@portal-hq/provider 4.1.4 → 4.1.6

package/lib/commonjs/signers/enclave.js

@@ -88,10 +88,22 @@ class EnclaveSigner {
                         break;
                 }
                 const shares = yield this.keychain.getShares();
+                // Validate shares exist
+                if (!shares.secp256k1) {
+                    throw new utils_1.PortalMpcError({
+                        code: utils_1.PortalErrorCodes.FailedToParseInputShareObject,
+                        id: 'MissingShare',
+                        message: '[Portal.Provider.EnclaveSigner] The SECP256K1 share is missing from the keychain.',
+                    });
+                }
                 let signingShare = shares.secp256k1.share;
                 if (curve === core_1.PortalCurve.ED25519) {
                     if (!shares.ed25519) {
-                        throw new Error('[Portal.Provider.EnclaveSigner] The ED25519 share is missing from the keychain.');
+                        throw new utils_1.PortalMpcError({
+                            code: utils_1.PortalErrorCodes.FailedToParseInputShareObject,
+                            id: 'MissingShare',
+                            message: '[Portal.Provider.EnclaveSigner] The ED25519 share is missing from the keychain.',
+                        });
                     }
                     signingShare = shares.ed25519.share;
                 }
@@ -107,17 +119,24 @@ class EnclaveSigner {
                     reqId: traceId,
                     connectionTracingEnabled: shouldSendMetrics,
                 };
+                // Build params
+                // Avoid double JSON encoding: if params is already a string (e.g. a hex message), pass it directly; otherwise stringify objects/arrays.
+                const params = this.buildParams(method, message.params);
                 let formattedParams;
-                let rpcUrl;
                 if (isRaw) {
-                    formattedParams = JSON.stringify(this.buildParams(method, message.params));
-                    rpcUrl = '';
-                    metrics.operation = Operation.RAW_SIGN;
+                    if (typeof params !== 'string') {
+                        throw new Error('[Portal.Provider.EnclaveSigner] For raw signing, params must be a string (e.g., a hex-encoded message).');
+                    }
+                    formattedParams = params;
                 }
                 else {
-                    formattedParams = JSON.stringify(this.buildParams(method, message.params));
-                    rpcUrl = provider.getGatewayUrl(chainId);
+                    formattedParams =
+                        typeof params === 'string' ? params : JSON.stringify(params);
                 }
+                // Get RPC URL (getGatewayUrl handles undefined chainId)
+                const rpcUrl = isRaw ? '' : provider.getGatewayUrl(chainId);
+                // Set metrics operation
+                metrics.operation = isRaw ? Operation.RAW_SIGN : Operation.SIGN;
                 if (typeof formattedParams !== 'string') {
                     throw new Error(`[Portal.Provider.EnclaveSigner] The formatted params for the signing request could not be converted to a string. The params were: ${formattedParams}`);
                 }
@@ -125,9 +144,40 @@ class EnclaveSigner {
                 metrics.sdkPreOperationMs = performance.now() - preOperationStartTime;
                 // Measure enclave signing operation time
                 const enclaveSignStartTime = performance.now();
-                const result = isRaw
-                    ? yield this.enclaveRawSign(apiKey, JSON.stringify(signingShare), formattedParams, curve || 'SECP256K1')
-                    : yield this.enclaveSign(apiKey, JSON.stringify(signingShare), message.method, formattedParams, rpcUrl, chainId || '', JSON.stringify(metadata));
+                // Build request based on operation type
+                let endpoint;
+                let requestBody;
+                if (isRaw) {
+                    // Raw sign endpoint and body
+                    endpoint = `/v1/raw/sign/${curve || 'SECP256K1'}`;
+                    requestBody = {
+                        params: formattedParams,
+                        share: JSON.stringify(signingShare),
+                    };
+                }
+                else {
+                    // Standard sign endpoint and body
+                    endpoint = '/v1/sign';
+                    requestBody = {
+                        method: message.method,
+                        params: formattedParams,
+                        share: JSON.stringify(signingShare),
+                        chainId: chainId || '',
+                        rpcUrl: rpcUrl,
+                        metadataStr: JSON.stringify(metadata),
+                        clientPlatform: 'REACT_NATIVE',
+                        clientPlatformVersion: (0, utils_1.getClientPlatformVersion)(),
+                    };
+                }
+                // Make API request and process response
+                let result;
+                try {
+                    const response = yield this.makeEnclaveRequest(endpoint, apiKey, requestBody);
+                    result = this.processEnclaveResponse(response);
+                }
+                catch (error) {
+                    this.handleEnclaveError(error);
+                }
                 // Post-operation processing time starts
                 const postOperationStartTime = performance.now();
                 // Record HTTP call time
@@ -181,118 +231,117 @@ class EnclaveSigner {
             }
         });
     }
-    enclaveRawSign(apiKey, signingShare, params, curve) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!apiKey || !signingShare || !params || !curve) {
-                return this.encodeErrorResult('INVALID_PARAMETERS', 'Invalid parameters provided for raw signing');
-            }
-            const requestBody = {
-                params: params,
-                share: signingShare,
-            };
-            const endpoint = `/v1/raw/sign/${curve}`;
-            try {
-                const response = yield this.requests.post(endpoint, {
-                    headers: {
-                        Authorization: `Bearer ${apiKey}`,
-                        'Content-Type': 'application/json',
-                    },
-                    body: requestBody,
-                });
-                return this.encodeSuccessResult(response.data);
-            }
-            catch (error) {
-                if ((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.data) {
-                    const portalError = this.decodePortalError(JSON.stringify(error.response.data));
-                    return this.encodeErrorResult(portalError === null || portalError === void 0 ? void 0 : portalError.id, portalError === null || portalError === void 0 ? void 0 : portalError.message);
-                }
-                return this.encodeErrorResult('SIGNING_NETWORK_ERROR', 
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
-                error.message || 'Network error occurred');
+    /**
