@theoo/sdk 0.4.2 → 0.4.4

package/dist/verify.js

@@ -0,0 +1,669 @@
+/**
+ * What the passkey signs, checked before it signs.
+ *
+ * Theoo holds no key that can move an account, but its server prepares what
+ * the passkey signs, and a 32-byte challenge says nothing on its face. So the
+ * server sends, with every challenge, the whole of what it is the hash of. The
+ * client rebuilds the hash itself, refuses if it differs, and reads the calls
+ * inside: they must be the ones this app asked for, or, for an operation the
+ * server builds from a quote (a swap, a desk order), they may move no more
+ * than the quote said, of no other token, and must leave nothing approved.
+ *
+ * A server that lies is therefore refused, not obeyed: the worst it can do is
+ * fail an operation, never redirect one.
+ */
+import { addressWord, padded, Reader, selector, splitCall, toBig, word } from "./abi.js";
+import { hashMessage, hashTypedData } from "./eip712.js";
+import { base58Encode, base64Decode, bytesToHex, concatBytes, equalBytes, hexToBytes, keccak256, pubkeyBytes, sha256, utf8 } from "./hash.js";
+import { decode as base64urlDecode } from "./base64url.js";
+import { callsHash, decodePropose, VAULT_FACTORY, VAULT_SEL } from "./vault.js";
+import { encodeSolanaCalls, INSTRUCTIONS_SYSVAR, isSolanaVault, predictSolanaVault, SOLANA_VAULT_PROGRAM, SOLANA_VAULT_TAG, solanaProposalAddress, SYSTEM_PROGRAM, u64le } from "./solana-vault.js";
+/** Thrown before the passkey is asked: what the server sent isn't what was asked for. */
+export class SigningRefused extends Error {
+    constructor(reason) {
+        super(`Not signed: ${reason}`);
+        this.code = "SIGNING_REFUSED";
+        this.name = "SigningRefused";
+    }
+}
+function refuse(why) {
+    throw new SigningRefused(why);
+}
+/* ── addresses Theoo's quotes may route through ───────────────────────── */
+/** 0x's AllowanceHolder: the only spender a token swap approves. Same address on every chain. */
+export const ALLOWANCE_HOLDER = "0x0000000000001ff3684f28c67538d4d072c22734";
+/** LI.FI's Diamond: the only spender a cross-chain swap approves. Same address on every chain. */
+export const LIFI_DIAMOND = "0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae";
+/**
+ * Account implementations an `upgrade_account` may move to: the canonical
+ * set's, the same address on every chain. The first is live today; the
+ * second is the reviewed build that replaces it (contracts/canonical.env).
+ * Drop the first once the chains have moved.
+ */
+export const ACCOUNT_IMPLEMENTATIONS = ["0xf122b33015796a277227983d86412b2434755482", "0x137a9240690af9c37f817e44c49cbfec70ec594a"];
+const NATIVE = ["native", "0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "0x0000000000000000000000000000000000000000"];
+const EIP7702_MARKER = "0x7702000000000000000000000000000000000000";
+const lower = (a) => a.toLowerCase();
+const u128 = (v) => {
+    if (v < 0n || v >= 1n << 128n)
+        refuse("a gas value does not fit 128 bits");
+    return word(v).subarray(16);
+};
+const EIP712_DOMAIN = keccak256(utf8("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"));
+const PACKED_USEROP = keccak256(utf8("PackedUserOperation(address sender,uint256 nonce,bytes initCode,bytes callData,bytes32 accountGasLimits,uint256 preVerificationGas,bytes32 gasFees,bytes paymasterAndData)"));
+/** The EntryPoint v0.8 hash of an operation: what its passkey signs. */
+export function userOpHash(op, entryPoint, chainId) {
+    if (op.factory && lower(op.factory) === EIP7702_MARKER)
+        refuse("EIP-7702 operations are not Theoo's");
+    const initCode = op.factory ? concatBytes(hexToBytes(op.factory), hexToBytes(op.factoryData ?? "0x")) : new Uint8Array();
+    const paymasterAndData = op.paymaster
+        ? concatBytes(hexToBytes(op.paymaster), u128(toBig(op.paymasterVerificationGasLimit ?? 0)), u128(toBig(op.paymasterPostOpGasLimit ?? 0)), hexToBytes(op.paymasterData ?? "0x"))
+        : new Uint8Array();
+    const struct = keccak256(concatBytes(PACKED_USEROP, addressWord(op.sender), word(toBig(op.nonce)), keccak256(initCode), keccak256(hexToBytes(op.callData)), concatBytes(u128(toBig(op.verificationGasLimit)), u128(toBig(op.callGasLimit))), word(toBig(op.preVerificationGas)), concatBytes(u128(toBig(op.maxPriorityFeePerGas)), u128(toBig(op.maxFeePerGas))), keccak256(paymasterAndData)));
