccountId,
+        // CheckGenesis carries the genesis hash as its additionalSigned (implicit) data.
+        genesisHash: checkGenesis.additionalSigned,
+        callData,
+        extensions: Object.values(signedExtensions).map(
+          ({ identifier, value, additionalSigned }) => ({
+            id: identifier,
+            extra: value,
+            additionalSigned
+          })
+        ),
+        txExtVersion
+      }
     }
-    return {
-      signature: toHex(result.value.signature),
-      signedTransaction: result.value.signedTransaction ? toHex(result.value.signedTransaction) : void 0
-    };
   };
 }
-function makeSignRawCallback(session, productAccountId) {
-  return async (payload) => {
+function txExtVersionFromMetadata(metadata) {
+  const decoded = unifyMetadata(decAnyMetadata(metadata));
+  const latestVersion = decoded.extrinsic.version.reduce((max, v) => Math.max(max, v), 0);
+  return latestVersion === 4 ? 0 : latestVersion;
+}
+async function requestSignedTransaction(session, request) {
+  const result = await session.createTransaction(request);
+  if (result.isErr()) {
+    throw new Error(`Mobile transaction signing rejected: ${result.error.message}`);
+  }
+  return result.value;
+}
+function makeTxSignTx(session, productAccountId) {
+  return async (callData, signedExtensions, metadata) => requestSignedTransaction(
+    session,
+    buildCreateTransactionRequest(
+      productAccountId,
+      callData,
+      signedExtensions,
+      txExtVersionFromMetadata(metadata)
+    )
+  );
+}
+function makeRawBytesSignCallback(session, productAccountId) {
+  return async (data) => {
     const result = await session.signRaw({
       productAccountId,
-      data: { tag: "Bytes", value: fromHex(payload.data) }
+      data: { tag: "Bytes", value: data }
     });
     if (result.isErr()) {
       throw new Error(`Mobile signing rejected: ${result.error.message}`);
     }
-    return {
-      id: 0,
-      signature: toHex(result.value.signature)
-    };
+    return result.value.signature;
   };
 }
 function buildSessionSigner(session, ref) {
-  const accountId = new Uint8Array(session.remoteAccount.accountId);
   const productAccountId = [ref.productId, ref.derivationIndex];
-  const accountIdHex = asHex(toHex(accountId));
-  return getPolkadotSignerFromPjs(
-    accountIdHex,
-    makeSignPayloadCallback(session, productAccountId),
-    makeSignRawCallback(session, productAccountId)
-  );
+  const publicKey = ref.publicKey ?? new Uint8Array(session.remoteAccount.accountId);
+  return {
+    publicKey,
+    // Transaction signing → host-papp `createTransaction`: the wallet builds
+    // and signs the extrinsic, so it can show a decoded tx (no `<Bytes>`
+    // envelope) and unknown signed extensions (e.g. `AsPgas`) survive.
+    signTx: makeTxSignTx(session, productAccountId),
+    // Arbitrary-byte signing keeps the `Bytes` tag so the wallet applies the
+    // `<Bytes>...</Bytes>` anti-phishing envelope exactly once on its side
+    // (correct for non-extrinsic user data).
