@medialane/sdk 0.194.0 → 0.197.0

package/dist/{chunk-MOIM2AAQ.js → chunk-6WVUUBFI.js}

@@ -1090,6 +1090,9 @@ async function deriveAesKey(prfSecret, hkdfInfo) {
     ["encrypt", "decrypt"]
   );
 }
+function generateDeviceKey() {
+  return crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
 function generateStarkKeyPair() {
   const privateKeyHex = "0x" + Array.from(ec.starkCurve.utils.randomPrivateKey()).map((b) => b.toString(16).padStart(2, "0")).join("");
   return { privateKeyHex, publicKeyHex: ec.starkCurve.getStarkKey(privateKeyHex) };
@@ -1212,6 +1215,38 @@ function computeAccountAddress(ownerPubkey, salt = 0) {
   );
 }
 
+// src/wallet/device-keys.ts
+var DATABASE = "medialane-wallet";
+var STORE = "device-keys";
+function open() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DATABASE, 1);
+    request.onupgradeneeded = () => request.result.createObjectStore(STORE);
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+async function run(mode, act) {
+  const db = await open();
+  try {
+    return await new Promise((resolve, reject) => {
+      const request = act(db.transaction(STORE, mode).objectStore(STORE));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+var indexedDbDeviceKeys = {
+  async save(credentialId, key) {
+    await run("readwrite", (store) => store.put(key, credentialId));
+  },
+  async load(credentialId) {
+    return await run("readonly", (store) => store.get(credentialId)) ?? null;
+  }
+};
+
 // src/wallet/passkey.ts
 var PasskeyCancelledError = class extends Error {
   constructor(message = "Passkey prompt was cancelled.") {
@@ -1219,6 +1254,12 @@ var PasskeyCancelledError = class extends Error {
     this.name = "PasskeyCancelledError";
   }
 };
+var DeviceKeyMissingError = class extends Error {
+  constructor() {
+    super("This browser no longer holds the wallet key. Recover the wallet with its recovery key.");
+    this.name = "DeviceKeyMissingError";
+  }
+};
 var PasskeyUnsupportedError = class extends Error {
   constructor(reason) {
     super(
@@ -1251,21 +1292,7 @@ function createPasskeyOwner(config) {
     if (!api) throw new PasskeyUnsupportedError("no-webauthn");
     return api;
   };
-  const browserRefusesPrf = async () => {
-    const read = config.clientCapabilities ?? (typeof PublicKeyCredential !== "undefined" && typeof PublicKeyCredential.getClientCapabilities === "function" ? () => PublicKeyCredential.getClientCapabilities() : void 0);
-    if (!read) return false;
-    try {
-      return (await read())["extension:prf"] === false;
-    } catch {
-      return false;
-    }
-  };
-  const ensurePrfPossible = async () => {
-    credentialsApi();
-    if (await browserRefusesPrf()) throw new PasskeyUnsupportedError("no-prf");
-  };
   async function registerPasskey() {
-    await ensurePrfPossible();
     let credential;
     try {
       credential = await credentialsApi().create({
@@ -1279,6 +1306,7 @@ function createPasskeyOwner(config) {
             { type: "public-key", alg: -257 }
           ],
           authenticatorSelection: {
+            authenticatorAttachment: "platform",
             residentKey: "required",
             userVerification: "required"
           },
@@ -1292,53 +1320,55 @@ function createPasskeyOwner(config) {
     const prf = credential.getClientExtensionResults().prf;
     return {
       credentialId: encodeBase64(credential.rawId),
-      prfFirst: prf?.results?.first ?? null,
-      prfEnabled: prf?.enabled
+      prfFirst: prf?.results?.first ?? null
     };
   }
-  async function prfSecret(credentialId) {
-    await ensurePrfPossible();
-    let assertion;
+  async function assertPasskey(credentialId, extensions) {
     try {
-      assertion = await credentialsApi().get({
+      return await credentialsApi().get({
         publicKey: {
           challenge: randomBytes(32),
           rpId: config.relyingPartyId(),
           allowCredentials: [{ type: "public-key", id: decodeBase64(credentialId) }],
           userVerification: "required",
-          extensions: { prf: { eval: { first: config.prfSalt } } }
