@chipi-stack/chipi-react 14.15.0 → 14.16.0

package/dist/{index-B8OIdrOX.d.mts → index-Dbqp9oNS.d.mts}

@@ -14,13 +14,39 @@ type CreateWalletInput = {
 /**
  * Hook for creating a new wallet.
  *
- * Supports dual-key wrapping: when `usePasskey: true` AND `encryptKey` (PIN) provided,
- * the private key is encrypted twice — once with the passkey-derived key (primary) and
- * once with the PIN (backup). If passkey fails later, PIN recovers the wallet.
+ * With `usePasskey: true` the hook creates a WebAuthn passkey and uses its PRF
+ * output, derived on the device, as the key that encrypts the private key. It
+ * stores the passkey's `credentialId` and `prfSupported` on the wallet so any
+ * device with the synced passkey can unlock it later with
+ * `getWalletEncryptKey(wallet.credentialId, { prfSupported: wallet.prfSupported })`.
+ * On a device without WebAuthn PRF it throws with `code: "PRF_UNSUPPORTED"`
+ * (the original `PrfUnsupportedError` is the `cause`) instead of creating a
+ * custodial wallet.
+ *
+ * - Passkey only (`usePasskey: true`, no `encryptKey`): `authMethod: "passkey"`.
+ *   Recommended for self-custodial apps; the passkey's platform sync (iCloud
+ *   Keychain, Google Password Manager) is the recovery path.
+ * - Passkey + PIN (`usePasskey: true` and `encryptKey`): `authMethod: "passkey+pin"`.
+ *   The private key is encrypted twice, once with the passkey key (primary)
+ *   and once with the PIN (backup). The backup is only as strong as the PIN,
+ *   which can be brute-forced offline against the stored ciphertext.
+ * - PIN only (`encryptKey`, no `usePasskey`): `authMethod: "pin"`. Legacy.
+ *
+ * The passkey's user name (shown by the OS passkey picker) is `externalUserId`.
  *
  * @example
  * ```tsx
- * // Passkey + PIN (recommended)
+ * // Passkey only (recommended)
+ * await createWalletAsync({
+ *   params: {
+ *     externalUserId: userId,
+ *     chain: Chain.STARKNET,
+ *     usePasskey: true,       // Creates the passkey; its PRF output encrypts the key
+ *   },
+ *   bearerToken,
+ * });
+ *
+ * // Passkey + PIN backup
  * await createWalletAsync({
  *   params: {
  *     encryptKey: pin,        // PIN backup
@@ -31,7 +57,7 @@ type CreateWalletInput = {
  *   bearerToken,
  * });
  *
- * // PIN only (backward compatible)
+ * // PIN only (legacy)
  * await createWalletAsync({
  *   params: {
  *     encryptKey: pin,
@@ -1871,19 +1897,52 @@ type ChipiApprovalRequest = {
  * `[session_pubkey, r, s, valid_until]`.
  */
 interface ChipiSessionPolicy {
-    /** Allowed (contractAddress, entrypoint) pairs the session may call. */
+    /**
+     * Allowed (contractAddress, entrypoint) pairs the session may call.
+     *
+     * Client side, `useChipiWalletObject` only routes a call through the session
+     * when its exact (contract, entrypoint) pair is listed. On-chain, though, the
+     * session whitelist is per entrypoint selector only: allowing `transfer` lets
+     * the session call `transfer` on ANY contract. Use `spendCaps` to bound what
+     * the session can move per token.
+     */
     allowedCalls: Array<{
         contractAddress: string;
         entrypoint: string;
     }>;
     /** Unix seconds after which the session is invalid. */
     validUntil: number;
-    /** Optional per-token spend caps, by token address. */
-    spendCaps?: Array<{
-        token: string;
-        amount: string;
-    }>;
+    /**
+     * Optional per-token spend caps, registered on-chain as spending policies in
+     * the same transaction as the session. A cap must never resolve to a window
+     * limit of 0 (on-chain, 0 means unlimited); that is rejected.
+     */
+    spendCaps?: ChipiSessionSpendCap[];
+}
+/**
+ * Simple per-token cap: `amount` (base units, decimal or hex string) is used as
+ * both the per-call and the per-window limit, with a window equal to the
+ * session lifetime.
+ */
+interface ChipiSessionSpendCapAmount {
+    /** ERC-20 token contract address. */
+    token: string;
+    /** Cap in token base units (e.g. "5000000" = 5 USDC). Must be > 0. */
+    amount: string;
+}
+/** Full per-token spending policy (mirrors `SpendingPolicyConfig`). */
+interface ChipiSessionSpendCapPolicy {
+    /** ERC-20 token contract address. */
+    token: string;
+    /** Max amount per single call, in token base units. */
+    maxPerCall: string | bigint;
+    /** Max cumulative amount within the rolling window, in base units. Must be > 0. */
+    maxPerWindow: string | bigint;
+    /** Rolling window duration in seconds (positive integer). */
+    windowSeconds: number;
 }
+/** A per-token spend cap: the simple `{ token, amount }` form or a full policy. */
+type ChipiSessionSpendCap = ChipiSessionSpendCapAmount | ChipiSessionSpendCapPolicy;
 /**
  * Everything the framework-agnostic SWO needs, supplied by the host layer
  * (`@chipi-stack/react`'s `useChipiWalletObject`, the hosted web-wallet, etc.).
@@ -1913,7 +1972,11 @@ interface ChipiWindowObjectDeps {
     getDeploymentData: () => Promise<AccountDeploymentData>;
     /** Optional: establish a session from a dApp-proposed policy (approve once). */
     createSession?: (policy: ChipiSessionPolicy) => Promise<void>;
-    /** Host approval gate. Defaults to auto-approve (harness) when omitted. */
+    /**
+     * Host approval gate: render the prompt and resolve `true` to approve.
