@medialane/sdk 0.198.0 → 0.199.0

package/dist/chunk-ZLMIHQWM.cjs

@@ -0,0 +1,975 @@
+'use strict';
+
+var chunk3HPMEDYH_cjs = require('./chunk-3HPMEDYH.cjs');
+var chunkH2NJB3AK_cjs = require('./chunk-H2NJB3AK.cjs');
+var hkdf_js = require('@noble/hashes/hkdf.js');
+var sha2_js = require('@noble/hashes/sha2.js');
+var starknet = require('starknet');
+
+// src/starknet/erc20.ts
+async function erc20Balance(provider, token, holder) {
+  const read = (entrypoint) => provider.callContract({ contractAddress: token, entrypoint, calldata: [holder] }, "latest");
+  const [low = "0x0", high = "0x0"] = await read("balanceOf").catch(() => read("balance_of"));
+  return BigInt(low) + (BigInt(high) << 128n);
+}
+
+// src/starknet/services/sponsoredExecutor.ts
+var SponsoredCallRejectedError = class extends Error {
+};
+var FALLBACK_FUNDING_FAILURES = /* @__PURE__ */ new Set(["sponsor_unavailable", "credits_exhausted"]);
+function allowsFallbackFunding(code, status, stage) {
+  if (code) return FALLBACK_FUNDING_FAILURES.has(code);
+  return stage === "build" ? status >= 500 : status === 503;
+}
+async function failureOf(res, fallback) {
+  const body = await res.json().catch(() => null);
+  return { reason: body?.error || fallback, code: typeof body?.code === "string" ? body.code : void 0 };
+}
+async function executeSponsored(config, signer, request) {
+  const doFetch = config.fetchImpl ?? fetch;
+  const base = config.proxyUrl.replace(/\/$/, "");
+  const headers = { "Content-Type": "application/json", ...config.headers };
+  const buildRes = await doFetch(`${base}/build`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  if (!buildRes.ok) {
+    const { reason, code } = await failureOf(buildRes, "We couldn't prepare this transaction.");
+    if (allowsFallbackFunding(code, buildRes.status, "build")) return { status: "unavailable", reason };
+    throw new SponsoredCallRejectedError(reason);
+  }
+  const { typedData } = await buildRes.json();
+  const signature = await signer.signTypedData(typedData);
+  const executeRes = await doFetch(`${base}/execute`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ ...request, typedData, signature })
+  });
+  if (!executeRes.ok) {
+    const { reason, code } = await failureOf(executeRes, "We couldn't submit this transaction.");
+    if (allowsFallbackFunding(code, executeRes.status, "execute")) {
+      return { status: "unavailable", reason };
+    }
+    throw new SponsoredCallRejectedError(reason);
+  }
+  const { transactionHash } = await executeRes.json();
+  return { status: "sponsored", transactionHash };
+}
+var STARK_ORDER = 3618502788666131213697322783095070105526743751716087489154079457884512865583n;
+function deriveOwnerKeyPair(secret, recipientId) {
+  const prk = hkdf_js.extract(sha2_js.sha256, secret);
+  const okm = hkdf_js.expand(sha2_js.sha256, prk, new TextEncoder().encode(recipientId), 32);
+  let scalar = BigInt("0x" + Buffer.from(okm).toString("hex")) % STARK_ORDER;
+  if (scalar === 0n) scalar = 1n;
+  const privateKey = starknet.num.toHex(scalar);
+  const publicKey = starknet.ec.starkCurve.getStarkKey(privateKey);
+  return { privateKey, publicKey };
+}
+function ownerConstructorCalldata(ownerPubkey) {
+  return ["0x0", starknet.num.toHex(ownerPubkey), "0x1"];
+}
+function computeAccountAddress(ownerPubkey, salt = 0) {
+  return starknet.hash.calculateContractAddressFromHash(
+    starknet.num.toHex(salt),
+    chunk3HPMEDYH_cjs.STARKNET_MEDIAWALLET_CLASS_HASH,
+    ownerConstructorCalldata(ownerPubkey),
+    0
