@stelis/agent-q-core 0.0.0

package/dist/provider-protocol.js

@@ -0,0 +1,637 @@
+import { MAX_FIRMWARE_NAME_LENGTH, MAX_FIRMWARE_VERSION_LENGTH, MAX_HARDWARE_ID_LENGTH, isDeviceState, isClientName, isProvisioningState, isSafeDeviceId, isSafeRequestId, isSessionId, sanitizeDisplayText, } from "./safe-text.js";
+import { ProtocolError } from "./protocol-error.js";
+import { ED25519_PUBLIC_KEY_BASE64_PATTERN, MAX_ACCOUNTS_PER_RESPONSE, MAX_CAPABILITY_ACCOUNTS_PER_CHAIN, MAX_CAPABILITY_CHAINS, MAX_RAW_PROTOCOL_JSON_BYTES, MAX_SESSION_TTL_MS, MAX_SIGN_RESULT_PAYLOAD_BASE64_CHARS, MAX_SIGNING_CAPABILITIES, MAX_SUI_SIGN_PERSONAL_MESSAGE_BASE64_CHARS, MAX_SUI_SIGN_PERSONAL_MESSAGE_BYTES, MAX_SUI_SIGN_TRANSACTION_TX_BYTES, MAX_SUI_SIGN_TRANSACTION_TX_BYTES_BASE64_CHARS, PROTOCOL_VERSION, HASH_ID_PATTERN, RULE_REF_PATTERN, SIGN_RESULT_ERROR_MESSAGES, SUI_ADDRESS_PATTERN, SUI_CHAIN_ID, SUI_DERIVATION_PATH, SUI_ED25519_SIGNATURE_BASE64_PATTERN, SUI_SIGN_PERSONAL_MESSAGE_METHOD, SUI_SIGN_TRANSACTION_METHOD, SUI_SIGN_TRANSACTION_NETWORKS, consumeProtocolResponseChunk, createRequestId, asRecord, hasOnlyObjectKeys, hasSecretPayloadKey, isRecord, isSuiAddressForPublicKey, rejectSecretPayload, requireOnlyKeys, utf8ByteLength, validateCanonicalBase64Syntax, } from "./protocol-primitives.js";
+import { SIGN_CHAIN_PATTERN, SIGN_METHOD_PATTERN, } from "./protocol-management-primitives.js";
+export { ProtocolError };
+export { ED25519_PUBLIC_KEY_BASE64_PATTERN, MAX_ACCOUNTS_PER_RESPONSE, MAX_CAPABILITY_ACCOUNTS_PER_CHAIN, MAX_CAPABILITY_CHAINS, MAX_RAW_PROTOCOL_JSON_BYTES, MAX_SESSION_TTL_MS, MAX_SIGN_RESULT_PAYLOAD_BASE64_CHARS, MAX_SIGNING_CAPABILITIES, MAX_SUI_SIGN_PERSONAL_MESSAGE_BASE64_CHARS, MAX_SUI_SIGN_PERSONAL_MESSAGE_BYTES, MAX_SUI_SIGN_TRANSACTION_TX_BYTES, MAX_SUI_SIGN_TRANSACTION_TX_BYTES_BASE64_CHARS, PROTOCOL_VERSION, SIGN_RESULT_ERROR_MESSAGES, SUI_ADDRESS_PATTERN, SUI_CHAIN_ID, SUI_DERIVATION_PATH, SUI_ED25519_SIGNATURE_BASE64_PATTERN, SUI_SIGN_PERSONAL_MESSAGE_METHOD, SUI_SIGN_TRANSACTION_METHOD, SUI_SIGN_TRANSACTION_NETWORKS, consumeProtocolResponseChunk, createRequestId, isSuiAddressForPublicKey, };
+export { AGENT_Q_USB_PRODUCT_ID_NUMBER, AGENT_Q_USB_VENDOR_ID_NUMBER, DEFAULT_AGENT_Q_USB_BAUD_RATE, INTERNAL_CONNECT_DEADLINE_MS, INTERNAL_DISCONNECT_DEADLINE_MS, INTERNAL_SIGN_PERSONAL_MESSAGE_DEADLINE_MS, INTERNAL_SIGN_TRANSACTION_DEADLINE_MS, INTERNAL_USB_DEADLINE_MS, MAX_PROTOCOL_RESPONSE_LINE_BYTES, } from "./transport-invariants.js";
+export function makeConnectRequest(clientName, id = createRequestId()) {
+    validateRequestId(id);
+    if (!isClientName(clientName)) {
+        throw new ProtocolError("invalid_client_name", "clientName must be 1-64 printable ASCII characters.");
+    }
+    return { id, version: PROTOCOL_VERSION, type: "connect", params: { clientName } };
+}
+export function makeDisconnectRequest(sessionId, id = createRequestId()) {
+    validateRequestId(id);
+    validateSessionId(sessionId);
+    return { id, version: PROTOCOL_VERSION, type: "disconnect", sessionId };
+}
+export function makeGetCapabilitiesRequest(sessionId, id = createRequestId()) {
+    validateRequestId(id);
+    validateSessionId(sessionId);
+    return { id, version: PROTOCOL_VERSION, type: "get_capabilities", sessionId };
+}
+export function makeGetAccountsRequest(sessionId, id = createRequestId()) {
+    validateRequestId(id);
+    validateSessionId(sessionId);
+    return { id, version: PROTOCOL_VERSION, type: "get_accounts", sessionId };
+}
+// `id` is required (and not freshly generated): get_result/ack_result target a specific
+// prior request's buffered signing result, so the caller passes that request's id.
+export function makeGetResultRequest(sessionId, id) {
+    validateRequestId(id);
+    validateSessionId(sessionId);
+    return { id, version: PROTOCOL_VERSION, type: "get_result", sessionId };
+}
+export function makeAckResultRequest(sessionId, id) {
+    validateRequestId(id);
+    validateSessionId(sessionId);
