@chipi-stack/backend 14.7.0 → 14.9.0

package/dist/index.mjs

@@ -387,6 +387,9 @@ function ed25519PubkeyFelts(publicKey) {
   const { low, high } = bytesToLeU256(publicKey);
   return [low, high];
 }
+function ed25519OwnerPubkeyParam(publicKey) {
+  return ed25519PubkeyFelts(publicKey).map((f) => "0x" + f.toString(16)).join(",");
+}
 async function buildEd25519Envelope(params) {
   const ownerIndex = params.ownerIndex ?? 0n;
   if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {
@@ -497,6 +500,14 @@ var init_encryption2 = __esm({
     init_encryption();
   }
 });
+
+// src/shhh/signers/stark.ts
+var stark_exports = {};
+__export(stark_exports, {
+  buildStarkEnvelope: () => buildStarkEnvelope,
+  starkOwnerId: () => starkOwnerId,
+  starkPubkeyFelts: () => starkPubkeyFelts
+});
 function buildStarkEnvelope(params) {
   const pkHex = "0x" + (typeof params.privateKey === "bigint" ? params.privateKey : BigInt(params.privateKey)).toString(16).padStart(64, "0");
   const sig = ec.starkCurve.sign("0x" + params.messageHash.toString(16), pkHex);
@@ -947,7 +958,15 @@ var executePaymasterTransaction = async ({
         usePasskey ? "encryptKey is required when using passkey. The passkey authentication should have provided the encryptKey." : "encryptKey is required for transaction execution"
       );
     }
-    const walletType = wallet.walletType ?? "READY";
+    let walletType = wallet.walletType ?? "READY";
+    if (!wallet.walletType) {
+      try {
+        const resolveProvider = new RpcProvider({ nodeUrl: WALLET_RPC_ENDPOINTS.CHIPI });
+        const onChainClassHash = await resolveProvider.getClassHashAt(wallet.publicKey, "latest");
+        walletType = getWalletTypeFromClassHash(onChainClassHash) ?? "READY";
+      } catch {
+      }
+    }
     if (walletType === "SHHH") {
       const { executeShhhSponsoredRaw: executeShhhSponsoredRaw2 } = await Promise.resolve().then(() => (init_execute_paymaster_raw(), execute_paymaster_raw_exports));
       const shhhSignerKind = (wallet.signerKind ?? "STARK") || "STARK";
@@ -2821,6 +2840,79 @@ var ChipiSessions = class {
     }
   }
 };
+var ChipiTreasury = class {
+  constructor(client, apiSecretKey) {
+    this.client = client;
+    this.apiSecretKey = apiSecretKey;
+  }
+  base(treasuryId) {
+    return `${API_ENDPOINTS.TREASURIES}/${treasuryId}/transactions`;
+  }
+  /** Resolve a `sk_` for the secret-gated reads/execute, or fail loudly. */
+  secret(bearerToken) {
+    const token = bearerToken ?? this.apiSecretKey;
+    if (!token) {
+      throw new Error(
+        "A secret key (sk_) is required for treasury execute / list / allowance. Pass `bearerToken` to forTreasury(...) or configure the SDK with apiSecretKey. Call these from a server, never the browser."
+      );
+    }
+    return token;
+  }
+  /**
+   * Build a {@link TreasuryTransport} for one treasury + owner. Wire the
+   * returned object directly into chipi-react's `useProposeAction` /
+   * `useTreasuryProposals` `transport` prop, or call its methods yourself.
+   */
+  forTreasury(config) {
+    const { treasuryId, ownerPubkey } = config;
+    const base = this.base(treasuryId);
+    return {
+      // sk_ — read the proposal list. chipi-back returns
+      // { items, total, page, limit, hasMore }; the hook only reads `items`.
+      list: async () => {
+        const res = await this.client.get({
+          endpoint: base,
+          bearerToken: this.secret(config.bearerToken)
+        });
+        return { ...res, items: res.items ?? [] };
+      },
+      // pk_ + owner sig — no secret. `ownerPubkey` lets the backend verify the
+      // proposer envelope. `meta` (if present) is stripped server-side.
+      propose: async (body) => {
+        return this.client.post({
+          endpoint: base,
+          // Empty string → no Authorization header; the pk_ travels in
+          // x-api-key, which ApiKeyGuard accepts for propose.
