@chipi-stack/backend 14.7.0 → 14.9.0

package/dist/index.js

@@ -392,6 +392,9 @@ function ed25519PubkeyFelts(publicKey) {
   const { low, high } = bytesToLeU256(publicKey);
   return [low, high];
 }
+function ed25519OwnerPubkeyParam(publicKey) {
+  return ed25519PubkeyFelts(publicKey).map((f) => "0x" + f.toString(16)).join(",");
+}
 async function buildEd25519Envelope(params) {
   const ownerIndex = params.ownerIndex ?? 0n;
   if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {
@@ -502,6 +505,14 @@ var init_encryption2 = __esm({
     init_encryption();
   }
 });
+
+// src/shhh/signers/stark.ts
+var stark_exports = {};
+__export(stark_exports, {
+  buildStarkEnvelope: () => buildStarkEnvelope,
+  starkOwnerId: () => starkOwnerId,
+  starkPubkeyFelts: () => starkPubkeyFelts
+});
 function buildStarkEnvelope(params) {
   const pkHex = "0x" + (typeof params.privateKey === "bigint" ? params.privateKey : BigInt(params.privateKey)).toString(16).padStart(64, "0");
   const sig = starknet.ec.starkCurve.sign("0x" + params.messageHash.toString(16), pkHex);
@@ -952,7 +963,15 @@ var executePaymasterTransaction = async ({
         usePasskey ? "encryptKey is required when using passkey. The passkey authentication should have provided the encryptKey." : "encryptKey is required for transaction execution"
       );
     }
-    const walletType = wallet.walletType ?? "READY";
+    let walletType = wallet.walletType ?? "READY";
+    if (!wallet.walletType) {
+      try {
+        const resolveProvider = new starknet.RpcProvider({ nodeUrl: shared.WALLET_RPC_ENDPOINTS.CHIPI });
+        const onChainClassHash = await resolveProvider.getClassHashAt(wallet.publicKey, "latest");
+        walletType = shared.getWalletTypeFromClassHash(onChainClassHash) ?? "READY";
+      } catch {
+      }
+    }
     if (walletType === "SHHH") {
       const { executeShhhSponsoredRaw: executeShhhSponsoredRaw2 } = await Promise.resolve().then(() => (init_execute_paymaster_raw(), execute_paymaster_raw_exports));
       const shhhSignerKind = (wallet.signerKind ?? "STARK") || "STARK";
@@ -2826,6 +2845,79 @@ var ChipiSessions = class {
     }
   }
 };
+var ChipiTreasury = class {
+  constructor(client, apiSecretKey) {
+    this.client = client;
+    this.apiSecretKey = apiSecretKey;
+  }
+  base(treasuryId) {
+    return `${shared.API_ENDPOINTS.TREASURIES}/${treasuryId}/transactions`;
+  }
+  /** Resolve a `sk_` for the secret-gated reads/execute, or fail loudly. */
+  secret(bearerToken) {
+    const token = bearerToken ?? this.apiSecretKey;
+    if (!token) {
+      throw new Error(
+        "A secret key (sk_) is required for treasury execute / list / allowance. Pass `bearerToken` to forTreasury(...) or configure the SDK with apiSecretKey. Call these from a server, never the browser."
+      );
+    }
+    return token;
+  }
+  /**
+   * Build a {@link TreasuryTransport} for one treasury + owner. Wire the
+   * returned object directly into chipi-react's `useProposeAction` /
+   * `useTreasuryProposals` `transport` prop, or call its methods yourself.
+   */
+  forTreasury(config) {
+    const { treasuryId, ownerPubkey } = config;
+    const base = this.base(treasuryId);
+    return {
+      // sk_ — read the proposal list. chipi-back returns
+      // { items, total, page, limit, hasMore }; the hook only reads `items`.
+      list: async () => {
+        const res = await this.client.get({
+          endpoint: base,
+          bearerToken: this.secret(config.bearerToken)
+        });
+        return { ...res, items: res.items ?? [] };
+      },
+      // pk_ + owner sig — no secret. `ownerPubkey` lets the backend verify the
+      // proposer envelope. `meta` (if present) is stripped server-side.
+      propose: async (body) => {
+        return this.client.post({
+          endpoint: base,
+          // Empty string → no Authorization header; the pk_ travels in
+          // x-api-key, which ApiKeyGuard accepts for propose.
