@tezos-x/octez.connect-dapp 5.0.1 → 5.0.3

package/README.md

@@ -20,4 +20,4 @@ This package is published from the Trilitech-maintained octez.connect repository
 ## Notes
 
 - Trilitech publishes these packages under the `@tezos-x/octez.connect-*` scope
-- Release notes, package policy, and the current package list live in the repository README
+- Release notes live on the [GitHub Releases page](https://github.com/trilitech/octez.connect/releases); package policy lives in [CONTRIBUTING.md](https://github.com/trilitech/octez.connect/blob/master/CONTRIBUTING.md) and [MAINTAINERS.md](https://github.com/trilitech/octez.connect/blob/master/MAINTAINERS.md)

package/dist/cjs/dapp-client/DAppClient.d.ts

@@ -40,9 +40,10 @@ export declare class DAppClient extends Client {
     protected wcProjectId?: string;
     protected wcRelayUrl?: string;
     /**
-     * WalletConnect is opt-in: only enabled when `walletConnectOptions` is provided
-     * and `disableWalletConnect` is not set. When false, no WC transport is built,
-     * listened to, or offered for pairing, and no default projectId is applied.
+     * WalletConnect is enabled by default (as in 4.8.x) using the shared
+     * DEFAULT_WALLETCONNECT_PROJECT_ID unless `walletConnectOptions` overrides it.
+     * Set `disableWalletConnect: true` to opt out. When false, no WC transport is
+     * built, listened to, or offered for pairing.
      */
     protected isWalletConnectEnabled: boolean;
     private isGetActiveAccountHandled;

