@meddleware/token-deployer-ui 0.0.9 → 0.0.11

package/src/composables/useAccessGate.ts

@@ -1,127 +0,0 @@
-import { computed, ref } from 'vue'
-import { ACCESS_GATE } from '../config.js'
-import type { WalrusNetwork } from '../config.js'
-import {
-  fetchAccessNfts,
-  buildPurchaseTx,
-  buildConsumeTx,
-  fetchRelayChallenge,
-  personalMessageForNonce,
-  buildAccessProofToken,
-} from '../lib/accessGate.js'
-import type { AccessGateConfig, OwnedObjectsClient } from '../lib/accessGate.js'
-import type { Executor } from '../lib/deploy.js'
-import type { Transaction } from '@mysten/sui/transactions'
-
-/** A wallet personal-message signer, as exposed by `useWallet().signPersonalMessage`. */
-export type PersonalMessageSigner = (message: Uint8Array) => Promise<{ signature: string }>
-
-/**
- * Reactive NFT-gate state for the operator relay.
- *
- * When no gate is configured for the network (`ACCESS_GATE[network] == null`), the relay is
- * treated as OPEN (`hasAccess === true`) and this composable is inert — behaviour is
- * unchanged from before gating existed. When a gate IS configured, `checkOwnership` decides
- * access with a single `getOwnedObjects` call (the same cheap pattern as the relay health
- * check), and `purchase`/`buildRelayAccessToken` drive the buy + prove flows.
- */
-export function useAccessGate(
-  network: WalrusNetwork,
-  deps: {
-    getClient: (network: WalrusNetwork) => OwnedObjectsClient
-    /** Override the configured gate (mainly for testing); defaults to `ACCESS_GATE[network]`. */
-    gate?: AccessGateConfig | null
-  },
-) {
-  const gate: AccessGateConfig | null = deps.gate !== undefined ? deps.gate : ACCESS_GATE[network]
-  const gateConfigured = gate !== null
-
-  // No gate → open. Gate → unknown until checked.
-  const hasAccess = ref<boolean | null>(gateConfigured ? null : true)
-  const usesRemaining = ref<number | null>(null)
-  /** Object id of the held access NFT (for the single-use consume step); null if none. */
-  const nftId = ref<string | null>(null)
-  const checking = ref(false)
-  const error = ref<string | null>(null)
-
-  /** Query whether `address` holds the gate NFT. Cheap; safe to call on connect. */
-  async function checkOwnership(address: string): Promise<void> {
-    if (!gate) {
-      hasAccess.value = true
-      return
-    }
-    checking.value = true
-    error.value = null
-    try {
-      const nfts = await fetchAccessNfts(
-        deps.getClient(network),
-        address,
-        gate.nftType,
-        gate.gateId,
-      )
-      hasAccess.value = nfts.length > 0
-      usesRemaining.value = nfts.length ? nfts[0].usesRemaining : null
-      nftId.value = nfts.length ? nfts[0].objectId : null
-    } catch (e) {
-      // A failed check must NOT hard-block the user: leave access unknown/false but keep the
-      // purchase path available (the gateway re-verifies server-side regardless).
-      hasAccess.value = false
-      nftId.value = null
-      error.value = e instanceof Error ? e.message : String(e)
-    } finally {
-      checking.value = false
-    }
-  }
-
-  /** Purchase access via the connected wallet, then re-check ownership. */
-  async function purchase(executor: Executor, address: string): Promise<void> {
-    if (!gate) throw new Error('No access gate configured for this network.')
-    const tx = buildPurchaseTx(gate)
-    const res = await executor.signAndExecute(tx)
-    if (res.digest) await executor.waitForTransaction(res.digest).catch(() => {})
-    await checkOwnership(address)
-  }
-
-  /** Build the consume PTB for a single-use NFT (woven into the upload flow before proving). */
-  function buildConsume(nftId: string, nonce: string): Transaction {
-    if (!gate) throw new Error('No access gate configured for this network.')
-    return buildConsumeTx(gate, nftId, nonce)
-  }
-
-  /**
-   * Fetch a challenge from the gateway (served at the operator relay host), sign it, and
-   * return the base64 access-proof token to pass to the Walrus client as the relay auth
-   * token. For single-use gates supply the on-chain consume `consumeDigest`.
-   */
-  async function buildRelayAccessToken(opts: {
-    relayHost: string
-    address: string
-    sign: PersonalMessageSigner
-    consumeDigest?: string
-  }): Promise<string> {
-    const challenge = await fetchRelayChallenge(opts.relayHost)
-    const { signature } = await opts.sign(personalMessageForNonce(challenge.nonce))
-    return buildAccessProofToken({
-      address: opts.address,
-      nonce: challenge.nonce,
-      signature,
-      consumeDigest: opts.consumeDigest,
-    })
-  }
-
-  return {
-    gate,
-    gateConfigured,
-    hasAccess,
-    usesRemaining,
-    nftId,
-    checking,
-    error,
-    /** Convenience: gate configured AND access confirmed. */
-    accessGranted: computed(() => !gateConfigured || hasAccess.value === true),
-    checkOwnership,
-    purchase,
-    buildConsume,
-    buildRelayAccessToken,
-  }
-}