+     * Parse API error from HttpError message
+     * HttpError format: "{status} - {statusText}: {responseBody}"
+     * API returns: {"id":"ERROR_ID","message":"error text","code":216}
+     */
+    parseApiError(errorMessage) {
+        // Extract response body after the colon
+        const colonIndex = errorMessage.indexOf(':');
+        if (colonIndex === -1) {
+            return null;
+        }
+        const responseBody = errorMessage.substring(colonIndex + 1).trim();
+        // Try to extract JSON object from response (handles prefixed JSON)
+        const jsonMatch = responseBody.match(/\{.*\}$/);
+        const jsonString = jsonMatch ? jsonMatch[0] : responseBody;
+        try {
+            const parsed = JSON.parse(jsonString);
+            // Ensure all required fields are present
+            if (parsed.id &&
+                parsed.message !== undefined &&
+                parsed.code !== undefined) {
+                return {
+                    id: parsed.id,
+                    message: parsed.message,
+                    code: parsed.code,
+                };
             }
-        });
+        }
+        catch (_a) {
+            // JSON parsing failed
+        }
+        return null;
     }
-    enclaveSign(apiKey, signingShare, method, params, rpcURL, chainId, metadata) {
-        var _a;
+    /**
+     * Make HTTP request to Enclave API
+     * Returns raw response without processing
+     */
+    makeEnclaveRequest(endpoint, apiKey, body) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!apiKey ||
-                !signingShare ||
-                !method ||
-                !params ||
-                !chainId ||
-                !metadata) {
-                return this.encodeErrorResult('INVALID_PARAMETERS', 'Invalid parameters provided');
-            }
-            const requestBody = {
-                method: method,
-                params: params,
-                share: signingShare,
-                chainId: chainId,
-                rpcUrl: rpcURL,
-                metadataStr: metadata,
-                clientPlatform: 'REACT_NATIVE',
-                clientPlatformVersion: (0, utils_1.getClientPlatformVersion)(),
-            };
-            try {
-                const response = yield this.requests.post('/v1/sign', {
-                    headers: {
-                        Authorization: `Bearer ${apiKey}`,
-                        'Content-Type': 'application/json',
-                    },
-                    body: requestBody,
-                });
-                return this.encodeSuccessResult(response.data);
-            }
-            catch (error) {
-                if ((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.data) {
-                    const portalError = this.decodePortalError(JSON.stringify(error.response.data));
-                    return this.encodeErrorResult(portalError === null || portalError === void 0 ? void 0 : portalError.id, portalError === null || portalError === void 0 ? void 0 : portalError.message);
-                }
-                return this.encodeErrorResult('SIGNING_NETWORK_ERROR', 
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
-                error.message || 'Network error occurred');
-            }
+            return yield this.requests.post(endpoint, {
+                headers: {
+                    Authorization: `Bearer ${apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body,
+            });
         });
     }
-    // Helper function to encode success results
-    encodeSuccessResult(data) {
-        const successResult = { data: data, error: undefined };
-        return this.encodeJSON(successResult);
-    }
-    // Helper function to decode Portal errors
-    decodePortalError(errorStr) {
-        if (!errorStr)
-            return null;
-        try {
-            return JSON.parse(errorStr);
+    /**
+     * Process Enclave API response
+     * Checks for error format and extracts data
+     */
+    processEnclaveResponse(response) {
+        // Check for API-level errors first
+        // API returns errors at top level: {id, message, code}
+        if ('id' in response && 'message' in response && 'code' in response) {
+            const errorResponse = response;
+            throw new utils_1.PortalMpcError({
+                code: errorResponse.code,
+                id: errorResponse.id,
+                message: errorResponse.message,
+            });
         }
-        catch (_a) {
-            return null;
+        // API returns success as: {data: string}
+        const successResponse = response;
+        if (!successResponse.data) {
+            throw new utils_1.PortalMpcError({
+                code: utils_1.PortalErrorCodes.BadRequest,
+                id: 'InvalidResponse',
+                message: 'API response missing data field',
+            });
         }
+        return successResponse.data;
     }
-    // Helper function to encode error results
-    encodeErrorResult(id, message) {
-        const errorResult = {
-            data: undefined,
-            error: { id, message },
-        };
-        return this.encodeJSON(errorResult);
-    }
-    // Helper function to encode any object to JSON string
-    encodeJSON(value) {
-        try {
-            const jsonString = JSON.stringify(value);
-            return jsonString;
+    /**
+     * Handle errors from Enclave API calls
+     * Parses and transforms to PortalMpcError
+     */
+    handleEnclaveError(error) {
+        // If it's already a PortalMpcError, re-throw it
+        if (error instanceof utils_1.PortalMpcError) {
+            throw error;
         }
-        catch (error) {
-            return JSON.stringify({
-                error: {
-                    id: 'ENCODING_ERROR',
-                    message: `Failed to encode JSON: ${error.message}`,
-                },
+        // Handle HTTP error responses
+        // HttpError format: "{status} - {statusText}: {responseBody}"
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
+        const errorMessage = typeof error.message === 'string' ? error.message : '';
+        // Try to parse API error from HttpError message
+        const apiError = this.parseApiError(errorMessage);
+        if (apiError) {
+            throw new utils_1.PortalMpcError({
+                code: apiError.code,
+                id: apiError.id,
+                message: apiError.message,
             });
         }
+        // Check for 401 Unauthorized
+        if (errorMessage.startsWith('401 -')) {
+            throw new utils_1.PortalMpcError({
+                code: utils_1.PortalErrorCodes.InvalidApiKey,
+                id: 'Unauthorized',
+                message: 'Unauthorized request',
+            });
+        }
+        // Handle network errors
+        throw new utils_1.PortalMpcError({
+            code: utils_1.PortalErrorCodes.SigningNetworkError,
+            id: 'SIGNING_NETWORK_ERROR',
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
+            message: errorMessage || 'Network error occurred',
+        });
     }
     sendMetrics(metrics, apiKey) {
         return __awaiter(this, void 0, void 0, function* () {