+    const domain = keccak256(concatBytes(EIP712_DOMAIN, keccak256(utf8("ERC4337")), keccak256(utf8("1")), word(BigInt(chainId)), addressWord(entryPoint)));
+    return keccak256(concatBytes(new Uint8Array([0x19, 0x01]), domain, struct));
+}
+/** The relayer-model account's own challenge: `keccak256(abi.encode(account, chainid, nonce, to, value, data))`. */
+export function legacyChallenge(account, chainId, nonce, call) {
+    const data = hexToBytes(call.data);
+    return keccak256(concatBytes(addressWord(account), word(BigInt(chainId)), word(nonce), addressWord(call.to), word(call.value), word(6n * 32n), word(BigInt(data.length)), padded(data)));
+}
+/** What the account's ERC-1271 check expects the passkey to have signed for `hash`. */
+export function replaySafeHash(account, chainId, hash) {
+    const domain = keccak256(concatBytes(EIP712_DOMAIN, keccak256(utf8("Theoo Account")), keccak256(utf8("1")), word(BigInt(chainId)), addressWord(account)));
+    const message = keccak256(concatBytes(keccak256(utf8("TheooMessage(bytes32 hash)")), hash));
+    return keccak256(concatBytes(new Uint8Array([0x19, 0x01]), domain, message));
+}
+/* ── reading the calls ────────────────────────────────────────────────── */
+const SEL = {
+    execute: selector("execute(address,uint256,bytes)"),
+    executeBatch: selector("executeBatch((address,uint256,bytes)[])"),
+    approve: selector("approve(address,uint256)"),
+    transfer: selector("transfer(address,uint256)"),
+    setGuardian: selector("setGuardian(address,bool,uint256)"),
+    cancelRecovery: selector("cancelRecovery()"),
+    grantSession: selector("grantSession(address,uint48,uint256,address)"),
+    grantSessionWithSelector: selector("grantSessionWithSelector(address,uint48,uint256,address,bytes4)"),
+    revokeSession: selector("revokeSession(address)"),
+    upgradeToAndCall: selector("upgradeToAndCall(address,bytes)"),
+    open: selector("open(bytes32,address,uint256,uint64)"),
+    release: selector("release(bytes32)"),
+    dispute: selector("dispute(bytes32)"),
+    markDelivered: selector("markDelivered(bytes32,bytes32)"),
+    fund: selector("fund(bytes32,address,uint256,address,uint64)"),
+    markSent: selector("markSent(bytes32,bytes32)"),
+};
+/** The calls an ERC-4337 operation's callData makes, as the account will run them. */
+export function decodeAccountCalls(callData) {
+    const { selector: sel, args } = splitCall(callData);
+    if (sel === SEL.execute)
+        return [{ to: args.address(0), value: args.uint(32), data: bytesToHex(args.bytes(64)) }];
+    if (sel === SEL.executeBatch) {
+        const arr = args.sub(0);
+        const n = Number(arr.uint(0));
+        if (n < 1 || n > 32)
+            refuse("the batch is empty or too long");
+        const items = new Reader(arr.data, arr.base + 32);
+        return Array.from({ length: n }, (_, i) => {
+            const t = items.sub(i * 32);
+            return { to: t.address(0), value: t.uint(32), data: bytesToHex(t.bytes(64)) };
+        });
+    }
+    return refuse("the operation does not call the account's execute or executeBatch");
+}
+const DEFAULT_MAX_FEE_WEI = 2n * 10n ** 16n;
+const same = (a, b) => lower(a) === lower(b);
+const isNative = (t) => NATIVE.includes(lower(t));
+const normData = (d) => lower(d && d !== "" ? d : "0x");
+function sameCalls(got, want) {
+    return (got.length === want.length &&
+        got.every((c, i) => same(c.to, want[i].to) && c.value === toBig(want[i].value ?? 0) && normData(c.data) === normData(want[i].data)));
+}
+function only(calls, n, what) {
+    if (calls.length !== n)
+        refuse(`${what} should be ${n === 1 ? "one call" : `${n} calls`}, not ${calls.length}`);
+}
+function selfCall(c, account, sel, what) {
+    if (!same(c.to, account))
+        refuse(`${what} must call the account itself`);
+    if (c.value !== 0n)
+        refuse(`${what} sends value`);
+    const s = splitCall(c.data);
+    if (s.selector !== sel)
+        refuse(`${what} calls something else`);
+    return s.args;
+}
+function call(c, sel, what) {
+    if (c.value !== 0n)
+        refuse(`${what} sends value`);
+    const s = splitCall(c.data);
+    if (s.selector !== sel)
+        refuse(`${what} calls something else`);
+    return s.args;
+}
+/**
+ * A quote's calls: approve exactly one spender for at most what the quote
+ * sells, use it, and leave nothing approved; or, selling the chain's own
+ * coin, one call carrying at most that much.