+    signBytes: makeRawBytesSignCallback(session, productAccountId)
+  };
 }
-function createSessionSigner(session, adapter) {
-  return buildSessionSigner(session, { productId: adapter.appId, derivationIndex: 0 });
+function createSessionSigner(session, adapter, publicKey) {
+  return buildSessionSigner(session, { productId: adapter.appId, derivationIndex: 0, publicKey });
 }
 function createSessionSignerForAccount(session, ref) {
   return buildSessionSigner(session, ref);
@@ -355,16 +370,27 @@ if (void 0) {
         opts.signRaw ?? (async () => {
           throw new Error("signRaw not stubbed in this test");
         })
+      ),
+      createTransaction: vi.fn(
+        opts.createTransaction ?? (async () => {
+          throw new Error("createTransaction not stubbed in this test");
+        })
       )
     };
+  }, ext = function(identifier, value, additionalSigned) {
+    return {
+      identifier,
+      value: new Uint8Array(value),
+      additionalSigned: new Uint8Array(additionalSigned)
+    };
   }, fakeAdapter = function(appId) {
     return { appId };
   };
-  makeSession2 = makeSession, fakeAdapter2 = fakeAdapter;
+  makeSession2 = makeSession, ext2 = ext, fakeAdapter2 = fakeAdapter;
   const { describe, test, expect, vi } = void 0;
   const { ok, err } = await null;
   describe("createSessionSigner", () => {
-    test("exposes Sr25519 public key matching remoteAccount.accountId", () => {
+    test("falls back to remoteAccount.accountId when no product key is passed", () => {
       const bytes = Array.from({ length: 32 }, (_, i) => i);
       const signer = createSessionSigner(
         makeSession({ accountIdBytes: bytes }),
@@ -372,7 +398,18 @@ if (void 0) {
       );
       expect(signer.publicKey).toEqual(new Uint8Array(bytes));
     });
-    test("signBytes routes through session.signRaw (anti-phishing wrap path)", async () => {
+    test("uses the host-supplied product-account public key when provided", () => {
+      const walletBytes = Array.from({ length: 32 }, (_, i) => i);
+      const productKey = new Uint8Array(32).fill(171);
+      const signer = createSessionSigner(
+        makeSession({ accountIdBytes: walletBytes }),
+        fakeAdapter("test-app"),
+        productKey
+      );
+      expect(signer.publicKey).toEqual(productKey);
+      expect(signer.publicKey).not.toEqual(new Uint8Array(walletBytes));
+    });
+    test("signBytes routes through session.signRaw with the Bytes tag", async () => {
       const sig = new Uint8Array([9, 8, 7, 6, 5, 4, 3, 2, 1]);
       const captured = [];
       const session = makeSession({
@@ -388,9 +425,9 @@ if (void 0) {
       const req = captured[0];
       expect(req.productAccountId).toEqual(["test-app", 0]);
       expect(req.data.tag).toBe("Bytes");
-      expect(req.data.value).toBeInstanceOf(Uint8Array);
+      expect(req.data.value).toEqual(new Uint8Array([1, 2, 3]));
     });
-    test("signBytes does NOT call session.signPayload (regression guard for BadProof bug)", async () => {
+    test("signBytes never calls session.signPayload (legacy-path regression guard)", async () => {
       const session = makeSession({
         signRaw: async () => ok({ signature: new Uint8Array([1]) })
       });
@@ -400,7 +437,7 @@ if (void 0) {
       expect(sessionWithSpies.signPayload.mock.calls).toHaveLength(0);
       expect(sessionWithSpies.signRaw.mock.calls).toHaveLength(1);
     });
-    test("signRaw throws with a clear error when the mobile rejects", async () => {
+    test("signBytes throws with a clear error when the mobile rejects", async () => {
       const session = makeSession({
         signRaw: async () => err({ message: "user declined" })
       });
@@ -410,148 +447,108 @@ if (void 0) {
       );
     });
   });
-  describe("makeSignPayloadCallback \u2014 tx signing path (the BadProof fix)", () => {
-    function pjsPayload(overrides = {}) {
-      return {
-        address: `0x${"00".repeat(32)}`,
-        blockHash: `0x${"11".repeat(32)}`,
-        blockNumber: "0x12345678",
-        era: "0xc501",
-        genesisHash: `0x${"22".repeat(32)}`,
-        method: "0xabcdef",
-        nonce: "0x00000001",
-        specVersion: "0x000003e8",
-        tip: `0x${"0".repeat(32)}`,
-        transactionVersion: "0x00000001",
-        signedExtensions: ["CheckMortality", "CheckNonce"],
-        version: 4,
-        ...overrides
-      };
-    }
-    test("forwards request to session.signPayload with the right productAccountId", async () => {
-      const captured = [];
-      const session = makeSession({
-        signPayload: async (req2) => {
-          captured.push(req2);
-          return ok({
-            signature: new Uint8Array([170, 187]),
-            signedTransaction: void 0
-          });