package/lib/esm/signers/enclave.js

@@ -8,7 +8,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { PortalCurve } from '@portal-hq/core';
-import { HttpRequester, getClientPlatformVersion, } from '@portal-hq/utils';
+import { HttpRequester, PortalErrorCodes, PortalMpcError, getClientPlatformVersion, } from '@portal-hq/utils';
 import UUID from 'react-native-uuid';
 var Operation;
 (function (Operation) {
@@ -83,10 +83,22 @@ class EnclaveSigner {
                         break;
                 }
                 const shares = yield this.keychain.getShares();
+                // Validate shares exist
+                if (!shares.secp256k1) {
+                    throw new PortalMpcError({
+                        code: PortalErrorCodes.FailedToParseInputShareObject,
+                        id: 'MissingShare',
+                        message: '[Portal.Provider.EnclaveSigner] The SECP256K1 share is missing from the keychain.',
+                    });
+                }
                 let signingShare = shares.secp256k1.share;
                 if (curve === PortalCurve.ED25519) {
                     if (!shares.ed25519) {
-                        throw new Error('[Portal.Provider.EnclaveSigner] The ED25519 share is missing from the keychain.');
+                        throw new PortalMpcError({
+                            code: PortalErrorCodes.FailedToParseInputShareObject,
+                            id: 'MissingShare',
+                            message: '[Portal.Provider.EnclaveSigner] The ED25519 share is missing from the keychain.',
+                        });
                     }
                     signingShare = shares.ed25519.share;
                 }
@@ -102,17 +114,24 @@ class EnclaveSigner {
                     reqId: traceId,
                     connectionTracingEnabled: shouldSendMetrics,
                 };
+                // Build params
+                // Avoid double JSON encoding: if params is already a string (e.g. a hex message), pass it directly; otherwise stringify objects/arrays.
+                const params = this.buildParams(method, message.params);
                 let formattedParams;
-                let rpcUrl;
                 if (isRaw) {
-                    formattedParams = JSON.stringify(this.buildParams(method, message.params));
-                    rpcUrl = '';
-                    metrics.operation = Operation.RAW_SIGN;
+                    if (typeof params !== 'string') {
+                        throw new Error('[Portal.Provider.EnclaveSigner] For raw signing, params must be a string (e.g., a hex-encoded message).');
+                    }
+                    formattedParams = params;
                 }
                 else {
-                    formattedParams = JSON.stringify(this.buildParams(method, message.params));
-                    rpcUrl = provider.getGatewayUrl(chainId);
+                    formattedParams =
+                        typeof params === 'string' ? params : JSON.stringify(params);
                 }
+                // Get RPC URL (getGatewayUrl handles undefined chainId)
+                const rpcUrl = isRaw ? '' : provider.getGatewayUrl(chainId);
+                // Set metrics operation
+                metrics.operation = isRaw ? Operation.RAW_SIGN : Operation.SIGN;
                 if (typeof formattedParams !== 'string') {
                     throw new Error(`[Portal.Provider.EnclaveSigner] The formatted params for the signing request could not be converted to a string. The params were: ${formattedParams}`);
                 }
@@ -120,9 +139,40 @@ class EnclaveSigner {
                 metrics.sdkPreOperationMs = performance.now() - preOperationStartTime;
                 // Measure enclave signing operation time
                 const enclaveSignStartTime = performance.now();
-                const result = isRaw
-                    ? yield this.enclaveRawSign(apiKey, JSON.stringify(signingShare), formattedParams, curve || 'SECP256K1')
-                    : yield this.enclaveSign(apiKey, JSON.stringify(signingShare), message.method, formattedParams, rpcUrl, chainId || '', JSON.stringify(metadata));
+                // Build request based on operation type
+                let endpoint;
+                let requestBody;
+                if (isRaw) {
+                    // Raw sign endpoint and body
+                    endpoint = `/v1/raw/sign/${curve || 'SECP256K1'}`;
+                    requestBody = {
+                        params: formattedParams,
+                        share: JSON.stringify(signingShare),
+                    };
+                }
+                else {
+                    // Standard sign endpoint and body
+                    endpoint = '/v1/sign';
+                    requestBody = {
+                        method: message.method,
+                        params: formattedParams,
+                        share: JSON.stringify(signingShare),
+                        chainId: chainId || '',
+                        rpcUrl: rpcUrl,
+                        metadataStr: JSON.stringify(metadata),
