@medialane/sdk 0.194.0 → 0.197.0

package/dist/{chunk-BLEFV7GP.cjs → chunk-2R7XBA34.cjs}

@@ -1092,6 +1092,9 @@ async function deriveAesKey(prfSecret, hkdfInfo) {
     ["encrypt", "decrypt"]
   );
 }
+function generateDeviceKey() {
+  return crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
 function generateStarkKeyPair() {
   const privateKeyHex = "0x" + Array.from(starknet.ec.starkCurve.utils.randomPrivateKey()).map((b) => b.toString(16).padStart(2, "0")).join("");
   return { privateKeyHex, publicKeyHex: starknet.ec.starkCurve.getStarkKey(privateKeyHex) };
@@ -1214,6 +1217,38 @@ function computeAccountAddress(ownerPubkey, salt = 0) {
   );
 }
 
+// src/wallet/device-keys.ts
+var DATABASE = "medialane-wallet";
+var STORE = "device-keys";
+function open() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DATABASE, 1);
+    request.onupgradeneeded = () => request.result.createObjectStore(STORE);
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+async function run(mode, act) {
+  const db = await open();
+  try {
+    return await new Promise((resolve, reject) => {
+      const request = act(db.transaction(STORE, mode).objectStore(STORE));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+var indexedDbDeviceKeys = {
+  async save(credentialId, key) {
+    await run("readwrite", (store) => store.put(key, credentialId));
+  },
+  async load(credentialId) {
+    return await run("readonly", (store) => store.get(credentialId)) ?? null;
+  }
+};
+
 // src/wallet/passkey.ts
 var PasskeyCancelledError = class extends Error {
   constructor(message = "Passkey prompt was cancelled.") {
@@ -1221,6 +1256,12 @@ var PasskeyCancelledError = class extends Error {
     this.name = "PasskeyCancelledError";
   }
 };
+var DeviceKeyMissingError = class extends Error {
+  constructor() {
+    super("This browser no longer holds the wallet key. Recover the wallet with its recovery key.");
+    this.name = "DeviceKeyMissingError";
+  }
+};
 var PasskeyUnsupportedError = class extends Error {
   constructor(reason) {
     super(
@@ -1253,21 +1294,7 @@ function createPasskeyOwner(config) {
     if (!api) throw new PasskeyUnsupportedError("no-webauthn");
     return api;
   };
-  const browserRefusesPrf = async () => {
-    const read = config.clientCapabilities ?? (typeof PublicKeyCredential !== "undefined" && typeof PublicKeyCredential.getClientCapabilities === "function" ? () => PublicKeyCredential.getClientCapabilities() : void 0);
-    if (!read) return false;
-    try {
-      return (await read())["extension:prf"] === false;
-    } catch {
-      return false;
-    }
-  };
-  const ensurePrfPossible = async () => {
-    credentialsApi();
-    if (await browserRefusesPrf()) throw new PasskeyUnsupportedError("no-prf");
-  };
   async function registerPasskey() {
-    await ensurePrfPossible();
     let credential;
     try {
       credential = await credentialsApi().create({
@@ -1281,6 +1308,7 @@ function createPasskeyOwner(config) {
             { type: "public-key", alg: -257 }
           ],
           authenticatorSelection: {
+            authenticatorAttachment: "platform",
             residentKey: "required",
             userVerification: "required"
           },
@@ -1294,53 +1322,55 @@ function createPasskeyOwner(config) {
     const prf = credential.getClientExtensionResults().prf;
     return {
       credentialId: encodeBase64(credential.rawId),
-      prfFirst: prf?.results?.first ?? null,
-      prfEnabled: prf?.enabled
+      prfFirst: prf?.results?.first ?? null
     };
   }
-  async function prfSecret(credentialId) {
-    await ensurePrfPossible();
-    let assertion;
+  async function assertPasskey(credentialId, extensions) {
     try {
-      assertion = await credentialsApi().get({
+      return await credentialsApi().get({
         publicKey: {
           challenge: randomBytes(32),
           rpId: config.relyingPartyId(),
           allowCredentials: [{ type: "public-key", id: decodeBase64(credentialId) }],
           userVerification: "required",
-          extensions: { prf: { eval: { first: config.prfSalt } } }
+          ...extensions ? { extensions } : {}
         }
       });
     } catch (err) {
       if (isPasskeyCancellation(err)) throw new PasskeyCancelledError();
       throw err;
     }
+  }
+  async function prfSecret(credentialId) {
+    const assertion = await assertPasskey(credentialId, {
+      prf: { eval: { first: config.prfSalt } }
+    });
     const result = assertion.getClientExtensionResults().prf?.results?.first;
     if (!result) throw new PasskeyUnsupportedError("no-prf");
     return new Uint8Array(result);
   }
-  const forgetCredential = async (credentialId) => {
-    const signal = config.signalUnknownCredential ?? (typeof PublicKeyCredential !== "undefined" && typeof PublicKeyCredential.signalUnknownCredential === "function" ? (options) => PublicKeyCredential.signalUnknownCredential(options) : void 0);
-    if (!signal) return;
-    const base64url = credentialId.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    try {
-      await signal({ rpId: config.relyingPartyId(), credentialId: base64url });
-    } catch {
-      return;
+  const deviceKeys = config.deviceKeys ?? indexedDbDeviceKeys;
+  async function lockFor(registration) {
+    if (registration.prfFirst) {
+      return { aes: await deriveAesKey(new Uint8Array(registration.prfFirst), config.hkdfInfo) };
     }
-  };
-  async function secretFromRegistration(registration) {
-    if (registration.prfFirst) return new Uint8Array(registration.prfFirst);
     try {
-      if (registration.prfEnabled === false) throw new PasskeyUnsupportedError("no-prf");
-      return await prfSecret(registration.credentialId);
+      return { aes: await deriveAesKey(await prfSecret(registration.credentialId), config.hkdfInfo) };
     } catch (err) {
-      if (err instanceof PasskeyUnsupportedError) await forgetCredential(registration.credentialId);
-      throw err;
+      if (!(err instanceof PasskeyUnsupportedError) || err.reason !== "no-prf") throw err;
     }
-  }
-  async function seal(secret, privateKeyHex) {
-    const aes = await deriveAesKey(secret, config.hkdfInfo);
+    const aes = await generateDeviceKey();
+    await deviceKeys.save(registration.credentialId, aes);
+    return { aes, lock: "device" };
+  }
+  async function unlockFor(sealed) {
+    if (sealed.lock !== "device") return deriveAesKey(await prfSecret(sealed.credentialId), config.hkdfInfo);
+    await assertPasskey(sealed.credentialId);
+    const aes = await deviceKeys.load(sealed.credentialId);
+    if (!aes) throw new DeviceKeyMissingError();
+    return aes;
+  }
+  async function seal(aes, privateKeyHex) {
     const iv = randomBytes(12);
     const ciphertext = await sealPrivateKey(aes, iv, privateKeyHex);
     return { iv: encodeBase64(iv), ciphertext: encodeBase64(ciphertext) };
@@ -1348,36 +1378,37 @@ function createPasskeyOwner(config) {
   return {
     async createOwnerKey() {
       const registration = await registerPasskey();
-      const secret = await secretFromRegistration(registration);
+      const { aes, lock } = await lockFor(registration);
       const { privateKeyHex, publicKeyHex } = generateStarkKeyPair();
-      const { iv, ciphertext } = await seal(secret, privateKeyHex);
+      const { iv, ciphertext } = await seal(aes, privateKeyHex);
       return {
         sealed: {
           credentialId: registration.credentialId,
           ownerPubKey: publicKeyHex,
           address: computeAccountAddress(publicKeyHex, 0),
           iv,
-          ciphertext
+          ciphertext,
+          ...lock ? { lock } : {}
         },
         privateKeyHex
       };
     },
     async unlockOwnerKey(sealed) {
-      const secret = await prfSecret(sealed.credentialId);
-      const aes = await deriveAesKey(secret, config.hkdfInfo);
+      const aes = await unlockFor(sealed);
       return unsealPrivateKey(aes, decodeBase64(sealed.iv), decodeBase64(sealed.ciphertext));
     },
     async sealImportedOwnerKey(recovery) {
       const { privateKeyHex, publicKeyHex } = starkKeyPairFromPrivateKey(recovery.privateKey);
       const registration = await registerPasskey();
-      const secret = await secretFromRegistration(registration);
-      const { iv, ciphertext } = await seal(secret, privateKeyHex);
+      const { aes, lock } = await lockFor(registration);
+      const { iv, ciphertext } = await seal(aes, privateKeyHex);
       return {
         credentialId: registration.credentialId,
         ownerPubKey: publicKeyHex,
         address: recovery.walletAddress,
         iv,
-        ciphertext
+        ciphertext,
+        ...lock ? { lock } : {}
       };
     }
   };
@@ -1821,6 +1852,7 @@ var UserFacingError = class extends Error {
 