+          ...extensions ? { extensions } : {}
         }
       });
     } catch (err) {
       if (isPasskeyCancellation(err)) throw new PasskeyCancelledError();
       throw err;
     }
+  }
+  async function prfSecret(credentialId) {
+    const assertion = await assertPasskey(credentialId, {
+      prf: { eval: { first: config.prfSalt } }
+    });
     const result = assertion.getClientExtensionResults().prf?.results?.first;
     if (!result) throw new PasskeyUnsupportedError("no-prf");
     return new Uint8Array(result);
   }
-  const forgetCredential = async (credentialId) => {
-    const signal = config.signalUnknownCredential ?? (typeof PublicKeyCredential !== "undefined" && typeof PublicKeyCredential.signalUnknownCredential === "function" ? (options) => PublicKeyCredential.signalUnknownCredential(options) : void 0);
-    if (!signal) return;
-    const base64url = credentialId.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-    try {
-      await signal({ rpId: config.relyingPartyId(), credentialId: base64url });
-    } catch {
-      return;
+  const deviceKeys = config.deviceKeys ?? indexedDbDeviceKeys;
+  async function lockFor(registration) {
+    if (registration.prfFirst) {
+      return { aes: await deriveAesKey(new Uint8Array(registration.prfFirst), config.hkdfInfo) };
     }
-  };
-  async function secretFromRegistration(registration) {
-    if (registration.prfFirst) return new Uint8Array(registration.prfFirst);
     try {
-      if (registration.prfEnabled === false) throw new PasskeyUnsupportedError("no-prf");
-      return await prfSecret(registration.credentialId);
+      return { aes: await deriveAesKey(await prfSecret(registration.credentialId), config.hkdfInfo) };
     } catch (err) {
-      if (err instanceof PasskeyUnsupportedError) await forgetCredential(registration.credentialId);
-      throw err;
+      if (!(err instanceof PasskeyUnsupportedError) || err.reason !== "no-prf") throw err;
     }
-  }
-  async function seal(secret, privateKeyHex) {
-    const aes = await deriveAesKey(secret, config.hkdfInfo);
+    const aes = await generateDeviceKey();
+    await deviceKeys.save(registration.credentialId, aes);
+    return { aes, lock: "device" };
+  }
+  async function unlockFor(sealed) {
+    if (sealed.lock !== "device") return deriveAesKey(await prfSecret(sealed.credentialId), config.hkdfInfo);
+    await assertPasskey(sealed.credentialId);
+    const aes = await deviceKeys.load(sealed.credentialId);
+    if (!aes) throw new DeviceKeyMissingError();
+    return aes;
+  }
+  async function seal(aes, privateKeyHex) {
     const iv = randomBytes(12);
     const ciphertext = await sealPrivateKey(aes, iv, privateKeyHex);
     return { iv: encodeBase64(iv), ciphertext: encodeBase64(ciphertext) };
@@ -1346,36 +1376,37 @@ function createPasskeyOwner(config) {
   return {
     async createOwnerKey() {
       const registration = await registerPasskey();
-      const secret = await secretFromRegistration(registration);
+      const { aes, lock } = await lockFor(registration);
       const { privateKeyHex, publicKeyHex } = generateStarkKeyPair();
-      const { iv, ciphertext } = await seal(secret, privateKeyHex);
+      const { iv, ciphertext } = await seal(aes, privateKeyHex);
       return {
         sealed: {
           credentialId: registration.credentialId,
           ownerPubKey: publicKeyHex,
           address: computeAccountAddress(publicKeyHex, 0),
           iv,
-          ciphertext
+          ciphertext,
+          ...lock ? { lock } : {}
         },
         privateKeyHex
       };
     },
     async unlockOwnerKey(sealed) {
-      const secret = await prfSecret(sealed.credentialId);
-      const aes = await deriveAesKey(secret, config.hkdfInfo);
+      const aes = await unlockFor(sealed);
       return unsealPrivateKey(aes, decodeBase64(sealed.iv), decodeBase64(sealed.ciphertext));
     },
     async sealImportedOwnerKey(recovery) {
       const { privateKeyHex, publicKeyHex } = starkKeyPairFromPrivateKey(recovery.privateKey);
       const registration = await registerPasskey();
