@idos-network/client 1.2.0 → 2.2.0

package/dist/index.js

@@ -1,465 +1,2 @@
-import { buildInsertableIDOSCredential, matchLevelOrHigher, recordFilter } from "@idos-network/credentials/utils";
-import { createClientKwilSigner, createWebKwilClient, signNearMessage } from "@idos-network/kwil-infra";
-import { addAttribute, addWallet, addWallets, dagMessage, dwgMessage, getAccessGrantsGrantedCount, getAccessGrantsOwned, getAttributes, getCredentialOwned, getCredentialShared, getCredentials, getGrants, getUser, getWallets, hasProfile, removeCredential, removeWallet, revokeAccessGrant, shareCredential } from "@idos-network/kwil-infra/actions";
-import { base64Decode, base64Encode, hexEncodeSha256Hash, utf8Decode, utf8Encode } from "@idos-network/utils/codecs";
-import { LocalStorageStore } from "@idos-network/utils/store";
-import invariant from "tiny-invariant";
-import { BaseProvider } from "@idos-network/enclave";
-//#region src/enclave/iframe-enclave.ts
-var IframeEnclave = class extends BaseProvider {
-	container;
-	iframe;
-	hostUrl;
-	bound = false;
-	constructor(options) {
-		super(options);
-		if (!this.options.container) throw new Error("container is required");
-		this.container = this.options.container;
-		this.hostUrl = new URL(this.options.url ?? "https://enclave.idos.network");
-		this.iframe = document.createElement("iframe");
-		this.iframe.id = "idos-enclave-iframe";
-	}
-	/** @see parent method */
-	async load() {
-		await this.createAndLoadIframe();
-		await this.requestToEnclave("load");
-		await this.reconfigure();
-		await this.bindMessageListener();
-	}
-	/** @override parent method to call iframe */
-	async reset() {
-		this.requestToEnclave("reset");
-	}
-	/** @override parent method to call iframe */
-	async reconfigure(options = {}) {
-		super.reconfigure(options);
-		await this.requestToEnclave("reconfigure", this.options);
-	}
-	/** @override parent method to call iframe */
-	async confirm(message) {
-		this.showEnclave();
-		try {
-			return await this.requestToEnclave("confirm", message);
-		} catch (error) {
-			console.error(error);
-			return false;
-		} finally {
-			this.hideEnclave();
-		}
-	}
-	/** @override parent method to call iframe */
-	async filterCredentials(credentials, privateFieldFilters) {
-		return await this.requestToEnclave("filterCredentials", credentials, privateFieldFilters);
-	}
-	/** @override parent method to call iframe */
-	async encrypt(message, receiverPublicKey) {
-		return this.requestToEnclave("encrypt", message, receiverPublicKey);
-	}
-	/** @override parent method to call iframe */
-	async decrypt(message, senderPublicKey) {
-		return this.requestToEnclave("decrypt", message, senderPublicKey);
-	}
-	/** @override parent method to call iframe */
-	async backupUserEncryptionProfile() {
-		this.showEnclave();
-		try {
-			await this.requestToEnclave("backupUserEncryptionProfile");
-		} catch (error) {
-			console.error(error);
-		} finally {
-			this.hideEnclave();
-		}
-	}
-	/** @override parent method to call iframe */
-	async ensureUserEncryptionProfile() {
-		this.showEnclave();
-		try {
-			return await this.requestToEnclave("ensureUserEncryptionProfile");
-		} finally {
-			this.hideEnclave();
-		}
-	}
-	async addAddressMessageToSign(address, publicKey, addressToAddType) {
-		return this.requestToEnclave("addAddressMessageToSign", address, publicKey, addressToAddType);
-	}
-	async removeAddressMessageToSign(address, publicKey, addressToRemoveType) {
-		return this.requestToEnclave("removeAddressMessageToSign", address, publicKey, addressToRemoveType);
-	}
-	async addAddressToMpcSecret(userId, message, signature) {
-		return this.requestToEnclave("addAddressToMpcSecret", userId, message, signature);
-	}
-	async removeAddressFromMpcSecret(userId, message, signature) {
-		return this.requestToEnclave("removeAddressFromMpcSecret", userId, message, signature);
-	}
-	async createAndLoadIframe() {
-		const container = document.querySelector(this.container);
-		if (!container) throw new Error(`Can't find container with selector ${this.container}`);
-		const permissionsPolicies = ["publickey-credentials-get", "storage-access"];
-		const liftedSandboxRestrictions = [