+  );
+}
+var STARKNET_SIGNER_TYPE = "0x537461726b6e6574205369676e6572";
+var OPTION_NONE = "0x1";
+var SIGNER_STARKNET = "0x0";
+function computeOwnerGuid(ownerPubkey) {
+  return starknet.hash.computePoseidonHash(STARKNET_SIGNER_TYPE, starknet.num.toHex(ownerPubkey));
+}
+function changeOwners(accountAddress, guidsToRemove, pubkeysToAdd) {
+  return {
+    contractAddress: accountAddress,
+    entrypoint: "change_owners",
+    calldata: [
+      starknet.num.toHex(guidsToRemove.length),
+      ...guidsToRemove,
+      starknet.num.toHex(pubkeysToAdd.length),
+      ...pubkeysToAdd.flatMap((p) => [SIGNER_STARKNET, starknet.num.toHex(p)]),
+      OPTION_NONE
+    ]
+  };
+}
+function buildAddOwnerCall(accountAddress, addOwnerPubkey) {
+  return changeOwners(accountAddress, [], [addOwnerPubkey]);
+}
+function buildRemoveOwnerCall(accountAddress, removeOwnerPubkey) {
+  return changeOwners(accountAddress, [computeOwnerGuid(removeOwnerPubkey)], []);
+}
+function buildRemoveOwnerByGuidCall(accountAddress, ownerGuid) {
+  return changeOwners(accountAddress, [starknet.num.toHex(ownerGuid)], []);
+}
+function buildDeployAccountParams(ownerPubkey, salt = 0) {
+  return {
+    classHash: chunk3HPMEDYH_cjs.STARKNET_MEDIAWALLET_CLASS_HASH,
+    constructorCalldata: ownerConstructorCalldata(ownerPubkey),
+    addressSalt: starknet.num.toHex(salt),
+    contractAddress: computeAccountAddress(ownerPubkey, salt)
+  };
+}
+var norm = (address) => chunk3HPMEDYH_cjs.normalizeAddress("STARKNET", address);
+var SIGNER_TYPE_NAMES = ["Starknet", "Secp256k1", "Secp256r1"];
+function encodeFeltArray(items) {
+  return [starknet.num.toHex(items.length), ...items];
+}
+function encodeStarknetSigner(pubkey) {
+  return ["0x0", starknet.num.toHex(pubkey)];
+}
+function encodeStarknetSignerArray(pubkeys) {
+  return [starknet.num.toHex(pubkeys.length), ...pubkeys.flatMap(encodeStarknetSigner)];
+}
+function buildSetFirstGuardianCall(address, guardianPubkey) {
+  return {
+    contractAddress: norm(address),
+    entrypoint: "change_guardians",
+    calldata: [...encodeFeltArray([]), ...encodeStarknetSignerArray([guardianPubkey])]
+  };
+}
+function buildTriggerEscapeOwnerCall(targetAddress, newOwnerPubkey) {
+  return {
+    contractAddress: norm(targetAddress),
+    entrypoint: "trigger_escape_owner",
+    calldata: encodeStarknetSigner(newOwnerPubkey)
+  };
+}
+function buildCompleteEscapeOwnerCall(targetAddress) {
+  return { contractAddress: norm(targetAddress), entrypoint: "escape_owner", calldata: [] };
+}
+function buildCancelEscapeCall(address) {
+  return { contractAddress: norm(address), entrypoint: "cancel_escape", calldata: [] };
+}
+function decodeGuardiansInfo(res) {
+  const len = Number(res[0]);
+  const out = [];
+  for (let i = 0; i < len; i++) {
+    const base = 1 + i * 3;
+    out.push({
+      type: SIGNER_TYPE_NAMES[Number(res[base])] ?? "Starknet",
+      guid: res[base + 1],
+      storedValue: res[base + 2]
+    });
+  }
+  return out;
+}
+var ESCAPE_TYPE_NAMES = ["None", "Guardian", "Owner"];
+var ESCAPE_STATUS_NAMES = ["None", "NotReady", "Ready", "Expired"];
+function decodeEscapeAndStatus(res) {
+  const readyAt = Number(res[0]);
+  const escapeType = ESCAPE_TYPE_NAMES[Number(res[1])] ?? "None";
+  const optionTag = Number(res[2]);
+  const statusIndex = optionTag === 0 ? 5 : 3;
+  const status = ESCAPE_STATUS_NAMES[Number(res[statusIndex])] ?? "None";
+  return { readyAt, escapeType, status };
+}
+async function getGuardians(provider, address) {