package/src/lib/accessGate.ts

@@ -1,141 +0,0 @@
-// Client-side helpers for the `access_gate` NFT primitive that gates the operator's
-// upload relay: ownership queries, purchase/consume PTB builders, and the wallet-signed
-// access-proof token.
-//
-// Self-contained (this app is standalone). The wire format mirrors
-// `@meddleware/nft-gate-client` and `@meddleware/sui-walrus`'s access helpers; the
-// `nft-gate` gateway is the authority that verifies these proofs.
-//
-// TODO(unify): consume `@meddleware/nft-gate-client` once published and drop the duplication.
-
-import { Transaction } from '@mysten/sui/transactions'
-
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
-/** Deployed gate + the NFT type that satisfies it. */
-export interface AccessGateConfig {
-  packageId: string
-  gateId: string
-  /** `<pkg>::access_gate::AccessNFT` or `…::SoulboundAccessNFT`. */
-  nftType: string
-  soulbound: boolean
-  /** Purchase price in MIST. */
-  priceMist: bigint
-}
-
-export interface OwnedAccessNft {
-  objectId: string
-  gateId: string
-  /** `null` = unlimited pass; otherwise remaining single-use count. */
-  usesRemaining: number | null
-}
-
-/** Minimal structural subset of the JSON-RPC client used here. */
-export interface OwnedObjectsClient {
-  getOwnedObjects(params: {
-    owner: string
-    filter?: { StructType: string }
-    options?: { showContent?: boolean; showType?: boolean }
-  }): Promise<{ data: unknown[] }>
-}
-
-function parseUsesRemaining(variant: any): number | null {
-  if (variant == null) return null
-  const fields = variant.fields ?? variant
-  const ur = fields?.uses_remaining ?? fields?.SingleUse?.uses_remaining
-  return ur != null ? Number(ur) : null
-}
-
-/** Parse a `getOwnedObjects` entry into an access NFT, or `null` if it isn't one. */
-export function parseOwnedAccessNft(entry: any): OwnedAccessNft | null {
-  const obj = entry?.data ?? entry
-  const objectId: string | undefined = obj?.objectId
-  const inner = obj?.content?.fields?.data?.fields
-  const gateId: string | undefined = inner?.gate_id ?? inner?.gateId
-  if (!objectId || !gateId) return null
-  return { objectId, gateId, usesRemaining: parseUsesRemaining(inner?.variant) }
-}
-
-/** All access NFTs of `nftType` owned by `owner`, optionally restricted to `gateId`. */
-export async function fetchAccessNfts(
-  client: OwnedObjectsClient,
-  owner: string,
-  nftType: string,
-  gateId?: string,
-): Promise<OwnedAccessNft[]> {
-  const { data } = await client.getOwnedObjects({
-    owner,
-    filter: { StructType: nftType },
-    options: { showContent: true, showType: true },
-  })
-  const parsed = (data ?? [])
-    .map(parseOwnedAccessNft)
-    .filter((n): n is OwnedAccessNft => n !== null)
-  return gateId ? parsed.filter((n) => n.gateId === gateId) : parsed
-}
-
-/** Build a PTB that buys access (splits the exact price from gas → `purchase`). */
-export function buildPurchaseTx(cfg: AccessGateConfig): Transaction {
-  const tx = new Transaction()
-  const [payment] = tx.splitCoins(tx.gas, [tx.pure.u64(cfg.priceMist)])
-  tx.moveCall({
-    target: `${cfg.packageId}::access_gate::purchase`,
-    arguments: [tx.object(cfg.gateId), payment],
-  })
-  return tx
-}
-
-/** Build a PTB that consumes one single-use, binding it to `nonce`. */
-export function buildConsumeTx(cfg: AccessGateConfig, nftId: string, nonce: string): Transaction {
-  const tx = new Transaction()
-  const fn = cfg.soulbound ? 'consume_soulbound' : 'consume'
-  const nonceBytes = Array.from(new TextEncoder().encode(nonce))
-  tx.moveCall({
-    target: `${cfg.packageId}::access_gate::${fn}`,
-    arguments: [tx.object(nftId), tx.object(cfg.gateId), tx.pure.vector('u8', nonceBytes)],
-  })
-  return tx
-}
-
-// ── Challenge / proof (mirror of the gateway's wire format) ───────────────────────
-
-export interface RelayChallenge {
-  nonce: string
-  expiresAt: number
-}
-
-export type PersonalMessageSigner = (message: Uint8Array) => Promise<{ signature: string }>
-
-export function personalMessageForNonce(nonce: string): Uint8Array {
-  return new TextEncoder().encode(`nft-gate:access:${nonce}`)
-}
-
-function toBase64(s: string): string {
-  return typeof btoa === 'function' ? btoa(s) : Buffer.from(s, 'utf-8').toString('base64')
-}
-
-export function buildAccessProofToken(proof: {
-  address: string
-  nonce: string
-  signature: string
-  consumeDigest?: string
-}): string {
-  const payload: Record<string, string> = {
-    address: proof.address,
-    nonce: proof.nonce,
-    signature: proof.signature,
-  }
-  if (proof.consumeDigest) payload.consumeDigest = proof.consumeDigest
-  return toBase64(JSON.stringify(payload))
-}
-
-export async function fetchRelayChallenge(
-  relayHost: string,
-  opts: { signal?: AbortSignal } = {},
-): Promise<RelayChallenge> {
-  const res = await fetch(`${relayHost.replace(/\/$/, '')}/v1/challenge`, { signal: opts.signal })
-  if (!res.ok) throw new Error(`challenge request failed: ${res.status}`)
-  const data = (await res.json()) as { nonce?: string; expiresAt?: number; expires_at?: number }
-  if (!data || typeof data.nonce !== 'string') throw new Error('challenge response missing nonce')
-  return { nonce: data.nonce, expiresAt: data.expiresAt ?? data.expires_at ?? 0 }
-}