+     * When omitted, every approval is denied (deny by default) and a single
+     * `console.warn` explains that `requestApproval` must be provided.
+     */
     requestApproval?: (req: ChipiApprovalRequest) => Promise<boolean>;
 }
 
@@ -1932,7 +1995,11 @@ interface UseChipiWalletObjectConfig {
     sessionPolicy?: ChipiSessionPolicy | null;
     /** Chain id felt; defaults to SN_MAIN. */
     chainId?: string;
-    /** Host approval gate (connect / execute / signTypedData / session). */
+    /**
+     * Host approval gate (connect / execute / signTypedData / session). When
+     * omitted, every approval is denied and a single `console.warn` explains
+     * that `requestApproval` must be provided.
+     */
     requestApproval?: (req: ChipiApprovalRequest) => Promise<boolean>;
 }
 /**
@@ -1945,6 +2012,15 @@ interface UseChipiWalletObjectConfig {
  * `injectChipiWallet`. `createSession(policy)` establishes a session on-chain
  * from a dApp-proposed policy (the "approve once" flow); the host stores the
  * returned SessionKeyData and feeds it back via `config.session`.
+ *
+ * Note: `allowedCalls` is matched per (contract, entrypoint) only client-side,
+ * for routing. On-chain the session whitelist is per entrypoint selector, not
+ * per contract, so pass `spendCaps` to bound token spend; with caps, the
+ * session and its spending policies are registered in one owner-signed
+ * transaction (`sdk.sessions.setupSession`).
+ *
+ * Approvals are deny-by-default: without `config.requestApproval`, every
+ * approval is denied and a single `console.warn` says so.
  */
 declare function useChipiWalletObject(config: UseChipiWalletObjectConfig): {
     deps: ChipiWindowObjectDeps;
@@ -2890,4 +2966,4 @@ declare function usePrivateBalance(input: PrivateBalanceInput): {
     refetch: (options?: _tanstack_react_query.RefetchOptions) => Promise<_tanstack_react_query.QueryObserverResult<Record<string, bigint>, Error>>;
 };
 
-export { usePrivateBalance as $, useCallAnyContract as A, useSignTypedData as B, type ChipiWindowObjectDeps as C, useChipiWalletObject as D, useRecordSendTransaction as E, useGetTokenBalance as F, useCreateSessionKey as G, useAddSessionKeyToContract as H, useRevokeSessionKey as I, useGetSessionData as J, useExecuteWithSession as K, useX402Payment as L, type UseX402PaymentConfig as M, type UseX402PaymentReturn as N, useShhhSigner as O, type UseShhhSignerReturn as P, useGuardianRecovery as Q, type RegisterSessionConfig as R, type SessionState as S, type UseGuardianRecoveryReturn as T, type UseChipiWalletObjectConfig as U, useThresholdSign as V, type UseThresholdSignReturn as W, type UseThresholdSignOptions as X, type ThresholdSignState as Y, useShield as Z, useUnshield as _, type ChipiApprovalRequest as a, derivePrivacyAccount as a0, netPrivateBalance as a1, type PrivacyConfig as a2, type PrivacyKeys as a3, type PrivacyStep as a4, type ShieldHookInput as a5, type PrivacyLedgerEvent as a6, type PrivateBalanceInput as a7, type ChipiSessionPolicy as b, useGetWallet as c, useChipiWallet as d, type UseChipiWalletConfig as e, type UseChipiWalletReturn as f, type ChipiWalletData as g, useChipiSession as h, type UseChipiSessionConfig as i, type UseChipiSessionReturn as j, type SessionWallet as k, useMigrateWalletToPasskey as l, useUpdateWalletEncryption as m, useMigrateWalletToShhh as n, useTransfer as o, type UseTransferConfig as p, useApprove as q, useGetTransactionList as r, useGetTransaction as s, useGetTransactionStatus as t, useCreateWallet as u, useSyncOnChainTransfers as v, usePurchaseSku as w, useGetSkuPurchase as x, useGetSkuList as y, useGetSku as z };
+export { type ThresholdSignState as $, useGetSkuPurchase as A, useGetSkuList as B, type ChipiWindowObjectDeps as C, useGetSku as D, useCallAnyContract as E, useSignTypedData as F, useChipiWalletObject as G, useRecordSendTransaction as H, useGetTokenBalance as I, useCreateSessionKey as J, useAddSessionKeyToContract as K, useRevokeSessionKey as L, useGetSessionData as M, useExecuteWithSession as N, useX402Payment as O, type UseX402PaymentConfig as P, type UseX402PaymentReturn as Q, type RegisterSessionConfig as R, type SessionState as S, useShhhSigner as T, type UseChipiWalletObjectConfig as U, type UseShhhSignerReturn as V, useGuardianRecovery as W, type UseGuardianRecoveryReturn as X, useThresholdSign as Y, type UseThresholdSignReturn as Z, type UseThresholdSignOptions as _, type ChipiApprovalRequest as a, useShield as a0, useUnshield as a1, usePrivateBalance as a2, derivePrivacyAccount as a3, netPrivateBalance as a4, type PrivacyConfig as a5, type PrivacyKeys as a6, type PrivacyStep as a7, type ShieldHookInput as a8, type PrivacyLedgerEvent as a9, type PrivateBalanceInput as aa, type ChipiSessionPolicy as b, type ChipiSessionSpendCap as c, type ChipiSessionSpendCapAmount as d, type ChipiSessionSpendCapPolicy as e, useGetWallet as f, useChipiWallet as g, type UseChipiWalletConfig as h, type UseChipiWalletReturn as i, type ChipiWalletData as j, useChipiSession as k, type UseChipiSessionConfig as l, type UseChipiSessionReturn as m, type SessionWallet as n, useMigrateWalletToPasskey as o, useUpdateWalletEncryption as p, useMigrateWalletToShhh as q, useTransfer as r, type UseTransferConfig as s, useApprove as t, useCreateWallet as u, useGetTransactionList as v, useGetTransaction as w, useGetTransactionStatus as x, useSyncOnChainTransfers as y, usePurchaseSku as z };

package/dist/{index-B8OIdrOX.d.ts → index-Dbqp9oNS.d.ts}

@@ -14,13 +14,39 @@ type CreateWalletInput = {
 /**
  * Hook for creating a new wallet.