-			"forms",
-			"modals",
-			"popups",
-			"popups-to-escape-sandbox",
-			"same-origin",
-			"scripts"
-		].map((toLift) => `allow-${toLift}`);
-		const referrerPolicy = "origin";
-		const styles = {
-			"aspect-ratio": "4/1",
-			"background-color": "transparent",
-			border: "none",
-			display: "block",
-			overflow: "hidden",
-			width: "100%"
-		};
-		this.iframe.allow = permissionsPolicies.join("; ");
-		this.iframe.referrerPolicy = referrerPolicy;
-		this.iframe.sandbox.add(...liftedSandboxRestrictions);
-		this.iframe.src = this.hostUrl.toString();
-		for (const [k, v] of Object.entries(styles)) this.iframe.style.setProperty(k, v);
-		let el;
-		while (el = document.getElementById(this.iframe.id)) {
-			console.log("reinstalling idOS iframe...");
-			container.removeChild(el);
-		}
-		container.appendChild(this.iframe);
-		return new Promise((resolve) => this.iframe.addEventListener("load", () => {
-			resolve();
-		}, { once: true }));
-	}
-	showEnclave() {
-		this.iframe.parentElement.classList.add("visible");
-	}
-	hideEnclave() {
-		this.iframe.parentElement.classList.remove("visible");
-	}
-	async requestToEnclave(method, ...args) {
-		return new Promise((resolve, reject) => {
-			const { port1, port2 } = new MessageChannel();
-			port1.onmessage = ({ data }) => {
-				port1.close();
-				data.error ? reject(data.error) : resolve(data.result);
-			};
-			this.iframe.contentWindow.postMessage({
-				method,
-				data: args
-			}, this.hostUrl.origin, [port2]);
-		});
-	}
-	bindMessageListener() {
-		if (!this.bound) window.addEventListener("message", this.onMessage.bind(this));
-		this.bound = true;
-	}
-	async onMessage(message) {
-		if (!message || !message.data || typeof message.data !== "object") return;
-		if (message.data.type !== "idOS:signTypedData" || message.origin !== this.hostUrl.origin) return;
-		const payload = message.data.payload;
-		const signature = await this.signTypedData(payload.domain, payload.types, payload.value);
-		await this.requestToEnclave("signTypedDataResponse", signature);
-	}
-};
-//#endregion
-//#region src/index.ts
-var idOSClientConfiguration = class {
-	state;
-	chainId;
-	nodeUrl;
-	enclaveOptions;
-	store;
-	enclaveProvider;
-	constructor(params) {
-		this.state = "configuration";
-		this.chainId = params.chainId;
-		this.nodeUrl = params.nodeUrl;
-		this.enclaveOptions = params.enclaveOptions;
-		this.store = params.store ?? new LocalStorageStore();
-		if (params.enclaveProvider) this.enclaveProvider = new params.enclaveProvider({
-			...params.enclaveOptions,
-			store: this.store
-		});
-		else this.enclaveProvider = new IframeEnclave(params.enclaveOptions);
-	}
-	async createClient() {
-		return idOSClientIdle.fromConfig(this);
-	}
-};
-var idOSClientIdle = class idOSClientIdle {
-	state;
-	store;
-	kwilClient;
-	enclaveProvider;
-	constructor(store, kwilClient, enclaveProvider) {
-		this.state = "idle";
-		this.store = store;
-		this.kwilClient = kwilClient;
-		this.enclaveProvider = enclaveProvider;
-	}
-	static async fromConfig(params) {
-		const kwilClient = await createWebKwilClient({
-			nodeUrl: params.nodeUrl,
-			chainId: params.chainId
-		});
-		await params.enclaveProvider.load();
-		return new idOSClientIdle(params.store, kwilClient, params.enclaveProvider);
-	}
-	async addressHasProfile(address) {
-		return hasProfile(this.kwilClient, { address }).then((res) => res.has_profile);
-	}
-	async withUserSigner(_signer) {
-		let signer = _signer;
-		const [kwilSigner, walletIdentifier, walletPublicKey, walletType] = await createClientKwilSigner(this.store, this.kwilClient, signer);
-		this.kwilClient.setSigner(kwilSigner);
-		if (walletType === "NEAR") {
-			const originalSigner = signer;
-			signer = { signMessage: async (message) => {
-				return { signedMessage: await signNearMessage(originalSigner, message) };
-			} };
-		}
-		return new idOSClientWithUserSigner(this, signer, kwilSigner, walletIdentifier, walletPublicKey, walletType);
-	}
-	async logOut() {
-		return this;
-	}
-};
-var idOSClientWithUserSigner = class {
-	state;
-	store;
-	kwilClient;
-	enclaveProvider;
-	signer;
-	kwilSigner;
-	walletIdentifier;
-	walletPublicKey;
-	walletType;
