@bwalletx/connect 0.4.1 → 0.5.0

package/dist/index.cjs

@@ -30,21 +30,28 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  ACCESS_ERROR_STATUS: () => ACCESS_ERROR_STATUS,
+  ACCESS_PROTOCOL: () => ACCESS_PROTOCOL,
+  ACCESS_VERSION: () => ACCESS_VERSION,
+  AccessError: () => AccessError,
   BRC29_PROTOCOL: () => BRC29_PROTOCOL,
   BWALLETX_RDNS: () => BWALLETX_RDNS,
   GET_URL: () => GET_URL,
   LOGIN_PROTOCOL: () => LOGIN_PROTOCOL,
   LOGO_URL: () => LOGO_URL,
+  PROTOCOL_MEDIA: () => PROTOCOL_MEDIA,
   PaymentError: () => PaymentError,
   RDNS_EXTENSION: () => RDNS_EXTENSION,
   RDNS_MOBILE: () => RDNS_MOBILE,
   SIGNIN_CSS: () => SIGNIN_CSS,
   SIGNIN_TAG: () => SIGNIN_TAG,
   WEB_WALLET_URL: () => WEB_WALLET_URL,
+  accessErrorMessage: () => accessErrorMessage,
   amountInSats: () => amountInSats,
   brc100Option: () => brc100Option,
   buildAuthorizeUrl: () => buildAuthorizeUrl,
   buyToken: () => buyToken,
+  canonicalJson: () => canonicalJson,
   clearPairing: () => clearPairing,
   connectBwalletX: () => connectBwalletX,
   defineBwalletxSignin: () => defineBwalletxSignin,
@@ -61,13 +68,18 @@ __export(src_exports, {
   pairingOption: () => pairingOption,
   pay: () => pay,
   pickWallet: () => pickWallet,
+  protocolMediaUrl: () => protocolMediaUrl,
+  proveHoldings: () => proveHoldings,
   qrSvg: () => qrSvg,
   renderButton: () => renderButton,
+  requestAccess: () => requestAccess,
   resolvePaymailP2P: () => resolvePaymailP2P,
   restorePairing: () => restorePairing,
   signInWithBwalletX: () => signInWithBwalletX,
   signinText: () => signinText,
-  tip: () => tip
+  throwIfAccessError: () => throwIfAccessError,
+  tip: () => tip,
+  toAccessError: () => toAccessError
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -541,6 +553,239 @@ function renderButton(el2, opts = {}) {
   return b;
 }
 
+// src/access-client.ts
+var import_sdk3 = require("@bsv/sdk");
+
+// src/access.ts
+var ACCESS_VERSION = 1;
+var ACCESS_PROTOCOL = [2, "bwalletx access"];
+var MAX_HOLDING_PROOFS = 50;
+var ACCESS_ERROR_STATUS = {
+  not_installed: 424,
+  user_rejected: 403,
+  wrong_account: 409,
+  insufficient_tokens: 403,
+  identity_level_too_low: 403,
+  kyc_required: 403,
+  indexer_unavailable: 503,
+  expired: 401,
+  replay: 401,
+  invalid_signature: 401,
+  bad_request: 400
+};
+var AccessError = class extends Error {
+  code;
+  have;
+  need;
+  constructor(code, message, extra = {}) {
+    super(message ?? code);
+    this.name = "AccessError";
+    this.code = code;
+    this.have = extra.have;
+    this.need = extra.need;
+  }
+  toJSON() {
+    const b = { error: this.code, message: this.message };
+    if (this.have !== void 0) b.have = this.have;
+    if (this.need !== void 0) b.need = this.need;
+    return b;
+  }
+};
+var PROTOCOL_MEDIA = {
+  "401": { name: "Identity", color: "#22c55e", video: "assets/protocol/401.mp4", poster: "assets/protocol/401.jpg" },
+  "402": { name: "Payment", color: "#3b82f6", video: "assets/protocol/402.mp4", poster: "assets/protocol/402.jpg" },
+  "403": { name: "Access", color: "#ef4444", video: "assets/protocol/403.mp4", poster: "assets/protocol/403.jpg" }
+};
+function protocolMediaUrl(kind, which, version = "latest") {
+  return `https://unpkg.com/@bwalletx/connect@${version}/${PROTOCOL_MEDIA[kind][which]}`;
+}
+function canonicalJson(v) {
+  if (v === null) return "null";
+  if (typeof v === "string" || typeof v === "boolean") return JSON.stringify(v);
+  if (typeof v === "number") {
+    if (!Number.isFinite(v)) throw new Error("canonicalJson: non-finite number");
+    return JSON.stringify(v);
+  }
+  if (Array.isArray(v)) return `[${v.map((x) => canonicalJson(x)).join(",")}]`;