package/src/lib/walrus.ts

@@ -1,144 +0,0 @@
-// Minimal Walrus client for icon uploads. Mirrors the canonical helpers in the
-// `@meddleware/sui-walrus` package (createWalrusClient / createBlobUploadFlow /
-// walrusBlobUrl / fetchOwnedWalrusBlobs) but is kept self-contained here so it
-// resolves cleanly in the app's Vite build and preserves the lazy-load boundary
-// around `@mysten/walrus`. Once `@meddleware/sui-walrus` is published this file
-// should be replaced by imports from it (injecting the app's relay host + max tip).
-//
-// Icons are stored as RAW blobs (not quilts) so `GET /v1/blobs/<blobId>` returns
-// the exact image bytes — directly renderable by wallets/explorers. An upload
-// relay is REQUIRED (direct-to-storage-node writes fail from browsers). Verified
-// end-to-end on testnet (scripts/walrus-upload verification).
-
-import { SuiGrpcClient } from '@mysten/sui/grpc'
-import { walrus, blobIdFromInt } from '@mysten/walrus'
-import type { SuiJsonRpcClient } from '@mysten/sui/jsonRpc'
-import { WALRUS_RELAY_HOSTS, WALRUS_MAX_TIP_MIST, WALRUS_RPC_URLS } from '../config.js'
-
-export { ICON_EPOCHS } from './walrus-constants.js'
-
-export type WalrusNetwork = 'testnet' | 'mainnet'
-
-const AGGREGATOR_HOSTS: Record<WalrusNetwork, string> = {
-  testnet: 'https://aggregator.walrus-testnet.walrus.space',
-  mainnet: 'https://aggregator.walrus-mainnet.walrus.space',
-}
-
-/** Public URL that serves the raw blob bytes. */
-export function walrusBlobUrl(network: WalrusNetwork, blobId: string): string {
-  return `${AGGREGATOR_HOSTS[network]}/v1/blobs/${blobId}`
-}
-
-/** Options for {@link createWalrusClient}. */
-export interface CreateWalrusClientOptions {
-  /** Browser WASM URL (Vite `?url` import). */
-  wasmUrl?: string
-  /**
-   * Upload relay host. Defaults to the configured operator/public relay for the
-   * network ({@link WALRUS_RELAY_HOSTS}); pass a value to honour a user-supplied URL.
-   */
-  uploadRelayHost?: string
-  /**
-   * Maximum tip (MIST) the client will pay. Defaults to {@link WALRUS_MAX_TIP_MIST}.
-   * The SDK throws if the relay's tip exceeds this, so keep it above the relay tip.
-   */
-  uploadRelayMaxTipMist?: bigint
-  /**
-   * Access-proof token for an NFT-gated operator relay (base64 JSON from the access gate).
-   * Sent as the relay `Authorization: Bearer` header; the `nft-gate` gateway verifies it
-   * before proxying to the relay. Omit for the public relay or an ungated operator relay.
-   */
-  uploadRelayAuthToken?: string
-  /**
-   * gRPC fullnode URL for the underlying `SuiGrpcClient`. Defaults to
-   * {@link WALRUS_RPC_URLS} for the network (operator-overridable via `VITE_WALRUS_RPC_*`).
-   * NOTE: must be a **gRPC** endpoint — not a JSON-RPC URL (see `WALRUS_RPC_URLS`).
-   */
-  rpcUrl?: string
-}
-
-/**
- * A Walrus-extended gRPC client configured with an upload relay + tip guard.
- *
- * The relay's tip address/amount is fetched by the SDK from the relay's