+  describe("buildCreateTransactionRequest \u2014 tx payload (the AsPgas fix)", () => {
+    const checkGenesis = ext("CheckGenesis", [], [17, 34, 51]);
+    test("wraps the payload as v1 with signer, callData, and txExtVersion", () => {
+      const callData = new Uint8Array([202, 17]);
+      const req = buildCreateTransactionRequest(
+        ["my-app", 3],
+        callData,
+        { CheckGenesis: checkGenesis },
+        5
+      );
+      expect(req.payload.tag).toBe("v1");
+      expect(req.payload.value.signer).toEqual(["my-app", 3]);
+      expect(req.payload.value.callData).toEqual(callData);
+      expect(req.payload.value.txExtVersion).toBe(5);
+    });
+    test("takes the genesis hash from CheckGenesis.additionalSigned", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis },
+        0
+      );
+      expect(req.payload.value.genesisHash).toEqual(new Uint8Array([17, 34, 51]));
+    });
+    test("maps every signed extension to { id, extra, additionalSigned }", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis, CheckNonce: ext("CheckNonce", [7], []) },
+        0
+      );
+      expect(req.payload.value.extensions).toEqual([
+        {
+          id: "CheckGenesis",
+          extra: new Uint8Array([]),
+          additionalSigned: new Uint8Array([17, 34, 51])
+        },
+        {
+          id: "CheckNonce",
+          extra: new Uint8Array([7]),
+          additionalSigned: new Uint8Array([])
         }
+      ]);
+    });
+    test("preserves an unknown signed extension verbatim (e.g. AsPgas)", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis, AsPgas: ext("AsPgas", [222, 173], [190, 239]) },
+        0
+      );
+      expect(req.payload.value.extensions).toContainEqual({
+        id: "AsPgas",
+        extra: new Uint8Array([222, 173]),
+        additionalSigned: new Uint8Array([190, 239])
       });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      await callback(pjsPayload());
-      expect(captured).toHaveLength(1);
-      const req = captured[0];
-      expect(req.productAccountId).toEqual(["my-app", 0]);
-    });
-    test("does NOT call session.signRaw (BadProof regression guard)", async () => {
-      const session = makeSession({
-        signPayload: async () => ok({ signature: new Uint8Array([1]), signedTransaction: void 0 })
-      });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      await callback(pjsPayload());
-      const sessionWithSpies = session;
-      expect(sessionWithSpies.signPayload.mock.calls).toHaveLength(1);
-      expect(sessionWithSpies.signRaw.mock.calls).toHaveLength(0);
     });
-    test("translates every PJS hex field into a 0x-prefixed string", async () => {
-      const captured = [];
-      const session = makeSession({
-        signPayload: async (req2) => {
-          captured.push(req2);
-          return ok({
-            signature: new Uint8Array([0]),
-            signedTransaction: void 0
-          });
-        }
-      });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      await callback(
-        pjsPayload({
-          // Mix of already-prefixed and unprefixed inputs to exercise asHex.
-          blockHash: `0x${"ab".repeat(32)}`,
-          nonce: "1234abcd"
-          // unprefixed — asHex must add 0x
-        })
-      );
-      const req = captured[0];
-      for (const field of [
-        "blockHash",
-        "blockNumber",
-        "era",
-        "genesisHash",
-        "method",
-        "nonce",
-        "specVersion",
-        "tip",
-        "transactionVersion"
-      ]) {
-        expect(req[field], `${field} must be 0x-prefixed`).toMatch(/^0x[0-9a-fA-F]*$/);
-      }
+    test("throws a clear error when CheckGenesis is absent", () => {
+      expect(
+        () => buildCreateTransactionRequest(["my-app", 0], new Uint8Array([0]), {}, 0)
+      ).toThrow(/CheckGenesis/);
     });
-    test("forwards optional fields when present, omits when absent", async () => {
+  });
+  describe("requestSignedTransaction \u2014 SSO round-trip", () => {
+    const request = buildCreateTransactionRequest(
+      ["my-app", 0],
+      new Uint8Array([0]),
+      { CheckGenesis: ext("CheckGenesis", [], [1]) },
+      0
+    );
+    test("returns the signed extrinsic bytes from the mobile response", async () => {
+      const signed = new Uint8Array([171, 205, 239]);
+      const session = makeSession({ createTransaction: async () => ok(signed) });
+      const out = await requestSignedTransaction(session, request);
+      expect(out).toBe(signed);
+    });
+    test("calls session.createTransaction \u2014 never signRaw/signPayload \u2014 with the request", async () => {
       const captured = [];
       const session = makeSession({
-        signPayload: async (req2) => {
-          captured.push(req2);