  *
- * Supports dual-key wrapping: when `usePasskey: true` AND `encryptKey` (PIN) provided,
- * the private key is encrypted twice — once with the passkey-derived key (primary) and
- * once with the PIN (backup). If passkey fails later, PIN recovers the wallet.
+ * With `usePasskey: true` the hook creates a WebAuthn passkey and uses its PRF
+ * output, derived on the device, as the key that encrypts the private key. It
+ * stores the passkey's `credentialId` and `prfSupported` on the wallet so any
+ * device with the synced passkey can unlock it later with
+ * `getWalletEncryptKey(wallet.credentialId, { prfSupported: wallet.prfSupported })`.
+ * On a device without WebAuthn PRF it throws with `code: "PRF_UNSUPPORTED"`
+ * (the original `PrfUnsupportedError` is the `cause`) instead of creating a
+ * custodial wallet.
+ *
+ * - Passkey only (`usePasskey: true`, no `encryptKey`): `authMethod: "passkey"`.
+ *   Recommended for self-custodial apps; the passkey's platform sync (iCloud
+ *   Keychain, Google Password Manager) is the recovery path.
+ * - Passkey + PIN (`usePasskey: true` and `encryptKey`): `authMethod: "passkey+pin"`.
+ *   The private key is encrypted twice, once with the passkey key (primary)
+ *   and once with the PIN (backup). The backup is only as strong as the PIN,
+ *   which can be brute-forced offline against the stored ciphertext.
+ * - PIN only (`encryptKey`, no `usePasskey`): `authMethod: "pin"`. Legacy.
+ *
+ * The passkey's user name (shown by the OS passkey picker) is `externalUserId`.
  *
  * @example
  * ```tsx
- * // Passkey + PIN (recommended)
+ * // Passkey only (recommended)
+ * await createWalletAsync({
+ *   params: {
+ *     externalUserId: userId,
+ *     chain: Chain.STARKNET,
+ *     usePasskey: true,       // Creates the passkey; its PRF output encrypts the key
+ *   },
+ *   bearerToken,
+ * });
+ *
+ * // Passkey + PIN backup
  * await createWalletAsync({
  *   params: {
  *     encryptKey: pin,        // PIN backup
@@ -31,7 +57,7 @@ type CreateWalletInput = {
  *   bearerToken,
  * });
  *
- * // PIN only (backward compatible)
+ * // PIN only (legacy)
  * await createWalletAsync({
  *   params: {
  *     encryptKey: pin,
@@ -1871,19 +1897,52 @@ type ChipiApprovalRequest = {
  * `[session_pubkey, r, s, valid_until]`.
  */
 interface ChipiSessionPolicy {
-    /** Allowed (contractAddress, entrypoint) pairs the session may call. */
+    /**
+     * Allowed (contractAddress, entrypoint) pairs the session may call.
+     *
+     * Client side, `useChipiWalletObject` only routes a call through the session
+     * when its exact (contract, entrypoint) pair is listed. On-chain, though, the
+     * session whitelist is per entrypoint selector only: allowing `transfer` lets
+     * the session call `transfer` on ANY contract. Use `spendCaps` to bound what
+     * the session can move per token.
+     */
     allowedCalls: Array<{
         contractAddress: string;
         entrypoint: string;
     }>;
     /** Unix seconds after which the session is invalid. */
     validUntil: number;
-    /** Optional per-token spend caps, by token address. */
-    spendCaps?: Array<{
-        token: string;
-        amount: string;
-    }>;
+    /**
+     * Optional per-token spend caps, registered on-chain as spending policies in
+     * the same transaction as the session. A cap must never resolve to a window
+     * limit of 0 (on-chain, 0 means unlimited); that is rejected.
+     */
+    spendCaps?: ChipiSessionSpendCap[];
+}
+/**
+ * Simple per-token cap: `amount` (base units, decimal or hex string) is used as
+ * both the per-call and the per-window limit, with a window equal to the
+ * session lifetime.
+ */
+interface ChipiSessionSpendCapAmount {
+    /** ERC-20 token contract address. */
+    token: string;
+    /** Cap in token base units (e.g. "5000000" = 5 USDC). Must be > 0. */
+    amount: string;
+}
+/** Full per-token spending policy (mirrors `SpendingPolicyConfig`). */
+interface ChipiSessionSpendCapPolicy {
+    /** ERC-20 token contract address. */
+    token: string;
+    /** Max amount per single call, in token base units. */
+    maxPerCall: string | bigint;
+    /** Max cumulative amount within the rolling window, in base units. Must be > 0. */
+    maxPerWindow: string | bigint;
+    /** Rolling window duration in seconds (positive integer). */
+    windowSeconds: number;
 }
+/** A per-token spend cap: the simple `{ token, amount }` form or a full policy. */
+type ChipiSessionSpendCap = ChipiSessionSpendCapAmount | ChipiSessionSpendCapPolicy;
 /**
  * Everything the framework-agnostic SWO needs, supplied by the host layer
  * (`@chipi-stack/react`'s `useChipiWalletObject`, the hosted web-wallet, etc.).