+          bearerToken: "",
+          body: { ...body, ownerPubkey }
+        });
+      },
+      // pk_ + owner sig — approve an existing proposal.
+      sign: async (proposalId, body) => {
+        return this.client.post({
+          endpoint: `${base}/${proposalId}/sign`,
+          bearerToken: "",
+          body: { ...body, ownerPubkey }
+        });
+      },
+      // sk_ — relay the assembled threshold calldata through the paymaster.
+      execute: async (proposalId, calldata) => {
+        return this.client.post({
+          endpoint: `${base}/${proposalId}/execute`,
+          bearerToken: this.secret(config.bearerToken),
+          body: { calldata }
+        });
+      },
+      // sk_ — the free-execute meter (org-scoped).
+      getMultisigAllowance: async () => {
+        return this.client.get({
+          endpoint: `${API_ENDPOINTS.TREASURIES}/${treasuryId}/multisig-allowance`,
+          bearerToken: this.secret(config.bearerToken)
+        });
+      }
+    };
+  }
+};
 var InMemoryNonceStore = class {
   constructor() {
     this.used = /* @__PURE__ */ new Set();
@@ -3087,6 +3179,43 @@ var signTypedData = async ({
     throw error;
   }
 };
+function toFeltHex(x) {
+  return "0x" + x.toString(16).padStart(64, "0");
+}
+var signTypedDataArray = async ({
+  params
+}) => {
+  const { encryptKey, wallet, typedData: typedData2 } = params;
+  if (!encryptKey) throw new Error("encryptKey is required for signing typed data");
+  if (!wallet || !wallet.encryptedPrivateKey || !wallet.publicKey) {
+    throw new Error("wallet with publicKey and encryptedPrivateKey is required");
+  }
+  if (!typedData2) throw new Error("typedData is required for signing");
+  const walletType = wallet.walletType ?? "READY";
+  if (!Object.prototype.hasOwnProperty.call(WALLET_RPC_ENDPOINTS, walletType)) {
+    throw new Error(`Unsupported wallet type: "${String(walletType)}"`);
+  }
+  let privateKeyDecrypted;
+  try {
+    privateKeyDecrypted = decryptPrivateKey(wallet.encryptedPrivateKey, encryptKey);
+  } catch {
+    throw new Error("Failed to decrypt private key. Verify the encryptKey is correct.");
+  }
+  const messageHash = BigInt(typedData.getMessageHash(typedData2, wallet.publicKey));
+  if (walletType === "SHHH") {
+    const { buildStarkEnvelope: buildStarkEnvelope2 } = await Promise.resolve().then(() => (init_stark(), stark_exports));
+    const envelope = buildStarkEnvelope2({
+      privateKey: privateKeyDecrypted,
+      messageHash,
+      ownerIndex: 0n
+    });
+    return envelope.map(toFeltHex);
+  }
+  const provider = new RpcProvider({ nodeUrl: WALLET_RPC_ENDPOINTS[walletType] });
+  const account = new Account({ provider, address: wallet.publicKey, signer: privateKeyDecrypted });
+  const { r, s } = normalizeSignature(await account.signMessage(typedData2));
+  return [r, s];
+};
 
 // src/chipi-sdk.ts
 var ChipiSDK = class {
@@ -3100,6 +3229,7 @@ var ChipiSDK = class {
     this.skus = new ChipiSkus(this.client);
     this.sessions = new ChipiSessions(this.client);
     this.exchanges = new ChipiExchanges(this.client);
+    this.treasury = new ChipiTreasury(this.client, config.apiSecretKey);
     this.executeTransaction = this.executeTransaction.bind(this);
     this.executeTransactionWithSession = this.executeTransactionWithSession.bind(this);
     this.transfer = this.transfer.bind(this);
@@ -3110,6 +3240,7 @@ var ChipiSDK = class {
     this.purchaseSku = this.purchaseSku.bind(this);
     this.getUsdAmount = this.getUsdAmount.bind(this);
     this.signTypedData = this.signTypedData.bind(this);
+    this.signTypedDataArray = this.signTypedDataArray.bind(this);
     this.createPaymasterAdapter = this.createPaymasterAdapter.bind(this);
     this.createX402Facilitator = this.createX402Facilitator.bind(this);
   }
@@ -3238,6 +3369,14 @@ var ChipiSDK = class {
   async signTypedData({ params }) {
     return signTypedData({ params });
   }
+  /**
+   * Sign SNIP-12 typed data and return the full signature span (felt strings) —
+   * the shape a dApp's `wallet_signTypedData` expects. Wallet-type aware:
+   * SHHH returns the V2_SNIP12 owner envelope; standard accounts return [r, s].