+                        clientPlatform: 'REACT_NATIVE',
+                        clientPlatformVersion: getClientPlatformVersion(),
+                    };
+                }
+                // Make API request and process response
+                let result;
+                try {
+                    const response = yield this.makeEnclaveRequest(endpoint, apiKey, requestBody);
+                    result = this.processEnclaveResponse(response);
+                }
+                catch (error) {
+                    this.handleEnclaveError(error);
+                }
                 // Post-operation processing time starts
                 const postOperationStartTime = performance.now();
                 // Record HTTP call time
@@ -176,118 +226,117 @@ class EnclaveSigner {
             }
         });
     }
-    enclaveRawSign(apiKey, signingShare, params, curve) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!apiKey || !signingShare || !params || !curve) {
-                return this.encodeErrorResult('INVALID_PARAMETERS', 'Invalid parameters provided for raw signing');
-            }
-            const requestBody = {
-                params: params,
-                share: signingShare,
-            };
-            const endpoint = `/v1/raw/sign/${curve}`;
-            try {
-                const response = yield this.requests.post(endpoint, {
-                    headers: {
-                        Authorization: `Bearer ${apiKey}`,
-                        'Content-Type': 'application/json',
-                    },
-                    body: requestBody,
-                });
-                return this.encodeSuccessResult(response.data);
-            }
-            catch (error) {
-                if ((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.data) {
-                    const portalError = this.decodePortalError(JSON.stringify(error.response.data));
-                    return this.encodeErrorResult(portalError === null || portalError === void 0 ? void 0 : portalError.id, portalError === null || portalError === void 0 ? void 0 : portalError.message);
-                }
-                return this.encodeErrorResult('SIGNING_NETWORK_ERROR', 
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
-                error.message || 'Network error occurred');
+    /**
+     * Parse API error from HttpError message
+     * HttpError format: "{status} - {statusText}: {responseBody}"
+     * API returns: {"id":"ERROR_ID","message":"error text","code":216}
+     */
+    parseApiError(errorMessage) {
+        // Extract response body after the colon
+        const colonIndex = errorMessage.indexOf(':');
+        if (colonIndex === -1) {
+            return null;
+        }
+        const responseBody = errorMessage.substring(colonIndex + 1).trim();
+        // Try to extract JSON object from response (handles prefixed JSON)
+        const jsonMatch = responseBody.match(/\{.*\}$/);
+        const jsonString = jsonMatch ? jsonMatch[0] : responseBody;
+        try {
+            const parsed = JSON.parse(jsonString);
+            // Ensure all required fields are present
+            if (parsed.id &&
+                parsed.message !== undefined &&
+                parsed.code !== undefined) {
+                return {
+                    id: parsed.id,
+                    message: parsed.message,
+                    code: parsed.code,
+                };
             }
-        });
+        }
+        catch (_a) {
+            // JSON parsing failed
+        }
+        return null;
     }
-    enclaveSign(apiKey, signingShare, method, params, rpcURL, chainId, metadata) {
-        var _a;
+    /**
+     * Make HTTP request to Enclave API
+     * Returns raw response without processing
+     */
+    makeEnclaveRequest(endpoint, apiKey, body) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (!apiKey ||
-                !signingShare ||
-                !method ||
-                !params ||
-                !chainId ||
-                !metadata) {
-                return this.encodeErrorResult('INVALID_PARAMETERS', 'Invalid parameters provided');
-            }
-            const requestBody = {
-                method: method,
-                params: params,
-                share: signingShare,
-                chainId: chainId,
-                rpcUrl: rpcURL,
-                metadataStr: metadata,
-                clientPlatform: 'REACT_NATIVE',
-                clientPlatformVersion: getClientPlatformVersion(),
-            };
-            try {
-                const response = yield this.requests.post('/v1/sign', {
-                    headers: {
-                        Authorization: `Bearer ${apiKey}`,
-                        'Content-Type': 'application/json',
-                    },
-                    body: requestBody,
-                });
-                return this.encodeSuccessResult(response.data);
-            }
-            catch (error) {
-                if ((_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.data) {