-	constructor(idOSClientIdle, signer, kwilSigner, walletIdentifier, walletPublicKey, walletType) {
-		this.state = "with-user-signer";
-		this.store = idOSClientIdle.store;
-		this.kwilClient = idOSClientIdle.kwilClient;
-		this.enclaveProvider = idOSClientIdle.enclaveProvider;
-		this.signer = signer;
-		this.kwilSigner = kwilSigner;
-		this.walletIdentifier = walletIdentifier;
-		this.walletPublicKey = walletPublicKey;
-		this.walletType = walletType;
-		this.enclaveProvider.setSigner(this.signer);
-	}
-	async logOut() {
-		this.kwilClient.setSigner(void 0);
-		return new idOSClientIdle(this.store, this.kwilClient, this.enclaveProvider);
-	}
-	async hasProfile() {
-		return hasProfile(this.kwilClient, { address: this.walletIdentifier }).then((x) => x.has_profile);
-	}
-	async createUserEncryptionProfile(userId, forceEncryptionPasswordStore) {
-		await this.enclaveProvider.reconfigure({
-			mode: "new",
-			userId,
-			walletAddress: this.walletIdentifier,
-			walletPublicKey: this.walletPublicKey,
-			walletType: this.walletType,
-			encryptionPasswordStore: forceEncryptionPasswordStore,
-			expectedUserEncryptionPublicKey: void 0
-		});
-		return this.enclaveProvider.ensureUserEncryptionProfile();
-	}
-	async logIn() {
-		if (!await this.hasProfile()) throw new Error("User does not have a profile");
-		const kwilUser = await getUser(this.kwilClient);
-		await this.enclaveProvider.reconfigure({
-			mode: "existing",
-			userId: kwilUser.id,
-			expectedUserEncryptionPublicKey: kwilUser.recipient_encryption_public_key,
-			walletAddress: this.walletIdentifier,
-			walletType: this.walletType,
-			encryptionPasswordStore: kwilUser.encryption_password_store,
-			walletPublicKey: this.walletPublicKey
-		});
-		return new idOSClientLoggedIn(this, kwilUser);
-	}
-};
-var idOSClientLoggedIn = class {
-	state;
-	store;
-	kwilClient;
-	enclaveProvider;
-	signer;
-	kwilSigner;
-	walletIdentifier;
-	walletPublicKey;
-	walletType;
-	user;
-	constructor(idOSClientWithUserSigner, user) {
-		this.state = "logged-in";
-		this.store = idOSClientWithUserSigner.store;
-		this.kwilClient = idOSClientWithUserSigner.kwilClient;
-		this.enclaveProvider = idOSClientWithUserSigner.enclaveProvider;
-		this.signer = idOSClientWithUserSigner.signer;
-		this.kwilSigner = idOSClientWithUserSigner.kwilSigner;
-		this.walletIdentifier = idOSClientWithUserSigner.walletIdentifier;
-		this.walletPublicKey = idOSClientWithUserSigner.walletPublicKey;
-		this.walletType = idOSClientWithUserSigner.walletType;
-		this.user = user;
-	}
-	async logOut() {
-		this.kwilClient.setSigner(void 0);
-		return new idOSClientIdle(this.store, this.kwilClient, this.enclaveProvider);
-	}
-	async requestDWGMessage(params) {
-		return dwgMessage(this.kwilClient, params).then((res) => res.message);
-	}
-	async removeCredential(id) {
-		await removeCredential(this.kwilClient, { id });
-		return { id };
-	}
-	async getCredentialById(id) {
-		return getCredentialOwned(this.kwilClient, { id }).then((res) => res[0]);
-	}
-	async shareCredential(credential) {
-		await shareCredential(this.kwilClient, credential);
-		return credential;
-	}
-	async getAllCredentials() {
-		return getCredentials(this.kwilClient);
-	}
-	async getAccessGrantsOwned() {
-		return getAccessGrantsOwned(this.kwilClient);
-	}
-	async getAttributes() {
-		return getAttributes(this.kwilClient);
-	}
-	async createAttribute(attribute) {
-		await addAttribute(this.kwilClient, attribute);
-		return attribute;
-	}
-	async getCredentialContentSha256Hash(id) {
-		const credential = await this.getCredentialById(id);
-		invariant(credential, `"idOSCredential" with id ${id} not found`);
-		await this.enclaveProvider.ensureUserEncryptionProfile();
-		return hexEncodeSha256Hash(await this.enclaveProvider.decrypt(base64Decode(credential.content), base64Decode(credential.encryptor_public_key)));
-	}
-	async getCredentialContent(id) {
-		const credential = await this.getCredentialById(id);
-		invariant(credential, `"idOSCredential" with id ${id} not found`);
-		await this.enclaveProvider.ensureUserEncryptionProfile();
-		return utf8Decode(await this.enclaveProvider.decrypt(base64Decode(credential.content), base64Decode(credential.encryptor_public_key)));
