@shadow-corp/nearconnect 1.0.0

package/build/security/rate-limiter.js

@@ -0,0 +1,212 @@
+"use strict";
+/**
+ * Rate Limiting & Anti-Abuse Layer
+ * Prevents brute force attacks and rapid-fire abuse
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rpcLimiter = exports.signLimiter = exports.connectLimiter = exports.RateLimiter = void 0;
+exports.rateLimit = rateLimit;
+exports.withRateLimit = withRateLimit;
+class RateLimiter {
+    entries = new Map();
+    config;
+    constructor(config) {
+        this.config = {
+            maxRequests: 10,
+            windowMs: 60000, // 1 minute
+            blockDurationMs: 300000, // 5 minutes
+            slidingWindow: true,
+            ...config,
+        };
+    }
+    /**
+     * Check if an action is allowed and record the request
+     */
+    check(action) {
+        const now = Date.now();
+        const entry = this.entries.get(action) || { requests: [] };
+        // Check if currently blocked
+        if (entry.blockedUntil && entry.blockedUntil > now) {
+            const retryAfter = Math.ceil((entry.blockedUntil - now) / 1000);
+            return {
+                allowed: false,
+                retryAfter,
+                remaining: 0,
+                resetIn: entry.blockedUntil - now,
+            };
+        }
+        // Clean old requests outside the window
+        const windowStart = now - this.config.windowMs;
+        entry.requests = entry.requests.filter(t => t > windowStart);
+        // Check if limit exceeded
+        if (entry.requests.length >= this.config.maxRequests) {
+            // Block the action
+            entry.blockedUntil = now + this.config.blockDurationMs;
+            this.entries.set(action, entry);
+            return {
+                allowed: false,
+                retryAfter: Math.ceil(this.config.blockDurationMs / 1000),
+                remaining: 0,
+                resetIn: this.config.blockDurationMs,
+            };
+        }
+        // Record this request
+        entry.requests.push(now);
+        this.entries.set(action, entry);
+        // Calculate reset time
+        const oldestRequest = entry.requests[0] || now;
+        const resetIn = this.config.slidingWindow
+            ? oldestRequest + this.config.windowMs - now
+            : this.config.windowMs - (now - oldestRequest);
+        return {
+            allowed: true,
+            remaining: this.config.maxRequests - entry.requests.length,
+            resetIn: Math.max(0, resetIn),
+        };
+    }
+    /**
+     * Check without recording (peek)
+     */
+    peek(action) {
+        const now = Date.now();
+        const entry = this.entries.get(action) || { requests: [] };
+        // Check if currently blocked
+        if (entry.blockedUntil && entry.blockedUntil > now) {
+            return {
+                allowed: false,
+                retryAfter: Math.ceil((entry.blockedUntil - now) / 1000),
+                remaining: 0,
+                resetIn: entry.blockedUntil - now,
+            };
+        }
+        // Count recent requests
+        const windowStart = now - this.config.windowMs;
+        const recentRequests = entry.requests.filter(t => t > windowStart);
+        return {
+            allowed: recentRequests.length < this.config.maxRequests,
+            remaining: Math.max(0, this.config.maxRequests - recentRequests.length),
+            resetIn: recentRequests.length > 0
+                ? (recentRequests[0] || now) + this.config.windowMs - now
+                : 0,
+        };
+    }
+    /**
+     * Reset limits for an action
+     */
+    reset(action) {
+        this.entries.delete(action);
+    }
+    /**
+     * Reset all limits
+     */
+    resetAll() {
+        this.entries.clear();
+    }
+    /**
+     * Manually block an action
+     */
+    block(action, durationMs) {
+        const entry = this.entries.get(action) || { requests: [] };
+        entry.blockedUntil = Date.now() + (durationMs || this.config.blockDurationMs);
+        this.entries.set(action, entry);
+    }
+    /**
+     * Unblock an action
+     */
+    unblock(action) {
+        const entry = this.entries.get(action);
+        if (entry) {
+            delete entry.blockedUntil;
+            this.entries.set(action, entry);
+        }
+    }
+    /**
+     * Get current status for all tracked actions