+    return { id, version: PROTOCOL_VERSION, type: "ack_result", sessionId };
+}
+export function makeSignTransactionRequest(sessionId, chain, method, params, id = createRequestId()) {
+    validateRequestId(id);
+    const route = identifySignRoute(SUI_SIGN_TRANSACTION_METHOD, chain, method);
+    validateSessionId(sessionId);
+    const normalizedParams = validateSignTransactionParams(params);
+    const request = {
+        id,
+        version: PROTOCOL_VERSION,
+        type: SUI_SIGN_TRANSACTION_METHOD,
+        sessionId,
+        chain: route.chain,
+        method: route.method,
+        params: normalizedParams,
+    };
+    validateRawRequestSize(request, "sign_transaction");
+    return request;
+}
+export function makeSignPersonalMessageRequest(sessionId, chain, method, params, id = createRequestId()) {
+    validateRequestId(id);
+    const route = identifySignRoute(SUI_SIGN_PERSONAL_MESSAGE_METHOD, chain, method);
+    validateSessionId(sessionId);
+    const normalizedParams = validateSignPersonalMessageParams(params);
+    const request = {
+        id,
+        version: PROTOCOL_VERSION,
+        type: SUI_SIGN_PERSONAL_MESSAGE_METHOD,
+        sessionId,
+        chain: route.chain,
+        method: route.method,
+        params: normalizedParams,
+    };
+    validateRawRequestSize(request, "sign_personal_message");
+    return request;
+}
+export function serializeProviderProtocolRequest(request) {
+    return `${JSON.stringify(normalizeProviderProtocolRequest(request))}\n`;
+}
+export function parseJsonLine(line) {
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        throw new ProtocolError("invalid_json", "Invalid JSON response.");
+    }
+}
+export function parseProviderProtocolResponse(line, expectedId) {
+    const value = parseJsonLine(line);
+    if (!isRecord(value)) {
+        throw new ProtocolError("protocol_error", "Protocol response must be an object.");
+    }
+    if (value.version !== PROTOCOL_VERSION) {
+        throw new ProtocolError("incompatible_version", "Unsupported protocol response version.");
+    }
+    if (expectedId !== undefined && value.id !== expectedId) {
+        throw new ProtocolError("protocol_error", "Protocol response id does not match request id.");
+    }
+    if (value.type === "error") {
+        return sanitizeProtocolErrorResponse(value);
+    }
+    if (value.type === "connect_result") {
+        return sanitizeConnectResponse(value);
+    }
+    if (value.type === "disconnect_result") {
+        return sanitizeDisconnectResponse(value);
+    }
+    if (value.type === "capabilities") {
+        return sanitizeCapabilitiesResponse(value);
+    }
+    if (value.type === "accounts") {
+        return sanitizeAccountsResponse(value);
+    }
+    if (value.type === "sign_result") {
+        return sanitizeSignResultResponse(value);
+    }
+    if (value.type === "ack_result") {
+        return sanitizeAckResultResponse(value);
+    }
+    throw new ProtocolError("protocol_error", "Provider protocol response type is unsupported.");
+}
+export function assertConnectResponse(response) {
+    if (response.type === "error") {
+        throw new ProtocolError(response.error.code, response.error.message);
+    }
+    if (response.type !== "connect_result") {
+        throw new ProtocolError("protocol_error", "Protocol response type is not connect_result.");
+    }
+    return response;
+}
+export function assertDisconnectResponse(response) {
+    if (response.type === "error") {
+        throw new ProtocolError(response.error.code, response.error.message);
+    }
+    if (response.type !== "disconnect_result") {
+        throw new ProtocolError("protocol_error", "Protocol response type is not disconnect_result.");
+    }
+    return response;
+}
+export function assertAckResultResponse(response) {
+    if (response.type === "error") {
+        throw new ProtocolError(response.error.code, response.error.message);
+    }
+    if (response.type !== "ack_result") {
+        throw new ProtocolError("protocol_error", "Protocol response type is not ack_result.");
