@medialane/sdk 0.103.0 → 0.105.0

package/dist/index.cjs

@@ -3,6 +3,8 @@
 var zod = require('zod');
 var sha3_js = require('@noble/hashes/sha3.js');
 var base = require('@scure/base');
+var hmac_js = require('@noble/hashes/hmac.js');
+var sha2_js = require('@noble/hashes/sha2.js');
 
 // src/config.ts
 
@@ -1280,8 +1282,23 @@ var PUBLIC_RPC_FALLBACKS = [
   "https://rpc.starknet.lava.build"
 ];
 var TRANSIENT_BODY_RE = /"code"\s*:\s*-32001|"code"\s*:\s*-32603|unable to complete|rate.?limit|too many|throttl|exceed.*quota|temporarily unavailable|service unavailable|overload|gateway.*time|upstream.*time|backend.*error/i;
+var POLICY_REFUSAL_CODES = [-32003, -32005, -32600];
+function isPolicyRefusal(input) {
+  let body = input.body;
+  if (typeof body === "string") {
+    try {
+      body = JSON.parse(body);
+    } catch {
+      return false;
+    }
+  }
+  const err = body?.error;
+  const code = err && typeof err === "object" ? err.code : void 0;
+  return typeof code === "number" && POLICY_REFUSAL_CODES.includes(code);
+}
 function isTransientRpcError(input) {
   const { status, body } = input;
+  if (isPolicyRefusal({ body })) return false;
   if (typeof status === "number" && (status === 429 || status >= 500)) return true;
   if (body == null) return false;
   if (typeof body === "object") {
@@ -1327,6 +1344,16 @@ function createFailoverFetch(urls, options = {}) {
   };
   return failover;
 }
+var PAID_UPSTREAM_MARKERS = [
+  "rpc.starknet.lava.build",
+  "g.alchemy.com",
+  "ALCHEMY_RPC_URL",
+  "STARKNET_RPC_URL",
+  "AVNU_PAYMASTER_API_KEY",
+  "@avnu/avnu-sdk",
+  "api.pinata.cloud",
+  "PINATA_JWT"
+];
 
 // src/server/rate-limit.ts
 function createRateLimiter(windowMs, max) {
@@ -1534,6 +1561,81 @@ async function getBackendSignedUrl(config, kind = "image") {
   if (!res.ok || !data.data) throw new Error(data.error ?? "Failed to create upload URL");
   return data.data.url;
 }
+var IDENTITY_PREFIX = "siws_";
+var ACCOUNT_SESSION_PREFIX = "account_session_";
+var IDENTITY_DOMAIN = "siws-identity-v1";
+var ACCOUNT_SESSION_DOMAIN = "account-session-v1";
+var IDENTITY_TTL_SECONDS = 86400;
+var ACCOUNT_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+var CLOCK_SKEW_SECONDS = 60;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function toHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function sign(secret, domain, payload) {
+  const message = domain === null ? payload : `${domain}.${payload}`;
+  return toHex(hmac_js.hmac(sha2_js.sha256, encoder.encode(secret), encoder.encode(message)));
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function signatureMatches(secret, domain, payload, provided) {
+  return constantTimeEquals(provided, sign(secret, domain, payload)) || constantTimeEquals(provided, sign(secret, null, payload));
+}
+function encodePayload(value) {
+  return base.base64urlnopad.encode(encoder.encode(JSON.stringify(value)));
+}
+function decodePayload(payload) {
+  try {
+    return JSON.parse(decoder.decode(base.base64urlnopad.decode(payload)));
+  } catch {
+    return null;
+  }
+}
+function splitToken(raw, prefix) {
+  if (!raw.startsWith(prefix)) return null;
+  const inner = raw.slice(prefix.length);
+  const dot = inner.lastIndexOf(".");
+  if (dot === -1) return null;
+  return { payload: inner.slice(0, dot), signature: inner.slice(dot + 1) };
+}
+function withinLifetime(iat, exp) {
+  if (!iat || !exp) return false;
+  const now = Math.floor(Date.now() / 1e3);
+  return exp >= now && iat <= now + CLOCK_SKEW_SECONDS;
+}
+function issueSiwsToken(secret, chain, wallet, ttlSeconds = IDENTITY_TTL_SECONDS) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const payload = encodePayload({ sub: wallet, chain, iat, exp: iat + ttlSeconds });
+  return `${IDENTITY_PREFIX}${payload}.${sign(secret, IDENTITY_DOMAIN, payload)}`;
+}
+function verifySiwsToken(secret, raw) {
+  const parts = splitToken(raw, IDENTITY_PREFIX);
+  if (!parts) return null;
+  if (!signatureMatches(secret, IDENTITY_DOMAIN, parts.payload, parts.signature)) return null;
+  const data = decodePayload(parts.payload);
+  if (!data?.sub || !withinLifetime(data.iat, data.exp)) return null;
+  return { address: data.sub, chain: data.chain ?? "STARKNET" };
+}
+function issueAccountSessionToken(secret, accountId, ttlSeconds = ACCOUNT_SESSION_TTL_SECONDS) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const payload = encodePayload({ accountId, iat, exp: iat + ttlSeconds });
+  return `${ACCOUNT_SESSION_PREFIX}${payload}.${sign(secret, ACCOUNT_SESSION_DOMAIN, payload)}`;
+}
+function verifyAccountSessionToken(secret, raw) {
+  const parts = splitToken(raw, ACCOUNT_SESSION_PREFIX);
+  if (!parts) return null;
+  if (!signatureMatches(secret, ACCOUNT_SESSION_DOMAIN, parts.payload, parts.signature)) return null;
+  const data = decodePayload(parts.payload);
+  if (!data?.accountId || !withinLifetime(data.iat, data.exp)) return null;
+  return data.accountId;
+}
 