+     */
+    getStatus() {
+        const status = new Map();
+        for (const action of this.entries.keys()) {
+            status.set(action, this.peek(action));
+        }
+        return status;
+    }
+    /**
+     * Cleanup expired entries
+     */
+    cleanup() {
+        const now = Date.now();
+        const windowStart = now - this.config.windowMs;
+        for (const [action, entry] of this.entries.entries()) {
+            // Remove expired blocks
+            if (entry.blockedUntil && entry.blockedUntil <= now) {
+                delete entry.blockedUntil;
+            }
+            // Remove old requests
+            entry.requests = entry.requests.filter(t => t > windowStart);
+            // Remove empty entries
+            if (entry.requests.length === 0 && !entry.blockedUntil) {
+                this.entries.delete(action);
+            }
+            else {
+                this.entries.set(action, entry);
+            }
+        }
+    }
+}
+exports.RateLimiter = RateLimiter;
+/**
+ * Pre-configured rate limiter for wallet connections
+ * Allows 5 connection attempts per minute, blocks for 2 minutes after
+ */
+exports.connectLimiter = new RateLimiter({
+    maxRequests: 5,
+    windowMs: 60000, // 1 minute
+    blockDurationMs: 120000, // 2 minutes
+});
+/**
+ * Pre-configured rate limiter for transaction signing
+ * Allows 20 signs per minute, blocks for 1 minute after
+ */
+exports.signLimiter = new RateLimiter({
+    maxRequests: 20,
+    windowMs: 60000, // 1 minute
+    blockDurationMs: 60000, // 1 minute
+});
+/**
+ * Pre-configured rate limiter for RPC calls
+ * Allows 100 calls per minute
+ */
+exports.rpcLimiter = new RateLimiter({
+    maxRequests: 100,
+    windowMs: 60000,
+    blockDurationMs: 30000,
+});
+/**
+ * Decorator to rate limit a function
+ */
+function rateLimit(limiter, action) {
+    return function (_target, _propertyKey, descriptor) {
+        const original = descriptor.value;
+        descriptor.value = async function (...args) {
+            const result = limiter.check(action);
+            if (!result.allowed) {
+                throw new Error(`Rate limited. Retry in ${result.retryAfter} seconds.`);
+            }
+            return original.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+/**
+ * Higher-order function to wrap an async function with rate limiting
+ */
+function withRateLimit(fn, limiter, action) {
+    return (async (...args) => {
+        const result = limiter.check(action);
+        if (!result.allowed) {
+            throw new Error(`Rate limited. Retry in ${result.retryAfter} seconds.`);
+        }
+        return fn(...args);
+    });
+}
+//# sourceMappingURL=rate-limiter.js.map

package/build/security/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/security/rate-limiter.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAsOH,8BAkBC;AAKD,sCAYC;AA5OD,MAAa,WAAW;IACd,OAAO,GAAgC,IAAI,GAAG,EAAE,CAAC;IACjD,MAAM,CAA4B;IAE1C,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,KAAK,EAAU,WAAW;YACpC,eAAe,EAAE,MAAM,EAAE,YAAY;YACrC,aAAa,EAAE,IAAI;YACnB,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAc;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAE3D,6BAA6B;QAC7B,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,KAAK,CAAC,YAAY,GAAG,GAAG;aAClC,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/C,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAE7D,0BAA0B;QAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACrD,mBAAmB;YACnB,KAAK,CAAC,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEhC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;gBACzD,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;aACrC,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEhC,uBAAuB;QACvB,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;YACvC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,GAAG;YAC5C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,GAAG,GAAG,aAAa,CAAC,CAAC;QAEjD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC1D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,MAAc;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAE3D,6BAA6B;QAC7B,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;gBACxD,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,KAAK,CAAC,YAAY,GAAG,GAAG;aAClC,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAEnE,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW;YACxD,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC;YACvE,OAAO,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,GAAG;gBACzD,CAAC,CAAC,CAAC;SACN,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAc,EAAE,UAAmB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC3D,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,YAAY,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAE/C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,wBAAwB;YACxB,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC,YAAY,CAAC;YAC5B,CAAC;YAED,sBAAsB;YACtB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;YAE7D,uBAAuB;YACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACvD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAtKD,kCAsKC;AAED;;;GAGG;AACU,QAAA,cAAc,GAAG,IAAI,WAAW,CAAC;IAC5C,WAAW,EAAE,CAAC;IACd,QAAQ,EAAE,KAAK,EAAS,WAAW;IACnC,eAAe,EAAE,MAAM,EAAE,YAAY;CACtC,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,WAAW,GAAG,IAAI,WAAW,CAAC;IACzC,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,KAAK,EAAQ,WAAW;IAClC,eAAe,EAAE,KAAK,EAAE,WAAW;CACpC,CAAC,CAAC;AAEH;;;GAGG;AACU,QAAA,UAAU,GAAG,IAAI,WAAW,CAAC;IACxC,WAAW,EAAE,GAAG;IAChB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,KAAK;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAoB,EAAE,MAAc;IAC5D,OAAO,UACL,OAAgB,EAChB,YAAoB,EACpB,UAAsC;QAEtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAM,CAAC;QAEnC,UAAU,CAAC,KAAK,GAAG,KAAK,WAA0B,GAAG,IAAe;YAClE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,WAAW,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,CAAM,CAAC;QAEP,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAC3B,EAAK,EACL,OAAoB,EACpB,MAAc;IAEd,OAAO,CAAC,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,WAAW,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,CAAC,CAAM,CAAC;AACV,CAAC"}

package/build/security/secure-storage.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Secure Storage Layer
+ * Encrypts sensitive session data to protect against localStorage theft
+ */
+export interface SecureStorageOptions {
+    /** Whether to encrypt the data */
+    encrypt?: boolean;
+    /** Time to live in milliseconds */
+    ttl?: number;
+}
+export declare class SecureStorage {
+    private namespace;
+    private encryptionKey;
+    private initialized;
+    constructor(namespace?: string);
+    /**
+     * Initialize encryption (call once on app start)
+     * Must be called before using encrypted storage
+     */
+    init(): Promise<void>;
+    /**
+     * Get key material from session-specific entropy
+     */
+    private getKeyMaterial;
+    /**
+     * Get or create session-specific entropy
+     */
+    private getOrCreateSessionEntropy;
+    /**
+     * Store data securely
+     */
+    set<T>(key: string, value: T, options?: SecureStorageOptions): Promise<void>;
+    /**
+     * Retrieve data
+     */
+    get<T>(key: string, options?: SecureStorageOptions): Promise<T | null>;
+    /**
+     * Check if a key exists
+     */
+    has(key: string): boolean;
+    /**
+     * Remove data
+     */
+    remove(key: string): void;
+    /**
+     * Clear all data for this namespace
+     */
+    clear(): void;
+    /**
+     * Cleanup expired entries
+     */
+    cleanup(): void;
+    /**
+     * Get all keys in this namespace
+     */
+    keys(): string[];
+    /**
+     * Encrypt plaintext using AES-GCM
+     */
+    private encrypt;
+    /**
+     * Decrypt ciphertext
+     */
+    private decrypt;
+    /**
+     * Check if data looks encrypted
+     */
+    private looksEncrypted;
+    /**
+     * Check if encryption is available
+     */
+    isEncryptionAvailable(): boolean;
+}
+/**
+ * Create and initialize a secure storage instance
+ */
+export declare function createSecureStorage(namespace?: string): Promise<SecureStorage>;

package/build/security/secure-storage.js

@@ -0,0 +1,242 @@
+"use strict";
+/**
+ * Secure Storage Layer
+ * Encrypts sensitive session data to protect against localStorage theft
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureStorage = void 0;
+exports.createSecureStorage = createSecureStorage;
+class SecureStorage {
+    namespace;
+    encryptionKey = null;
+    initialized = false;
+    constructor(namespace = 'near-connect') {
+        this.namespace = namespace;
+    }
+    /**