@@ -1913,7 +1972,11 @@ interface ChipiWindowObjectDeps {
     getDeploymentData: () => Promise<AccountDeploymentData>;
     /** Optional: establish a session from a dApp-proposed policy (approve once). */
     createSession?: (policy: ChipiSessionPolicy) => Promise<void>;
-    /** Host approval gate. Defaults to auto-approve (harness) when omitted. */
+    /**
+     * Host approval gate: render the prompt and resolve `true` to approve.
+     * When omitted, every approval is denied (deny by default) and a single
+     * `console.warn` explains that `requestApproval` must be provided.
+     */
     requestApproval?: (req: ChipiApprovalRequest) => Promise<boolean>;
 }
 
@@ -1932,7 +1995,11 @@ interface UseChipiWalletObjectConfig {
     sessionPolicy?: ChipiSessionPolicy | null;
     /** Chain id felt; defaults to SN_MAIN. */
     chainId?: string;
-    /** Host approval gate (connect / execute / signTypedData / session). */
+    /**
+     * Host approval gate (connect / execute / signTypedData / session). When
+     * omitted, every approval is denied and a single `console.warn` explains
+     * that `requestApproval` must be provided.
+     */
     requestApproval?: (req: ChipiApprovalRequest) => Promise<boolean>;
 }
 /**
@@ -1945,6 +2012,15 @@ interface UseChipiWalletObjectConfig {
  * `injectChipiWallet`. `createSession(policy)` establishes a session on-chain
  * from a dApp-proposed policy (the "approve once" flow); the host stores the
  * returned SessionKeyData and feeds it back via `config.session`.
+ *
+ * Note: `allowedCalls` is matched per (contract, entrypoint) only client-side,
+ * for routing. On-chain the session whitelist is per entrypoint selector, not
+ * per contract, so pass `spendCaps` to bound token spend; with caps, the
+ * session and its spending policies are registered in one owner-signed
+ * transaction (`sdk.sessions.setupSession`).
+ *
+ * Approvals are deny-by-default: without `config.requestApproval`, every
+ * approval is denied and a single `console.warn` says so.
  */
 declare function useChipiWalletObject(config: UseChipiWalletObjectConfig): {
     deps: ChipiWindowObjectDeps;
@@ -2890,4 +2966,4 @@ declare function usePrivateBalance(input: PrivateBalanceInput): {
     refetch: (options?: _tanstack_react_query.RefetchOptions) => Promise<_tanstack_react_query.QueryObserverResult<Record<string, bigint>, Error>>;
 };
 
-export { usePrivateBalance as $, useCallAnyContract as A, useSignTypedData as B, type ChipiWindowObjectDeps as C, useChipiWalletObject as D, useRecordSendTransaction as E, useGetTokenBalance as F, useCreateSessionKey as G, useAddSessionKeyToContract as H, useRevokeSessionKey as I, useGetSessionData as J, useExecuteWithSession as K, useX402Payment as L, type UseX402PaymentConfig as M, type UseX402PaymentReturn as N, useShhhSigner as O, type UseShhhSignerReturn as P, useGuardianRecovery as Q, type RegisterSessionConfig as R, type SessionState as S, type UseGuardianRecoveryReturn as T, type UseChipiWalletObjectConfig as U, useThresholdSign as V, type UseThresholdSignReturn as W, type UseThresholdSignOptions as X, type ThresholdSignState as Y, useShield as Z, useUnshield as _, type ChipiApprovalRequest as a, derivePrivacyAccount as a0, netPrivateBalance as a1, type PrivacyConfig as a2, type PrivacyKeys as a3, type PrivacyStep as a4, type ShieldHookInput as a5, type PrivacyLedgerEvent as a6, type PrivateBalanceInput as a7, type ChipiSessionPolicy as b, useGetWallet as c, useChipiWallet as d, type UseChipiWalletConfig as e, type UseChipiWalletReturn as f, type ChipiWalletData as g, useChipiSession as h, type UseChipiSessionConfig as i, type UseChipiSessionReturn as j, type SessionWallet as k, useMigrateWalletToPasskey as l, useUpdateWalletEncryption as m, useMigrateWalletToShhh as n, useTransfer as o, type UseTransferConfig as p, useApprove as q, useGetTransactionList as r, useGetTransaction as s, useGetTransactionStatus as t, useCreateWallet as u, useSyncOnChainTransfers as v, usePurchaseSku as w, useGetSkuPurchase as x, useGetSkuList as y, useGetSku as z };
+export { type ThresholdSignState as $, useGetSkuPurchase as A, useGetSkuList as B, type ChipiWindowObjectDeps as C, useGetSku as D, useCallAnyContract as E, useSignTypedData as F, useChipiWalletObject as G, useRecordSendTransaction as H, useGetTokenBalance as I, useCreateSessionKey as J, useAddSessionKeyToContract as K, useRevokeSessionKey as L, useGetSessionData as M, useExecuteWithSession as N, useX402Payment as O, type UseX402PaymentConfig as P, type UseX402PaymentReturn as Q, type RegisterSessionConfig as R, type SessionState as S, useShhhSigner as T, type UseChipiWalletObjectConfig as U, type UseShhhSignerReturn as V, useGuardianRecovery as W, type UseGuardianRecoveryReturn as X, useThresholdSign as Y, type UseThresholdSignReturn as Z, type UseThresholdSignOptions as _, type ChipiApprovalRequest as a, useShield