package/dist/cjs/dapp-client/DAppClient.js

@@ -44,11 +44,12 @@ class DAppClient extends octez_connect_core_1.Client {
         super(Object.assign({ storage: config && config.storage ? config.storage : new octez_connect_core_1.LocalStorage() }, config));
         this.events = new events_1.BeaconEventHandler();
         /**
-         * WalletConnect is opt-in: only enabled when `walletConnectOptions` is provided
-         * and `disableWalletConnect` is not set. When false, no WC transport is built,
-         * listened to, or offered for pairing, and no default projectId is applied.
+         * WalletConnect is enabled by default (as in 4.8.x) using the shared
+         * DEFAULT_WALLETCONNECT_PROJECT_ID unless `walletConnectOptions` overrides it.
+         * Set `disableWalletConnect: true` to opt out. When false, no WC transport is
+         * built, listened to, or offered for pairing.
          */
-        this.isWalletConnectEnabled = false;
+        this.isWalletConnectEnabled = true;
         this.isGetActiveAccountHandled = false;
         this.openRequestsOtherTabs = new Set();
         /**
@@ -69,12 +70,15 @@ class DAppClient extends octez_connect_core_1.Client {
         this.debounceSetActiveAccount = false;
         this.multiTabChannel = new octez_connect_core_1.MultiTabChannel('octez.connect-sdk-channel', this.onBCMessageHandler.bind(this), this.onElectedLeaderhandler.bind(this));
         this.description = config.description;
-        // WalletConnect is opt-in: only when walletConnectOptions is provided and not
-        // explicitly disabled. Don't apply the default projectId otherwise (#32).
-        this.isWalletConnectEnabled =
-            Boolean(config.walletConnectOptions) && !config.disableWalletConnect;
+        // WalletConnect is enabled BY DEFAULT (as in 4.8.x) with the shared
+        // ecosystem projectId, so dApps don't have to register with WalletConnect
+        // Cloud to offer WC wallets (e.g. Kukai Mobile) — the free tier covers the
+        // ecosystem's volume. `walletConnectOptions` overrides the projectId/relay,
+        // `disableWalletConnect: true` opts out entirely (e.g. environments where
+        // the WC provider cannot run, see #32).
+        this.isWalletConnectEnabled = !config.disableWalletConnect;
         this.wcProjectId = this.isWalletConnectEnabled
-            ? ((_a = config.walletConnectOptions) === null || _a === void 0 ? void 0 : _a.projectId) || '24469fd0a06df227b6e5f7dc7de0ff4f'
+            ? ((_a = config.walletConnectOptions) === null || _a === void 0 ? void 0 : _a.projectId) || octez_connect_core_1.DEFAULT_WALLETCONNECT_PROJECT_ID
             : undefined;
         this.wcRelayUrl = this.isWalletConnectEnabled ? (_b = config.walletConnectOptions) === null || _b === void 0 ? void 0 : _b.relayUrl : undefined;
         this.featuredWallets = config.featuredWallets;
@@ -444,8 +448,8 @@ class DAppClient extends octez_connect_core_1.Client {
             yield this.addListener(this.postMessageTransport);
             this.p2pTransport = new DappP2PTransport_1.DappP2PTransport(this.name, keyPair, this.storage, this.matrixNodes, this.iconUrl, this.appUrl);
             yield this.addListener(this.p2pTransport);
-            // WalletConnect is opt-in (#32): skip building/listening the transport when
-            // no walletConnectOptions were provided or it was explicitly disabled.
+            // WalletConnect is on by default; skip building/listening the transport
+            // only when explicitly disabled via disableWalletConnect (#32).
             if (this.isWalletConnectEnabled) {
                 const wcOptions = {
                     projectId: this.wcProjectId,
@@ -603,7 +607,8 @@ class DAppClient extends octez_connect_core_1.Client {
                         }
                         else {
                             // The persisted active account was paired over WalletConnect but WC
-                            // is now opt-out/disabled (#32), so there is no matching transport to
+                            // has since been disabled (`disableWalletConnect`, #32) or failed to
+                            // initialize, so there is no matching transport to
                             // restore. Without this branch none of the conditions above call
                             // resolve() and the init promise created above never settles, so
                             // init() (and every later call awaiting it) hangs forever. Resolve on
@@ -1175,7 +1180,7 @@ class DAppClient extends octez_connect_core_1.Client {
             // reading response.message.version would always miss and collapse to '0',
             // misrouting v4 responses when no peer is persisted yet.
             const walletPeerV3 = yield this.getPeer();
-            const walletPeerVersionV3 = (_a = walletPeerV3 === null || walletPeerV3 === void 0 ? void 0 : walletPeerV3.version) !== null && _a !== void 0 ? _a : response.version;
+            const walletPeerVersionV3 = (_a = (0, octez_connect_core_1.effectivePeerVersion)(walletPeerV3)) !== null && _a !== void 0 ? _a : response.version;
             const partialAccountInfos = yield blockchain.getAccountInfosFromPermissionResponse(response.message, walletPeerVersionV3);
             const blockchainDataScopes = response.message.blockchainData.scopes;
             const accountInfos = partialAccountInfos.map((p) => ({
@@ -1323,10 +1328,11 @@ class DAppClient extends octez_connect_core_1.Client {
             this.sendMetrics('performance-metrics/save', yield this.buildPayload('connect', 'success'));
             logger.log('requestPermissions', '######## MESSAGE #######');
             logger.log('requestPermissions', message);
-            // walletPeer.version is the negotiated pairing version; fall back to the
-            // response envelope version when no peer is persisted yet.
+            // Capability-aware peer version (legacy wallets echo the dApp's version
+            // at pairing — see effectivePeerVersion); fall back to the response
+            // envelope version when no peer is persisted yet.
             const walletPeer = yield this.getPeer();
