@parity/product-sdk-terminal 0.2.1 → 0.3.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   createNodeStorageAdapter
-} from "./chunk-5MCLSFKQ.js";
+} from "./chunk-GHOFKVUG.js";
 
 // src/adapter.ts
 import {
@@ -26,7 +26,6 @@ function createTerminalAdapter(options) {
   const statementStore = createPapiStatementStoreAdapter(trackedLazyClient);
   const adapter = createPappAdapter({
     appId: options.appId,
-    metadata: options.metadataUrl,
     hostMetadata: options.hostMetadata,
     adapters: {
       storage,
@@ -38,6 +37,7 @@ function createTerminalAdapter(options) {
   return {
     ...adapter,
     appId: options.appId,
+    storageDir: options.storageDir,
     destroy() {
       if (destroyPromise) return destroyPromise;
       destroyPromise = teardown(adapter.sessions, trackedLazyClient);
@@ -272,20 +272,57 @@ if (void 0) {
 var fakeLazyClient2;
 
 // src/signer.ts
-import { toHex } from "@polkadot-api/utils";
-import { getPolkadotSigner } from "polkadot-api/signer";
-function makeTxSignCallback(session, productAccountId) {
-  return async (toSign) => {
-    const result = await session.signRaw({
-      productAccountId,
-      data: { tag: "Payload", value: toHex(toSign) }
-    });
-    if (result.isErr()) {
-      throw new Error(`Mobile signing rejected: ${result.error.message}`);
+import { decAnyMetadata, unifyMetadata } from "@polkadot-api/substrate-bindings";
+function buildCreateTransactionRequest(productAccountId, callData, signedExtensions, txExtVersion) {
+  const checkGenesis = signedExtensions.CheckGenesis;
+  if (!checkGenesis) {
+    throw new Error(
+      "Cannot build transaction: chain did not provide the CheckGenesis signed extension"
+    );
+  }
+  return {
+    payload: {
+      tag: "v1",
+      value: {
+        signer: productAccountId,
+        // CheckGenesis carries the genesis hash as its additionalSigned (implicit) data.
+        genesisHash: checkGenesis.additionalSigned,
+        callData,
+        extensions: Object.values(signedExtensions).map(
+          ({ identifier, value, additionalSigned }) => ({
+            id: identifier,
+            extra: value,
+            additionalSigned
+          })
+        ),
+        txExtVersion
+      }
     }
-    return result.value.signature;
   };
 }
+function txExtVersionFromMetadata(metadata) {
+  const decoded = unifyMetadata(decAnyMetadata(metadata));
+  const latestVersion = decoded.extrinsic.version.reduce((max, v) => Math.max(max, v), 0);
+  return latestVersion === 4 ? 0 : latestVersion;
+}
+async function requestSignedTransaction(session, request) {
+  const result = await session.createTransaction(request);
+  if (result.isErr()) {
+    throw new Error(`Mobile transaction signing rejected: ${result.error.message}`);
+  }
+  return result.value;
+}
+function makeTxSignTx(session, productAccountId) {
+  return async (callData, signedExtensions, metadata) => requestSignedTransaction(
+    session,
+    buildCreateTransactionRequest(
+      productAccountId,
+      callData,
+      signedExtensions,
+      txExtVersionFromMetadata(metadata)
+    )
+  );
+}
 function makeRawBytesSignCallback(session, productAccountId) {
   return async (data) => {
     const result = await session.signRaw({
@@ -300,19 +337,21 @@ function makeRawBytesSignCallback(session, productAccountId) {
 }
 function buildSessionSigner(session, ref) {
   const productAccountId = [ref.productId, ref.derivationIndex];
-  const publicKey = new Uint8Array(session.remoteAccount.accountId);
-  const base = getPolkadotSigner(
-    publicKey,
-    "Sr25519",
-    makeTxSignCallback(session, productAccountId)
-  );
+  const publicKey = ref.publicKey ?? new Uint8Array(session.remoteAccount.accountId);
   return {
-    ...base,
+    publicKey,
+    // Transaction signing → host-papp `createTransaction`: the wallet builds
+    // and signs the extrinsic, so it can show a decoded tx (no `<Bytes>`
+    // envelope) and unknown signed extensions (e.g. `AsPgas`) survive.