- * `/v1/tip-config`; only the `max` (client-side ceiling) is set here. The
- * default relay is the operator relay when `VITE_WALRUS_RELAY_*` is set,
- * otherwise the public Mysten relay (which earns the operator nothing).
- */
-export function createWalrusClient(
-  network: WalrusNetwork,
-  wasmUrlOrOptions?: string | CreateWalrusClientOptions,
-) {
-  // Back-compat: a bare string is treated as the WASM URL.
-  const opts: CreateWalrusClientOptions =
-    typeof wasmUrlOrOptions === 'string' ? { wasmUrl: wasmUrlOrOptions } : (wasmUrlOrOptions ?? {})
-  const host = opts.uploadRelayHost ?? WALRUS_RELAY_HOSTS[network]
-  const maxTip = opts.uploadRelayMaxTipMist ?? WALRUS_MAX_TIP_MIST
-  const baseUrl = opts.rpcUrl ?? WALRUS_RPC_URLS[network]
-  return new SuiGrpcClient({ network, baseUrl }).$extend(
-    walrus({
-      ...(opts.wasmUrl ? { wasmUrl: opts.wasmUrl } : {}),
-      uploadRelay: {
-        host,
-        sendTip: { max: Number(maxTip) },
-        ...(opts.uploadRelayAuthToken
-          ? { headers: { Authorization: `Bearer ${opts.uploadRelayAuthToken}` } }
-          : {}),
-      },
-    }),
-  )
-}
-
-/** Raw-blob write flow: encode -> register(tx) -> upload -> certify(tx) -> getBlob. */
-export function createBlobUploadFlow(
-  client: ReturnType<typeof createWalrusClient>,
-  bytes: Uint8Array,
-) {
-  return client.walrus.writeBlobFlow({ blob: bytes })
-}
-
-/** A Walrus blob object owned by a Sui address. */
-export interface OwnedBlob {
-  objectId: string
-  /** Aggregator-URL-compatible blob ID string. */
-  blobId: string
-  size: number
-  endEpoch: number
-  certified: boolean
-}
-
-/**
- * Return all Walrus blobs owned by `owner`. Uses `getBlobType()` for dynamic
- * package resolution so no hardcoded addresses are needed.
- */
-export async function fetchOwnedWalrusBlobs(
-  suiClient: SuiJsonRpcClient,
-  walrusClient: ReturnType<typeof createWalrusClient>,
-  owner: string,
-): Promise<OwnedBlob[]> {
-  const blobType = await walrusClient.walrus.getBlobType()
-  const { data } = await suiClient.getOwnedObjects({
-    owner,
-    filter: { StructType: blobType },
-    options: { showContent: true },
-  })
-  const blobs: OwnedBlob[] = []
-  for (const item of data) {
-    if (!item.data) continue
-    const fields = (item.data.content as { fields?: Record<string, unknown> } | undefined)?.fields
-    if (!fields) continue
-    const storage = fields.storage as { fields?: { end_epoch?: unknown } } | undefined
-    try {
-      blobs.push({
-        objectId: item.data.objectId,
-        blobId: blobIdFromInt(BigInt(fields.blob_id as string)),
-        size: Number(fields.size),
-        endEpoch: Number(storage?.fields?.end_epoch ?? 0),
-        certified: fields.certified_epoch !== null && fields.certified_epoch !== undefined,
-      })
-    } catch {
-      // Skip blobs whose fields cannot be parsed.
-    }
-  }
-  return blobs
-}