-	}
-	async requestDAGMessage(params) {
-		return dagMessage(this.kwilClient, params).then((res) => res.message);
-	}
-	async getGrants(params) {
-		return {
-			grants: await getGrants(this.kwilClient, params),
-			totalCount: await this.getGrantsCount()
-		};
-	}
-	async addWallets(params) {
-		await addWallets(this.kwilClient, params);
-		return params;
-	}
-	async getGrantsCount() {
-		return getAccessGrantsGrantedCount(this.kwilClient, { user_id: null }).then((res) => res.count);
-	}
-	async getCredentialShared(id) {
-		return getCredentialShared(this.kwilClient, { id }).then((res) => res[0]);
-	}
-	async revokeAccessGrant(id) {
-		await revokeAccessGrant(this.kwilClient, { id });
-		return { id };
-	}
-	async addWallet(params) {
-		await addWallet(this.kwilClient, params);
-		if (this.user.encryption_password_store !== "mpc") {
-			console.log("MPC is not enabled or the user is not using MPC");
-			return params;
-		}
-		if (!params.wallet_type) throw new Error("Wallet type is required for MPC users");
-		const messageToSign = await this.enclaveProvider.addAddressMessageToSign(params.address, params.public_key ?? void 0, params.wallet_type);
-		const signature = await this.enclaveProvider.signTypedData(messageToSign.domain, messageToSign.types, messageToSign.value);
-		const result = await this.enclaveProvider.addAddressToMpcSecret(this.user.id, messageToSign.value, signature);
-		if (result !== "success") console.error(`Failed to add wallet to MPC: ${result}`);
-		return params;
-	}
-	async getWallets() {
-		return getWallets(this.kwilClient);
-	}
-	async removeWallet(id) {
-		const wallet = (await this.getWallets()).find((wallet) => wallet.id === id);
-		if (!wallet) throw new Error(`Wallet with id ${id} not found`);
-		await removeWallet(this.kwilClient, { id });
-		if (this.user.encryption_password_store !== "mpc") {
-			console.log("MPC is not enabled or the user is not using MPC");
-			return { id };
-		}
-		const messageToSign = await this.enclaveProvider.removeAddressMessageToSign(wallet.address, wallet.public_key ?? void 0, wallet.wallet_type);
-		const signature = await this.enclaveProvider.signTypedData(messageToSign.domain, messageToSign.types, messageToSign.value);
-		const result = await this.enclaveProvider.removeAddressFromMpcSecret(wallet.user_id, messageToSign.value, signature);
-		if (result !== "success") console.error(`Failed to add wallet to MPC: ${result}`);
-		return { id };
-	}
-	async removeWallets(ids) {
-		for (const id of ids) await this.removeWallet(id);
-		return ids;
-	}
-	async filterCredentials(requirements) {
-		let result = (await this.getAllCredentials()).filter((cred) => !cred.original_id && !!cred.public_notes).filter((cred) => {
-			return requirements.acceptedIssuers?.some((issuer) => issuer.authPublicKey === cred.issuer_auth_public_key);
-		});
-		const publicNotesFieldFilters = requirements.publicNotesFieldFilters;
-		const credentialLevelOrHigherFilter = requirements.credentialLevelOrHigherFilter;
-		const privateFieldFilters = requirements.privateFieldFilters;
-		if (credentialLevelOrHigherFilter) result = result.filter((credential) => {
-			let publicNotes;
-			try {
-				publicNotes = JSON.parse(credential.public_notes);
-			} catch (_) {
-				throw new Error(`Credential ${credential.id} has non-JSON public notes.`);
-			}
-			return matchLevelOrHigher(credentialLevelOrHigherFilter.userLevel, credentialLevelOrHigherFilter.requiredAddons, publicNotes.level);
-		});
-		if (publicNotesFieldFilters && (Object.keys(publicNotesFieldFilters.pick).length > 0 || Object.keys(publicNotesFieldFilters.omit).length > 0)) result = result.filter((credential) => {
-			let publicNotes;
-			try {
-				publicNotes = JSON.parse(credential.public_notes);
-			} catch (_) {
-				throw new Error(`Credential ${credential.id} has non-JSON public notes.`);
-			}
-			return recordFilter(publicNotes, publicNotesFieldFilters.pick, publicNotesFieldFilters.omit);
-		});
-		if (privateFieldFilters && (Object.keys(privateFieldFilters.pick).length > 0 || Object.keys(privateFieldFilters.omit).length > 0)) {
-			const fullCredentials = await Promise.all(result.map((credential) => this.getCredentialById(credential.id)));