+    }
+    return response;
+}
+export function assertCapabilitiesResponse(response) {
+    if (response.type === "error") {
+        throw new ProtocolError(response.error.code, response.error.message);
+    }
+    if (response.type !== "capabilities") {
+        throw new ProtocolError("protocol_error", "Protocol response type is not capabilities.");
+    }
+    return response;
+}
+export function assertAccountsResponse(response) {
+    if (response.type === "error") {
+        throw new ProtocolError(response.error.code, response.error.message);
+    }
+    if (response.type !== "accounts") {
+        throw new ProtocolError("protocol_error", "Protocol response type is not accounts.");
+    }
+    return response;
+}
+export function assertSignResultResponse(response) {
+    if (response.type === "error") {
+        throw new ProtocolError(response.error.code, response.error.message);
+    }
+    if (response.type !== "sign_result") {
+        throw new ProtocolError("protocol_error", "Protocol response type is not sign_result.");
+    }
+    return response;
+}
+function normalizeProviderProtocolRequest(request) {
+    if (!isRecord(request)) {
+        throw new ProtocolError("invalid_method", "Provider protocol request must be an object.");
+    }
+    if (request.version !== PROTOCOL_VERSION) {
+        throw new ProtocolError("unsupported_version", "Unsupported provider protocol request version.");
+    }
+    switch (request.type) {
+        case "connect": {
+            requireOnlyKeys(request, ["id", "version", "type", "params"], "connect request");
+            const params = asRecord(request.params, "connect params");
+            requireOnlyKeys(params, ["clientName"], "connect params");
+            return makeConnectRequest(params.clientName, request.id);
+        }
+        case "disconnect":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId"], "disconnect request");
+            return makeDisconnectRequest(request.sessionId, request.id);
+        case "get_accounts":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId"], "get_accounts request");
+            return makeGetAccountsRequest(request.sessionId, request.id);
+        case "get_result":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId"], "get_result request");
+            return makeGetResultRequest(request.sessionId, request.id);
+        case "ack_result":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId"], "ack_result request");
+            return makeAckResultRequest(request.sessionId, request.id);
+        case "get_capabilities":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId"], "get_capabilities request");
+            return makeGetCapabilitiesRequest(request.sessionId, request.id);
+        case "sign_personal_message":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId", "chain", "method", "params"], "sign_personal_message request");
+            requireOnlyKeys(asRecord(request.params, "sign_personal_message params"), ["network", "message"], "sign_personal_message params");
+            return makeSignPersonalMessageRequest(request.sessionId, request.chain, request.method, request.params, request.id);
+        case "sign_transaction":
+            requireOnlyKeys(request, ["id", "version", "type", "sessionId", "chain", "method", "params"], "sign_transaction request");
+            requireOnlyKeys(asRecord(request.params, "sign_transaction params"), ["network", "txBytes"], "sign_transaction params");
+            return makeSignTransactionRequest(request.sessionId, request.chain, request.method, request.params, request.id);
+        default:
+            throw new ProtocolError("invalid_method", "Provider protocol request type is unsupported.");
+    }
+}
+function validateRequestId(id) {
+    if (!isSafeRequestId(id)) {
+        throw new ProtocolError("invalid_request_id", "Invalid request id.");
+    }
+}
+function validateSessionId(sessionId) {
+    if (!isSessionId(sessionId)) {