+ */
+function quoteSpend(calls, account, budget, spender, what) {
+    for (const c of calls)
+        if (same(c.to, account))
+            refuse(`${what} calls the account itself`);
+    if (calls.length === 1) {
+        const [c] = calls;
+        if (budget && !isNative(budget.token))
+            refuse(`${what} sells a token but approves nothing`);
+        if (budget && c.value > budget.amount + (budget.extraNative ?? 0n))
+            refuse(`${what} sends more than the quote`);
+        if (spender && !same(c.to, spender) && !budget)
+            refuse(`${what} goes somewhere unexpected`);
+        const s = splitCall(c.data).selector;
+        if (s === SEL.approve || s === SEL.transfer)
+            refuse(`${what} moves a token it shouldn't`);
+        return;
+    }
+    only(calls, 3, what);
+    const [first, use, last] = calls;
+    const a = call(first, SEL.approve, `${what}'s approval`);
+    const r = call(last, SEL.approve, `${what}'s reset`);
+    if (!same(first.to, last.to) || !same(a.address(0), r.address(0)))
+        refuse(`${what} resets a different approval`);
+    if (r.uint(32) !== 0n)
+        refuse(`${what} leaves an approval behind`);
+    if (spender && !same(a.address(0), spender))
+        refuse(`${what} approves an unexpected spender`);
+    if (!same(use.to, a.address(0)))
+        refuse(`${what} uses a different contract than it approved`);
+    if (budget) {
+        if (isNative(budget.token) || !same(first.to, budget.token))
+            refuse(`${what} approves another token`);
+        if (a.uint(32) > budget.amount)
+            refuse(`${what} approves more than the quote`);
+    }
+    if (use.value > (budget?.extraNative ?? 0n))
+        refuse(`${what} sends more of the chain's coin than the quote`);
+    const s = splitCall(use.data).selector;
+    if (s === SEL.approve || s === SEL.transfer)
+        refuse(`${what} moves a token it shouldn't`);
+}
+const keccakRef = (reference) => bytesToHex(keccak256(utf8(reference.trim())));
+// Operations the server builds from a quote or an order: what leaves the
+// account is bounded by its amount, so it has to be known.
+const NEEDS_BUDGET = new Set(["swap", "bridge", "espees_buy", "cash_out", "espees_sell_fund"]);
+/** The calls, against what was asked for. */
+export function checkCalls(kind, calls, account, o) {
+    if (NEEDS_BUDGET.has(kind.kind) && !o.budget)
+        refuse("pass the quote or order itself, not its id, so its amount can be checked");
+    switch (kind.kind) {
+        case "call":
+            if (!sameCalls(calls, [kind.call]))
+                refuse("the call isn't the one asked for");
+            return;
+        case "batch":
+            if (!sameCalls(calls, kind.calls))
+                refuse("the calls aren't the ones asked for");
+            return;
+        case "enable_recovery": {
+            only(calls, 1, "turning on recovery");
+            const a = selfCall(calls[0], account, SEL.setGuardian, "turning on recovery");
+            if (!a.bool(32))
+                refuse("turning on recovery removes a guardian");
+            return;
+        }
+        case "cancel_recovery":
+            only(calls, 1, "cancelling recovery");
+            selfCall(calls[0], account, SEL.cancelRecovery, "cancelling recovery");
+            return;
+        case "grant_session":
+        case "renew_session": {
+            only(calls, 1, "a session grant");
+            const c = calls[0];
+            const sel = splitCall(c.data).selector;
+            const narrowed = sel === SEL.grantSessionWithSelector;
+            const a = selfCall(c, account, narrowed ? SEL.grantSessionWithSelector : SEL.grantSession, "a session grant");
+            const s = kind.session;
+            if (a.uint(32) !== BigInt(s.expiresAt))
+                refuse("the session's expiry isn't the one asked for");
+            // A grant with no cap is a cap of zero. A renewal with none keeps the
+            // cap it had, which only the server knows.