+          bearerToken: "",
+          body: { ...body, ownerPubkey }
+        });
+      },
+      // pk_ + owner sig — approve an existing proposal.
+      sign: async (proposalId, body) => {
+        return this.client.post({
+          endpoint: `${base}/${proposalId}/sign`,
+          bearerToken: "",
+          body: { ...body, ownerPubkey }
+        });
+      },
+      // sk_ — relay the assembled threshold calldata through the paymaster.
+      execute: async (proposalId, calldata) => {
+        return this.client.post({
+          endpoint: `${base}/${proposalId}/execute`,
+          bearerToken: this.secret(config.bearerToken),
+          body: { calldata }
+        });
+      },
+      // sk_ — the free-execute meter (org-scoped).
+      getMultisigAllowance: async () => {
+        return this.client.get({
+          endpoint: `${shared.API_ENDPOINTS.TREASURIES}/${treasuryId}/multisig-allowance`,
+          bearerToken: this.secret(config.bearerToken)
+        });
+      }
+    };
+  }
+};
 var InMemoryNonceStore = class {
   constructor() {
     this.used = /* @__PURE__ */ new Set();
@@ -3092,6 +3184,43 @@ var signTypedData = async ({
     throw error;
   }
 };
+function toFeltHex(x) {
+  return "0x" + x.toString(16).padStart(64, "0");
+}
+var signTypedDataArray = async ({
+  params
+}) => {
+  const { encryptKey, wallet, typedData: typedData2 } = params;
+  if (!encryptKey) throw new Error("encryptKey is required for signing typed data");
+  if (!wallet || !wallet.encryptedPrivateKey || !wallet.publicKey) {
+    throw new Error("wallet with publicKey and encryptedPrivateKey is required");
+  }
+  if (!typedData2) throw new Error("typedData is required for signing");
+  const walletType = wallet.walletType ?? "READY";
+  if (!Object.prototype.hasOwnProperty.call(shared.WALLET_RPC_ENDPOINTS, walletType)) {
+    throw new Error(`Unsupported wallet type: "${String(walletType)}"`);
+  }
+  let privateKeyDecrypted;
+  try {
+    privateKeyDecrypted = exports.decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);
+  } catch {
+    throw new Error("Failed to decrypt private key. Verify the encryptKey is correct.");
+  }
+  const messageHash = BigInt(starknet.typedData.getMessageHash(typedData2, wallet.publicKey));
+  if (walletType === "SHHH") {
+    const { buildStarkEnvelope: buildStarkEnvelope2 } = await Promise.resolve().then(() => (init_stark(), stark_exports));
+    const envelope = buildStarkEnvelope2({
+      privateKey: privateKeyDecrypted,
+      messageHash,
+      ownerIndex: 0n
+    });
+    return envelope.map(toFeltHex);
+  }
+  const provider = new starknet.RpcProvider({ nodeUrl: shared.WALLET_RPC_ENDPOINTS[walletType] });
+  const account = new starknet.Account({ provider, address: wallet.publicKey, signer: privateKeyDecrypted });
+  const { r, s } = normalizeSignature(await account.signMessage(typedData2));
+  return [r, s];
+};
 
 // src/chipi-sdk.ts
 var ChipiSDK = class {
@@ -3105,6 +3234,7 @@ var ChipiSDK = class {
     this.skus = new ChipiSkus(this.client);
     this.sessions = new ChipiSessions(this.client);
     this.exchanges = new ChipiExchanges(this.client);
+    this.treasury = new ChipiTreasury(this.client, config.apiSecretKey);
     this.executeTransaction = this.executeTransaction.bind(this);
     this.executeTransactionWithSession = this.executeTransactionWithSession.bind(this);
     this.transfer = this.transfer.bind(this);
@@ -3115,6 +3245,7 @@ var ChipiSDK = class {
     this.purchaseSku = this.purchaseSku.bind(this);
     this.getUsdAmount = this.getUsdAmount.bind(this);
     this.signTypedData = this.signTypedData.bind(this);
+    this.signTypedDataArray = this.signTypedDataArray.bind(this);
     this.createPaymasterAdapter = this.createPaymasterAdapter.bind(this);
     this.createX402Facilitator = this.createX402Facilitator.bind(this);
   }
@@ -3243,6 +3374,14 @@ var ChipiSDK = class {
   async signTypedData({ params }) {
     return signTypedData({ params });
   }
+  /**
+   * Sign SNIP-12 typed data and return the full signature span (felt strings) —
+   * the shape a dApp's `wallet_signTypedData` expects. Wallet-type aware:
+   * SHHH returns the V2_SNIP12 owner envelope; standard accounts return [r, s].