+  const res = await provider.callContract({
+    contractAddress: norm(address),
+    entrypoint: "get_guardians_info",
+    calldata: []
+  });
+  return decodeGuardiansInfo(res);
+}
+async function getOwners(provider, address) {
+  const res = await provider.callContract({
+    contractAddress: norm(address),
+    entrypoint: "get_owners_info",
+    calldata: []
+  });
+  return decodeGuardiansInfo(res);
+}
+async function getEscape(provider, address) {
+  const res = await provider.callContract({
+    contractAddress: norm(address),
+    entrypoint: "get_escape_and_status",
+    calldata: []
+  });
+  return decodeEscapeAndStatus(res);
+}
+async function getEscapeSecurityPeriod(provider, address) {
+  const res = await provider.callContract({
+    contractAddress: norm(address),
+    entrypoint: "get_escape_security_period",
+    calldata: []
+  });
+  return Number(res[0]);
+}
+async function deriveAesKey(prfSecret, hkdfInfo) {
+  const hkdf = await crypto.subtle.importKey("raw", prfSecret, "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: hkdfInfo },
+    hkdf,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function generateDeviceKey() {
+  return crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+function generateStarkKeyPair() {
+  const privateKeyHex = "0x" + Array.from(starknet.ec.starkCurve.utils.randomPrivateKey()).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return { privateKeyHex, publicKeyHex: starknet.ec.starkCurve.getStarkKey(privateKeyHex) };
+}
+var InvalidStarkPrivateKeyError = class extends Error {
+  constructor(reason) {
+    super(`Not a valid Starknet private key: ${reason}`);
+    this.name = "InvalidStarkPrivateKeyError";
+  }
+};
+function starkKeyPairFromPrivateKey(input) {
+  const trimmed = input.trim().replace(/\s+/g, "");
+  const body = trimmed.startsWith("0x") || trimmed.startsWith("0X") ? trimmed.slice(2) : trimmed;
+  if (body.length === 0) throw new InvalidStarkPrivateKeyError("it is empty");
+  if (!/^[0-9a-fA-F]+$/.test(body)) throw new InvalidStarkPrivateKeyError("it is not hexadecimal");
+  if (body.length > 64) throw new InvalidStarkPrivateKeyError("it is too long");
+  const value = BigInt("0x" + body);
+  if (value === 0n) throw new InvalidStarkPrivateKeyError("it is zero");
+  if (value >= starknet.ec.starkCurve.CURVE.n) throw new InvalidStarkPrivateKeyError("it is outside the curve order");
+  const privateKeyHex = "0x" + value.toString(16).padStart(64, "0");
+  return { privateKeyHex, publicKeyHex: starknet.ec.starkCurve.getStarkKey(privateKeyHex) };
+}
+async function sealPrivateKey(aesKey, iv, privateKeyHex) {
+  return crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    aesKey,
+    new TextEncoder().encode(privateKeyHex)
+  );
+}
+async function unsealPrivateKey(aesKey, iv, ciphertext) {
+  const buf = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, aesKey, ciphertext);
+  return new TextDecoder().decode(buf);
+}
+function signWithPrivateKey(privateKeyHex, msgHash) {
+  const sig = starknet.ec.starkCurve.sign(msgHash, privateKeyHex);
+  return [starknet.num.toHex(sig.r), starknet.num.toHex(sig.s)];
+}
+
+// src/wallet/store.ts
+function createOwnerStore(config) {
+  const { storeKey, changeEvent } = config;
+  const announce = () => {
+    if (typeof window === "undefined") return;
+    window.dispatchEvent(new Event(changeEvent));
+  };
+  return {
+    load() {
+      if (typeof window === "undefined") return null;
+      try {
+        const raw = localStorage.getItem(storeKey);