package/stylelint.config.js

@@ -1,33 +0,0 @@
-// Stylelint over the library's CSS and the <style> blocks of its SFCs.
-// postcss-html provides the custom syntax needed to lint Vue single-file components.
-export default {
-  extends: ['stylelint-config-standard'],
-  overrides: [{ files: ['**/*.vue'], customSyntax: 'postcss-html' }],
-  rules: {
-    // The design system leans heavily on custom properties and deliberate
-    // ordering; these standard rules are too noisy for a token-driven codebase.
-    'custom-property-empty-line-before': null,
-    'declaration-empty-line-before': null,
-    'comment-empty-line-before': null,
-    'rule-empty-line-before': null,
-    'at-rule-empty-line-before': null,
-    'no-descending-specificity': null,
-    // BEM-style class names (block__element--modifier) are intentional.
-    'selector-class-pattern': null,
-    // Some presentational SFCs use compact single-line multi-declaration rules.
-    'declaration-block-single-line-max-declarations': null,
-    // Preserve camelCase CSS keyword values (e.g. text-rendering: optimizeLegibility).
-    'value-keyword-case': null,
-    // Vue SFC scoped-style pseudo-classes.
-    'selector-pseudo-class-no-unknown': [
-      true,
-      { ignorePseudoClasses: ['deep', 'slotted', 'global'] },
-    ],
-    // Private panel vars use a leading-underscore convention (--_bg, --_text).
-    'custom-property-pattern': null,
-    // Vendor-prefixed properties are emitted by autoprefixer at build time; the
-    // hand-written -webkit-/-moz- font-smoothing pair is intentional.
-    'property-no-vendor-prefix': null,
-    'value-no-vendor-prefix': null,
-  },
-}