+  if (typeof v === "object") {
+    const o = v;
+    const keys = Object.keys(o).filter((k) => o[k] !== void 0).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported ${typeof v}`);
+}
+function challengeBytes(challenge) {
+  return Array.from(new TextEncoder().encode(challenge));
+}
+var TOKEN_ID = /^bsv21:[0-9a-f]{64}_\d{1,6}$/;
+var RAW = /^[1-9]\d{0,38}$/;
+function normaliseRequirement(r) {
+  if (!r || typeof r !== "object") throw new AccessError("bad_request", "require must be an object");
+  const req = r;
+  const out = {};
+  if (req.token !== void 0) {
+    const t = req.token;
+    if (!t || typeof t !== "object" || typeof t.id !== "string") throw new AccessError("bad_request", "require.token.id is required");
+    const id = t.id.trim().toLowerCase();
+    if (!TOKEN_ID.test(id)) throw new AccessError("bad_request", "require.token.id must be 'bsv21:<txid>_<vout>'");
+    const hasMin = t.min !== void 0;
+    const hasBps = t.minBps !== void 0;
+    if (hasMin === hasBps) throw new AccessError("bad_request", "require.token needs exactly one of min or minBps");
+    out.token = { id };
+    if (hasMin) {
+      if (typeof t.min !== "string" || !RAW.test(t.min)) throw new AccessError("bad_request", "require.token.min must be a positive integer string (raw units)");
+      out.token.min = t.min;
+    } else {
+      if (!Number.isInteger(t.minBps) || t.minBps < 1 || t.minBps > 1e4) {
+        throw new AccessError("bad_request", "require.token.minBps must be an integer 1..10000");
+      }
+      out.token.minBps = t.minBps;
+    }
+  }
+  if (req.identityLevel !== void 0) {
+    if (!Number.isInteger(req.identityLevel) || req.identityLevel < 1 || req.identityLevel > 10) {
+      throw new AccessError("bad_request", "require.identityLevel must be an integer 1..10");
+    }
+    out.identityLevel = req.identityLevel;
+  }
+  if (req.kyc !== void 0) {
+    if (typeof req.kyc !== "boolean") throw new AccessError("bad_request", "require.kyc must be a boolean");
+    if (req.kyc) out.kyc = true;
+  }
+  if (!out.token && !out.identityLevel && !out.kyc) throw new AccessError("bad_request", "require is empty");
+  return out;
+}
+function parseAccessChallenge(s) {
+  if (typeof s !== "string" || s.length > 4096) throw new AccessError("bad_request", "challenge must be a string");
+  let c;
+  try {
+    c = JSON.parse(s);
+  } catch {
+    throw new AccessError("bad_request", "challenge is not JSON");
+  }
+  if (!c || typeof c !== "object" || c.v !== 1) throw new AccessError("bad_request", "unsupported challenge version");
+  if (c.kind !== "401" && c.kind !== "402" && c.kind !== "403") throw new AccessError("bad_request", "bad kind");
+  if (typeof c.origin !== "string" || typeof c.nonce !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(c.nonce)) {
+    throw new AccessError("bad_request", "bad origin or nonce");
+  }
+  if (!Number.isInteger(c.iat) || !Number.isInteger(c.exp) || c.exp <= c.iat) throw new AccessError("bad_request", "bad iat/exp");
+  if (c.sub !== void 0 && (typeof c.sub !== "string" || !/^0[23][0-9a-f]{64}$/.test(c.sub))) throw new AccessError("bad_request", "bad sub");
+  c.require = normaliseRequirement(c.require);
+  if (canonicalJson(c) !== s) throw new AccessError("bad_request", "challenge is not canonical");
+  return c;
+}
+function accessErrorMessage(code, e = {}) {
+  switch (code) {
+    case "not_installed":
+      return "No bWalletX (or other BRC-100 wallet) was found.";
+    case "user_rejected":
+      return "The request was declined in the wallet.";
+    case "wrong_account":
+      return "The wallet is signed in to a different account than this site expects.";
+    case "insufficient_tokens":
