@sidhujag/sysweb3-keyring 2.1.7 → 2.1.9

package/cjs/host-keyring.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKeyringHost = exports.HostKeyring = void 0;
+const keyring_core_1 = require("./keyring-core");
+const keyring_host_1 = require("./keyring-host");
+/** Shared wallet engine with explicit host authority and hardware capabilities. */
+class HostKeyring extends keyring_core_1.KeyringCore {
+    constructor(host, options, createHardware) {
+        if (typeof createHardware !== 'function')
+            throw new TypeError('Keyring requires explicit hardware capabilities');
+        const { binding, publishControls } = (0, keyring_host_1.prepareKeyringHost)(host, options);
+        const hardware = createHardware();
+        if (!hardware ||
+            !('ledgerSigner' in hardware) ||
+            !('trezorSigner' in hardware))
+            throw new TypeError('Keyring requires explicit hardware capabilities');
+        super(binding, hardware);
+        publishControls?.();
+    }
+    /** Derive runtime state using the shared software account implementation. */
+    deriveEvmHdRuntimeAccount(request, options) {
+        return this.deriveSoftwareEvmHdRuntimeAccount(request, options);
+    }
+    /** Sign the prepared software envelope; the host retains it before broadcast. */
+    signPreparedEvmTransaction(request, options) {
+        return this.signPreparedSoftwareEvmTransaction(request, options);
+    }
+}
+exports.HostKeyring = HostKeyring;
+var keyring_host_2 = require("./keyring-host");
+Object.defineProperty(exports, "createKeyringHost", { enumerable: true, get: function () { return keyring_host_2.createKeyringHost; } });
+//# sourceMappingURL=host-keyring.js.map

package/cjs/host-keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-keyring.js","sourceRoot":"","sources":["../../src/host-keyring.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAC7C,iDAAoD;AAmBpD,mFAAmF;AACnF,MAAa,WAGX,SAAQ,0BAA6B;IACrC,YACE,IAAiB,EACjB,OAAuB,EACvB,cAAuD;QAEvD,IAAI,OAAO,cAAc,KAAK,UAAU;YACtC,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAA,iCAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,cAAc,IAAI,QAAQ,CAAC;YAC7B,CAAC,CAAC,cAAc,IAAI,QAAQ,CAAC;YAE7B,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzB,eAAe,EAAE,EAAE,CAAC;IACtB,CAAC;IAED,6EAA6E;IACtE,yBAAyB,CAC9B,OAAmC,EACnC,OAAmC;QAEnC,OAAO,IAAI,CAAC,iCAAiC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,iFAAiF;IAC1E,0BAA0B,CAC/B,OAA0C,EAC1C,OAAkC;QAElC,OAAO,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;CACF;AAtCD,kCAsCC;AAED,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA"}

package/cjs/index.js

@@ -31,6 +31,7 @@ __exportStar(require("./providers"), exports);
 __exportStar(require("./utils/derivation-paths"), exports);
 __exportStar(require("./network-utils"), exports);
 __exportStar(require("./hardware-wallet-manager"), exports);
+__exportStar(require("./hardware-wallet-types"), exports);
 var psbt_1 = require("./utils/psbt");
 Object.defineProperty(exports, "PsbtUtils", { enumerable: true, get: function () { return psbt_1.PsbtUtils; } });
 var watch_descriptor_1 = require("./utils/watch-descriptor");