as a0, useUnshield as a1, usePrivateBalance as a2, derivePrivacyAccount as a3, netPrivateBalance as a4, type PrivacyConfig as a5, type PrivacyKeys as a6, type PrivacyStep as a7, type ShieldHookInput as a8, type PrivacyLedgerEvent as a9, type PrivateBalanceInput as aa, type ChipiSessionPolicy as b, type ChipiSessionSpendCap as c, type ChipiSessionSpendCapAmount as d, type ChipiSessionSpendCapPolicy as e, useGetWallet as f, useChipiWallet as g, type UseChipiWalletConfig as h, type UseChipiWalletReturn as i, type ChipiWalletData as j, useChipiSession as k, type UseChipiSessionConfig as l, type UseChipiSessionReturn as m, type SessionWallet as n, useMigrateWalletToPasskey as o, useUpdateWalletEncryption as p, useMigrateWalletToShhh as q, useTransfer as r, type UseTransferConfig as s, useApprove as t, useCreateWallet as u, useGetTransactionList as v, useGetTransaction as w, useGetTransactionStatus as x, useSyncOnChainTransfers as y, usePurchaseSku as z };

package/dist/index.d.mts

@@ -4,8 +4,8 @@ import { ChipiSDK, NewOwnerInput } from '@chipi-stack/backend';
 import { ChipiSDKConfig, WalletType } from '@chipi-stack/types';
 export * from '@chipi-stack/types';
 export { Chain, ChainToken } from '@chipi-stack/types';
-import { C as ChipiWindowObjectDeps, U as UseChipiWalletObjectConfig } from './index-B8OIdrOX.mjs';
-export { a as ChipiApprovalRequest, b as ChipiSessionPolicy, g as ChipiWalletData, a2 as PrivacyConfig, a3 as PrivacyKeys, a6 as PrivacyLedgerEvent, a4 as PrivacyStep, a7 as PrivateBalanceInput, R as RegisterSessionConfig, S as SessionState, k as SessionWallet, a5 as ShieldHookInput, Y as ThresholdSignState, i as UseChipiSessionConfig, j as UseChipiSessionReturn, e as UseChipiWalletConfig, f as UseChipiWalletReturn, T as UseGuardianRecoveryReturn, P as UseShhhSignerReturn, X as UseThresholdSignOptions, W as UseThresholdSignReturn, p as UseTransferConfig, M as UseX402PaymentConfig, N as UseX402PaymentReturn, a0 as derivePrivacyAccount, a1 as netPrivateBalance, H as useAddSessionKeyToContract, q as useApprove, A as useCallAnyContract, h as useChipiSession, d as useChipiWallet, D as useChipiWalletObject, G as useCreateSessionKey, u as useCreateWallet, K as useExecuteWithSession, J as useGetSessionData, z as useGetSku, y as useGetSkuList, x as useGetSkuPurchase, F as useGetTokenBalance, s as useGetTransaction, r as useGetTransactionList, t as useGetTransactionStatus, c as useGetWallet, Q as useGuardianRecovery, l as useMigrateWalletToPasskey, n as useMigrateWalletToShhh, $ as usePrivateBalance, w as usePurchaseSku, E as useRecordSendTransaction, I as useRevokeSessionKey, O as useShhhSigner, Z as useShield, B as useSignTypedData, v as useSyncOnChainTransfers, V as useThresholdSign, o as useTransfer, _ as useUnshield, m as useUpdateWalletEncryption, L as useX402Payment } from './index-B8OIdrOX.mjs';
+import { C as ChipiWindowObjectDeps, U as UseChipiWalletObjectConfig } from './index-Dbqp9oNS.mjs';
+export { a as ChipiApprovalRequest, b as ChipiSessionPolicy, c as ChipiSessionSpendCap, d as ChipiSessionSpendCapAmount, e as ChipiSessionSpendCapPolicy, j as ChipiWalletData, a5 as PrivacyConfig, a6 as PrivacyKeys, a9 as PrivacyLedgerEvent, a7 as PrivacyStep, aa as PrivateBalanceInput, R as RegisterSessionConfig, S as SessionState, n as SessionWallet, a8 as ShieldHookInput, $ as ThresholdSignState, l as UseChipiSessionConfig, m as UseChipiSessionReturn, h as UseChipiWalletConfig, i as UseChipiWalletReturn, X as UseGuardianRecoveryReturn, V as UseShhhSignerReturn, _ as UseThresholdSignOptions, Z as UseThresholdSignReturn, s as UseTransferConfig, P as UseX402PaymentConfig, Q as UseX402PaymentReturn, a3 as derivePrivacyAccount, a4 as netPrivateBalance, K as useAddSessionKeyToContract, t as useApprove, E as useCallAnyContract, k as useChipiSession, g as useChipiWallet, G as useChipiWalletObject, J as useCreateSessionKey, u as useCreateWallet, N as useExecuteWithSession, M as useGetSessionData, D as useGetSku, B as useGetSkuList, A as useGetSkuPurchase, I as useGetTokenBalance, w as useGetTransaction, v as useGetTransactionList, x as useGetTransactionStatus, f as useGetWallet, W as useGuardianRecovery, o as useMigrateWalletToPasskey, q as useMigrateWalletToShhh, a2 as usePrivateBalance, z as usePurchaseSku, H as useRecordSendTransaction, L as useRevokeSessionKey, T as useShhhSigner, a0 as useShield, F as useSignTypedData, y as useSyncOnChainTransfers, Y as useThresholdSign, r as useTransfer, a1 as useUnshield, p as useUpdateWalletEncryption, O as useX402Payment } from './index-Dbqp9oNS.mjs';
 import { StarknetWindowObject } from '@starknet-io/types-js';
 import '@tanstack/react-query';
 import 'starknet';
@@ -61,6 +61,19 @@ declare function walletSupportsSessions(wallet: {
  * `deps`, so the same object powers walletv2's in-app browser, the hosted
  * web-wallet connector, and WalletConnect transport identically.