+      return `Not enough tokens: holding ${e.have ?? 0}, need ${e.need ?? "?"}.`;
+    case "identity_level_too_low":
+      return `Identity level ${e.have ?? 0} is below the required level ${e.need ?? "?"}.`;
+    case "kyc_required":
+      return "A verified identity (KYC) is required.";
+    case "indexer_unavailable":
+      return "Holdings could not be checked right now. Try again shortly.";
+    case "expired":
+      return "The request expired. Try again.";
+    case "replay":
+      return "That request was already used. Try again.";
+    case "invalid_signature":
+      return "The wallet signature did not verify.";
+    case "bad_request":
+      return "The request was malformed.";
+  }
+}
+
+// src/access-client.ts
+var ONESAT = [0, "onesat"];
+var LEGACY_ONESAT = [0, "p 1sat"];
+function toAccessError(e) {
+  if (e instanceof AccessError) return e;
+  const err = e;
+  const msg = String(err?.message ?? e ?? "");
+  if (err?.code === "NOT_FOUND") return new AccessError("not_installed", msg);
+  if (/reject|denied|declin|cancel|user/i.test(msg) || err?.code === "ERR_USER_REJECTED" || err?.status === 4001) {
+    return new AccessError("user_rejected", msg);
+  }
+  return new AccessError("bad_request", msg || "access failed");
+}
+function throwIfAccessError(body) {
+  const b = body;
+  if (b && typeof b.error === "string") throw new AccessError(b.error, b.message, { have: b.have, need: b.need });
+}
+function hash160FromP2pkh(script) {
+  const m = /^76a914([0-9a-f]{40})88ac$/i.exec(script.slice(-50));
+  return m ? m[1].toLowerCase() : null;
+}
+async function proveHoldings(wallet, challenge, tokenId, basket = "bsv21") {
+  const bare = tokenId.replace(/^bsv21:/, "");
+  const list = await wallet.listOutputs({ basket, include: "locking scripts", includeCustomInstructions: true, limit: 1e4 });
+  const byKey = /* @__PURE__ */ new Map();
+  const data = challengeBytes(challenge);
+  for (const out of list.outputs) {
+    if (byKey.size >= MAX_HOLDING_PROOFS) break;
+    let ci = {};
+    try {
+      ci = JSON.parse(out.customInstructions ?? "{}");
+    } catch {
+      continue;
+    }
+    if (ci.id !== bare || !ci.keyID) continue;
+    const want = out.lockingScript ? hash160FromP2pkh(out.lockingScript) : null;
+    const counterparty = ci.counterparty ?? "self";
+    for (const protocolID of ci.protocolID ? [ci.protocolID] : [ONESAT, LEGACY_ONESAT]) {
+      const { publicKey } = await wallet.getPublicKey({ protocolID, keyID: ci.keyID, counterparty });
+      const h = import_sdk3.Utils.toHex(import_sdk3.Hash.hash160(import_sdk3.PublicKey.fromString(publicKey).encode(true)));
+      if (want && h !== want) continue;
+      const existing = byKey.get(publicKey);
+      if (existing) {
+        existing.outpoints.push(out.outpoint.replace(".", "_"));
+        break;
+      }
+      const { signature } = await wallet.createSignature({ protocolID, keyID: ci.keyID, counterparty, data });
+      byKey.set(publicKey, { pubkey: publicKey, signature: Array.from(signature), outpoints: [out.outpoint.replace(".", "_")] });
+      break;
+    }
+  }
+  return [...byKey.values()];
+}
+async function requestAccess(o) {
+  let wallet;
+  try {
+    ({ wallet } = await connectBwalletX({ wallet: o.wallet, pairing: o.pairing, discoverMs: o.discoverMs }));
+  } catch (e) {
+    throw e?.code === "NOT_FOUND" ? new AccessError("not_installed") : toAccessError(e);
+  }
+  try {
+    const { publicKey: identityKey } = await wallet.getPublicKey({ identityKey: true });
+    const { challenge } = await o.challenge(identityKey);
+    const c = parseAccessChallenge(challenge);
+    if (c.sub && c.sub !== identityKey.toLowerCase()) throw new AccessError("wrong_account");
