Version 0.59.1

Fixed an address on the sign-in and account-creation screens that could send you to another site right after you signed in.

Both screens read a destination out of the address so they can return you to where you were going, and a specially formed value slipped past the check, pointed off this site, and the browser followed it. Anyone who clicked a link built that way was affected: the sign-in was real, and the page they landed on afterwards was not ours. It matters here more than elsewhere, because everything in NMTS rests on one secret you type — so a page that asks for your account code again is the whole attack. The destination is now rebuilt as a path inside this site rather than checked, so no spelling of it can point outward.

Added two checks before the built-in wallet signs: the bytes must be a Sui transaction, and it must be sent by your own wallet.

The wallet key lives in a separate worker and only signatures come back out, but until now the worker signed whatever it was handed as long as a key was loaded. Sui lets one party send a transaction while another pays for it, and the payer signs too — so a signature over somebody else's transaction would have made your wallet pay for their work. The wallet does not check what a transaction does, and cannot: sending, donating and exchanging are all things you legitimately sign. That layer is guarded by the rules that keep foreign code off the page in the first place.

Removed a way to ask the worker for a file key in raw form. Nothing used it.

The worker hands out handles, not keys: a handle only means something inside it and dies with the session. One method returned a file key itself, for a public-link feature that has not shipped, and it had no callers. A key that leaves lasts forever, so it is gone until the feature that needs it arrives with its own rules for handing one out.