+   */
+  async signTypedDataArray({ params }) {
+    return signTypedDataArray({ params });
+  }
   /**
    * Transfer tokens
    */
@@ -3765,6 +3904,12 @@ function eip191PubkeyFelts(pubkey) {
 function eip191OwnerId(pubkey) {
   return ownerCommitment(EIP191_KIND_TAG_FELT, eip191PubkeyFelts(pubkey));
 }
+function eip191OwnerPubkeyParam(pubkey) {
+  assertBytes("secp256k1 x coordinate", pubkey.x, 32);
+  assertBytes("secp256k1 y coordinate", pubkey.y, 32);
+  const toHex = (b) => "0x" + Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+  return `${toHex(pubkey.x)},${toHex(pubkey.y)}`;
+}
 function parseEip191Signature(signatureHex) {
   const hex = signatureHex.startsWith("0x") ? signatureHex.slice(2) : signatureHex;
   if (hex.length !== 130) {
@@ -3987,6 +4132,12 @@ function webauthnPubkeyFelts(pub) {
 function webauthnOwnerId(pub) {
   return ownerCommitment(WEBAUTHN_KIND_TAG_FELT, webauthnPubkeyFelts(pub));
 }
+function webauthnOwnerPubkeyParam(pub) {
+  assertBytes2("P-256 x coordinate", pub.x, 32);
+  assertBytes2("P-256 y coordinate", pub.y, 32);
+  const toHex = (b) => "0x" + Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+  return `${toHex(pub.x)},${toHex(pub.y)}`;
+}
 function buildWebAuthnEnvelopeFromAssertion(params) {
   const ownerIndex = params.ownerIndex ?? 0n;
   if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {
@@ -4542,6 +4693,82 @@ function secondsUntilExecutable(validAfterSecs, nowSecs) {
 init_threshold();
 init_execute_paymaster_raw();
 
+// src/shhh/account.ts
+init_oe();
+init_stark();
+init_execute_paymaster_raw();
+function generateNonce2() {
+  return BigInt(Date.now()) << 24n | BigInt(Math.floor(Math.random() * 16777216));
+}
+var ShhhAccount = class {
+  constructor(provider, address, privateKey, options = {}) {
+    this.provider = provider;
+    this.address = address;
+    this.privateKey = privateKey;
+    this.ownerIndex = options.ownerIndex ?? 0n;
+    this.chainId = options.chainId ?? resolveShhhChainId({});
+    this.submitFn = options.submit;
+  }
+  /**
+   * Build + sign an OutsideExecution for `calls` and return the
+   * serialized `execute_from_outside_v2` calldata (plus the underlying
+   * pieces). Use this when you want to broadcast the calldata yourself.
+   */
+  async signExecution(calls, options = {}) {
+    if (options.validForSeconds !== void 0) {
+      const maxValid = exports.MAX_OE_VALIDITY_WINDOW_SECONDS - OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER;
+      if (!Number.isFinite(options.validForSeconds) || options.validForSeconds <= 0) {
+        throw new Error(
+          "ShhhAccount: validForSeconds must be a positive finite number of seconds."
+        );
+      }
+      if (options.validForSeconds > maxValid) {
+        throw new Error(
+          `ShhhAccount: validForSeconds (${options.validForSeconds}) exceeds the max ${maxValid}s (the account caps the OE window at ${exports.MAX_OE_VALIDITY_WINDOW_SECONDS}s and ${OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER}s is reserved for clock skew).`
+        );
+      }
+    }
+    const outsideExecution = buildOutsideExecution({
+      nonce: options.nonce ?? generateNonce2(),
+      calls,
+      ...options.validForSeconds !== void 0 ? { executeBefore: BigInt(Math.floor(Date.now() / 1e3) + options.validForSeconds) } : {}
+    });
+    const messageHash = computeOeHash(outsideExecution, this.address, this.chainId);
+    const signature = buildStarkEnvelope({
+      privateKey: this.privateKey,
+      messageHash,
+      ownerIndex: this.ownerIndex
+    });
+    const calldata = serializeExecuteFromOutsideV2Calldata({ outsideExecution, signature });
+    return { outsideExecution, signature, messageHash, calldata };
+  }
+  /**
+   * Sign `calls` and broadcast them via the configured `submit` strategy.