+        throw new ProtocolError("invalid_session", "Invalid sessionId.");
+    }
+}
+export function validateSignTransactionInput(chain, method, params, requestType = "sign_transaction") {
+    identifySignRoute(SUI_SIGN_TRANSACTION_METHOD, chain, method);
+    return validateSignTransactionParams(params, requestType);
+}
+export function validateSignTransactionParams(params, requestType = "sign_transaction") {
+    const normalized = asSignParamsRecord(params, requestType, ["network", "txBytes"]);
+    return {
+        network: validateSuiNetwork(normalized.network),
+        txBytes: validateCanonicalBase64Syntax(normalized.txBytes, MAX_RAW_PROTOCOL_JSON_BYTES, "sui/sign_transaction txBytes"),
+    };
+}
+export function validateSignPersonalMessageInput(chain, method, params, requestType = "sign_personal_message") {
+    identifySignRoute(SUI_SIGN_PERSONAL_MESSAGE_METHOD, chain, method);
+    return validateSignPersonalMessageParams(params, requestType);
+}
+export function validateSignPersonalMessageParams(params, requestType = "sign_personal_message") {
+    const normalized = asSignParamsRecord(params, requestType, ["network", "message"]);
+    return {
+        network: validateSuiNetwork(normalized.network),
+        message: validateCanonicalBase64Syntax(normalized.message, MAX_RAW_PROTOCOL_JSON_BYTES, "sui/sign_personal_message message"),
+    };
+}
+export function identifySignRoute(operation, chain, method) {
+    if (typeof chain !== "string" ||
+        !SIGN_CHAIN_PATTERN.test(chain) ||
+        typeof method !== "string" ||
+        !SIGN_METHOD_PATTERN.test(method)) {
+        throw new ProtocolError("invalid_params", "Signing route identifiers are invalid.");
+    }
+    if (chain !== SUI_CHAIN_ID) {
+        // TODO: Add a new explicit chain case only when its Firmware adapter,
+        // core validation, capabilities, provider surface, tests, docs, and
+        // hardware evidence implement the same contract.
+        throw new ProtocolError("unsupported_chain", "Signing chain is unsupported.");
+    }
+    switch (operation) {
+        case SUI_SIGN_TRANSACTION_METHOD:
+            if (method === SUI_SIGN_TRANSACTION_METHOD) {
+                return {
+                    operation,
+                    chain: SUI_CHAIN_ID,
+                    method: SUI_SIGN_TRANSACTION_METHOD,
+                    route: "sui_sign_transaction",
+                };
+            }
+            break;
+        case SUI_SIGN_PERSONAL_MESSAGE_METHOD:
+            if (method === SUI_SIGN_PERSONAL_MESSAGE_METHOD) {
+                return {
+                    operation,
+                    chain: SUI_CHAIN_ID,
+                    method: SUI_SIGN_PERSONAL_MESSAGE_METHOD,
+                    route: "sui_sign_personal_message",
+                };
+            }
+            break;
+    }
+    throw new ProtocolError("unsupported_method", "Signing method is unsupported.");
+}
+function asSignParamsRecord(value, label, keys) {
+    const params = asRecord(value, `${label} params`);
+    if (hasSecretPayloadKey(params)) {
+        throw new ProtocolError("invalid_params", `${label} params must not include secret material.`);
+    }
+    requireOnlyKeys(params, keys, `${label} params`);
+    return params;
+}
+function validateSuiNetwork(value) {
+    if (!SUI_SIGN_TRANSACTION_NETWORKS.includes(value)) {
+        throw new ProtocolError("invalid_params", "sui signing network is unsupported.");
+    }
+    return value;
+}
+function validateRawRequestSize(request, method) {
+    if (utf8ByteLength(JSON.stringify(request)) > MAX_RAW_PROTOCOL_JSON_BYTES) {
+        throw new ProtocolError("invalid_params", `${method} request is too large for the runtime.`);
+    }
+}
+function sanitizeProtocolErrorResponse(value) {
+    if (!hasOnlyObjectKeys(value, ["id", "version", "type", "error"])) {
+        throw new ProtocolError("protocol_error", "Protocol error response contains unsupported fields.");
+    }
+    if (value.id !== undefined && typeof value.id !== "string") {