+   */
+  async signTypedDataArray({ params }) {
+    return signTypedDataArray({ params });
+  }
   /**
    * Transfer tokens
    */
@@ -3760,6 +3899,12 @@ function eip191PubkeyFelts(pubkey) {
 function eip191OwnerId(pubkey) {
   return ownerCommitment(EIP191_KIND_TAG_FELT, eip191PubkeyFelts(pubkey));
 }
+function eip191OwnerPubkeyParam(pubkey) {
+  assertBytes("secp256k1 x coordinate", pubkey.x, 32);
+  assertBytes("secp256k1 y coordinate", pubkey.y, 32);
+  const toHex = (b) => "0x" + Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+  return `${toHex(pubkey.x)},${toHex(pubkey.y)}`;
+}
 function parseEip191Signature(signatureHex) {
   const hex = signatureHex.startsWith("0x") ? signatureHex.slice(2) : signatureHex;
   if (hex.length !== 130) {
@@ -3982,6 +4127,12 @@ function webauthnPubkeyFelts(pub) {
 function webauthnOwnerId(pub) {
   return ownerCommitment(WEBAUTHN_KIND_TAG_FELT, webauthnPubkeyFelts(pub));
 }
+function webauthnOwnerPubkeyParam(pub) {
+  assertBytes2("P-256 x coordinate", pub.x, 32);
+  assertBytes2("P-256 y coordinate", pub.y, 32);
+  const toHex = (b) => "0x" + Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+  return `${toHex(pub.x)},${toHex(pub.y)}`;
+}
 function buildWebAuthnEnvelopeFromAssertion(params) {
   const ownerIndex = params.ownerIndex ?? 0n;
   if (ownerIndex < 0n || ownerIndex >= 0x100000000n) {
@@ -4537,6 +4688,82 @@ function secondsUntilExecutable(validAfterSecs, nowSecs) {
 init_threshold();
 init_execute_paymaster_raw();
 
-export { ANY_CALLER_FELT, APPLE_ISSUER, BOOTSTRAP_DOMAIN_SEPARATOR, ChipiBrowserSDK, ChipiClient, ChipiPaymasterAdapter, ChipiSDK, ChipiServerSDK, ChipiSessions, ChipiSkuPurchases, ChipiSkus, ChipiTransactions, ChipiWallets, DEFAULT_OP_EXPIRY_SECONDS, ISIGNER_CANONICAL_LABEL, ISIGNER_ID, ISRC9_V2_ID, MAX_OE_VALIDITY_WINDOW_SECONDS, MIN_THRESHOLD_OWNERS, OE_DOMAIN_NAME, OE_DOMAIN_REVISION, OE_DOMAIN_VERSION, OP_ADD_OWNER, OP_REMOVE_OWNER, OP_ROTATE_OWNER, OP_SET_THRESHOLD, ROLE_GUARDIAN, ROLE_OWNER, SIG_VERSION_V1_HEX_ASCII, SIG_VERSION_V2_SNIP12, SIG_VERSION_V2_THRESHOLD, STARKNET_MESSAGE_PREFIX, TIMELOCK_SECONDS, VIEW_SELECTORS, X402Facilitator, X402ShhhClient, assertValidV2Snip12Envelope, buildBootstrapSignedCall, buildCancelPendingOpCall, buildCancelRecoveryCall, buildEd25519Envelope, buildEd25519EnvelopeFromSignature, buildEip191EnvelopeFromPrivateKey, buildEip191EnvelopeFromSignature, buildExecuteAddOwnerCall, buildExecuteRemoveOwnerCall, buildExecuteRotateOwnerCall, buildExecuteSetThresholdCall, buildFinalizeRecoveryCall, buildInitiateRecoveryCall, buildJwtAppleSubEnvelopeFromTestKey, buildJwtAppleSubEnvelopeFromTokenResponse, buildMigrationCalls, buildOutsideExecution, buildProposeAddOwnerCall, buildProposeRemoveOwnerCall, buildProposeRotateOwnerCall, buildProposeSetThresholdCall, buildStarkEnvelope, buildThresholdEnvelope, buildWebAuthnEnvelopeFromAssertion, buildWebAuthnEnvelopeFromPrivateKey, byteArrayToFelts, computeAddressSalt, computeBootstrapMessage, computeISignerId, computeOeHash, computeShhhAddress, computeSnip12Hash, decryptPrivateKey, ed25519OwnerId, ed25519PubkeyFelts, ed25519SignedBytes, eip191OwnerId, eip191PubkeyFelts, encryptPrivateKey, estimateThresholdGasOverhead, executeShhhSponsoredRaw, hashCall, hashCalls, hashOutsideExecutionStruct, hashStarknetDomain, isReadyToExecute, jwtAppleSubHash, jwtAppleSubOwnerId, jwtAppleSubPubkeyFelts, labelToFelt, locateSubClaim, messageHashToNonceB64url, migrateChipiWalletToShhh, ownerCommitment, parseAppleIdToken, parseDerEcdsaSignature, parseEip191Signature, parseThresholdEnvelope, resolveShhhChainId, secondsUntilExecutable, serializeExecuteFromOutsideV2Calldata, signBootstrapMessage, signTypedData, snip12HashToHexAsciiBytes, starkOwnerId, starkPubkeyFelts, webauthnOwnerId, webauthnPubkeyFelts, wrapV2Snip12Envelope, wrapV2ThresholdEnvelope, x402Middleware };
+// src/shhh/account.ts
+init_oe();
+init_stark();
+init_execute_paymaster_raw();
+function generateNonce2() {
+  return BigInt(Date.now()) << 24n | BigInt(Math.floor(Math.random() * 16777216));
+}
+var ShhhAccount = class {
+  constructor(provider, address, privateKey, options = {}) {
+    this.provider = provider;
+    this.address = address;
+    this.privateKey = privateKey;
+    this.ownerIndex = options.ownerIndex ?? 0n;
+    this.chainId = options.chainId ?? resolveShhhChainId({});
+    this.submitFn = options.submit;
+  }
+  /**
+   * Build + sign an OutsideExecution for `calls` and return the
+   * serialized `execute_from_outside_v2` calldata (plus the underlying
+   * pieces). Use this when you want to broadcast the calldata yourself.
+   */
+  async signExecution(calls, options = {}) {
+    if (options.validForSeconds !== void 0) {
+      const maxValid = MAX_OE_VALIDITY_WINDOW_SECONDS - OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER;
+      if (!Number.isFinite(options.validForSeconds) || options.validForSeconds <= 0) {
+        throw new Error(
+          "ShhhAccount: validForSeconds must be a positive finite number of seconds."
+        );
+      }
+      if (options.validForSeconds > maxValid) {
+        throw new Error(
+          `ShhhAccount: validForSeconds (${options.validForSeconds}) exceeds the max ${maxValid}s (the account caps the OE window at ${MAX_OE_VALIDITY_WINDOW_SECONDS}s and ${OE_EXECUTE_AFTER_CLOCK_SKEW_BUFFER}s is reserved for clock skew).`
+        );
+      }
+    }
+    const outsideExecution = buildOutsideExecution({
+      nonce: options.nonce ?? generateNonce2(),
+      calls,
+      ...options.validForSeconds !== void 0 ? { executeBefore: BigInt(Math.floor(Date.now() / 1e3) + options.validForSeconds) } : {}
+    });
+    const messageHash = computeOeHash(outsideExecution, this.address, this.chainId);
+    const signature = buildStarkEnvelope({
+      privateKey: this.privateKey,
+      messageHash,
+      ownerIndex: this.ownerIndex
+    });
+    const calldata = serializeExecuteFromOutsideV2Calldata({ outsideExecution, signature });
+    return { outsideExecution, signature, messageHash, calldata };
+  }
+  /**
+   * Sign `calls` and broadcast them via the configured `submit` strategy.
+   * Mirrors starknet.js `Account.execute` ergonomically. Returns the
+   * transaction hash without waiting for inclusion — use
+   * `provider.waitForTransaction(transactionHash)` if you need to block.
+   */
+  async execute(calls, options = {}) {
+    if (!this.submitFn) {
+      throw new Error(
+        "ShhhAccount.execute: no submit strategy configured. Pass `submit` in the ShhhAccount constructor options (e.g. submitViaAccount(fundedAccount) for self-sovereign, or a paymaster relay for gasless), or call signExecution() and broadcast the calldata yourself."