package/test-results/.last-run.json

@@ -1,4 +0,0 @@
-{
-  "status": "failed",
-  "failedTests": []
-}

package/tests/accessGate.test.ts

@@ -1,108 +0,0 @@
-import { describe, it, expect, vi, afterEach } from 'vitest'
-import {
-  parseOwnedAccessNft,
-  fetchAccessNfts,
-  buildPurchaseTx,
-  buildConsumeTx,
-  personalMessageForNonce,
-  buildAccessProofToken,
-  fetchRelayChallenge,
-} from '../src/lib/accessGate.js'
-import type { AccessGateConfig, OwnedObjectsClient } from '../src/lib/accessGate.js'
-
-afterEach(() => vi.restoreAllMocks())
-
-const PKG = '0x00000000000000000000000000000000000000000000000000000000000000aa'
-const GATE = '0x00000000000000000000000000000000000000000000000000000000000000a1'
-const NFT_TYPE = `${PKG}::access_gate::AccessNFT`
-
-const cfg: AccessGateConfig = {
-  packageId: PKG,
-  gateId: GATE,
-  nftType: NFT_TYPE,
-  soulbound: false,
-  priceMist: 1000n,
-}
-
-function entry(objectId: string, gateId: string, uses?: number) {
-  return {
-    data: {
-      objectId,
-      content: {
-        fields: {
-          data: {
-            fields: {
-              gate_id: gateId,
-              variant:
-                uses === undefined
-                  ? { variant: 'UnlimitedPass', fields: {} }
-                  : { variant: 'SingleUse', fields: { uses_remaining: String(uses) } },
-            },
-          },
-        },
-      },
-    },
-  }
-}
-
-function commandsJson(tx: { getData: () => unknown }): string {
-  return JSON.stringify(tx.getData())
-}
-
-describe('accessGate lib', () => {
-  it('parses unlimited pass and single-use NFTs', () => {
-    expect(parseOwnedAccessNft(entry('0x1', GATE))).toEqual({
-      objectId: '0x1',
-      gateId: GATE,
-      usesRemaining: null,
-    })
-    expect(parseOwnedAccessNft(entry('0x2', GATE, 5))?.usesRemaining).toBe(5)
-    expect(parseOwnedAccessNft({ data: { objectId: '0x9', content: { fields: {} } } })).toBeNull()
-  })
-
-  it('fetchAccessNfts filters by gate and passes the StructType filter', async () => {
-    const client: OwnedObjectsClient = {
-      getOwnedObjects: vi.fn(async () => ({
-        data: [entry('0x1', GATE), entry('0x2', '0xother', 1)],
-      })),
-    }
-    const nfts = await fetchAccessNfts(client, '0xowner', NFT_TYPE, GATE)
-    expect(nfts).toHaveLength(1)
-    expect(nfts[0].objectId).toBe('0x1')
-    expect(client.getOwnedObjects).toHaveBeenCalledWith(
-      expect.objectContaining({ owner: '0xowner', filter: { StructType: NFT_TYPE } }),
-    )
-  })
-
-  it('buildPurchaseTx splits gas and calls purchase', () => {
-    const json = commandsJson(buildPurchaseTx(cfg))
-    expect(json).toContain('SplitCoins')
-    expect(json).toContain('"function":"purchase"')
-  })
-
-  it('buildConsumeTx selects consume vs consume_soulbound', () => {
-    expect(commandsJson(buildConsumeTx(cfg, '0x1', 'n'))).toContain('"function":"consume"')
-    expect(commandsJson(buildConsumeTx({ ...cfg, soulbound: true }, '0x1', 'n'))).toContain(
-      '"function":"consume_soulbound"',
-    )
-  })
-
-  it('encodes the proof token and message', () => {
-    expect(new TextDecoder().decode(personalMessageForNonce('x'))).toBe('nft-gate:access:x')
-    const token = buildAccessProofToken({ address: '0x1', nonce: 'n', signature: 's', consumeDigest: 'd' })
-    expect(JSON.parse(Buffer.from(token, 'base64').toString('utf-8'))).toEqual({
-      address: '0x1',
-      nonce: 'n',
-      signature: 's',
-      consumeDigest: 'd',
-    })
-  })
-
-  it('fetchRelayChallenge parses the gateway response', async () => {
-    vi.stubGlobal(
-      'fetch',
-      vi.fn(async () => new Response(JSON.stringify({ nonce: 'abc', expiresAt: 7 }), { status: 200 })),
-    )
-    expect(await fetchRelayChallenge('https://relay.example')).toEqual({ nonce: 'abc', expiresAt: 7 })
-  })
-})