+            const cap = kind.kind === "grant_session" ? toBig(s.spendCap ?? 0) : s.spendCap != null ? toBig(s.spendCap) : null;
+            if (cap !== null && a.uint(64) !== cap)
+                refuse("the session's spend cap isn't the one asked for");
+            if (kind.kind === "grant_session") {
+                if (!same(a.address(96), kind.session.target))
+                    refuse("the session's target isn't the one asked for");
+                const want = kind.session.selector ?? null;
+                if (want ? !narrowed || lower(a.bytes32(128).slice(0, 10)) !== lower(want) : narrowed)
+                    refuse("the session's function isn't the one asked for");
+            }
+            return;
+        }
+        case "revoke_session":
+            only(calls, 1, "revoking a session");
+            selfCall(calls[0], account, SEL.revokeSession, "revoking a session");
+            return;
+        case "upgrade_account": {
+            only(calls, 1, "an upgrade");
+            const a = selfCall(calls[0], account, SEL.upgradeToAndCall, "an upgrade");
+            if (!ACCOUNT_IMPLEMENTATIONS.includes(lower(a.address(0))))
+                refuse("the upgrade's target isn't a known Theoo account");
+            if (a.bytes(32).length !== 0)
+                refuse("the upgrade runs code as it lands");
+            return;
+        }
+        case "swap":
+            return quoteSpend(calls, account, o.budget, calls.length === 1 ? null : ALLOWANCE_HOLDER, "the swap");
+        case "bridge":
+            return quoteSpend(calls, account, o.budget, calls.length === 1 ? null : LIFI_DIAMOND, "the cross-chain swap");
+        case "espees_buy": {
+            only(calls, 2, "paying the desk");
+            const [approve, open] = calls;
+            const a = call(approve, SEL.approve, "paying the desk");
+            const p = call(open, SEL.open, "paying the desk");
+            if (!same(a.address(0), open.to))
+                refuse("paying the desk approves a different contract");
+            if (!same(p.address(32), approve.to) || p.uint(64) !== a.uint(32))
+                refuse("paying the desk pays a different amount or token");
+            if (o.budget && (!same(approve.to, o.budget.token) || a.uint(32) > o.budget.amount))
+                refuse("paying the desk pays more than the quote");
+            return;
+        }
+        case "espees_release":
+            only(calls, 1, "releasing the payment");
+            call(calls[0], SEL.release, "releasing the payment");
+            return;
+        case "espees_dispute":
+        case "espees_sell_dispute":
+            only(calls, 1, "a dispute");
+            call(calls[0], SEL.dispute, "a dispute");
+            return;
+        case "espees_sell_release":
+            only(calls, 1, "paying the seller");
+            call(calls[0], SEL.release, "paying the seller");
+            return;
+        case "desk_deliver": {
+            only(calls, 1, "marking it delivered");
+            const a = call(calls[0], SEL.markDelivered, "marking it delivered");
+            if (lower(a.bytes32(32)) !== keccakRef(kind.reference))
+                refuse("the delivery reference isn't the one given");
+            return;
+        }
+        case "espees_sell_sent": {
+            only(calls, 1, "saying it was sent");
+            const a = call(calls[0], SEL.markSent, "saying it was sent");
+            if (lower(a.bytes32(32)) !== keccakRef(kind.reference))
+                refuse("the reference isn't the one given");
+            return;
+        }
+        case "espees_sell_fund": {
+            only(calls, 2, "locking the payout");
+            const [approve, fund] = calls;
+            const a = call(approve, SEL.approve, "locking the payout");
+            const f = call(fund, SEL.fund, "locking the payout");
+            if (!same(a.address(0), fund.to))
+                refuse("locking the payout approves a different contract");
+            if (!same(f.address(32), approve.to) || f.uint(64) !== a.uint(32))
+                refuse("locking the payout locks a different amount or token");