+    signTx: makeTxSignTx(session, productAccountId),
+    // Arbitrary-byte signing keeps the `Bytes` tag so the wallet applies the
+    // `<Bytes>...</Bytes>` anti-phishing envelope exactly once on its side
+    // (correct for non-extrinsic user data).
     signBytes: makeRawBytesSignCallback(session, productAccountId)
   };
 }
-function createSessionSigner(session, adapter) {
-  return buildSessionSigner(session, { productId: adapter.appId, derivationIndex: 0 });
+function createSessionSigner(session, adapter, publicKey) {
+  return buildSessionSigner(session, { productId: adapter.appId, derivationIndex: 0, publicKey });
 }
 function createSessionSignerForAccount(session, ref) {
   return buildSessionSigner(session, ref);
@@ -331,17 +370,27 @@ if (void 0) {
         opts.signRaw ?? (async () => {
           throw new Error("signRaw not stubbed in this test");
         })
+      ),
+      createTransaction: vi.fn(
+        opts.createTransaction ?? (async () => {
+          throw new Error("createTransaction not stubbed in this test");
+        })
       )
     };
+  }, ext = function(identifier, value, additionalSigned) {
+    return {
+      identifier,
+      value: new Uint8Array(value),
+      additionalSigned: new Uint8Array(additionalSigned)
+    };
   }, fakeAdapter = function(appId) {
     return { appId };
   };
-  makeSession2 = makeSession, fakeAdapter2 = fakeAdapter;
+  makeSession2 = makeSession, ext2 = ext, fakeAdapter2 = fakeAdapter;
   const { describe, test, expect, vi } = void 0;
   const { ok, err } = await null;
-  const { fromHex } = await null;
   describe("createSessionSigner", () => {
-    test("exposes Sr25519 public key matching remoteAccount.accountId", () => {
+    test("falls back to remoteAccount.accountId when no product key is passed", () => {
       const bytes = Array.from({ length: 32 }, (_, i) => i);
       const signer = createSessionSigner(
         makeSession({ accountIdBytes: bytes }),
@@ -349,6 +398,17 @@ if (void 0) {
       );
       expect(signer.publicKey).toEqual(new Uint8Array(bytes));
     });
+    test("uses the host-supplied product-account public key when provided", () => {
+      const walletBytes = Array.from({ length: 32 }, (_, i) => i);
+      const productKey = new Uint8Array(32).fill(171);
+      const signer = createSessionSigner(
+        makeSession({ accountIdBytes: walletBytes }),
+        fakeAdapter("test-app"),
+        productKey
+      );
+      expect(signer.publicKey).toEqual(productKey);
+      expect(signer.publicKey).not.toEqual(new Uint8Array(walletBytes));
+    });
     test("signBytes routes through session.signRaw with the Bytes tag", async () => {
       const sig = new Uint8Array([9, 8, 7, 6, 5, 4, 3, 2, 1]);
       const captured = [];
@@ -387,75 +447,103 @@ if (void 0) {
       );
     });
   });
-  describe("makeTxSignCallback \u2014 tx signing path (the AsPgas fix)", () => {
-    test("forwards bytes-to-sign under the Payload tag with the right productAccountId", async () => {
-      const captured = [];
-      const session = makeSession({
-        signRaw: async (req2) => {
-          captured.push(req2);
-          return ok({ signature: new Uint8Array([170, 187]) });
+  describe("buildCreateTransactionRequest \u2014 tx payload (the AsPgas fix)", () => {
+    const checkGenesis = ext("CheckGenesis", [], [17, 34, 51]);
+    test("wraps the payload as v1 with signer, callData, and txExtVersion", () => {
+      const callData = new Uint8Array([202, 17]);
+      const req = buildCreateTransactionRequest(
+        ["my-app", 3],
+        callData,
+        { CheckGenesis: checkGenesis },
+        5
+      );
+      expect(req.payload.tag).toBe("v1");
+      expect(req.payload.value.signer).toEqual(["my-app", 3]);
+      expect(req.payload.value.callData).toEqual(callData);
+      expect(req.payload.value.txExtVersion).toBe(5);
+    });
+    test("takes the genesis hash from CheckGenesis.additionalSigned", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis },
+        0
+      );
+      expect(req.payload.value.genesisHash).toEqual(new Uint8Array([17, 34, 51]));
+    });
+    test("maps every signed extension to { id, extra, additionalSigned }", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis, CheckNonce: ext("CheckNonce", [7], []) },
+        0
+      );
+      expect(req.payload.value.extensions).toEqual([
+        {
+          id: "CheckGenesis",
+          extra: new Uint8Array([]),
+          additionalSigned: new Uint8Array([17, 34, 51])
+        },
+        {
+          id: "CheckNonce",
+          extra: new Uint8Array([7]),
+          additionalSigned: new Uint8Array([])
         }
-      });