  *
+ * Approvals are deny-by-default: every sensitive action goes through
+ * `deps.requestApproval`. When it is omitted, every approval is denied (and a
+ * single `console.warn` says so) instead of being auto-approved.
+ *
+ * Connection model (per window object, i.e. per injected dApp page):
+ *  - `wallet_requestAccounts` asks for a `connect` approval once, even when the
+ *    wallet is unlocked and has accounts. With `silent_mode: true` it never
+ *    prompts: it returns the accounts if already approved, else `[]`.
+ *  - `wallet_getPermissions` returns `[]` until that approval, `["accounts"]` after.
+ *  - `wallet_signTypedData` rejects (INVALID_REQUEST_PAYLOAD, no prompt) when
+ *    the typed data's `domain.chainId` is set and differs from `deps.chainId`.
+ *    "SN_MAIN" and "0x534e5f4d41494e" are treated as the same chain.
+ *
  * Returns the wallet plus an `emit` controller so the host can fire
  * accountsChanged / networkChanged on connect, disconnect, or lock.
  */

package/dist/index.d.ts

@@ -4,8 +4,8 @@ import { ChipiSDK, NewOwnerInput } from '@chipi-stack/backend';
 import { ChipiSDKConfig, WalletType } from '@chipi-stack/types';
 export * from '@chipi-stack/types';
 export { Chain, ChainToken } from '@chipi-stack/types';
-import { C as ChipiWindowObjectDeps, U as UseChipiWalletObjectConfig } from './index-B8OIdrOX.js';
-export { a as ChipiApprovalRequest, b as ChipiSessionPolicy, g as ChipiWalletData, a2 as PrivacyConfig, a3 as PrivacyKeys, a6 as PrivacyLedgerEvent, a4 as PrivacyStep, a7 as PrivateBalanceInput, R as RegisterSessionConfig, S as SessionState, k as SessionWallet, a5 as ShieldHookInput, Y as ThresholdSignState, i as UseChipiSessionConfig, j as UseChipiSessionReturn, e as UseChipiWalletConfig, f as UseChipiWalletReturn, T as UseGuardianRecoveryReturn, P as UseShhhSignerReturn, X as UseThresholdSignOptions, W as UseThresholdSignReturn, p as UseTransferConfig, M as UseX402PaymentConfig, N as UseX402PaymentReturn, a0 as derivePrivacyAccount, a1 as netPrivateBalance, H as useAddSessionKeyToContract, q as useApprove, A as useCallAnyContract, h as useChipiSession, d as useChipiWallet, D as useChipiWalletObject, G as useCreateSessionKey, u as useCreateWallet, K as useExecuteWithSession, J as useGetSessionData, z as useGetSku, y as useGetSkuList, x as useGetSkuPurchase, F as useGetTokenBalance, s as useGetTransaction, r as useGetTransactionList, t as useGetTransactionStatus, c as useGetWallet, Q as useGuardianRecovery, l as useMigrateWalletToPasskey, n as useMigrateWalletToShhh, $ as usePrivateBalance, w as usePurchaseSku, E as useRecordSendTransaction, I as useRevokeSessionKey, O as useShhhSigner, Z as useShield, B as useSignTypedData, v as useSyncOnChainTransfers, V as useThresholdSign, o as useTransfer, _ as useUnshield, m as useUpdateWalletEncryption, L as useX402Payment } from './index-B8OIdrOX.js';
+import { C as ChipiWindowObjectDeps, U as UseChipiWalletObjectConfig } from './index-Dbqp9oNS.js';
+export { a as ChipiApprovalRequest, b as ChipiSessionPolicy, c as ChipiSessionSpendCap, d as ChipiSessionSpendCapAmount, e as ChipiSessionSpendCapPolicy, j as ChipiWalletData, a5 as PrivacyConfig, a6 as PrivacyKeys, a9 as PrivacyLedgerEvent, a7 as PrivacyStep, aa as PrivateBalanceInput, R as RegisterSessionConfig, S as SessionState, n as SessionWallet, a8 as ShieldHookInput, $ as ThresholdSignState, l as UseChipiSessionConfig, m as UseChipiSessionReturn, h as UseChipiWalletConfig, i as UseChipiWalletReturn, X as UseGuardianRecoveryReturn, V as UseShhhSignerReturn, _ as UseThresholdSignOptions, Z as UseThresholdSignReturn, s as UseTransferConfig, P as UseX402PaymentConfig, Q as UseX402PaymentReturn, a3 as derivePrivacyAccount, a4 as netPrivateBalance, K as useAddSessionKeyToContract, t as useApprove, E as useCallAnyContract, k as useChipiSession, g as useChipiWallet, G as useChipiWalletObject, J as useCreateSessionKey, u as useCreateWallet, N as useExecuteWithSession, M as useGetSessionData, D as useGetSku, B as useGetSkuList, A as useGetSkuPurchase, I as useGetTokenBalance, w as useGetTransaction, v as useGetTransactionList, x as useGetTransactionStatus, f as useGetWallet, W as useGuardianRecovery, o as useMigrateWalletToPasskey, q as useMigrateWalletToShhh, a2 as usePrivateBalance, z as usePurchaseSku, H as useRecordSendTransaction, L as useRevokeSessionKey, T as useShhhSigner, a0 as useShield, F as useSignTypedData, y as useSyncOnChainTransfers, Y as useThresholdSign, r as useTransfer, a1 as useUnshield, p as useUpdateWalletEncryption, O as useX402Payment } from './index-Dbqp9oNS.js';
 import { StarknetWindowObject } from '@starknet-io/types-js';
 import '@tanstack/react-query';
 import 'starknet';
@@ -61,6 +61,19 @@ declare function walletSupportsSessions(wallet: {
  * `deps`, so the same object powers walletv2's in-app browser, the hosted
  * web-wallet connector, and WalletConnect transport identically.