+            if (o.budget && (!same(approve.to, o.budget.token) || a.uint(32) > o.budget.amount))
+                refuse("locking the payout locks more than the order");
+            return;
+        }
+        case "cash_out": {
+            only(calls, 1, "cashing out");
+            const t = call(calls[0], SEL.transfer, "cashing out");
+            if (o.budget && (!same(calls[0].to, o.budget.token) || t.uint(32) > o.budget.amount))
+                refuse("cashing out sends more than the quote");
+            return;
+        }
+        case "vault_create": {
+            only(calls, 1, "making a multisig");
+            const c = calls[0];
+            if (!same(c.to, VAULT_FACTORY))
+                refuse("making a multisig calls something other than the vault factory");
+            const a = call(c, VAULT_SEL.create, "making a multisig");
+            const owners = a.sub(0);
+            const n = Number(owners.uint(0));
+            const want = kind.vault.owners;
+            if (n !== want.length)
+                refuse("the multisig's owners aren't the ones asked for");
+            for (let i = 0; i < n; i++)
+                if (!same(owners.address(32 + 32 * i), want[i]))
+                    refuse("the multisig's owners aren't the ones asked for");
+            if (Number(a.uint(32)) !== kind.vault.threshold)
+                refuse("the multisig's threshold isn't the one asked for");
+            if (Number(a.uint(64)) !== (kind.vault.delay ?? 0))
+                refuse("the multisig's wait isn't the one asked for");
+            if (kind.vault.salt && lower(a.bytes32(96)) !== lower(kind.vault.salt))
+                refuse("the multisig's salt isn't the one asked for");
+            return;
+        }
+        case "vault_propose": {
+            const [first, ...rest] = calls;
+            if (!first)
+                refuse("a proposal makes no call");
+            if (!same(first.to, kind.vault) || first.value !== 0n)
+                refuse("the proposal goes to another vault");
+            let proposed = [];
+            try {
+                proposed = decodePropose(first.data);
+            }
+            catch {
+                refuse("the proposal isn't a proposal");
+            }
+            if (callsHash(proposed) !== callsHash(kind.calls))
+                refuse("the proposal's calls aren't the ones asked for");
+            vaultRun(rest, kind.vault, kind.run, null);
+            return;
+        }
+        case "vault_approve": {
+            const [first, ...rest] = calls;
+            if (!first || !same(first.to, kind.vault))
+                refuse("the approval goes to another vault");
+            const a = call(first, VAULT_SEL.approve, "an approval");
+            if (a.uint(0) !== BigInt(kind.proposal))
+                refuse("the approval is for another proposal");
+            if (lower(a.bytes32(32)) !== lower(kind.callsHash))
+                refuse("the approval names other calls than the ones shown");
+            vaultRun(rest, kind.vault, kind.run, kind.proposal);
+            return;
+        }
+        case "vault_revoke":
+        case "vault_reject":
+        case "vault_cancel":
+        case "vault_execute": {
+            const what = { vault_revoke: "revoke", vault_reject: "reject", vault_cancel: "cancel", vault_execute: "execute" };
+            only(calls, 1, `a vault ${what[kind.kind]}`);
+            const c = calls[0];
+            if (!same(c.to, kind.vault))
+                refuse("it goes to another vault");
+            const a = call(c, VAULT_SEL[what[kind.kind]], `a vault ${what[kind.kind]}`);
+            if (a.uint(0) !== BigInt(kind.proposal))
+                refuse("it's for another proposal");
+            return;
+        }
+        default:
+            return refuse(`this client doesn't know how to check a ${kind.kind}`);
+    }
+}
+/**
+ * The run a vault operation may carry after proposing or approving: nothing,
+ * or, when `run` isn't off, one `execute` on the same vault — of the very
+ * proposal approved, when that is known. A run can only ever run what its
+ * owners approved, but it should still be the one the user meant.