-                    const portalError = this.decodePortalError(JSON.stringify(error.response.data));
-                    return this.encodeErrorResult(portalError === null || portalError === void 0 ? void 0 : portalError.id, portalError === null || portalError === void 0 ? void 0 : portalError.message);
-                }
-                return this.encodeErrorResult('SIGNING_NETWORK_ERROR', 
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
-                error.message || 'Network error occurred');
-            }
+            return yield this.requests.post(endpoint, {
+                headers: {
+                    Authorization: `Bearer ${apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body,
+            });
         });
     }
-    // Helper function to encode success results
-    encodeSuccessResult(data) {
-        const successResult = { data: data, error: undefined };
-        return this.encodeJSON(successResult);
-    }
-    // Helper function to decode Portal errors
-    decodePortalError(errorStr) {
-        if (!errorStr)
-            return null;
-        try {
-            return JSON.parse(errorStr);
+    /**
+     * Process Enclave API response
+     * Checks for error format and extracts data
+     */
+    processEnclaveResponse(response) {
+        // Check for API-level errors first
+        // API returns errors at top level: {id, message, code}
+        if ('id' in response && 'message' in response && 'code' in response) {
+            const errorResponse = response;
+            throw new PortalMpcError({
+                code: errorResponse.code,
+                id: errorResponse.id,
+                message: errorResponse.message,
+            });
         }
-        catch (_a) {
-            return null;
+        // API returns success as: {data: string}
+        const successResponse = response;
+        if (!successResponse.data) {
+            throw new PortalMpcError({
+                code: PortalErrorCodes.BadRequest,
+                id: 'InvalidResponse',
+                message: 'API response missing data field',
+            });
         }
+        return successResponse.data;
     }
-    // Helper function to encode error results
-    encodeErrorResult(id, message) {
-        const errorResult = {
-            data: undefined,
-            error: { id, message },
-        };
-        return this.encodeJSON(errorResult);
-    }
-    // Helper function to encode any object to JSON string
-    encodeJSON(value) {
-        try {
-            const jsonString = JSON.stringify(value);
-            return jsonString;
+    /**
+     * Handle errors from Enclave API calls
+     * Parses and transforms to PortalMpcError
+     */
+    handleEnclaveError(error) {
+        // If it's already a PortalMpcError, re-throw it
+        if (error instanceof PortalMpcError) {
+            throw error;
         }
-        catch (error) {
-            return JSON.stringify({
-                error: {
-                    id: 'ENCODING_ERROR',
-                    message: `Failed to encode JSON: ${error.message}`,
-                },
+        // Handle HTTP error responses
+        // HttpError format: "{status} - {statusText}: {responseBody}"
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
+        const errorMessage = typeof error.message === 'string' ? error.message : '';
+        // Try to parse API error from HttpError message
+        const apiError = this.parseApiError(errorMessage);
+        if (apiError) {
+            throw new PortalMpcError({
+                code: apiError.code,
+                id: apiError.id,
+                message: apiError.message,
             });
         }
+        // Check for 401 Unauthorized
+        if (errorMessage.startsWith('401 -')) {
+            throw new PortalMpcError({
+                code: PortalErrorCodes.InvalidApiKey,
+                id: 'Unauthorized',
+                message: 'Unauthorized request',
+            });
+        }
+        // Handle network errors
+        throw new PortalMpcError({
+            code: PortalErrorCodes.SigningNetworkError,
+            id: 'SIGNING_NETWORK_ERROR',
+            // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
+            message: errorMessage || 'Network error occurred',
+        });
     }
     sendMetrics(metrics, apiKey) {
         return __awaiter(this, void 0, void 0, function* () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portal-hq/provider",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "license": "MIT",
   "main": "lib/commonjs/index",
   "module": "lib/esm/index",
@@ -19,8 +19,8 @@
     "test": "jest"
   },
   "dependencies": {
-    "@portal-hq/connect": "^4.1.4",
-    "@portal-hq/utils": "^4.1.4",
+    "@portal-hq/connect": "^4.1.6",
+    "@portal-hq/utils": "^4.1.6",
     "@types/react-native-uuid": "^2.0.0",
     "react-native-uuid": "^2.0.3"
   },
@@ -32,5 +32,5 @@
     "ts-jest": "^29.0.3",
     "typescript": "^4.8.4"
   },
-  "gitHead": "6507173bd858f430a4144bd9e700878a879cf286"
+  "gitHead": "6906f8cc1dbd92d87effa174b8fa73b74bf63532"
 }