+    if (Date.now() / 1e3 >= c.exp) throw new AccessError("expired");
+    const { signature } = await wallet.createSignature({
+      protocolID: ACCESS_PROTOCOL,
+      keyID: c.nonce,
+      counterparty: "anyone",
+      data: challengeBytes(challenge)
+    });
+    const response = { v: 1, challenge, identityKey, signature: Array.from(signature) };
+    if (c.require.token) response.holdings = await proveHoldings(wallet, challenge, c.require.token.id, o.tokenBasket);
+    let verified;
+    if (o.verify) {
+      verified = await o.verify(response);
+      throwIfAccessError(verified);
+    }
+    return { response, verified, wallet };
+  } catch (e) {
+    throw toAccessError(e);
+  }
+}
+
 // src/element.ts
 var SIGNIN_TAG = "bwalletx-signin";
 var GET_URL = "https://bwalletx.com/get";
@@ -636,6 +881,10 @@ async function postJson(url, body) {
   if (!res.ok) throw new Error(data.error ?? `HTTP ${res.status}`);
   return data;
 }
+async function postAccess(url, body) {
+  const res = await fetch(url, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  return res.json().catch(() => ({ error: "bad_request", message: `HTTP ${res.status}` }));
+}
 var OBSERVED = ["size", "theme", "label", "brand", "subtitle", "loading", "disabled", "full-width", "aria-label", "get-url", "web-url"];
 function createClass() {
   return class BwalletxSigninElement extends HTMLElement {
@@ -718,6 +967,26 @@ function createClass() {
         if (!found) {
           this.#notFound = true;
           this.#emit("bwalletx-not-found");
+          if (this.#attr("require-token")) this.#emit("bwalletx-access-denied", { code: "not_installed", message: "No wallet found" });
+          return;
+        }
+        const requireToken = this.#attr("require-token");
+        if (requireToken) {
+          const verifyUrl2 = this.#attr("verify-url");
+          const min = this.#attr("min");
+          const minBps = this.#attr("min-bps");
+          const hint = { token: { id: requireToken, ...minBps ? { minBps: Number(minBps) } : { min: min ?? "1" } } };
+          try {
+            const a = await requestAccess({
+              wallet: found.wallet,
+              challenge: (identityKey) => postJson(challengeUrl, { identityKey, require: hint }),
+              verify: verifyUrl2 ? (response2) => postAccess(verifyUrl2, response2) : void 0
+            });
+            this.#emit("bwalletx-access-granted", { identityKey: a.response.identityKey, response: a.verified });
+          } catch (e) {
+            const err = e instanceof AccessError ? e : new AccessError("bad_request", String(e));
+            this.#emit("bwalletx-access-denied", { code: err.code, message: err.message, have: err.have, need: err.need });
+          }
           return;
         }
         const r = await signInWithBwalletX({ wallet: found.wallet, challenge: (identityKey) => postJson(challengeUrl, { identityKey }) });
@@ -742,7 +1011,7 @@ function defineBwalletxSignin(tag = SIGNIN_TAG) {
 }
 
 // src/pay.ts
-var import_sdk3 = require("@bsv/sdk");
+var import_sdk4 = require("@bsv/sdk");
 var BRC29_PROTOCOL = [2, "3241645161d8"];
 var PaymentError = class extends Error {
   constructor(code, message, maybeSent = false, cause) {
@@ -762,13 +1031,13 @@ var isPaymail = (s) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
 function randomB64(n) {
   const b = new Uint8Array(n);
   globalThis.crypto.getRandomValues(b);
-  return import_sdk3.Utils.toBase64(Array.from(b));
+  return import_sdk4.Utils.toBase64(Array.from(b));
 }
 function opReturn(text) {
-  const d = import_sdk3.Utils.toArray(text, "utf8");
+  const d = import_sdk4.Utils.toArray(text, "utf8");