-			invariant(fullCredentials.every((cred) => cred !== void 0), "Some credentials could not be fetched in full form for private field filtering");
-			const matches = await this.enclaveProvider.filterCredentials(fullCredentials, privateFieldFilters);
-			result = result.filter((credential) => matches.some((matchedCredential) => matchedCredential.id === credential.id));
-		}
-		return result;
-	}
-	async requestAccessGrant(credentialId, { consumerEncryptionPublicKey, consumerAuthPublicKey, lockedUntil = 0 }) {
-		const credential = await this.getCredentialById(credentialId);
-		const contentHash = await this.getCredentialContentSha256Hash(credentialId);
-		invariant(credential, `"idOSCredential" with id ${credentialId} not found`);
-		const plaintextContent = utf8Decode(await this.enclaveProvider.decrypt(base64Decode(credential.content), base64Decode(credential.encryptor_public_key)));
-		await this.enclaveProvider.ensureUserEncryptionProfile();
-		const { content, encryptorPublicKey } = await this.enclaveProvider.encrypt(utf8Encode(plaintextContent), base64Decode(consumerEncryptionPublicKey));
-		const insertableCredential = {
-			...credential,
-			...buildInsertableIDOSCredential(credential.user_id, "", base64Encode(content), base64Encode(encryptorPublicKey)),
-			original_credential_id: credential.id,
-			id: crypto.randomUUID(),
-			grantee_wallet_identifier: consumerAuthPublicKey,
-			locked_until: lockedUntil,
-			content_hash: contentHash
-		};
-		await this.shareCredential(insertableCredential);
-		return insertableCredential;
-	}
-};
-function createIDOSClient(params) {
-	return new idOSClientConfiguration({
-		nodeUrl: params.nodeUrl,
-		enclaveOptions: params.enclaveOptions
-	});
-}
-//#endregion
-export { IframeEnclave, createIDOSClient, idOSClientConfiguration, idOSClientIdle, idOSClientLoggedIn, idOSClientWithUserSigner, signNearMessage };
-
+import{buildEphemeralSignedCredentialContentReference as e,buildPreliminaryIDOSCredential as t,mapPreliminaryToIDOSCredential as n,matchLevelOrHigher as r,recordFilter as i}from"@idos-network/credentials/utils";import{createClientKwilSigner as a,createKgwAuthenticatedBlobGateway as o,createNodeKwilClient as s,createWebKwilClient as c,isMmTokenAuth as l,mmTokenCredentialContentUri as u,signNearMessage as d}from"@idos-network/kwil-infra";import{addAttribute as f,addWallet as p,addWalletMessage as m,addWallets as h,createPreliminaryCredential as g,dwgMessage as _,getAccessGrantsGrantedCount as v,getAccessGrantsOwned as y,getAttributes as b,getCredentialOwned as x,getCredentialShared as S,getCredentials as C,getGrants as w,getUser as T,getWallets as E,hasProfile as D,removeCredential as O,removeWallet as k,revokeAccessGrant as A,sharePreliminaryCredential as j,toDelegatedWriteGrantBaseParams as ee}from"@idos-network/kwil-infra/actions";import{NodeKwil as te}from"@idos-network/kwil-js";import{BlobGateway as M,createBlobContentReference as N,requireAccessTokenForUkycContent as P,resolveCredentialEncryptedContent as F}from"@idos-network/utils/blob-gateway";import{base64Decode as I,base64Encode as L,hexEncodeSha256Hash as R,utf8Decode as z}from"@idos-network/utils/codecs";import{LocalStorageStore as B,MemoryStore as V}from"@idos-network/utils/store";import H from"tiny-invariant";import{BaseProvider as U}from"@idos-network/enclave";var W=class extends U{container;iframe;hostUrl;bound=!1;constructor(e){if(super(e),!this.options.container)throw Error(`container is required`);this.container=this.options.container,this.hostUrl=new URL(this.options.url??