  *
+ * Approvals are deny-by-default: every sensitive action goes through
+ * `deps.requestApproval`. When it is omitted, every approval is denied (and a
+ * single `console.warn` says so) instead of being auto-approved.
+ *
+ * Connection model (per window object, i.e. per injected dApp page):
+ *  - `wallet_requestAccounts` asks for a `connect` approval once, even when the
+ *    wallet is unlocked and has accounts. With `silent_mode: true` it never
+ *    prompts: it returns the accounts if already approved, else `[]`.
+ *  - `wallet_getPermissions` returns `[]` until that approval, `["accounts"]` after.
+ *  - `wallet_signTypedData` rejects (INVALID_REQUEST_PAYLOAD, no prompt) when
+ *    the typed data's `domain.chainId` is set and differs from `deps.chainId`.
+ *    "SN_MAIN" and "0x534e5f4d41494e" are treated as the same chain.
+ *
  * Returns the wallet plus an `emit` controller so the host can fire
  * accountsChanged / networkChanged on connect, disconnect, or lock.
  */

package/dist/index.js

@@ -20418,6 +20418,41 @@ function hexEq(a, b) {
     return a === b;
   }
 }
+function parseCapAmount(value, field, token) {
+  try {
+    const v = typeof value === "bigint" ? value : BigInt(String(value).trim());
+    if (v < 0n) throw new Error("negative");
+    return v;
+  } catch {
+    throw new Error(
+      `session_spend_cap_invalid: ${field} for token ${token} must be a non-negative integer in base units (got "${String(value)}")`
+    );
+  }
+}
+function toSpendingPolicies(caps, lifetimeSeconds) {
+  return caps.map((cap) => {
+    const policy = "maxPerWindow" in cap ? {
+      token: cap.token,
+      maxPerCall: parseCapAmount(cap.maxPerCall, "maxPerCall", cap.token),
+      maxPerWindow: parseCapAmount(cap.maxPerWindow, "maxPerWindow", cap.token),
+      windowSeconds: cap.windowSeconds
+    } : (() => {
+      const amount = parseCapAmount(cap.amount, "amount", cap.token);
+      return {
+        token: cap.token,
+        maxPerCall: amount,
+        maxPerWindow: amount,
+        windowSeconds: Math.max(1, lifetimeSeconds)
+      };
+    })();
+    if (policy.maxPerWindow === 0n) {
+      throw new Error(
+        `session_spend_cap_zero: the cap for token ${cap.token} resolves to maxPerWindow = 0, which means unlimited on-chain. Use a positive cap.`
+      );
+    }
+    return policy;
+  });
+}
 function sessionCovers(policy, calls) {
   if (!policy?.allowedCalls?.length) return false;
   return calls.every(
@@ -20432,6 +20467,10 @@ function useChipiWalletObject(config3) {
   const { signTypedDataAsync } = useSignTypedData();
   const { createSessionKeyAsync } = useCreateSessionKey();
   const { addSessionKeyToContractAsync } = useAddSessionKeyToContract();
+  const { chipiSDK } = useChipiContext();
+  const sdk = React.useRef(chipiSDK);
+  sdk.current = chipiSDK;
+  const warnedMissingApproval = React.useRef(false);
   const cfg = React.useRef(config3);
   cfg.current = config3;
   const requireWallet = () => {
@@ -20444,28 +20483,33 @@ function useChipiWalletObject(config3) {
       if (policy.validUntil <= nowSec()) throw new Error("session_policy_expired");
       const c = cfg.current;
       const wallet = requireWallet();
+      const lifetimeSeconds = Math.max(1, policy.validUntil - nowSec());
+      const spendingPolicies = policy.spendCaps?.length ? toSpendingPolicies(policy.spendCaps, lifetimeSeconds) : [];
       const encryptKey = await c.getEncryptKey();
       const session = await createSessionKeyAsync({
         encryptKey,
-        durationSeconds: Math.max(1, policy.validUntil - nowSec())
+        durationSeconds: lifetimeSeconds
       });
       const bearerToken = await c.getBearerToken();
-      await addSessionKeyToContractAsync({
-        params: {
-          encryptKey,
-          wallet,
-          sessionConfig: {
-            sessionPublicKey: session.publicKey,
-            validUntil: policy.validUntil,
-            maxCalls: 1e3,
-            // selectors; empty = all entrypoints allowed
-            allowedEntrypoints: policy.allowedCalls.map(
-              (a) => hash_exports.getSelectorFromName(a.entrypoint)
-            )
-          }
-        },
-        bearerToken
-      });
+      const params = {
+        encryptKey,
+        wallet,
+        sessionConfig: {
+          sessionPublicKey: session.publicKey,
+          validUntil: policy.validUntil,
+          maxCalls: 1e3,
+          // Selectors; empty = all entrypoints allowed. On-chain this is a
+          // per-selector whitelist, NOT scoped to allowedCalls' contracts.