+        throw new ProtocolError("protocol_error", "Protocol error response id is malformed.");
+    }
+    const error = asRecord(value.error, "Protocol error response error");
+    if (typeof error.code !== "string" || typeof error.message !== "string") {
+        throw new ProtocolError("protocol_error", "Protocol error response is malformed.");
+    }
+    requireOnlyKeys(error, ["code", "message"], "Protocol error response error");
+    return {
+        id: value.id,
+        version: PROTOCOL_VERSION,
+        type: "error",
+        error: { code: error.code, message: error.message },
+    };
+}
+function sanitizeConnectResponse(value) {
+    if (typeof value.id !== "string") {
+        throw new ProtocolError("protocol_error", "Connect response id is malformed.");
+    }
+    if (value.status === "approved") {
+        requireOnlyKeys(value, ["id", "version", "type", "status", "sessionId", "sessionTtlMs", "device"], "Connect approved response");
+        const device = sanitizeStrictDeviceStatus(value.device, "Connect response device object");
+        if (!isSessionId(value.sessionId)) {
+            throw new ProtocolError("protocol_error", "Connect response sessionId is malformed.");
+        }
+        if (typeof value.sessionTtlMs !== "number" ||
+            !Number.isInteger(value.sessionTtlMs) ||
+            value.sessionTtlMs <= 0 ||
+            value.sessionTtlMs > MAX_SESSION_TTL_MS) {
+            throw new ProtocolError("protocol_error", "Connect response sessionTtlMs is malformed.");
+        }
+        return {
+            id: value.id,
+            version: PROTOCOL_VERSION,
+            type: "connect_result",
+            status: "approved",
+            sessionId: value.sessionId,
+            sessionTtlMs: value.sessionTtlMs,
+            device,
+        };
+    }
+    if (value.status === "rejected") {
+        requireOnlyKeys(value, ["id", "version", "type", "status", "error"], "Connect rejected response");
+        const error = asRecord(value.error, "Connect rejected response error");
+        if (typeof error.code !== "string" || typeof error.message !== "string") {
+            throw new ProtocolError("protocol_error", "Connect rejected response error object is malformed.");
+        }
+        requireOnlyKeys(error, ["code", "message"], "Connect rejected response error");
+        return {
+            id: value.id,
+            version: PROTOCOL_VERSION,
+            type: "connect_result",
+            status: "rejected",
+            error: { code: error.code, message: error.message },
+        };
+    }
+    throw new ProtocolError("protocol_error", "Connect response status is unsupported.");
+}
+function sanitizeDisconnectResponse(value) {
+    requireOnlyKeys(value, ["id", "version", "type", "status"], "Disconnect response");
+    if (typeof value.id !== "string" || value.status !== "disconnected") {
+        throw new ProtocolError("protocol_error", "Disconnect response is malformed.");
+    }
+    return { id: value.id, version: PROTOCOL_VERSION, type: "disconnect_result", status: "disconnected" };
+}
+function sanitizeAckResultResponse(value) {
+    requireOnlyKeys(value, ["id", "version", "type", "status"], "Ack result response");
+    if (typeof value.id !== "string" || value.status !== "acked") {
+        throw new ProtocolError("protocol_error", "Ack result response is malformed.");
+    }
+    return { id: value.id, version: PROTOCOL_VERSION, type: "ack_result", status: "acked" };
+}
+function sanitizeCapabilitiesResponse(value) {
+    if (typeof value.id !== "string") {
+        throw new ProtocolError("protocol_error", "Capabilities response id is malformed.");
+    }
+    rejectSecretPayload(value, "Capabilities response");
+    requireOnlyKeys(value, ["id", "version", "type", "chains", "signing"], "Capabilities response");
+    if (!Array.isArray(value.chains) || value.chains.length !== MAX_CAPABILITY_CHAINS) {
+        throw new ProtocolError("protocol_error", "Capabilities response chains are malformed.");