-          return ok({
-            signature: new Uint8Array([0]),
-            signedTransaction: void 0
-          });
+        createTransaction: async (req) => {
+          captured.push(req);
+          return ok(new Uint8Array([1]));
         }
       });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      await callback(
-        pjsPayload({
-          metadataHash: "0xdeadbeef",
-          mode: 1,
-          withSignedTransaction: true,
-          assetId: "0xfeed"
-        })
-      );
-      const req = captured[0];
-      expect(req.metadataHash).toBe("0xdeadbeef");
-      expect(req.mode).toBe(1);
-      expect(req.withSignedTransaction).toBe(true);
-      expect(req.assetId).toBe("0xfeed");
-    });
-    test("hex-encodes signature and signedTransaction in the PJS return shape", async () => {
-      const session = makeSession({
-        signPayload: async () => ok({
-          signature: new Uint8Array([171, 205]),
-          signedTransaction: new Uint8Array([1, 2, 3])
-        })
-      });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      const result = await callback(pjsPayload());
-      expect(result.signature).toBe("0xabcd");
-      expect(result.signedTransaction).toBe("0x010203");
-    });
-    test("omits signedTransaction when host-papp returns undefined", async () => {
-      const session = makeSession({
-        signPayload: async () => ok({
-          signature: new Uint8Array([0]),
-          signedTransaction: void 0
-        })
-      });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      const result = await callback(pjsPayload());
-      expect(result.signature).toBe("0x00");
-      expect(result.signedTransaction).toBeUndefined();
+      await requestSignedTransaction(session, request);
+      expect(captured).toEqual([request]);
+      const spies = session;
+      expect(spies.createTransaction.mock.calls).toHaveLength(1);
+      expect(spies.signPayload.mock.calls).toHaveLength(0);
+      expect(spies.signRaw.mock.calls).toHaveLength(0);
     });
     test("throws a clear error when the mobile rejects", async () => {
       const session = makeSession({
-        signPayload: async () => err({ message: "user declined" })
+        createTransaction: async () => err({ message: "user declined" })
       });
-      const callback = makeSignPayloadCallback(session, ["my-app", 0]);
-      await expect(callback(pjsPayload())).rejects.toThrow(
-        "Mobile signing rejected: user declined"
+      await expect(requestSignedTransaction(session, request)).rejects.toThrow(
+        "Mobile transaction signing rejected: user declined"
       );
     });
   });
-  describe("makeSignRawCallback", () => {
-    test("forwards request to session.signRaw with the right productAccountId", async () => {
+  describe("makeRawBytesSignCallback", () => {
+    test("forwards data verbatim under the Bytes tag with the right productAccountId", async () => {
       const captured = [];
       const session = makeSession({
         signRaw: async (req2) => {
@@ -559,30 +556,22 @@ if (void 0) {
           return ok({ signature: new Uint8Array([255]) });
         }
       });
-      const callback = makeSignRawCallback(session, ["my-app", 5]);
-      await callback({
-        address: `0x${"00".repeat(32)}`,
-        data: "0xdeadbeef",
-        type: "bytes"
-      });
+      const callback = makeRawBytesSignCallback(session, ["my-app", 5]);
+      await callback(new Uint8Array([222, 173, 190, 239]));
       expect(captured).toHaveLength(1);
       const req = captured[0];
       expect(req.productAccountId).toEqual(["my-app", 5]);
       expect(req.data.tag).toBe("Bytes");
       expect(Array.from(req.data.value)).toEqual([222, 173, 190, 239]);
     });
-    test("hex-encodes signature in the PJS return shape with id: 0", async () => {
+    test("returns the raw signature bytes from the mobile response", async () => {
+      const sig = new Uint8Array([66]);
       const session = makeSession({
-        signRaw: async () => ok({ signature: new Uint8Array([66]) })
-      });
-      const callback = makeSignRawCallback(session, ["my-app", 0]);
-      const result = await callback({
-        address: `0x${"00".repeat(32)}`,
-        data: "0x00",
-        type: "bytes"
+        signRaw: async () => ok({ signature: sig })
       });
-      expect(result.id).toBe(0);
-      expect(result.signature).toBe("0x42");
+      const callback = makeRawBytesSignCallback(session, ["my-app", 0]);
+      const out = await callback(new Uint8Array([0]));
+      expect(out).toBe(sig);
     });
   });
   describe("createSessionSignerForAccount", () => {
@@ -624,6 +613,7 @@ if (void 0) {
   });
 }
 var makeSession2;
+var ext2;
 var fakeAdapter2;
 
 // src/sessions.ts