-            const walletPeerVersion = (_a = walletPeer === null || walletPeer === void 0 ? void 0 : walletPeer.version) !== null && _a !== void 0 ? _a : message.version;
+            const walletPeerVersion = (_a = (0, octez_connect_core_1.effectivePeerVersion)(walletPeer)) !== null && _a !== void 0 ? _a : message.version;
             // Gate the freshly-paired wallet against the dApp's required minimum (a
             // no-op under the default, permissive minimum). Throws
             // VersionUnsupportedBeaconError when the wallet is too old.
@@ -1949,10 +1955,15 @@ class DAppClient extends octez_connect_core_1.Client {
         });
     }
     // Throws VersionUnsupportedBeaconError when a wallet that reported a version
-    // is below requiredMinimumVersion (or reports a malformed one). A peer that
-    // never reported a version (legacy pairing predating versioning) is treated
-    // as unknown and allowed through, so raising the minimum never retroactively
-    // breaks an already-paired session on a pure read.
+    // is below requiredMinimumVersion (or reports a malformed one). Callers pass
+    // the EFFECTIVE version (see effectivePeerVersion): a declared version is
+    // only trusted alongside the v5 `protocolVersion` pairing marker; a
+    // marker-less wallet that declared one counts as '2' (legacy wallets echo
+    // the dApp's version, so the raw peer.version may read deceptively high).
+    // A peer that never reported a version (WalletConnect pairings, legacy
+    // pairings predating versioning) is treated as unknown and allowed through,
+    // so raising the minimum never retroactively breaks an already-paired
+    // session on a pure read.
     assertWalletVersionMeetsMinimum(walletVersion) {
         if (walletVersion === undefined) {
             return;
@@ -2162,13 +2173,16 @@ class DAppClient extends octez_connect_core_1.Client {
             // Enforce the dApp's required minimum before a request leaves the SDK.
             // No-op under the default (permissive) minimum; otherwise rejects an
             // under-minimum wallet with VersionUnsupportedBeaconError.
-            this.assertWalletVersionMeetsMinimum(peer === null || peer === void 0 ? void 0 : peer.version);
-            // The wire dialect is negotiated per peer — min(peer.version,
-            // BEACON_VERSION), floor '2'. A wrapped-capable peer (>= 3) receives the
-            // flat requestInput (the unchanged public shape) mapped onto the wrapped
-            // Tezos payload; a legacy peer receives the flat v2 message it has
-            // always spoken. Integrators never see either dialect.
-            const negotiatedVersion = (0, octez_connect_core_1.negotiateEnvelopeVersion)(peer === null || peer === void 0 ? void 0 : peer.version);
+            this.assertWalletVersionMeetsMinimum((0, octez_connect_core_1.effectivePeerVersion)(peer));
+            // The wire dialect is negotiated per peer — min(effective peer version,
+            // BEACON_VERSION), floor '2'. The effective version is capability-aware:
+            // legacy wallets ECHO the dApp's version in their pairing response, so
+            // peer.version alone would misread a 4.8.x wallet as v4; only peers that
+            // sent the v5 `protocolVersion` marker are trusted. A wrapped-capable
+            // peer receives the flat requestInput (the unchanged public shape)
+            // mapped onto the wrapped Tezos payload; a legacy peer receives the flat
+            // v2 message it has always spoken. Integrators never see either dialect.
+            const negotiatedVersion = (0, octez_connect_core_1.negotiateEnvelopeVersion)((0, octez_connect_core_1.effectivePeerVersion)(peer));
             const requestSenderId = yield (0, octez_connect_core_1.getSenderId)(yield this.beaconId);
             let request;
             if ((0, octez_connect_core_1.usesWrappedMessages)(negotiatedVersion)) {
@@ -2275,14 +2289,21 @@ class DAppClient extends octez_connect_core_1.Client {
             const account = yield this.getActiveAccount();
             const peer = yield this.getPeer(account);
             // Enforce the dApp's required minimum before a request leaves the SDK.
-            this.assertWalletVersionMeetsMinimum(peer === null || peer === void 0 ? void 0 : peer.version);
+            this.assertWalletVersionMeetsMinimum((0, octez_connect_core_1.effectivePeerVersion)(peer));
+            // The envelope carries the version negotiated against the effective
+            // (capability-aware) peer version — see effectivePeerVersion: legacy
+            // wallets echo the dApp's version, so only peers that sent the v5
+            // `protocolVersion` marker are trusted with the v4 dialect. Unlike
+            // makeRequest, this path is wrapper-only (the v3 blockchainData shape
+            // has no flat equivalent), so it floors at '3' instead of '2': a legacy
+            // wallet routes a version-'3' wrapper through its v3 branch, whereas a
+            // '2'-stamped wrapper would be misrouted as flat and silently dropped.
+            const negotiatedVersion = (0, octez_connect_core_1.negotiateEnvelopeVersion)((0, octez_connect_core_1.effectivePeerVersion)(peer));
             const request = {
                 id: messageId,
-                // The envelope carries the version negotiated against the peer:
-                // min(peer.version, BEACON_VERSION), floor '3'. A v3 wallet treats any
-                // version >= 3 as a wrapped message; a v4 wallet reaches its
-                // multi-network branch only when it declared v4 at pairing.
-                version: (0, octez_connect_core_1.negotiateEnvelopeVersion)(peer === null || peer === void 0 ? void 0 : peer.version),
+                version: (0, octez_connect_core_1.usesWrappedMessages)(negotiatedVersion)
+                    ? negotiatedVersion
+                    : String(octez_connect_core_1.MESSAGE_WRAPPED_FROM_VERSION),
                 senderId: yield (0, octez_connect_core_1.getSenderId)(yield this.beaconId),
                 message: requestInput
             };