package/src/signers/enclave.ts

@@ -4,6 +4,8 @@ import {
   HttpRequester,
   IPortalProvider,
   KeychainAdapter,
+  PortalErrorCodes,
+  PortalMpcError,
   type SigningRequestArguments,
   getClientPlatformVersion,
 } from '@portal-hq/utils'
@@ -12,9 +14,7 @@ import UUID from 'react-native-uuid'
 import {
   type MpcSignerOptions,
   PortalMobileMpcMetadata,
-  type EnclaveSignRequest,
   type EnclaveSignResponse,
-  type EnclaveSignResult,
 } from '../../types'
 import Signer from './abstract'
 
@@ -88,13 +88,27 @@ class EnclaveSigner implements Signer {
       }
 
       const shares = await this.keychain.getShares()
+
+      // Validate shares exist
+      if (!shares.secp256k1) {
+        throw new PortalMpcError({
+          code: PortalErrorCodes.FailedToParseInputShareObject,
+          id: 'MissingShare',
+          message:
+            '[Portal.Provider.EnclaveSigner] The SECP256K1 share is missing from the keychain.',
+        })
+      }
+
       let signingShare = shares.secp256k1.share
 
       if (curve === PortalCurve.ED25519) {
         if (!shares.ed25519) {
-          throw new Error(
-            '[Portal.Provider.EnclaveSigner] The ED25519 share is missing from the keychain.',
-          )
+          throw new PortalMpcError({
+            code: PortalErrorCodes.FailedToParseInputShareObject,
+            id: 'MissingShare',
+            message:
+              '[Portal.Provider.EnclaveSigner] The ED25519 share is missing from the keychain.',
+          })
         }
         signingShare = shares.ed25519.share
       }
@@ -112,22 +126,29 @@ class EnclaveSigner implements Signer {
         connectionTracingEnabled: shouldSendMetrics,
       }
 
+      // Build params
+      // Avoid double JSON encoding: if params is already a string (e.g. a hex message), pass it directly; otherwise stringify objects/arrays.
+      const params = this.buildParams(method, message.params)
       let formattedParams: string
-      let rpcUrl: string
 
       if (isRaw) {
-        formattedParams = JSON.stringify(
-          this.buildParams(method, message.params),
-        )
-        rpcUrl = ''
-        metrics.operation = Operation.RAW_SIGN
+        if (typeof params !== 'string') {
+          throw new Error(
+            '[Portal.Provider.EnclaveSigner] For raw signing, params must be a string (e.g., a hex-encoded message).',
+          )
+        }
+        formattedParams = params
       } else {
-        formattedParams = JSON.stringify(
-          this.buildParams(method, message.params),
-        )
-        rpcUrl = provider.getGatewayUrl(chainId)
+        formattedParams =
+          typeof params === 'string' ? params : JSON.stringify(params)
       }
 
+      // Get RPC URL (getGatewayUrl handles undefined chainId)
+      const rpcUrl = isRaw ? '' : provider.getGatewayUrl(chainId)
+
+      // Set metrics operation
+      metrics.operation = isRaw ? Operation.RAW_SIGN : Operation.SIGN
+
       if (typeof formattedParams !== 'string') {
         throw new Error(
           `[Portal.Provider.EnclaveSigner] The formatted params for the signing request could not be converted to a string. The params were: ${formattedParams}`,
@@ -140,22 +161,44 @@ class EnclaveSigner implements Signer {
       // Measure enclave signing operation time
       const enclaveSignStartTime = performance.now()
 