`https://enclave.idos.network`),this.iframe=document.createElement(`iframe`),this.iframe.id=`idos-enclave-iframe`}async load(){await this.createAndLoadIframe(),await this.requestToEnclave(`load`),await this.reconfigure(),await this.bindMessageListener()}async reset(){throw Error(`Embedding pages cannot reset enclave storage`)}async reconfigure(e={}){super.reconfigure(e),await this.requestToEnclave(`reconfigure`,this.options)}async confirm(e){this.showEnclave();try{return await this.requestToEnclave(`confirm`,e)}catch(e){return console.error(e),!1}finally{this.hideEnclave()}}async filterCredentials(e,t){return await this.requestToEnclave(`filterCredentials`,e,t)}async encrypt(e,t){return this.requestToEnclave(`encrypt`,e,t)}async decrypt(e,t){return this.requestToEnclave(`decrypt`,e,t)}async backupUserEncryptionProfile(){this.showEnclave();try{await this.requestToEnclave(`backupUserEncryptionProfile`)}catch(e){console.error(e)}finally{this.hideEnclave()}}async ensureUserEncryptionProfile(){this.showEnclave();try{return await this.requestToEnclave(`ensureUserEncryptionProfile`)}finally{this.hideEnclave()}}async addAddressMessageToSign(e,t,n){return this.requestToEnclave(`addAddressMessageToSign`,e,t,n)}async removeAddressMessageToSign(e,t,n){return this.requestToEnclave(`removeAddressMessageToSign`,e,t,n)}async addAddressToMpcSecret(e,t,n){return this.requestToEnclave(`addAddressToMpcSecret`,e,t,n)}async removeAddressFromMpcSecret(e,t,n){return this.requestToEnclave(`removeAddressFromMpcSecret`,e,t,n)}async createAndLoadIframe(){let e=document.querySelector(this.container);if(!e)throw Error(`Can't find container with selector ${this.container}`);let t=[`publickey-credentials-get`,`storage-access`],n=[`forms`,`modals`,`popups`,`popups-to-escape-sandbox`,`same-origin`,`scripts`].map(e=>`allow-${e}`),r={"aspect-ratio":`4/1`,"background-color":`transparent`,border:`none`,display:`block`,overflow:`hidden`,width:`100%`};this.iframe.allow=t.join(`; `),this.iframe.referrerPolicy=`origin`,this.iframe.sandbox.add(...n),this.iframe.src=this.hostUrl.toString();for(let[e,t]of Object.entries(r))this.iframe.style.setProperty(e,t);let i;for(;i=document.getElementById(this.iframe.id);)console.log(`reinstalling idOS iframe...`),e.removeChild(i);return e.appendChild(this.iframe),new Promise(e=>this.iframe.addEventListener(`load`,()=>{e()},{once:!0}))}showEnclave(){this.iframe.parentElement.classList.add(`visible`)}hideEnclave(){this.iframe.parentElement.classList.remove(`visible`)}async requestToEnclave(e,...t){return new Promise((n,r)=>{let{port1:i,port2:a}=new MessageChannel;i.onmessage=({data:e})=>{i.close(),e.error?r(e.error):n(e.result)},this.iframe.contentWindow.postMessage({method:e,data:t},this.hostUrl.origin,[a])})}bindMessageListener(){this.bound||window.addEventListener(`message`,this.onMessage.bind(this)),this.bound=!0}async onMessage(e){if(!e||!e.data||typeof e.data!=`object`||e.data.type!==`idOS:signTypedData`||e.origin!==this.hostUrl.origin)return;let t=e.data.payload,n=await this.signTypedData(t.domain,t.types,t.value);await this.requestToEnclave(`signTypedDataResponse`,n)}};function G(){return typeof window<`u`}function K(e){return e.client instanceof te}function q(e){return G()?new M({url:e,fetchFn:(e,t)=>fetch(e,{...t,credentials:`include`})}):new M({url:e})}function J(e,t){return K(e.kwilClient)?o({url:e.blobGateway.url,kwilClient:e.kwilClient,signer:t}):l(t)?e.blobGateway.withAccessToken(t.accessToken):e.blobGateway}function Y(e,t,n){if(e===`MM`)return u(t,n)}var X=class{state;chainId;nodeUrl;blobGatewayUrl;enclaveOptions;store;enclaveProvider;constructor(e){this.state=`configuration`,this.chainId=e.chainId,this.nodeUrl=e.nodeUrl,this.blobGatewayUrl=e.blobGatewayUrl,this.enclaveOptions=e.enclaveOptions,this.store=e.store??(G()?new B:new V),this.enclaveProvider=e.enclaveProvider?new e.enclaveProvider({...e.enclaveOptions,store:this.store}):new W(e.enclaveOptions)}async createClient(){return Z.fromConfig(this)}},Z=class e{state;store;kwilClient;enclaveProvider;blobGateway;constructor(e,t,n,r){this.state=`idle`,this.store=e,this.kwilClient=t,this.enclaveProvider=n,this.blobGateway=r}static async fromConfig(t){let n=await(G()?c:s)({nodeUrl:t.nodeUrl,chainId:t.chainId});await t.enclaveProvider.load();let r=t.blobGatewayUrl??t.nodeUrl;return new e(t.store,n,t.enclaveProvider,q(r))}async addressHasProfile(e){return D(this.kwilClient,{address:e}).then(e=>e.has_profile)}async withUserSigner(e){let t=e,[n,r,i,o]=await a(this.store,this.kwilClient,t);if(this.kwilClient.setSigner(n),o===`NEAR`){let e=t;t={signMessage:async t=>({signedMessage:await d(e,t)})}}return new Q(this,t,n,r,i,o,J(this,n))}async logOut(){return