-      const callback = makeTxSignCallback(session, ["my-app", 0]);
-      await callback(new Uint8Array([222, 173, 190, 239]));
-      expect(captured).toHaveLength(1);
-      const req = captured[0];
-      expect(req.productAccountId).toEqual(["my-app", 0]);
-      expect(req.data.tag).toBe("Payload");
-      expect(req.data.value).toBe("0xdeadbeef");
+      ]);
     });
-    test("never calls session.signPayload (legacy PJS-shape regression guard)", async () => {
-      const session = makeSession({
-        signRaw: async () => ok({ signature: new Uint8Array([1]) })
+    test("preserves an unknown signed extension verbatim (e.g. AsPgas)", () => {
+      const req = buildCreateTransactionRequest(
+        ["my-app", 0],
+        new Uint8Array([0]),
+        { CheckGenesis: checkGenesis, AsPgas: ext("AsPgas", [222, 173], [190, 239]) },
+        0
+      );
+      expect(req.payload.value.extensions).toContainEqual({
+        id: "AsPgas",
+        extra: new Uint8Array([222, 173]),
+        additionalSigned: new Uint8Array([190, 239])
       });
-      const callback = makeTxSignCallback(session, ["my-app", 0]);
-      await callback(new Uint8Array([1, 2, 3]));
-      const sessionWithSpies = session;
-      expect(sessionWithSpies.signPayload.mock.calls).toHaveLength(0);
-      expect(sessionWithSpies.signRaw.mock.calls).toHaveLength(1);
     });
-    test("returns the raw signature bytes from the mobile response", async () => {
-      const sig = new Uint8Array([171, 205, 239]);
-      const session = makeSession({
-        signRaw: async () => ok({ signature: sig })
-      });
-      const callback = makeTxSignCallback(session, ["my-app", 0]);
-      const out = await callback(new Uint8Array([0]));
-      expect(out).toBe(sig);
+    test("throws a clear error when CheckGenesis is absent", () => {
+      expect(
+        () => buildCreateTransactionRequest(["my-app", 0], new Uint8Array([0]), {}, 0)
+      ).toThrow(/CheckGenesis/);
     });
-    test("preserves arbitrary signed-extension payload bytes verbatim", async () => {
-      const customExtensionBytes = new Uint8Array([
-        // arbitrary scale-encoded extension payload — content
-        // doesn't matter, only that it round-trips exactly
-        1,
-        2,
-        3,
-        255,
-        254,
-        253,
-        66,
-        67,
-        68
-      ]);
+  });
+  describe("requestSignedTransaction \u2014 SSO round-trip", () => {
+    const request = buildCreateTransactionRequest(
+      ["my-app", 0],
+      new Uint8Array([0]),
+      { CheckGenesis: ext("CheckGenesis", [], [1]) },
+      0
+    );
+    test("returns the signed extrinsic bytes from the mobile response", async () => {
+      const signed = new Uint8Array([171, 205, 239]);
+      const session = makeSession({ createTransaction: async () => ok(signed) });
+      const out = await requestSignedTransaction(session, request);
+      expect(out).toBe(signed);
+    });
+    test("calls session.createTransaction \u2014 never signRaw/signPayload \u2014 with the request", async () => {
       const captured = [];
       const session = makeSession({
-        signRaw: async (req2) => {
-          captured.push(req2);
-          return ok({ signature: new Uint8Array([0]) });
+        createTransaction: async (req) => {
+          captured.push(req);
+          return ok(new Uint8Array([1]));
         }
       });
-      const callback = makeTxSignCallback(session, ["my-app", 0]);
-      await callback(customExtensionBytes);
-      const req = captured[0];
-      expect(fromHex(req.data.value)).toEqual(customExtensionBytes);
+      await requestSignedTransaction(session, request);
+      expect(captured).toEqual([request]);
+      const spies = session;
+      expect(spies.createTransaction.mock.calls).toHaveLength(1);
+      expect(spies.signPayload.mock.calls).toHaveLength(0);
+      expect(spies.signRaw.mock.calls).toHaveLength(0);
     });
     test("throws a clear error when the mobile rejects", async () => {
       const session = makeSession({
-        signRaw: async () => err({ message: "user declined" })
+        createTransaction: async () => err({ message: "user declined" })
       });
-      const callback = makeTxSignCallback(session, ["my-app", 0]);
-      await expect(callback(new Uint8Array([0]))).rejects.toThrow(
-        "Mobile signing rejected: user declined"
+      await expect(requestSignedTransaction(session, request)).rejects.toThrow(
+        "Mobile transaction signing rejected: user declined"
       );
     });
   });
@@ -525,6 +613,7 @@ if (void 0) {
   });
 }
 var makeSession2;
+var ext2;
 var fakeAdapter2;
 
 // src/sessions.ts