package/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,0CAAwB;AACxB,+CAA0D;AAAjD,wHAAA,wBAAwB,OAAA;AACjC,4CAA0B;AAC1B,kDAAgC;AAChC,oDAAkC;AAClC,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAE1B,qDAG2B;AAFzB,2HAAA,wBAAwB,OAAA;AACxB,iIAAA,8BAA8B,OAAA;AAOhC,8CAA4B;AAC5B,2DAAyC;AACzC,kDAAgC;AAChC,4DAA0C;AAC1C,qCAAyC;AAAhC,iGAAA,SAAS,OAAA;AAClB,6DAGkC;AAFhC,2HAAA,uBAAuB,OAAA;AACvB,sHAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,0CAAwB;AACxB,+CAA0D;AAAjD,wHAAA,wBAAwB,OAAA;AACjC,4CAA0B;AAC1B,kDAAgC;AAChC,oDAAkC;AAClC,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAE1B,qDAG2B;AAFzB,2HAAA,wBAAwB,OAAA;AACxB,iIAAA,8BAA8B,OAAA;AAOhC,8CAA4B;AAC5B,2DAAyC;AACzC,kDAAgC;AAChC,4DAA0C;AAC1C,0DAAwC;AACxC,qCAAyC;AAAhC,iGAAA,SAAS,OAAA;AAClB,6DAGkC;AAFhC,2HAAA,uBAAuB,OAAA;AACvB,sHAAA,kBAAkB,OAAA"}