+    }
+    const signing = sanitizeSigningCapabilities(value.signing);
+    return {
+        id: value.id,
+        version: PROTOCOL_VERSION,
+        type: "capabilities",
+        chains: value.chains.map((entry) => sanitizeCapabilityChain(entry)),
+        ...(signing === undefined ? {} : { signing }),
+    };
+}
+function sanitizeAccountsResponse(value) {
+    if (typeof value.id !== "string") {
+        throw new ProtocolError("protocol_error", "Accounts response id is malformed.");
+    }
+    rejectSecretPayload(value, "Accounts response");
+    requireOnlyKeys(value, ["id", "version", "type", "accounts"], "Accounts response");
+    if (!Array.isArray(value.accounts) || value.accounts.length !== MAX_ACCOUNTS_PER_RESPONSE) {
+        throw new ProtocolError("protocol_error", "Accounts response accounts are malformed.");
+    }
+    return {
+        id: value.id,
+        version: PROTOCOL_VERSION,
+        type: "accounts",
+        accounts: value.accounts.map((entry) => sanitizeAccount(entry)),
+    };
+}
+function sanitizeCapabilityChain(value) {
+    const chain = asRecord(value, "Capability chain entry");
+    rejectSecretPayload(chain, "Capability chain entry");
+    requireOnlyKeys(chain, ["id", "accounts", "methods"], "Capability chain entry");
+    if (chain.id !== SUI_CHAIN_ID) {
+        throw new ProtocolError("protocol_error", "Capability chain is unsupported.");
+    }
+    if (!Array.isArray(chain.accounts) || chain.accounts.length !== MAX_CAPABILITY_ACCOUNTS_PER_CHAIN) {
+        throw new ProtocolError("protocol_error", "Capability accounts are malformed.");
+    }
+    if (!Array.isArray(chain.methods) || chain.methods.length !== 0) {
+        throw new ProtocolError("protocol_error", "Capability method is unsupported.");
+    }
+    return {
+        id: SUI_CHAIN_ID,
+        accounts: chain.accounts.map((entry) => sanitizeCapabilityAccount(entry)),
+        methods: [],
+    };
+}
+function sanitizeCapabilityAccount(value) {
+    const account = asRecord(value, "Capability account entry");
+    rejectSecretPayload(account, "Capability account entry");
+    requireOnlyKeys(account, ["keyScheme", "derivationPath"], "Capability account entry");
+    if (account.keyScheme !== "ed25519" || account.derivationPath !== SUI_DERIVATION_PATH) {
+        throw new ProtocolError("protocol_error", "Capability account entry is unsupported.");
+    }
+    return { keyScheme: "ed25519", derivationPath: SUI_DERIVATION_PATH };
+}
+function sanitizeSigningCapabilities(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const signing = asRecord(value, "Signing capabilities");
+    requireOnlyKeys(signing, ["authorization", "methods"], "Signing capabilities");
+    if (signing.authorization !== "user" && signing.authorization !== "policy") {
+        throw new ProtocolError("protocol_error", "Signing authorization is unsupported.");
+    }
+    if (!Array.isArray(signing.methods) || signing.methods.length === 0 || signing.methods.length > MAX_SIGNING_CAPABILITIES) {
+        throw new ProtocolError("protocol_error", "Signing capabilities are malformed.");
+    }
+    const methods = signing.methods.map((entry) => sanitizeSigningCapabilityEntry(entry));
+    const methodNames = new Set(methods.map((entry) => entry.method));
+    if (methodNames.size !== methods.length) {
+        throw new ProtocolError("protocol_error", "Signing capability is duplicated.");
+    }
+    if (signing.authorization === "policy") {
+        if (methods.length !== 1 || !methodNames.has(SUI_SIGN_TRANSACTION_METHOD)) {
+            throw new ProtocolError("protocol_error", "Signing capability is unsupported.");
+        }
+    }
+    else if (methods.length !== 2 ||
+        !methodNames.has(SUI_SIGN_TRANSACTION_METHOD) ||
+        !methodNames.has(SUI_SIGN_PERSONAL_MESSAGE_METHOD)) {
+        throw new ProtocolError("protocol_error", "Signing capability is unsupported.");
+    }
+    return { authorization: signing.authorization, methods };
+}