   const len = d.length;
   const push = len < 76 ? [len] : len <= 255 ? [76, len] : [77, len & 255, len >> 8];
-  return import_sdk3.Utils.toHex([0, 106, ...push, ...d]);
+  return import_sdk4.Utils.toHex([0, 106, ...push, ...d]);
 }
 var clip = (s, n) => s.length > n ? s.slice(0, n - 1) + "\u2026" : s;
 var describe = (s) => clip(s.length < 5 ? `${s} payment`.trim() : s, 50);
@@ -864,7 +1133,7 @@ async function pay(source, req, o = {}) {
     } catch (e) {
       throw new PaymentError("WALLET_ERROR", `The wallet could not derive the payment key: ${e.message}`, false, e);
     }
-    outputs = [{ script: new import_sdk3.P2PKH().lock(import_sdk3.PublicKey.fromString(pk).toHash()).toHex(), satoshis: sats, description: "payment" }];
+    outputs = [{ script: new import_sdk4.P2PKH().lock(import_sdk4.PublicKey.fromString(pk).toHash()).toHex(), satoshis: sats, description: "payment" }];
     remittance = { senderIdentityKey: me, derivationPrefix, derivationSuffix, outputIndex: 0 };
   } else if (isPaymail(to)) {
     const r2 = await (o.resolvePaymail ?? ((p, s) => resolvePaymailP2P(p, s, o.fetch ?? fetch)))(to, sats);
@@ -872,7 +1141,7 @@ async function pay(source, req, o = {}) {
     submit = r2.submit;
   } else {
     try {
-      outputs = [{ script: new import_sdk3.P2PKH().lock(to).toHex(), satoshis: sats, description: "payment" }];
+      outputs = [{ script: new import_sdk4.P2PKH().lock(to).toHex(), satoshis: sats, description: "payment" }];
     } catch {
       throw new PaymentError("BAD_REQUEST", `Not a paymail, address or identity key: ${to}`);
     }
@@ -882,7 +1151,7 @@ async function pay(source, req, o = {}) {
   if (!r.txid) throw new PaymentError("WALLET_ERROR", "The wallet did not return a txid", true);
   const tx = r.tx ? Array.from(r.tx) : void 0;
   if (submit && tx) {
-    await submit(import_sdk3.Transaction.fromAtomicBEEF(tx).toHex()).catch(() => {
+    await submit(import_sdk4.Transaction.fromAtomicBEEF(tx).toHex()).catch(() => {
     });
   }
   return { txid: r.txid, tx, sats, outputs, remittance };
@@ -903,7 +1172,7 @@ async function buyToken(source, req) {
 }
 
 // src/wallets.ts
-var import_sdk4 = require("@bsv/sdk");
+var import_sdk5 = require("@bsv/sdk");
 async function brc100Connected(wallet, o) {
   await wallet.waitForAuthentication({}).catch(() => {
   });
@@ -962,7 +1231,7 @@ function handcashAdapter(o) {
 var NAMES = { [RDNS_EXTENSION]: "bWalletX", "space.bwallet.mobile": "bWalletX" };
 async function probe(substrate, ms) {
   try {
-    const w = new import_sdk4.WalletClient(substrate);
+    const w = new import_sdk5.WalletClient(substrate);
     const ok = await Promise.race([w.isAuthenticated({}).then(() => true), new Promise((r) => setTimeout(() => r(false), ms))]);
     return ok ? w : null;
   } catch {
@@ -1120,21 +1389,28 @@ function pickWallet(options, o = {}) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCESS_ERROR_STATUS,
+  ACCESS_PROTOCOL,
+  ACCESS_VERSION,
+  AccessError,
   BRC29_PROTOCOL,
   BWALLETX_RDNS,
   GET_URL,
   LOGIN_PROTOCOL,
   LOGO_URL,
+  PROTOCOL_MEDIA,
   PaymentError,
   RDNS_EXTENSION,
   RDNS_MOBILE,
   SIGNIN_CSS,
   SIGNIN_TAG,
   WEB_WALLET_URL,
+  accessErrorMessage,
   amountInSats,
   brc100Option,
   buildAuthorizeUrl,
   buyToken,
+  canonicalJson,
   clearPairing,
   connectBwalletX,
   defineBwalletxSignin,
@@ -1151,12 +1427,17 @@ function pickWallet(options, o = {}) {
   pairingOption,
   pay,
   pickWallet,
+  protocolMediaUrl,
+  proveHoldings,
   qrSvg,
   renderButton,
+  requestAccess,
   resolvePaymailP2P,
   restorePairing,
   signInWithBwalletX,
   signinText,
-  tip
+  throwIfAccessError,
+  tip,
+  toAccessError
 });
 //# sourceMappingURL=index.cjs.map