package/cjs/keyring-core.js

@@ -70,6 +70,7 @@ const SLH_DSA_SETUP_SECRET_HEX_LENGTH = 64;
 const SLH_DSA_PARAMETER_SET = 'SLH-DSA-SHA2-128-24';
 const current_vault_refusal_1 = require("./current-vault-refusal");
 const ethers_v6_1 = require("./ethers-v6");
+const hardware_transaction_authority_1 = require("./hardware-transaction-authority");
 const initial_state_1 = require("./initial-state");
 const keyring_host_1 = require("./keyring-host");
 const private_records_1 = require("./private-records");
@@ -153,6 +154,10 @@ class KeyringCore {
         this.getVaultState = null;
         // Method to inject store getter from Pali side
         this.setVaultStateGetter = (getter) => {
+            if (typeof getter !== 'function')
+                throw new TypeError('Vault state getter must be a function');
+            if (this.getVaultState)
+                throw new Error('Vault state getter is already bound');
             this.getVaultState = getter;
         };
         // Helper method to get current vault state
@@ -193,6 +198,7 @@ class KeyringCore {
         this.sessionPassword = null;
         this.sessionMnemonic = null; // can be a mnemonic or a zprv, can be changed to a zprv when using an imported wallet
         this.privateRecordSessionRevision = 0;
+        this.sessionLifetime = new AbortController();
         _KeyringCore_deviceUnlockRetired.set(this, false);
         _KeyringCore_sessionOwnership.set(this, void 0);
         this.createSyscoinTransactions = () => new syscoin_core_1.SyscoinTransactionsCore(this.getSigner, this.getReadOnlySigner, this.getAccountsState, this.syscoinHardwareSigners, this.capturePsbtSigningContext);
@@ -214,7 +220,7 @@ class KeyringCore {
         };
         this.isUnlocked = () => !!this.sessionPassword && !this.sessionPassword.isCleared();
         this.lockWallet = async () => {
-            this.privateRecordSessionRevision++;
+            this.retireSessionLifetime();
             // Clear secure session data
             if (this.sessionPassword) {
                 this.sessionPassword.clear();
@@ -254,8 +260,8 @@ class KeyringCore {
                 }
             }
         };
-        // Direct secure transfer of session data to another keyring
-        this.transferSessionTo = (targetKeyring) => {
+        /** Retire hardware before preparing a synchronous, one-use session move. */
+        this.prepareSessionTransfer = async (targetKeyring, assertCurrent) => {
             if (!this.isUnlocked()) {
                 throw new Error('Source keyring must be unlocked to transfer session');
             }
@@ -263,21 +269,78 @@ class KeyringCore {
             if (!(targetKeyring instanceof KeyringCore) ||
                 targetKeyring.authority !== this.authority ||
                 targetKeyring.storage !== this.storage ||
-                targetKeyring.vaultPersistence !== this.vaultPersistence) {
+                targetKeyring.vaultPersistence !== this.vaultPersistence ||
+                __classPrivateFieldGet(targetKeyring, _KeyringCore_sessionOwnership, "f").tracker !== __classPrivateFieldGet(this, _KeyringCore_sessionOwnership, "f").tracker) {
                 throw new Error('Cannot transfer session between different wallet authorities');
             }
-            if (targetKeyring === this)
-                return;
-            // Transfer ownership of our buffers to the target
-            if (!this.sessionPassword || !this.sessionMnemonic) {
-                throw new Error('Session data is missing during transfer');
+            const sourceGuard = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
+            const targetRevision = targetKeyring.privateRecordSessionRevision;
+            const ledger = this.ledgerSigner;
+            const trezor = this.trezorSigner;
+            const retirementChecks = [];
+            const checkOwnership = () => {
+                sourceGuard();
+                if (!this.isUnlocked() ||
+                    !this.sessionMnemonic ||
+                    this.ledgerSigner !== ledger ||
+                    this.trezorSigner !== trezor ||
+                    __classPrivateFieldGet(targetKeyring, _KeyringCore_sessionOwnership, "f").destroyed ||
+                    targetKeyring.privateRecordSessionRevision !== targetRevision)
+                    throw new Error('Wallet session changed during transfer preparation');
+            };
+            const check = () => {
+                checkOwnership();
+                (0, hardware_transaction_authority_1.assertHardwareOperationCurrent)(assertCurrent);
+                for (const assertRetired of retirementChecks)
+                    (0, hardware_transaction_authority_1.assertHardwareOperationCurrent)(assertRetired);
+                checkOwnership();
+            };
+            check();
+            if (targetKeyring !== this) {
+                const signals = [
+                    this.sessionLifetime.signal,
+                    targetKeyring.sessionLifetime.signal,
+                ];
+                let cancel;
+                const cancelled = new Promise((_resolve, reject) => {
+                    cancel = () => reject(new Error('Wallet session changed during transfer preparation'));
+                    for (const signal of signals)
+                        signal.addEventListener('abort', cancel, { once: true });
+                });
+                const signers = [ledger, trezor].filter((signer) => signer !== undefined);
+                const retirement = Promise.allSettled(signers.map((signer) => Promise.resolve().then(() => signer.retire()))).then((results) => {
+                    for (const result of results) {
+                        if (result.status === 'rejected')
+                            throw result.reason;
+                        retirementChecks.push(result.value);
+                    }
+                });
+                try {
+                    await Promise.race([retirement, cancelled]);
+                }