+ */
+function vaultRun(rest, vault, run, proposal) {
+    if (rest.length === 0)
+        return;
+    if (run === false || rest.length !== 1)
+        refuse("it does more than was asked");
+    const c = rest[0];
+    if (!same(c.to, vault))
+        refuse("it runs something in another vault");
+    const a = call(c, VAULT_SEL.execute, "running it");
+    if (proposal !== null && a.uint(0) !== BigInt(proposal))
+        refuse("it runs another proposal");
+}
+function challengeOf(prepared) {
+    const c = hexToBytes(prepared.challenge);
+    const fromOptions = prepared.webauthnOptions?.publicKey?.challenge;
+    if (typeof fromOptions !== "string" || !equalBytes(base64urlDecode(fromOptions), c)) {
+        refuse("the passkey would be asked to sign something other than the stated challenge");
+    }
+    return c;
+}
+/** Check a prepared EVM operation against what was asked for. Throws `SigningRefused`. */
+export function checkPrepared(kind, prepared, o = {}) {
+    if (o.chain !== undefined && prepared.chain !== o.chain)
+        refuse("it is for another chain");
+    const challenge = challengeOf(prepared);
+    const payload = prepared.payload;
+    let calls;
+    if (payload?.type === "userOp") {
+        const op = payload.userOp;
+        if (!same(op.sender, prepared.account))
+            refuse("it is for another account");
+        if (!equalBytes(userOpHash(op, payload.entryPoint, prepared.chain), challenge))
+            refuse("the challenge isn't the hash of the operation shown");
+        if (prepared.sponsored && !op.paymaster)
+            refuse("it says gas is paid for but nothing pays it");
+        if (!op.paymaster) {
+            const gas = toBig(op.callGasLimit) + toBig(op.verificationGasLimit) + toBig(op.preVerificationGas);
+            if (gas * toBig(op.maxFeePerGas) > (o.maxFeeWei ?? DEFAULT_MAX_FEE_WEI))
+                refuse("its network fee could be more than allowed");
+        }
+        calls = decodeAccountCalls(op.callData);
+        // The EntryPoint holds the account's gas deposit: a session that may call it may withdraw it.
+        if (kind.kind === "grant_session" && same(kind.session.target, payload.entryPoint))
+            refuse("a session may not target the EntryPoint");
+    }
+    else if (payload?.type === "legacy") {
+        const c = { to: payload.call.to, value: toBig(payload.call.value), data: payload.call.data };
+        if (!equalBytes(legacyChallenge(prepared.account, prepared.chain, toBig(payload.nonce), c), challenge)) {
+            refuse("the challenge isn't the hash of the call shown");
+        }
+        calls = [c];
+    }
+    else {
+        return refuse("the server didn't say what the passkey would sign");
+    }
+    checkCalls(kind, calls, prepared.account, o);
+}
+/** Check a message-signing request: the hash is the message's, and the challenge is what the account expects for it. */
+export function checkSignBegin(req, begun) {
+    let want;
+    if (req.message !== undefined)
+        want = hashMessage(req.message);
+    else if (req.typedData !== undefined) {
+        try {
+            want = hashTypedData(req.typedData);
+        }
+        catch (e) {
+            return refuse(`the typed data can't be checked here (${e instanceof Error ? e.message : e})`);
+        }
+    }
+    else if (req.hash !== undefined)
+        want = hexToBytes(req.hash);
+    else
+        return refuse("nothing to sign");
+    if (!equalBytes(hexToBytes(begun.hash), want))
+        refuse("the hash isn't the message's");
+    const challenge = challengeOf(begun);
+    if (!equalBytes(replaySafeHash(begun.account, begun.chain, want), challenge))
+        refuse("the challenge isn't for this account and message");
+}
+const le = (b, off, n) => {
+    let v = 0n;
+    for (let i = n - 1; i >= 0; i--)