this}},Q=class{state;store;kwilClient;enclaveProvider;signer;kwilSigner;walletIdentifier;walletPublicKey;walletType;blobGateway;constructor(e,t,n,r,i,a,o){this.state=`with-user-signer`,this.store=e.store,this.kwilClient=e.kwilClient,this.enclaveProvider=e.enclaveProvider,this.signer=t,this.kwilSigner=n,this.walletIdentifier=r,this.walletPublicKey=i,this.walletType=a,this.blobGateway=o,this.enclaveProvider.setSigner(this.signer)}async logOut(){return this.kwilClient.setSigner(void 0),await this.enclaveProvider.reset(),new Z(this.store,this.kwilClient,this.enclaveProvider,q(this.blobGateway.url))}async hasProfile(){return D(this.kwilClient,{address:this.walletIdentifier}).then(e=>e.has_profile)}async createUserEncryptionProfile(e,t){return await this.enclaveProvider.reconfigure({mode:`new`,userId:e,walletAddress:this.walletIdentifier,walletPublicKey:this.walletPublicKey,walletType:this.walletType,encryptionPasswordStore:t,expectedUserEncryptionPublicKey:void 0}),this.enclaveProvider.ensureUserEncryptionProfile()}async logIn(){if(!await this.hasProfile())throw Error(`User does not have a profile`);let e=await T(this.kwilClient);return await this.enclaveProvider.reconfigure({mode:`existing`,userId:e.id,expectedUserEncryptionPublicKey:e.recipient_encryption_public_key,walletAddress:this.walletIdentifier,walletType:this.walletType,encryptionPasswordStore:e.encryption_password_store,walletPublicKey:this.walletPublicKey}),new $(this,e)}},$=class{state;store;kwilClient;enclaveProvider;signer;kwilSigner;walletIdentifier;walletPublicKey;walletType;user;blobGateway;constructor(e,t){this.state=`logged-in`,this.store=e.store,this.kwilClient=e.kwilClient,this.enclaveProvider=e.enclaveProvider,this.signer=e.signer,this.kwilSigner=e.kwilSigner,this.walletIdentifier=e.walletIdentifier,this.walletPublicKey=e.walletPublicKey,this.walletType=e.walletType,this.user=t,this.blobGateway=e.blobGateway}async logOut(){return this.kwilClient.setSigner(void 0),await this.enclaveProvider.reset(),new Z(this.store,this.kwilClient,this.enclaveProvider,q(this.blobGateway.url))}async requestDWGMessage(e){return _(this.kwilClient,e).then(e=>e.message)}async createCredential(e,r,i){let a=crypto.randomUUID(),o={...await t({publicNotes:e,plaintextContent:r,recipientEncryptionPublicKey:I(this.user.recipient_encryption_public_key),issuerSigningSecretKey:i,contentUri:Y(this.walletType,this.kwilSigner,a)}),id:a};P(o.contentUri,this.blobGateway.hasAccessToken);let s=crypto.randomUUID(),c={request_id:s,credential_id:o.id,issuer_auth_public_key:o.issuerAuthPublicKey,encryptor_public_key:o.encryptorPublicKey,content_uri:o.contentUri,content_size:o.contentSize,content_hash:R(r),public_notes:o.publicNotes,public_notes_signature:o.publicNotesSignature,broader_signature:o.broaderSignature};return await g(this.kwilClient,c),await this.blobGateway.uploadCredentialBlobs({requestId:s,original:o.encryptedContent}),n(o)}async removeCredential(e){let t=await this.getCredentialById(e);H(t,`"idOSCredential" with id ${e} not found`);let n=t.content_uri??null;return P(n,this.blobGateway.hasAccessToken),await O(this.kwilClient,{id:e}),n&&await this.blobGateway.deleteCredentialBlob({credentialId:e}),{id:e}}async getCredentialById(e){return x(this.kwilClient,{id:e}).then(e=>e[0])}async shareCredential(e){return await j(this.kwilClient,e),e}async getAllCredentials(){return C(this.kwilClient)}async getAccessGrantsOwned(){return y(this.kwilClient)}async getAttributes(){return b(this.kwilClient)}async createAttribute(e){return await f(this.kwilClient,e),e}async getCredentialContentSha256Hash(e){let t=await this.getCredentialById(e);H(t,`"idOSCredential" with id ${e} not found`);let n=await this.#t(t);return R(n)}async getCredentialContent(e){let t=await this.getCredentialById(e);H(t,`"idOSCredential" with id ${e} not found`);let n=await this.#t(t);return z(n)}async getCredentialWithEncryptedContent(e){let t=await this.getCredentialById(e);return H(t,`"idOSCredential" with id ${e} not found`),this.#e(t)}async getCredentialSharedContent(e){let t=await this.getCredentialShared(e);H(t,`Shared credential with id ${e} not found`);let n=await this.