+                finally {
+                    for (const signal of signals)
+                        signal.removeEventListener('abort', cancel);
+                }
+                check();
             }
-            __classPrivateFieldGet(targetKeyring, _KeyringCore_instances, "m", _KeyringCore_acceptSessionFrom).call(targetKeyring, this);
-            this.privateRecordSessionRevision++;
-            __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
-            // Null out our references (do NOT clear buffers - target owns them now)
-            this.sessionPassword = null;
-            this.sessionMnemonic = null;
+            let consumed = false;
+            return Object.freeze({
+                transfer: () => {
+                    if (consumed)
+                        throw new Error('Session transfer has already been used');
+                    consumed = true;
+                    check();
+                    if (targetKeyring === this)
+                        return;
+                    __classPrivateFieldGet(targetKeyring, _KeyringCore_instances, "m", _KeyringCore_acceptSessionFrom).call(targetKeyring, this);
+                    this.retireSessionLifetime();
+                    __classPrivateFieldSet(this, _KeyringCore_deviceUnlockRetired, true, "f");
+                    // Move the original SecureBuffers without copying their contents.
+                    this.sessionPassword = null;
+                    this.sessionMnemonic = null;
+                },
+            });
         };
         this.addNewAccount = async (label) => {
             // Check if wallet is unlocked
@@ -1249,6 +1312,22 @@ class KeyringCore {
         // No need to explicitly set active account - it's managed externally
         return account;
     }
+    /** Capture wallet-session authority without binding an account or network. */
+    captureUnlockedSessionGuard() {
+        const assertOwner = __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_captureSessionGuard).call(this);
+        const assertCurrent = () => {
+            assertOwner();
+            if (!this.isUnlocked())
+                throw new Error('Wallet unlock session changed');
+        };
+        assertCurrent();
+        return assertCurrent;
+    }
+    retireSessionLifetime() {
+        this.privateRecordSessionRevision++;
+        this.sessionLifetime.abort();
+        this.sessionLifetime = new AbortController();
+    }
     /**
      * Returns canLogin:false only when the first vault authentication fails.
      * Storage, platform and session restoration failures reject so callers do
@@ -1859,51 +1938,7 @@ class KeyringCore {
     }
     /** The software facade owns this public capability; no device fallback. */
     signPreparedSoftwareEvmTransaction(input, options) {
-        // Capture authority before parsing caller data or invoking host callbacks.
-        const assertSession = this.capturePsbtSigningContext();
-        const vault = this.getVault();
-        const selected = { ...vault.activeAccount };
-        const selectedAccount = vault.accounts[selected.type]?.[selected.id];
-        const encryptedKey = selectedAccount?.xprv;
-        const request = (0, prepared_evm_1.snapshotPreparedEvmRequest)(input);
-        const hostGuard = (0, prepared_evm_1.preparedEvmGuard)(options);
-        const assertCurrent = () => {
-            assertSession();
-            const current = this.getVault();
-            const account = current.accounts[selected.type]?.[selected.id];
-            if ((selected.type !== types_1.KeyringAccountType.HDAccount &&
-                selected.type !== types_1.KeyringAccountType.Imported) ||
-                !account ||
-                account.id !== selected.id ||
-                account.isLedgerWallet ||
-                account.isTrezorWallet ||
-                account.isSmartAccount ||
-                typeof encryptedKey !== 'string' ||
-                encryptedKey.length === 0 ||
-                account.xprv !== encryptedKey ||
-                request.account.type !== selected.type ||
-                request.account.id !== selected.id ||
-                request.account.expectedAddress !== (0, ethers_v6_1.getAddress)(account.address) ||
-                current.activeNetwork.kind !== sysweb3_network_1.INetworkType.Ethereum ||
-                current.activeNetwork.slip44 !== 60 ||
-                !Number.isSafeInteger(current.activeNetwork.chainId) ||
-                current.activeNetwork.chainId <= 0 ||
-                BigInt(current.activeNetwork.chainId).toString() !==
-                    request.network.chainId ||
-                current.activeNetwork.url !== request.network.url)
-                throw new Error('Prepared EVM signing context changed or is unsupported');
-        };
-        assertCurrent();
-        hostGuard();
-        assertCurrent();
-        const key = this.getDecryptedPrivateKey();
-        if ((0, ethers_v6_1.getAddress)(key.address) !== request.account.expectedAddress)
-            throw new Error('Prepared EVM signer address mismatch');
-        assertCurrent();
-        const { signed } = (0, prepared_evm_1.signPreparedEvmEnvelope)(request.transaction, key.decryptedPrivateKey);
-        hostGuard();
-        assertCurrent();
-        return signed;
+        return this.ethereumTransaction.signPreparedEvmTransaction(input, options);
     }
     writeUtf8Diagnostic(hasUtf8Error) {
         try {
@@ -2743,7 +2778,7 @@ _KeyringCore_deviceUnlockRetired = new WeakMap(), _KeyringCore_sessionOwnership
     };
 }, _KeyringCore_replaceSessionBuffers = function _KeyringCore_replaceSessionBuffers(sessionPassword, sessionMnemonic, sourceToken) {
     __classPrivateFieldGet(this, _KeyringCore_instances, "m", _KeyringCore_assertSessionOwner).call(this, sourceToken);
-    this.privateRecordSessionRevision++;
+    this.retireSessionLifetime();
     // Clear any existing data first
     if (this.sessionPassword) {
         this.sessionPassword.clear();