+        v = (v << 8n) | BigInt(b[off + i]);
+    return v;
+};
+function decodeAction(b, at = 0) {
+    const need = (n) => {
+        if (at + n > b.length)
+            refuse("the Solana action ends early");
+    };
+    need(1);
+    const tag = b[at];
+    switch (tag) {
+        case 1:
+            need(41);
+            return [{ tag, to: b.slice(at + 1, at + 33), lamports: le(b, at + 33, 8) }, 41];
+        case 2: {
+            need(34);
+            const program = b.slice(at + 1, at + 33);
+            const n = b[at + 33];
+            let p = at + 34;
+            const accounts = [];
+            for (let i = 0; i < n; i++) {
+                need(p - at + 34);
+                accounts.push({ key: b.slice(p, p + 32), signer: b[p + 32] === 1, writable: b[p + 33] === 1 });
+                p += 34;
+            }
+            need(p - at + 2);
+            const len = Number(le(b, p, 2));
+            need(p - at + 2 + len);
+            return [{ tag, program, accounts, data: b.slice(p + 2, p + 2 + len) }, p + 2 + len - at];
+        }
+        case 3:
+            need(35);
+            return [{ tag, guardian: b.slice(at + 1, at + 33), on: b[at + 33] === 1, threshold: b[at + 34] }, 35];
+        case 4:
+            return [{ tag }, 1];
+        case 5:
+            need(81);
+            return [{ tag, key: b.slice(at + 1, at + 33), target: b.slice(at + 33, at + 65), expiresAt: le(b, at + 65, 8), spendCap: le(b, at + 73, 8) }, 81];
+        case 6:
+            need(33);
+            return [{ tag, key: b.slice(at + 1, at + 33) }, 33];
+        case 7: {
+            need(2);
+            const n = b[at + 1];
+            let p = at + 2;
+            const actions = [];
+            for (let i = 0; i < n; i++) {
+                const [a, used] = decodeAction(b, p);
+                actions.push(a);
+                p += used;
+            }
+            return [{ tag, actions }, p - at];
+        }
+        default:
+            return refuse("the Solana action is of an unknown kind");
+    }
+}
+const is = (m, key, signer, writable) => !!m && equalBytes(m.key, typeof key === "string" ? pubkeyBytes(key) : key) && m.signer === signer && m.writable === writable;
+/**
+ * A vault action the server wrote, checked as exactly what was asked: the
+ * vault program, the vault, the proposal, the hash, and the user's own
+ * account as the owner. The only other signer allowed is a payer for the
+ * rent of what it creates — never the user's account, whose funds the
+ * program cannot take for rent anyway.
+ */
+function sameVaultAction(got, want, account) {
+    if (got.tag !== 2 || !equalBytes(got.program, pubkeyBytes(SOLANA_VAULT_PROGRAM)))
+        return false;
+    const [a0, a1, a2, a3, a4, a5] = got.accounts;
+    const d = got.data;
+    const me = pubkeyBytes(account);
+    const payer = (m) => !!m && m.signer && m.writable && !equalBytes(m.key, me);
+    switch (want.kind) {
+        case "vault_create": {
+            const v = want.vault;
+            const n = v.owners.length;
+            if (got.accounts.length !== 3 || !payer(a0) || !is(a2, SYSTEM_PROGRAM, false, false))
+                return false;
+            if (d.length !== 1 + 1 + 32 * n + 1 + 8 + 32 || d[0] !== SOLANA_VAULT_TAG.create || d[1] !== n)
+                return false;
+            const owners = concatBytes(...v.owners.map(pubkeyBytes));
+            const salt = d.slice(2 + 32 * n + 9);
+            if (!equalBytes(d.slice(2, 2 + 32 * n), owners) || d[2 + 32 * n] !== v.threshold)
+                return false;
+            if (!equalBytes(d.slice(3 + 32 * n, 11 + 32 * n), u64le(v.delay ?? 0)))
+                return false;
+            if (v.salt && !equalBytes(salt, hexToBytes(v.salt)))
+                return false;
+            // The vault it makes is where these settings put it.