+     * Initialize encryption (call once on app start)
+     * Must be called before using encrypted storage
+     */
+    async init() {
+        if (this.initialized)
+            return;
+        try {
+            const keyMaterial = await this.getKeyMaterial();
+            this.encryptionKey = await crypto.subtle.deriveKey({
+                name: 'PBKDF2',
+                salt: new TextEncoder().encode(this.namespace + ':salt'),
+                iterations: 100000,
+                hash: 'SHA-256',
+            }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+            this.initialized = true;
+        }
+        catch (error) {
+            console.warn('[SecureStorage] Encryption initialization failed, falling back to unencrypted storage', error);
+            this.initialized = true;
+        }
+    }
+    /**
+     * Get key material from session-specific entropy
+     */
+    async getKeyMaterial() {
+        // Combine multiple entropy sources for key derivation
+        const entropy = [
+            navigator.userAgent,
+            window.screen.width.toString(),
+            window.screen.height.toString(),
+            new Date().getTimezoneOffset().toString(),
+            this.getOrCreateSessionEntropy(),
+        ].join('|');
+        return crypto.subtle.importKey('raw', new TextEncoder().encode(entropy), 'PBKDF2', false, ['deriveKey']);
+    }
+    /**
+     * Get or create session-specific entropy
+     */
+    getOrCreateSessionEntropy() {
+        const key = `${this.namespace}:entropy`;
+        let entropy = sessionStorage.getItem(key);
+        if (!entropy) {
+            entropy = crypto.randomUUID() + crypto.randomUUID();
+            sessionStorage.setItem(key, entropy);
+        }
+        return entropy;
+    }
+    /**
+     * Store data securely
+     */
+    async set(key, value, options = {}) {
+        if (!this.initialized) {
+            await this.init();
+        }
+        const fullKey = `${this.namespace}:${key}`;
+        const wrapper = {
+            data: value,
+            timestamp: Date.now(),
+            ttl: options.ttl,
+            encrypted: options.encrypt && this.encryptionKey !== null,
+        };
+        let stored;
+        if (options.encrypt && this.encryptionKey) {
+            stored = await this.encrypt(JSON.stringify(wrapper));
+        }
+        else {
+            stored = JSON.stringify(wrapper);
+        }
+        try {
+            localStorage.setItem(fullKey, stored);
+        }
+        catch (error) {
+            // Handle quota exceeded
+            if (error instanceof DOMException && error.name === 'QuotaExceededError') {
+                this.cleanup();
+                localStorage.setItem(fullKey, stored);
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+    /**
+     * Retrieve data
+     */
+    async get(key, options = {}) {
+        if (!this.initialized) {
+            await this.init();
+        }
+        const fullKey = `${this.namespace}:${key}`;
+        const stored = localStorage.getItem(fullKey);
+        if (!stored)
+            return null;
+        try {
+            let parsed;
+            // Try to decrypt if it looks encrypted (base64)
+            if (options.encrypt && this.encryptionKey && this.looksEncrypted(stored)) {
+                parsed = await this.decrypt(stored);
+            }
+            else {
+                parsed = stored;
+            }
+            const wrapper = JSON.parse(parsed);
+            // Check TTL
+            if (wrapper.ttl && Date.now() - wrapper.timestamp > wrapper.ttl) {
+                this.remove(key);
+                return null;
+            }
+            return wrapper.data;
+        }
+        catch (error) {
+            // Corrupted or tampered data, remove it
+            console.warn(`[SecureStorage] Failed to retrieve ${key}, removing corrupted data`);
+            this.remove(key);
+            return null;
+        }
+    }
+    /**
+     * Check if a key exists
+     */
+    has(key) {
+        return localStorage.getItem(`${this.namespace}:${key}`) !== null;
+    }
+    /**
+     * Remove data
+     */
+    remove(key) {
+        localStorage.removeItem(`${this.namespace}:${key}`);
+    }
+    /**
+     * Clear all data for this namespace
+     */
+    clear() {