+function sanitizeSigningCapabilityEntry(value) {
+    const entry = asRecord(value, "Signing capability entry");
+    rejectSecretPayload(entry, "Signing capability entry");
+    requireOnlyKeys(entry, ["chain", "method"], "Signing capability entry");
+    if (entry.chain !== SUI_CHAIN_ID ||
+        (entry.method !== SUI_SIGN_TRANSACTION_METHOD && entry.method !== SUI_SIGN_PERSONAL_MESSAGE_METHOD)) {
+        throw new ProtocolError("protocol_error", "Signing capability is unsupported.");
+    }
+    return { chain: SUI_CHAIN_ID, method: entry.method };
+}
+function sanitizeAccount(value) {
+    const account = asRecord(value, "Account entry");
+    rejectSecretPayload(account, "Account entry");
+    requireOnlyKeys(account, ["chain", "address", "publicKey", "keyScheme", "derivationPath"], "Account entry");
+    if (account.chain !== SUI_CHAIN_ID ||
+        typeof account.address !== "string" ||
+        !SUI_ADDRESS_PATTERN.test(account.address) ||
+        typeof account.publicKey !== "string" ||
+        !ED25519_PUBLIC_KEY_BASE64_PATTERN.test(account.publicKey) ||
+        !isSuiAddressForPublicKey(account.address, account.publicKey) ||
+        account.keyScheme !== "ed25519" ||
+        account.derivationPath !== SUI_DERIVATION_PATH) {
+        throw new ProtocolError("protocol_error", "Account entry is unsupported.");
+    }
+    return {
+        chain: SUI_CHAIN_ID,
+        address: account.address,
+        publicKey: account.publicKey,
+        keyScheme: "ed25519",
+        derivationPath: SUI_DERIVATION_PATH,
+    };
+}
+function sanitizeSignResultResponse(value) {
+    if (typeof value.id !== "string" || typeof value.status !== "string") {
+        throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+    }
+    rejectSecretPayload(value, "Sign result response");
+    if (value.status === "signed") {
+        requireOnlyKeys(value, ["id", "version", "type", "authorization", "status", "chain", "method", "signature", "messageBytes"], "Sign result response");
+        if ((value.authorization !== "user" && value.authorization !== "policy") ||
+            value.chain !== SUI_CHAIN_ID ||
+            typeof value.signature !== "string" ||
+            !SUI_ED25519_SIGNATURE_BASE64_PATTERN.test(value.signature)) {
+            throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+        }
+        if (value.method === SUI_SIGN_TRANSACTION_METHOD) {
+            if (value.messageBytes !== undefined) {
+                throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+            }
+            return {
+                id: value.id,
+                version: PROTOCOL_VERSION,
+                type: "sign_result",
+                authorization: value.authorization,
+                status: "signed",
+                chain: SUI_CHAIN_ID,
+                method: SUI_SIGN_TRANSACTION_METHOD,
+                signature: value.signature,
+            };
+        }
+        if (value.method === SUI_SIGN_PERSONAL_MESSAGE_METHOD) {
+            if (value.authorization !== "user") {
+                throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+            }
+            const messageBytes = validateCanonicalBase64Syntax(value.messageBytes, MAX_SIGN_RESULT_PAYLOAD_BASE64_CHARS, "sui/sign_personal_message messageBytes", "protocol_error");
+            return {
+                id: value.id,
+                version: PROTOCOL_VERSION,
+                type: "sign_result",
+                authorization: "user",
+                status: "signed",
+                chain: SUI_CHAIN_ID,
+                method: SUI_SIGN_PERSONAL_MESSAGE_METHOD,
+                signature: value.signature,
+                messageBytes,
+            };
+        }
+        throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+    }
+    if (value.status === "user_rejected" || value.status === "user_timed_out") {
+        requireOnlyKeys(value, ["id", "version", "type", "authorization", "status", "error"], "Sign result response");