+      );
+    }
+    const { calldata } = await this.signExecution(calls, options);
+    return this.submitFn({ accountAddress: this.address, calldata });
+  }
+};
+function submitViaAccount(funded) {
+  return async ({ accountAddress, calldata }) => {
+    const { transaction_hash } = await funded.execute({
+      contractAddress: accountAddress,
+      entrypoint: "execute_from_outside_v2",
+      calldata
+    });
+    return { transactionHash: transaction_hash };
+  };
+}
+
+export { ANY_CALLER_FELT, APPLE_ISSUER, BOOTSTRAP_DOMAIN_SEPARATOR, ChipiBrowserSDK, ChipiClient, ChipiPaymasterAdapter, ChipiSDK, ChipiServerSDK, ChipiSessions, ChipiSkuPurchases, ChipiSkus, ChipiTransactions, ChipiTreasury, ChipiWallets, DEFAULT_OP_EXPIRY_SECONDS, ISIGNER_CANONICAL_LABEL, ISIGNER_ID, ISRC9_V2_ID, MAX_OE_VALIDITY_WINDOW_SECONDS, MIN_THRESHOLD_OWNERS, OE_DOMAIN_NAME, OE_DOMAIN_REVISION, OE_DOMAIN_VERSION, OP_ADD_OWNER, OP_REMOVE_OWNER, OP_ROTATE_OWNER, OP_SET_THRESHOLD, ROLE_GUARDIAN, ROLE_OWNER, SIG_VERSION_V1_HEX_ASCII, SIG_VERSION_V2_SNIP12, SIG_VERSION_V2_THRESHOLD, STARKNET_MESSAGE_PREFIX, ShhhAccount, TIMELOCK_SECONDS, VIEW_SELECTORS, X402Facilitator, X402ShhhClient, assertValidV2Snip12Envelope, buildBootstrapSignedCall, buildCancelPendingOpCall, buildCancelRecoveryCall, buildEd25519Envelope, buildEd25519EnvelopeFromSignature, buildEip191EnvelopeFromPrivateKey, buildEip191EnvelopeFromSignature, buildExecuteAddOwnerCall, buildExecuteRemoveOwnerCall, buildExecuteRotateOwnerCall, buildExecuteSetThresholdCall, buildFinalizeRecoveryCall, buildInitiateRecoveryCall, buildJwtAppleSubEnvelopeFromTestKey, buildJwtAppleSubEnvelopeFromTokenResponse, buildMigrationCalls, buildOutsideExecution, buildProposeAddOwnerCall, buildProposeRemoveOwnerCall, buildProposeRotateOwnerCall, buildProposeSetThresholdCall, buildStarkEnvelope, buildThresholdEnvelope, buildWebAuthnEnvelopeFromAssertion, buildWebAuthnEnvelopeFromPrivateKey, byteArrayToFelts, computeAddressSalt, computeBootstrapMessage, computeISignerId, computeOeHash, computeShhhAddress, computeSnip12Hash, decryptPrivateKey, ed25519OwnerId, ed25519OwnerPubkeyParam, ed25519PubkeyFelts, ed25519SignedBytes, eip191OwnerId, eip191OwnerPubkeyParam, eip191PubkeyFelts, encryptPrivateKey, estimateThresholdGasOverhead, executeShhhSponsoredRaw, hashCall, hashCalls, hashOutsideExecutionStruct, hashStarknetDomain, isReadyToExecute, jwtAppleSubHash, jwtAppleSubOwnerId, jwtAppleSubPubkeyFelts, labelToFelt, locateSubClaim, messageHashToNonceB64url, migrateChipiWalletToShhh, ownerCommitment, parseAppleIdToken, parseDerEcdsaSignature, parseEip191Signature, parseThresholdEnvelope, resolveShhhChainId, secondsUntilExecutable, serializeExecuteFromOutsideV2Calldata, signBootstrapMessage, signTypedData, signTypedDataArray, snip12HashToHexAsciiBytes, starkOwnerId, starkPubkeyFelts, submitViaAccount, webauthnOwnerId, webauthnOwnerPubkeyParam, webauthnPubkeyFelts, wrapV2Snip12Envelope, wrapV2ThresholdEnvelope, x402Middleware };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map