#t(t);return z(n)}async getGrants(e){return{grants:await w(this.kwilClient,e),totalCount:await this.getGrantsCount()}}async addWallets(e){return await h(this.kwilClient,e),e}async getGrantsCount(){return v(this.kwilClient,{user_id:null}).then(e=>e.count)}async getCredentialShared(e){return S(this.kwilClient,{id:e}).then(e=>e[0])}async revokeAccessGrant(e){return await A(this.kwilClient,{id:e}),{id:e}}async addWalletMessage(e){return(await m(this.kwilClient,e)).message}async addWallet(e){if(await p(this.kwilClient,e),this.user.encryption_password_store!==`mpc`)return console.log(`MPC is not enabled or the user is not using MPC`),e;if(!e.wallet_type)throw Error(`Wallet type is required for MPC users`);let t=await this.enclaveProvider.addAddressMessageToSign(e.address,e.public_key??void 0,e.wallet_type),n=await this.enclaveProvider.signTypedData(t.domain,t.types,t.value),r=await this.enclaveProvider.addAddressToMpcSecret(this.user.id,t.value,n);return r!==`success`&&console.error(`Failed to add wallet to MPC: ${r}`),e}async getWallets(){return E(this.kwilClient)}async removeWallet(e){let t=(await this.getWallets()).find(t=>t.id===e);if(!t)throw Error(`Wallet with id ${e} not found`);if(await k(this.kwilClient,{id:e}),this.user.encryption_password_store!==`mpc`)return console.log(`MPC is not enabled or the user is not using MPC`),{id:e};let n=await this.enclaveProvider.removeAddressMessageToSign(t.address,t.public_key??void 0,t.wallet_type),r=await this.enclaveProvider.signTypedData(n.domain,n.types,n.value),i=await this.enclaveProvider.removeAddressFromMpcSecret(t.user_id,n.value,r);return i!==`success`&&console.error(`Failed to add wallet to MPC: ${i}`),{id:e}}async removeWallets(e){for(let t of e)await this.removeWallet(t);return e}async filterCredentials(e){let t=(await this.getAllCredentials()).filter(e=>!e.original_id&&!!e.public_notes).filter(t=>e.acceptedIssuers?.some(e=>e.authPublicKey===t.issuer_auth_public_key)),n=e.publicNotesFieldFilters,a=e.credentialLevelOrHigherFilter,o=e.privateFieldFilters;if(a&&(t=t.filter(e=>{let t;try{t=JSON.parse(e.public_notes)}catch{throw Error(`Credential ${e.id} has non-JSON public notes.`)}return r(a.userLevel,a.requiredAddons,t.level)})),n&&(Object.keys(n.pick).length>0||Object.keys(n.omit).length>0)&&(t=t.filter(e=>{let t;try{t=JSON.parse(e.public_notes)}catch{throw Error(`Credential ${e.id} has non-JSON public notes.`)}return i(t,n.pick,n.omit)})),o&&(Object.keys(o.pick).length>0||Object.keys(o.omit).length>0)){let e=await Promise.all(t.map(e=>this.getCredentialById(e.id)));H(e.every(e=>e!==void 0),`Some credentials could not be fetched in full form for private field filtering`);let n=await this.enclaveProvider.filterCredentials(await Promise.all(e.map(e=>this.#e(e))),o);t=t.filter(e=>n.some(t=>t.id===e.id))}return t}async requestAccessGrant(t,{consumerEncryptionPublicKey:n,consumerAuthPublicKey:r,lockedUntil:i=0}){let a=await this.getCredentialById(t);H(a,`"idOSCredential" with id ${t} not found`);let o=await this.#t(a),s=R(o);await this.enclaveProvider.ensureUserEncryptionProfile();let{content:c,encryptorPublicKey:l}=await this.enclaveProvider.encrypt(o,I(n)),u=crypto.randomUUID(),d=Y(this.walletType,this.kwilSigner,u);P(d,this.blobGateway.hasAccessToken);let f=d?{uri:d,size:c.byteLength}:await N(c),p=e(``,f.uri),m=/^[0-9a-fA-F]{64}$/.test(r)?r.toLowerCase():r,h={...p,request_id:crypto.randomUUID(),copy_id:u,original_id:a.id,content_uri:f.uri,content_size:f.size,encryptor_public_key:L(l),grantee_wallet_identifier:m,locked_until:i,content_hash:s};return await this.shareCredential(h),await this.blobGateway.uploadCredentialBlobs({requestId:h.request_id,copy:c}),h}async#e(e){return e.content?e:{...e,content:L(await this.#n(e)),content_uri:null,content_size:null}}async#t(e){return await this.enclaveProvider.ensureUserEncryptionProfile(),this.enclaveProvider.decrypt(await this.#n(e),I(e.encryptor_public_key))}async#n(e){return F(e,this.blobGateway)}};function ne(e){return new X({nodeUrl:e.nodeUrl,blobGatewayUrl:e.blobGatewayUrl,enclaveOptions:e.enclaveOptions})}export{W as IframeEnclave,ne as createIDOSClient,X as idOSClientConfiguration,Z as idOSClientIdle,$ as idOSClientLoggedIn,Q as idOSClientWithUserSigner,d as signNearMessage,ee as toDelegatedWriteGrantBaseParams};
 //# sourceMappingURL=index.js.map