+        if (value.authorization !== "user") {
+            throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+        }
+        const expectedCode = value.status;
+        const error = sanitizeSignResultError(value.error, expectedCode);
+        return { id: value.id, version: PROTOCOL_VERSION, type: "sign_result", authorization: "user", status: expectedCode, error };
+    }
+    if (value.status === "policy_rejected") {
+        requireOnlyKeys(value, ["id", "version", "type", "authorization", "status", "policyHash", "ruleRef", "error"], "Sign result response");
+        if (value.authorization !== "policy" ||
+            typeof value.policyHash !== "string" ||
+            !HASH_ID_PATTERN.test(value.policyHash) ||
+            typeof value.ruleRef !== "string" ||
+            !RULE_REF_PATTERN.test(value.ruleRef)) {
+            throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+        }
+        const error = sanitizeSignResultError(value.error, "policy_rejected");
+        return {
+            id: value.id,
+            version: PROTOCOL_VERSION,
+            type: "sign_result",
+            authorization: "policy",
+            status: "policy_rejected",
+            policyHash: value.policyHash,
+            ruleRef: value.ruleRef,
+            error,
+        };
+    }
+    if (value.status === "signing_failed") {
+        requireOnlyKeys(value, ["id", "version", "type", "authorization", "status", "error"], "Sign result response");
+        if (value.authorization !== "user" && value.authorization !== "policy") {
+            throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+        }
+        const error = sanitizeSignResultError(value.error, "signing_failed");
+        return {
+            id: value.id,
+            version: PROTOCOL_VERSION,
+            type: "sign_result",
+            authorization: value.authorization,
+            status: "signing_failed",
+            error,
+        };
+    }
+    throw new ProtocolError("protocol_error", "Sign result response is malformed.");
+}
+function sanitizeSignResultError(value, expectedCode) {
+    const error = asRecord(value, "Sign result error");
+    requireOnlyKeys(error, ["code", "message"], "Sign result error");
+    if (error.code !== expectedCode || error.message !== SIGN_RESULT_ERROR_MESSAGES[expectedCode]) {
+        throw new ProtocolError("protocol_error", "Sign result response error is not canonical.");
+    }
+    return { code: expectedCode, message: SIGN_RESULT_ERROR_MESSAGES[expectedCode] };
+}
+function sanitizeStrictDeviceStatus(value, label) {
+    const device = asRecord(value, label);
+    requireOnlyKeys(device, ["deviceId", "state", "firmwareName", "hardware", "firmwareVersion"], label);
+    if (!isSafeDeviceId(device.deviceId) || !isDeviceState(device.state)) {
+        throw new ProtocolError("protocol_error", `${label} is malformed.`);
+    }
+    return {
+        deviceId: device.deviceId,
+        state: device.state,
+        firmwareName: sanitizeDisplayText(device.firmwareName, MAX_FIRMWARE_NAME_LENGTH),
+        hardware: sanitizeDisplayText(device.hardware, MAX_HARDWARE_ID_LENGTH),
+        firmwareVersion: sanitizeDisplayText(device.firmwareVersion, MAX_FIRMWARE_VERSION_LENGTH),
+    };
+}
+export function sanitizeDeviceStatus(value) {
+    if (!isRecord(value) || !isSafeDeviceId(value.deviceId) || !isDeviceState(value.state)) {
+        return null;
+    }
+    return {
+        deviceId: value.deviceId,
+        state: value.state,
+        firmwareName: sanitizeDisplayText(value.firmwareName, MAX_FIRMWARE_NAME_LENGTH),
+        hardware: sanitizeDisplayText(value.hardware, MAX_HARDWARE_ID_LENGTH),
+        firmwareVersion: sanitizeDisplayText(value.firmwareVersion, MAX_FIRMWARE_VERSION_LENGTH),
+    };
+}
+export function sanitizeProvisioningStatus(value) {
+    if (!isRecord(value) || !isProvisioningState(value.state)) {
+        return null;
+    }
+    return { state: value.state };
+}
+//# sourceMappingURL=provider-protocol.js.map