-      const secret = await secretFromRegistration(registration);
-      const { iv, ciphertext } = await seal(secret, privateKeyHex);
+      const { aes, lock } = await lockFor(registration);
+      const { iv, ciphertext } = await seal(aes, privateKeyHex);
       return {
         credentialId: registration.credentialId,
         ownerPubKey: publicKeyHex,
         address: recovery.walletAddress,
         iv,
-        ciphertext
+        ciphertext,
+        ...lock ? { lock } : {}
       };
     }
   };
@@ -1817,6 +1848,6 @@ var UserFacingError = class extends Error {
   }
 };
 
-export { ApiClient, DEFAULT_CURRENCY, FeeConfigSchema, InvalidStarkPrivateKeyError, MedialaneApiError, PasskeyCancelledError, PasskeyUnsupportedError, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DATA_TOKENIZATION_721_CONTRACT, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_DROP_FACTORY_START_BLOCK, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_CONTRACT, STARKNET_GENESIS_NFT_URI, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_MEDIAWALLET_CLASS_HASH, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, STARKNET_POP_FACTORY_START_BLOCK, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, UserFacingError, assetHref, chainFromSlug, chainSlug, coinHref, collectionHref, computeAccountAddress, createPasskeyOwner, deriveAesKey, dropHref, encodeU256, formatAmount, generateStarkKeyPair, getListableTokens, getService, getServicesByCapability, getTokenByAddress, getTokenBySymbol, hasCapability, isServiceId, listServices, normalizeAddress, normalizeHash, ownerConstructorCalldata, parseAmount, profileHref, resolveAppFeeConfig, resolveConfig, resolveFeeConfig, sealPrivateKey, shortenAddress, signWithPrivateKey, starkKeyPairFromPrivateKey, stringifyBigInts, u256ToBigInt, unsealPrivateKey };
-//# sourceMappingURL=chunk-MOIM2AAQ.js.map
-//# sourceMappingURL=chunk-MOIM2AAQ.js.map
+export { ApiClient, DEFAULT_CURRENCY, DeviceKeyMissingError, FeeConfigSchema, InvalidStarkPrivateKeyError, MedialaneApiError, PasskeyCancelledError, PasskeyUnsupportedError, STARKNET_COLLECTION_1155_CLASS_HASH, STARKNET_COLLECTION_1155_CONTRACT, STARKNET_COLLECTION_1155_FACTORY_CLASS_HASH, STARKNET_COLLECTION_1155_START_BLOCK, STARKNET_COLLECTION_721_CONTRACT, STARKNET_COLLECTION_721_START_BLOCK, STARKNET_CREATOR_COIN_CLASS_HASH, STARKNET_CREATOR_COIN_EKUBO_LAUNCHER, STARKNET_CREATOR_COIN_FACTORY_CLASS_HASH, STARKNET_CREATOR_COIN_FACTORY_CONTRACT, STARKNET_CREATOR_COIN_START_BLOCK, STARKNET_DATA_TOKENIZATION_721_CONTRACT, STARKNET_DROP_COLLECTION_CLASS_HASH, STARKNET_DROP_FACTORY_CONTRACT, STARKNET_DROP_FACTORY_START_BLOCK, STARKNET_EKUBO_CORE, STARKNET_GENESIS_MINT_CONTRACT, STARKNET_GENESIS_NFT_URI, STARKNET_IPCOLLECTION_CLASS_HASH, STARKNET_IPNFT_CLASS_HASH, STARKNET_IP_CLUB_COLLECTION_CLASS_HASH, STARKNET_IP_CLUB_FACTORY_CONTRACT, STARKNET_IP_SPONSORSHIP_CLASS_HASH, STARKNET_IP_SPONSORSHIP_CONTRACT, STARKNET_IP_TICKETS_FACTORY_CONTRACT, STARKNET_IP_TICKET_COLLECTION_CLASS_HASH, STARKNET_MARKETPLACE_1155_CLASS_HASH, STARKNET_MARKETPLACE_1155_CONTRACT, STARKNET_MARKETPLACE_1155_START_BLOCK, STARKNET_MARKETPLACE_721_CLASS_HASH, STARKNET_MARKETPLACE_721_CONTRACT, STARKNET_MARKETPLACE_721_START_BLOCK, STARKNET_MEDIAWALLET_CLASS_HASH, STARKNET_NFTCOMMENTS_CONTRACT, STARKNET_POP_COLLECTION_CLASS_HASH, STARKNET_POP_FACTORY_CONTRACT, STARKNET_POP_FACTORY_START_BLOCK, SUPPORTED_TOKENS, SUPPORTED_URL_CHAINS, UserFacingError, assetHref, chainFromSlug, chainSlug, coinHref, collectionHref, computeAccountAddress, createPasskeyOwner, deriveAesKey, dropHref, encodeU256, formatAmount, generateStarkKeyPair, getListableTokens, getService, getServicesByCapability, getTokenByAddress, getTokenBySymbol, hasCapability, indexedDbDeviceKeys, isServiceId, listServices, normalizeAddress, normalizeHash, ownerConstructorCalldata, parseAmount, profileHref, resolveAppFeeConfig, resolveConfig, resolveFeeConfig, sealPrivateKey, shortenAddress, signWithPrivateKey, starkKeyPairFromPrivateKey, stringifyBigInts, u256ToBigInt, unsealPrivateKey };
+//# sourceMappingURL=chunk-6WVUUBFI.js.map
+//# sourceMappingURL=chunk-6WVUUBFI.js.map