-      const result = isRaw
-        ? await this.enclaveRawSign(
-            apiKey,
-            JSON.stringify(signingShare),
-            formattedParams,
-            curve || 'SECP256K1',
-          )
-        : await this.enclaveSign(
-            apiKey,
-            JSON.stringify(signingShare),
-            message.method,
-            formattedParams,
-            rpcUrl,
-            chainId || '',
-            JSON.stringify(metadata),
-          )
+      // Build request based on operation type
+      let endpoint: string
+      let requestBody: Record<string, any>
+
+      if (isRaw) {
+        // Raw sign endpoint and body
+        endpoint = `/v1/raw/sign/${curve || 'SECP256K1'}`
+        requestBody = {
+          params: formattedParams,
+          share: JSON.stringify(signingShare),
+        }
+      } else {
+        // Standard sign endpoint and body
+        endpoint = '/v1/sign'
+        requestBody = {
+          method: message.method,
+          params: formattedParams,
+          share: JSON.stringify(signingShare),
+          chainId: chainId || '',
+          rpcUrl: rpcUrl,
+          metadataStr: JSON.stringify(metadata),
+          clientPlatform: 'REACT_NATIVE',
+          clientPlatformVersion: getClientPlatformVersion(),
+        }
+      }
+
+      // Make API request and process response
+      let result: string
+      try {
+        const response = await this.makeEnclaveRequest(
+          endpoint,
+          apiKey,
+          requestBody,
+        )
+        result = this.processEnclaveResponse(response)
+      } catch (error) {
+        this.handleEnclaveError(error)
+      }
 
       // Post-operation processing time starts
       const postOperationStartTime = performance.now()
@@ -216,153 +259,141 @@ class EnclaveSigner implements Signer {
     }
   }
 
-  private async enclaveRawSign(
-    apiKey: string,
-    signingShare: string,
-    params: string,
-    curve: string,
-  ): Promise<string> {
-    if (!apiKey || !signingShare || !params || !curve) {
-      return this.encodeErrorResult(
-        'INVALID_PARAMETERS',
-        'Invalid parameters provided for raw signing',
-      )
+  /**
+   * Parse API error from HttpError message
+   * HttpError format: "{status} - {statusText}: {responseBody}"
+   * API returns: {"id":"ERROR_ID","message":"error text","code":216}
+   */
+  private parseApiError(
+    errorMessage: string,
+  ): { id: string; message: string; code: number } | null {
+    // Extract response body after the colon
+    const colonIndex = errorMessage.indexOf(':')
+    if (colonIndex === -1) {
+      return null
     }
 
-    const requestBody = {
-      params: params,
-      share: signingShare,
-    }
+    const responseBody = errorMessage.substring(colonIndex + 1).trim()
 
-    const endpoint = `/v1/raw/sign/${curve}`
+    // Try to extract JSON object from response (handles prefixed JSON)
+    const jsonMatch = responseBody.match(/\{.*\}$/)
+    const jsonString = jsonMatch ? jsonMatch[0] : responseBody
 
     try {
-      const response = await this.requests.post<EnclaveSignResponse>(endpoint, {
-        headers: {
-          Authorization: `Bearer ${apiKey}`,
-          'Content-Type': 'application/json',
-        },
-        body: requestBody,
-      })
-
-      return this.encodeSuccessResult(response.data)
-    } catch (error: any) {
-      if (error?.response?.data) {
-        const portalError = this.decodePortalError(
-          JSON.stringify(error.response.data),
-        )
-        return this.encodeErrorResult(portalError?.id, portalError?.message)
+      const parsed = JSON.parse(jsonString)
+
+      // Ensure all required fields are present
+      if (
+        parsed.id &&
+        parsed.message !== undefined &&
+        parsed.code !== undefined
+      ) {
+        return {
+          id: parsed.id,
+          message: parsed.message,
+          code: parsed.code,
+        }
       }
-      return this.encodeErrorResult(
-        'SIGNING_NETWORK_ERROR',
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
-        error.message || 'Network error occurred',
-      )
+    } catch {
+      // JSON parsing failed
     }
+
+    return null
   }
 
-  private async enclaveSign(
+  /**
+   * Make HTTP request to Enclave API
+   * Returns raw response without processing
+   */
+  private async makeEnclaveRequest(
+    endpoint: string,
     apiKey: string,
-    signingShare: string,
-    method: string,
-    params: string,
-    rpcURL: string,
-    chainId: string,
-    metadata: string,
-  ): Promise<string> {
-    if (
-      !apiKey ||
-      !signingShare ||
-      !method ||
-      !params ||
-      !chainId ||
-      !metadata
-    ) {
-      return this.encodeErrorResult(
-        'INVALID_PARAMETERS',
-        'Invalid parameters provided',
-      )
-    }
+    body: Record<string, any>,
+  ): Promise<EnclaveSignResponse> {
+    return await this.requests.post<EnclaveSignResponse>(endpoint, {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body,
+    })
+  }
 