+            const at = predictSolanaVault(v.owners, v.threshold, v.delay ?? 0, bytesToHex(salt));
+            return is(a1, at.config, false, true);
+        }
+        case "vault_propose":
+            return (got.accounts.length === 6 &&
+                !!a0 && isSolanaVault(a0.key, want.vault) && !a0.signer && a0.writable &&
+                !!a1 && !a1.signer && a1.writable &&
+                is(a2, me, true, false) &&
+                payer(a3) &&
+                is(a4, SYSTEM_PROGRAM, false, false) &&
+                is(a5, INSTRUCTIONS_SYSVAR, false, false) &&
+                equalBytes(d, concatBytes(new Uint8Array([SOLANA_VAULT_TAG.propose]), encodeSolanaCalls(want.calls))));
+        case "vault_approve":
+        case "vault_revoke":
+        case "vault_reject":
+        case "vault_cancel": {
+            if (got.accounts.length !== 4 || !a0 || !isSolanaVault(a0.key, want.vault) || a0.signer || a0.writable)
+                return false;
+            if (!is(a1, solanaProposalAddress(base58Encode(a0.key), want.proposal), false, true) || !is(a2, me, true, false))
+                return false;
+            if (!is(a3, INSTRUCTIONS_SYSVAR, false, false))
+                return false;
+            const head = concatBytes(new Uint8Array([SOLANA_VAULT_TAG[want.kind.slice(6)]]), u64le(want.proposal));
+            const tail = want.kind === "vault_approve" ? hexToBytes(want.callsHash) : new Uint8Array();
+            return tail.length === (want.kind === "vault_approve" ? 32 : 0) && equalBytes(d, concatBytes(head, tail));
+        }
+        default:
+            return false;
+    }
+}
+function sameAction(got, want, account) {
+    switch (want.kind) {
+        case "transfer":
+            return got.tag === 1 && equalBytes(got.to, pubkeyBytes(want.to)) && got.lamports === BigInt(want.lamports);
+        case "invoke":
+            return (got.tag === 2 &&
+                equalBytes(got.program, pubkeyBytes(want.programId)) &&
+                got.accounts.length === want.accounts.length &&
+                got.accounts.every((a, i) => equalBytes(a.key, pubkeyBytes(want.accounts[i].pubkey)) &&
+                    a.signer === !!want.accounts[i].isSigner &&
+                    a.writable === !!want.accounts[i].isWritable) &&
+                equalBytes(got.data, base64Decode(want.data)));
+        case "batch":
+            return got.tag === 7 && got.actions.length === want.actions.length && got.actions.every((a, i) => sameAction(a, want.actions[i], account));
+        case "enable_recovery":
+            return got.tag === 3 && got.on;
+        case "cancel_recovery":
+            return got.tag === 4;
+        case "grant_session":
+            return (got.tag === 5 &&
+                equalBytes(got.target, pubkeyBytes(want.session.target)) &&
+                got.expiresAt === BigInt(want.session.expiresAt) &&
+                got.spendCap === BigInt(want.session.spendCap ?? 0));
+        case "renew_session":
+            return got.tag === 5 && got.expiresAt === BigInt(want.session.expiresAt) && (want.session.spendCap == null || got.spendCap === BigInt(want.session.spendCap));
+        case "revoke_session":
+            return got.tag === 6;
+        case "vault_create":
+        case "vault_propose":
+        case "vault_approve":
+        case "vault_revoke":
+        case "vault_reject":
+        case "vault_cancel":
+            return sameVaultAction(got, want, account);
+        default:
+            return false;
+    }
+}
+/** The Solana program's challenge: `sha256("theoo/solana/v1" ‖ program ‖ account ‖ nonce ‖ sha256(action))`. */
+export function solanaChallenge(programId, account, nonce, action) {
+    return sha256(concatBytes(utf8("theoo/solana/v1"), pubkeyBytes(programId), pubkeyBytes(account), (() => {
+        const b = new Uint8Array(8);
+        let n = nonce;
+        for (let i = 0; i < 8; i++) {
+            b[i] = Number(n & 0xffn);
+            n >>= 8n;
+        }
+        return b;
+    })(), sha256(action)));
+}
+/** Check a prepared Solana operation against the action asked for. Throws `SigningRefused`. */
+export function checkPreparedSolana(action, prepared) {
+    if (!prepared.programId || !prepared.action)
+        refuse("the server didn't say what the passkey would sign");
+    const challenge = challengeOf(prepared);
+    const bytes = hexToBytes(prepared.action);
+    const [decoded, used] = decodeAction(bytes);
+    if (used !== bytes.length)
+        refuse("the Solana action has trailing bytes");
+    let same = false;
+    try {
+        same = sameAction(decoded, action, prepared.account);
+    }
+    catch {
+        // An address or hex string that doesn't parse is not what was asked for.
+    }
+    if (!same)
+        refuse("the Solana action isn't the one asked for");
+    if (!equalBytes(solanaChallenge(prepared.programId, prepared.account, BigInt(prepared.nonce), bytes), challenge)) {
+        refuse("the challenge isn't the hash of the action shown");
+    }
+}
+//# sourceMappingURL=verify.js.map