+        const keys = Object.keys(localStorage).filter(k => k.startsWith(`${this.namespace}:`));
+        keys.forEach(k => localStorage.removeItem(k));
+    }
+    /**
+     * Cleanup expired entries
+     */
+    cleanup() {
+        const prefix = `${this.namespace}:`;
+        const now = Date.now();
+        for (let i = 0; i < localStorage.length; i++) {
+            const key = localStorage.key(i);
+            if (!key || !key.startsWith(prefix))
+                continue;
+            try {
+                const stored = localStorage.getItem(key);
+                if (!stored)
+                    continue;
+                // Only cleanup non-encrypted entries (we can't easily check encrypted ones)
+                if (!this.looksEncrypted(stored)) {
+                    const wrapper = JSON.parse(stored);
+                    if (wrapper.ttl && now - wrapper.timestamp > wrapper.ttl) {
+                        localStorage.removeItem(key);
+                    }
+                }
+            }
+            catch {
+                // Skip malformed entries
+            }
+        }
+    }
+    /**
+     * Get all keys in this namespace
+     */
+    keys() {
+        const prefix = `${this.namespace}:`;
+        return Object.keys(localStorage)
+            .filter(k => k.startsWith(prefix))
+            .map(k => k.slice(prefix.length));
+    }
+    /**
+     * Encrypt plaintext using AES-GCM
+     */
+    async encrypt(plaintext) {
+        if (!this.encryptionKey) {
+            throw new Error('Encryption not initialized');
+        }
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const encoded = new TextEncoder().encode(plaintext);
+        const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, this.encryptionKey, encoded);
+        // Combine IV + ciphertext
+        const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+        combined.set(iv, 0);
+        combined.set(new Uint8Array(ciphertext), iv.length);
+        return 'enc:' + btoa(String.fromCharCode(...combined));
+    }
+    /**
+     * Decrypt ciphertext
+     */
+    async decrypt(ciphertext) {
+        if (!this.encryptionKey) {
+            throw new Error('Encryption not initialized');
+        }
+        // Remove prefix
+        const data = ciphertext.startsWith('enc:') ? ciphertext.slice(4) : ciphertext;
+        const combined = Uint8Array.from(atob(data), c => c.charCodeAt(0));
+        const iv = combined.slice(0, 12);
+        const encryptedData = combined.slice(12);
+        const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, this.encryptionKey, encryptedData);
+        return new TextDecoder().decode(decrypted);
+    }
+    /**
+     * Check if data looks encrypted
+     */
+    looksEncrypted(data) {
+        return data.startsWith('enc:');
+    }
+    /**
+     * Check if encryption is available
+     */
+    isEncryptionAvailable() {
+        return this.encryptionKey !== null;
+    }
+}
+exports.SecureStorage = SecureStorage;
+/**
+ * Create and initialize a secure storage instance
+ */
+async function createSecureStorage(namespace) {
+    const storage = new SecureStorage(namespace);
+    await storage.init();
+    return storage;
+}
+//# sourceMappingURL=secure-storage.js.map

package/build/security/secure-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-storage.js","sourceRoot":"","sources":["../../src/security/secure-storage.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAqSH,kDAIC;AAzRD,MAAa,aAAa;IAChB,SAAS,CAAS;IAClB,aAAa,GAAqB,IAAI,CAAC;IACvC,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,YAAoB,cAAc;QAC5C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAChD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;gBACxD,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,SAAS;aAChB,EACD,WAAW,EACX,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;YACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,uFAAuF,EAAE,KAAK,CAAC,CAAC;YAC7G,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,sDAAsD;QACtD,MAAM,OAAO,GAAG;YACd,SAAS,CAAC,SAAS;YACnB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC/B,IAAI,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;YACzC,IAAI,CAAC,yBAAyB,EAAE;SACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEZ,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EACjC,QAAQ,EACR,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,yBAAyB;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,UAAU,CAAC;QACxC,IAAI,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACpD,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,UAAgC,EAAE;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAE3C,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;SAC1D,CAAC;QAEF,IAAI,MAAc,CAAC;QAEnB,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wBAAwB;YACxB,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACzE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,UAAgC,EAAE;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,IAAI,MAAc,CAAC;YAEnB,gDAAgD;YAChD,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzE,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAC;YAClB,CAAC;YAED,MAAM,OAAO,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEtD,YAAY;YACZ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wCAAwC;YACxC,OAAO,CAAC,IAAI,CAAC,sCAAsC,GAAG,2BAA2B,CAAC,CAAC;YACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,GAAW;QACb,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YAE9C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM;oBAAE,SAAS;gBAEtB,4EAA4E;gBAC5E,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACnC,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;wBACzD,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI;QACF,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;QACpC,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,OAAO,CAAC,SAAiB;QACrC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,IAAI,CAAC,aAAa,EAClB,OAAO,CACR,CAAC;QAEF,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAEpD,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,OAAO,CAAC,UAAkB;QACtC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,gBAAgB;QAChB,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAE9E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,IAAI,CAAC,aAAa,EAClB,aAAa,CACd,CAAC;QAEF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;IACrC,CAAC;CACF;AAhRD,sCAgRC;AAED;;GAEG;AACI,KAAK,UAAU,mBAAmB,CAAC,SAAkB;IAC1D,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/build/security/transaction-guard.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Transaction Verification Layer
+ * Analyzes transactions for risks before signing
+ */
+import type { Action } from '../types';
+export interface Transaction {
+    receiverId: string;
+    actions: Action[];
+}
+export interface TransactionLimits {
+    /** Max NEAR per transaction (in yoctoNEAR) */
+    maxTransferAmount?: bigint;
+    /** Max gas per action */
+    maxGasPerAction?: bigint;
+    /** Whitelist of allowed receivers */
+    allowedReceivers?: string[];
+    /** Blacklist of blocked receivers */
+    blockedReceivers?: string[];
+    /** Whitelist of allowed contract methods */
+    allowedMethods?: string[];
+    /** Blacklist of known dangerous methods */
+    blockedMethods?: string[];
+    /** Always prompt user for confirmation */
+    requireConfirmation?: boolean;
+}
+export interface TransactionRisk {
+    level: 'low' | 'medium' | 'high' | 'critical';
+    reasons: string[];
+    requiresExplicitApproval: boolean;
+}
+export declare class TransactionGuard {
+    private limits;
+    private customScamContracts;
+    constructor(limits?: TransactionLimits);
+    /**
+     * Add custom scam contracts to the blocklist
+     */
+    addScamContract(contractId: string): void;
+    /**
+     * Remove a contract from the custom blocklist
+     */
+    removeScamContract(contractId: string): void;
+    /**
+     * Update transaction limits
+     */
+    updateLimits(limits: Partial<TransactionLimits>): void;
+    /**
+     * Analyze transaction for risks before signing
+     */
+    analyzeRisk(tx: Transaction): TransactionRisk;
+    private analyzeAction;
+    private containsSuspiciousPatterns;
+    private escalate;
+    private formatNear;
+    /**
+     * Validate transaction can proceed (returns false for critical risks)
+     */
+    validate(tx: Transaction): {
+        valid: boolean;
+        error?: string;
+        risk: TransactionRisk;
+    };
+    /**
+     * Get human-readable risk description
+     */
+    getRiskDescription(risk: TransactionRisk): string;
+}
+/**
+ * Create a TransactionGuard with default safe limits
+ */
+export declare function createDefaultTransactionGuard(): TransactionGuard;