 exports.ApiClient = ApiClient;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
+exports.DeviceKeyMissingError = DeviceKeyMissingError;
 exports.FeeConfigSchema = FeeConfigSchema;
 exports.InvalidStarkPrivateKeyError = InvalidStarkPrivateKeyError;
 exports.MedialaneApiError = MedialaneApiError;
@@ -1884,6 +1916,7 @@ exports.getServicesByCapability = getServicesByCapability;
 exports.getTokenByAddress = getTokenByAddress;
 exports.getTokenBySymbol = getTokenBySymbol;
 exports.hasCapability = hasCapability;
+exports.indexedDbDeviceKeys = indexedDbDeviceKeys;
 exports.isServiceId = isServiceId;
 exports.listServices = listServices;
 exports.normalizeAddress = normalizeAddress;
@@ -1901,5 +1934,5 @@ exports.starkKeyPairFromPrivateKey = starkKeyPairFromPrivateKey;
 exports.stringifyBigInts = stringifyBigInts;
 exports.u256ToBigInt = u256ToBigInt;
 exports.unsealPrivateKey = unsealPrivateKey;
-//# sourceMappingURL=chunk-BLEFV7GP.cjs.map
-//# sourceMappingURL=chunk-BLEFV7GP.cjs.map
+//# sourceMappingURL=chunk-2R7XBA34.cjs.map
+//# sourceMappingURL=chunk-2R7XBA34.cjs.map