+          allowedEntrypoints: policy.allowedCalls.map(
+            (a) => hash_exports.getSelectorFromName(a.entrypoint)
+          )
+        }
+      };
+      if (spendingPolicies.length > 0) {
+        await sdk.current.sessions.setupSession({ ...params, spendingPolicies }, bearerToken);
+      } else {
+        await addSessionKeyToContractAsync({ params, bearerToken });
+      }
       return session;
     },
     [createSessionKeyAsync, addSessionKeyToContractAsync]
@@ -20510,7 +20554,17 @@ function useChipiWalletObject(config3) {
       createSession: async (policy) => {
         await createSession(policy);
       },
-      requestApproval: (req) => cfg.current.requestApproval?.(req) ?? Promise.resolve(true)
+      requestApproval: (req) => {
+        const gate = cfg.current.requestApproval;
+        if (gate) return gate(req);
+        if (!warnedMissingApproval.current) {
+          warnedMissingApproval.current = true;
+          console.warn(
+            "[ChipiSDK:Connect] No `requestApproval` was provided to useChipiWalletObject, so every approval (connect, execute, signTypedData, session) is denied. Pass `requestApproval` to show the user an approval UI and resolve true/false."
+          );
+        }
+        return Promise.resolve(false);
+      }
     }),
     [callAnyContractAsync, executeWithSessionAsync, signTypedDataAsync, createSession]
   );
@@ -21190,10 +21244,33 @@ var USER_REFUSED_OP = 113;
 var INVALID_REQUEST_PAYLOAD = 114;
 var ACCOUNT_ALREADY_DEPLOYED = 115;
 var UNKNOWN_ERROR = 163;
+var MISSING_APPROVAL_WARNING = "[ChipiSDK:Connect] No `requestApproval` was provided, so every approval (connect, execute, signTypedData, session) is denied. Pass `requestApproval` to show the user an approval UI and resolve true/false.";
+function normalizeChainId(value) {
+  try {
+    if (typeof value === "bigint") return value;
+    if (typeof value === "number") {
+      return Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
+    }
+    if (typeof value !== "string" || value.length === 0) return null;
+    if (/^0x[0-9a-f]+$/i.test(value) || /^[0-9]+$/.test(value)) return BigInt(value);
+    return BigInt(shortString_exports.encodeShortString(value));
+  } catch {
+    return null;
+  }
+}
 function createChipiWindowObject(deps) {
   const accountListeners = /* @__PURE__ */ new Set();
   const networkListeners = /* @__PURE__ */ new Set();
-  const approve = deps.requestApproval ?? (async () => true);
+  let approved = false;
+  let pendingConnect = null;
+  let warnedMissingApproval = false;
+  const approve = deps.requestApproval ?? (async () => {
+    if (!warnedMissingApproval) {
+      warnedMissingApproval = true;
+      console.warn(MISSING_APPROVAL_WARNING);
+    }
+    return false;
+  });
   async function requireApproval(req) {
     const ok = await approve(req);
     if (!ok) throw new RpcError2(USER_REFUSED_OP, "User refused the operation");
@@ -21201,19 +21278,27 @@ function createChipiWindowObject(deps) {
   const request = (async (call) => {
     switch (call.type) {
       case "wallet_requestAccounts": {
-        const accounts = await deps.getAccounts();
-        if (accounts.length === 0) {
-          await requireApproval({ type: "connect" });
-          return deps.getAccounts();
+        if (call.params?.silent_mode) {
+          return approved ? deps.getAccounts() : [];
+        }
+        if (approved) {
+          const accounts = await deps.getAccounts();
+          if (accounts.length > 0) return accounts;
         }
-        return accounts;
+        if (!pendingConnect) {
+          pendingConnect = requireApproval({ type: "connect" }).then(() => {
+            approved = true;
+          }).finally(() => {
+            pendingConnect = null;
+          });
+        }
+        await pendingConnect;
+        return deps.getAccounts();
       }
       case "wallet_requestChainId":
         return deps.chainId;
-      case "wallet_getPermissions": {
-        const accounts = await deps.getAccounts();
-        return accounts.length > 0 ? ["accounts"] : [];
-      }
+      case "wallet_getPermissions":
+        return approved ? ["accounts"] : [];
       case "wallet_addInvokeTransaction": {
         const wireCalls = call.params?.calls ?? [];
         if (wireCalls.length === 0) {
@@ -21226,14 +21311,31 @@ function createChipiWindowObject(deps) {
       }
       case "wallet_signTypedData": {
         const typedData = call.params;
+        const domainChainId = typedData?.domain?.chainId;
+        if (domainChainId !== void 0 && domainChainId !== null) {
+          const expected = normalizeChainId(deps.chainId);
+          const actual = normalizeChainId(domainChainId);
+          if (actual === null || expected === null || actual !== expected) {
+            throw new RpcError2(
+              INVALID_REQUEST_PAYLOAD,
+              `wallet_signTypedData: domain.chainId ${String(domainChainId)} does not match the wallet chain ${deps.chainId}`
+            );
+          }
+        }
         await requireApproval({ type: "signTypedData", typedData });
         return deps.signTypedData(typedData);
       }
       case "wallet_deploymentData":
         try {
           return await deps.getDeploymentData();
-        } catch {
-          throw new RpcError2(ACCOUNT_ALREADY_DEPLOYED, "Account already deployed");
+        } catch (err2) {
+          if (err2 instanceof Error && err2.message === "account_already_deployed") {
+            throw new RpcError2(ACCOUNT_ALREADY_DEPLOYED, "Account already deployed");
+          }
+          throw new RpcError2(
+            UNKNOWN_ERROR,
+            err2 instanceof Error ? err2.message : "Could not read deployment data"
+          );
         }
       case "wallet_supportedSpecs":
         return SUPPORTED_SPECS;