 // src/metadata.ts
 var RESERVED_TRAITS = /* @__PURE__ */ new Set([
@@ -1628,18 +1730,22 @@ function resolveSafeImageContentType(contentType) {
 }
 var MAX_IPFS_GATEWAY_RESPONSE_BYTES = 25 * 1024 * 1024;
 
+exports.ACCOUNT_SESSION_TTL_SECONDS = ACCOUNT_SESSION_TTL_SECONDS;
 exports.ALLOWED_IMAGE_CONTENT_TYPES = ALLOWED_IMAGE_CONTENT_TYPES;
 exports.ApiClient = ApiClient;
 exports.CHAINS = CHAINS;
 exports.DEFAULT_CHAIN = DEFAULT_CHAIN;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
 exports.FeeConfigSchema = FeeConfigSchema;
+exports.IDENTITY_TTL_SECONDS = IDENTITY_TTL_SECONDS;
 exports.IPFS_SAFE_CONTENT_TYPE_PREFIXES = IPFS_SAFE_CONTENT_TYPE_PREFIXES;
 exports.MAX_IMAGE_PROXY_BYTES = MAX_IMAGE_PROXY_BYTES;
 exports.MAX_IMAGE_REDIRECTS = MAX_IMAGE_REDIRECTS;
 exports.MAX_IPFS_GATEWAY_RESPONSE_BYTES = MAX_IPFS_GATEWAY_RESPONSE_BYTES;
 exports.MedialaneApiError = MedialaneApiError;
 exports.OPEN_LICENSES = OPEN_LICENSES;
+exports.PAID_UPSTREAM_MARKERS = PAID_UPSTREAM_MARKERS;
+exports.POLICY_REFUSAL_CODES = POLICY_REFUSAL_CODES;
 exports.PUBLIC_RPC_FALLBACKS = PUBLIC_RPC_FALLBACKS;
 exports.RESERVED_TRAITS = RESERVED_TRAITS;
 exports.STARKNET_COLLECTION_1155_CLASS_HASH = STARKNET_COLLECTION_1155_CLASS_HASH;
@@ -1700,11 +1806,14 @@ exports.getStarknetCoordinates = getStarknetCoordinates;
 exports.getTokenByAddress = getTokenByAddress;
 exports.getTokenBySymbol = getTokenBySymbol;
 exports.hasCapability = hasCapability;
+exports.isPolicyRefusal = isPolicyRefusal;
 exports.isPrivateHost = isPrivateHost;
 exports.isSameOrigin = isSameOrigin;
 exports.isServiceId = isServiceId;
 exports.isTransientRpcError = isTransientRpcError;
 exports.isValidIpfsCidPath = isValidIpfsCidPath;
+exports.issueAccountSessionToken = issueAccountSessionToken;
+exports.issueSiwsToken = issueSiwsToken;
 exports.listServices = listServices;
 exports.normalizeAddress = normalizeAddress;
 exports.normalizeHash = normalizeHash;
@@ -1722,5 +1831,7 @@ exports.uploadDirectoryToBackend = uploadDirectoryToBackend;
 exports.uploadFileToBackend = uploadFileToBackend;
 exports.uploadJsonToBackend = uploadJsonToBackend;
 exports.validateUrl = validateUrl;
+exports.verifyAccountSessionToken = verifyAccountSessionToken;
+exports.verifySiwsToken = verifySiwsToken;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map