+   * Mirrors starknet.js `Account.execute` ergonomically. Returns the
+   * transaction hash without waiting for inclusion — use
+   * `provider.waitForTransaction(transactionHash)` if you need to block.
+   */
+  async execute(calls, options = {}) {
+    if (!this.submitFn) {
+      throw new Error(
+        "ShhhAccount.execute: no submit strategy configured. Pass `submit` in the ShhhAccount constructor options (e.g. submitViaAccount(fundedAccount) for self-sovereign, or a paymaster relay for gasless), or call signExecution() and broadcast the calldata yourself."
+      );
+    }
+    const { calldata } = await this.signExecution(calls, options);
+    return this.submitFn({ accountAddress: this.address, calldata });
+  }
+};
+function submitViaAccount(funded) {
+  return async ({ accountAddress, calldata }) => {
+    const { transaction_hash } = await funded.execute({
+      contractAddress: accountAddress,
+      entrypoint: "execute_from_outside_v2",
+      calldata
+    });
+    return { transactionHash: transaction_hash };
+  };
+}
+
 Object.defineProperty(exports, "Chain", {
   enumerable: true,
   get: function () { return types.Chain; }
@@ -4565,6 +4792,7 @@ exports.ChipiSessions = ChipiSessions;
 exports.ChipiSkuPurchases = ChipiSkuPurchases;
 exports.ChipiSkus = ChipiSkus;
 exports.ChipiTransactions = ChipiTransactions;
+exports.ChipiTreasury = ChipiTreasury;
 exports.ChipiWallets = ChipiWallets;
 exports.DEFAULT_OP_EXPIRY_SECONDS = DEFAULT_OP_EXPIRY_SECONDS;
 exports.OP_ADD_OWNER = OP_ADD_OWNER;
@@ -4573,6 +4801,7 @@ exports.OP_ROTATE_OWNER = OP_ROTATE_OWNER;
 exports.OP_SET_THRESHOLD = OP_SET_THRESHOLD;
 exports.ROLE_GUARDIAN = ROLE_GUARDIAN;
 exports.ROLE_OWNER = ROLE_OWNER;
+exports.ShhhAccount = ShhhAccount;
 exports.TIMELOCK_SECONDS = TIMELOCK_SECONDS;
 exports.VIEW_SELECTORS = VIEW_SELECTORS;
 exports.X402Facilitator = X402Facilitator;
@@ -4611,9 +4840,11 @@ exports.computeOeHash = computeOeHash;
 exports.computeShhhAddress = computeShhhAddress;
 exports.computeSnip12Hash = computeSnip12Hash;
 exports.ed25519OwnerId = ed25519OwnerId;
+exports.ed25519OwnerPubkeyParam = ed25519OwnerPubkeyParam;
 exports.ed25519PubkeyFelts = ed25519PubkeyFelts;
 exports.ed25519SignedBytes = ed25519SignedBytes;
 exports.eip191OwnerId = eip191OwnerId;
+exports.eip191OwnerPubkeyParam = eip191OwnerPubkeyParam;
 exports.eip191PubkeyFelts = eip191PubkeyFelts;
 exports.estimateThresholdGasOverhead = estimateThresholdGasOverhead;
 exports.executeShhhSponsoredRaw = executeShhhSponsoredRaw;
@@ -4639,10 +4870,13 @@ exports.secondsUntilExecutable = secondsUntilExecutable;
 exports.serializeExecuteFromOutsideV2Calldata = serializeExecuteFromOutsideV2Calldata;
 exports.signBootstrapMessage = signBootstrapMessage;
 exports.signTypedData = signTypedData;
+exports.signTypedDataArray = signTypedDataArray;
 exports.snip12HashToHexAsciiBytes = snip12HashToHexAsciiBytes;
 exports.starkOwnerId = starkOwnerId;
 exports.starkPubkeyFelts = starkPubkeyFelts;
+exports.submitViaAccount = submitViaAccount;
 exports.webauthnOwnerId = webauthnOwnerId;
+exports.webauthnOwnerPubkeyParam = webauthnOwnerPubkeyParam;
 exports.webauthnPubkeyFelts = webauthnPubkeyFelts;
 exports.wrapV2Snip12Envelope = wrapV2Snip12Envelope;
 exports.wrapV2ThresholdEnvelope = wrapV2ThresholdEnvelope;