-    const requestBody: EnclaveSignRequest = {
-      method: method,
-      params: params,
-      share: signingShare,
-      chainId: chainId,
-      rpcUrl: rpcURL,
-      metadataStr: metadata,
-      clientPlatform: 'REACT_NATIVE',
-      clientPlatformVersion: getClientPlatformVersion(),
+  /**
+   * Process Enclave API response
+   * Checks for error format and extracts data
+   */
+  private processEnclaveResponse(response: EnclaveSignResponse): string {
+    // Check for API-level errors first
+    // API returns errors at top level: {id, message, code}
+    if ('id' in response && 'message' in response && 'code' in response) {
+      const errorResponse = response as {
+        id: string
+        message: string
+        code: number
+      }
+      throw new PortalMpcError({
+        code: errorResponse.code,
+        id: errorResponse.id,
+        message: errorResponse.message,
+      })
     }
 
-    try {
-      const response = await this.requests.post<EnclaveSignResponse>(
-        '/v1/sign',
-        {
-          headers: {
-            Authorization: `Bearer ${apiKey}`,
-            'Content-Type': 'application/json',
-          },
-          body: requestBody,
-        },
-      )
-
-      return this.encodeSuccessResult(response.data)
-    } catch (error: any) {
-      if (error?.response?.data) {
-        const portalError = this.decodePortalError(
-          JSON.stringify(error.response.data),
-        )
-        return this.encodeErrorResult(portalError?.id, portalError?.message)
-      }
-      return this.encodeErrorResult(
-        'SIGNING_NETWORK_ERROR',
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
-        error.message || 'Network error occurred',
-      )
+    // API returns success as: {data: string}
+    const successResponse = response as { data: string }
+    if (!successResponse.data) {
+      throw new PortalMpcError({
+        code: PortalErrorCodes.BadRequest,
+        id: 'InvalidResponse',
+        message: 'API response missing data field',
+      })
     }
-  }
 
-  // Helper function to encode success results
-  private encodeSuccessResult(data: string): string {
-    const successResult: EnclaveSignResult = { data: data, error: undefined }
-    return this.encodeJSON(successResult)
+    return successResponse.data
   }
 
-  // Helper function to decode Portal errors
-  private decodePortalError(
-    errorStr?: string,
-  ): { id?: string; message?: string } | null {
-    if (!errorStr) return null
-    try {
-      return JSON.parse(errorStr)
-    } catch {
-      return null
+  /**
+   * Handle errors from Enclave API calls
+   * Parses and transforms to PortalMpcError
+   */
+  private handleEnclaveError(error: any): never {
+    // If it's already a PortalMpcError, re-throw it
+    if (error instanceof PortalMpcError) {
+      throw error
     }
-  }
 
-  // Helper function to encode error results
-  private encodeErrorResult(id?: string, message?: string): string {
-    const errorResult: EnclaveSignResult = {
-      data: undefined,
-      error: { id, message },
+    // Handle HTTP error responses
+    // HttpError format: "{status} - {statusText}: {responseBody}"
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
+    const errorMessage: string =
+      typeof error.message === 'string' ? error.message : ''
+
+    // Try to parse API error from HttpError message
+    const apiError = this.parseApiError(errorMessage)
+    if (apiError) {
+      throw new PortalMpcError({
+        code: apiError.code,
+        id: apiError.id,
+        message: apiError.message,
+      })
     }
-    return this.encodeJSON(errorResult)
-  }
 
-  // Helper function to encode any object to JSON string
-  private encodeJSON<T>(value: T): string {
-    try {
-      const jsonString = JSON.stringify(value)
-      return jsonString
-    } catch (error: any) {
-      return JSON.stringify({
-        error: {
-          id: 'ENCODING_ERROR',
-          message: `Failed to encode JSON: ${error.message}`,
-        },
+    // Check for 401 Unauthorized
+    if (errorMessage.startsWith('401 -')) {
+      throw new PortalMpcError({
+        code: PortalErrorCodes.InvalidApiKey,
+        id: 'Unauthorized',
+        message: 'Unauthorized request',
       })
     }
+
+    // Handle network errors
+    throw new PortalMpcError({
+      code: PortalErrorCodes.SigningNetworkError,
+      id: 'SIGNING_NETWORK_ERROR',
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-argument
+      message: errorMessage || 'Network error occurred',
+    })
   }
 
   private async sendMetrics(

package/types.d.ts

@@ -179,10 +179,12 @@ export interface EnclaveSignRequest {
   clientPlatformVersion: string
 }
 
-export interface EnclaveSignResponse {
-  data: string
-  error?: {
-    id: string
-    message: string
-  }
-}
+export type EnclaveSignResponse =
+  | {
+      data: string
+    }
+  | {
+      id: string
+      message: string
+      code: number
+    }