+        return raw ? JSON.parse(raw) : null;
+      } catch {
+        return null;
+      }
+    },
+    loadAddress() {
+      return this.load()?.address ?? null;
+    },
+    save(sealed) {
+      const previous = this.load();
+      if (previous && previous.address !== sealed.address) {
+        localStorage.setItem(`${storeKey}:${previous.address}`, JSON.stringify(previous));
+      }
+      localStorage.setItem(storeKey, JSON.stringify(sealed));
+      announce();
+    },
+    clear() {
+      localStorage.removeItem(storeKey);
+      announce();
+    },
+    notifyChange: announce,
+    onChange(listener) {
+      window.addEventListener(changeEvent, listener);
+      return () => window.removeEventListener(changeEvent, listener);
+    }
+  };
+}
+
+// src/wallet/pairing.ts
+var SCHEME = "medialane-device";
+var VERSION = 1;
+var LABEL_MAX = 32;
+var STARK_PRIME = (1n << 251n) + 17n * (1n << 192n) + 1n;
+var InvalidPairingPayloadError = class extends Error {
+  constructor(message = "This code is not a Medialane device request.") {
+    super(message);
+    this.name = "InvalidPairingPayloadError";
+  }
+};
+function normalisePublicKey(input) {
+  if (typeof input !== "string" || !/^0x[0-9a-fA-F]+$/.test(input)) {
+    throw new InvalidPairingPayloadError("That device key is not valid.");
+  }
+  const value = BigInt(input);
+  if (value === 0n || value >= STARK_PRIME) {
+    throw new InvalidPairingPayloadError("That device key is not valid.");
+  }
+  return `0x${value.toString(16)}`;
+}
+function sanitiseLabel(input) {
+  const raw = typeof input === "string" ? input : "";
+  return raw.replace(/\s+/g, " ").trim().slice(0, LABEL_MAX);
+}
+function encodePairingPayload(payload) {
+  return JSON.stringify({
+    scheme: SCHEME,
+    version: VERSION,
+    publicKey: normalisePublicKey(payload.publicKey),
+    label: sanitiseLabel(payload.label)
+  });
+}
+function parsePairingPayload(encoded) {
+  let data;
+  try {
+    data = JSON.parse(encoded);
+  } catch {
+    throw new InvalidPairingPayloadError();
+  }
+  if (data === null || typeof data !== "object") throw new InvalidPairingPayloadError();
+  if (data.scheme !== SCHEME || data.version !== VERSION) throw new InvalidPairingPayloadError();
+  return {
+    publicKey: normalisePublicKey(data.publicKey),
+    label: sanitiseLabel(data.label)
+  };
+}
+function parseAccountAddress(input) {
+  const trimmed = typeof input === "string" ? input.trim() : "";
+  if (!/^0x[0-9a-fA-F]{50,64}$/.test(trimmed)) {
+    throw new InvalidPairingPayloadError("That does not look like an account address.");
+  }
+  if (BigInt(trimmed) === 0n) {
+    throw new InvalidPairingPayloadError("That does not look like an account address.");
+  }
+  return trimmed;
+}
+
+// src/wallet/recovery-key.ts
+var PREFIX = "medialane-recovery:v1:";
+var ADDRESS = /^0x[0-9a-fA-F]{1,64}$/;
+var InvalidRecoveryKeyError = class extends Error {
+  constructor(message = "This is not a valid recovery key.") {
+    super(message);
+    this.name = "InvalidRecoveryKeyError";
+  }
+};
+var canonicalAddress = (address) => `0x${BigInt(address).toString(16).padStart(64, "0")}`;
+function keyPair(privateKey) {
+  try {
+    return starkKeyPairFromPrivateKey(privateKey);
+  } catch {
+    throw new InvalidRecoveryKeyError();
+  }
+}
+function encodeRecoveryKey(key) {
+  if (!ADDRESS.test(key.walletAddress) || BigInt(key.walletAddress) === 0n) throw new InvalidRecoveryKeyError();
+  return `${PREFIX}${canonicalAddress(key.walletAddress)}:${keyPair(key.privateKey).privateKeyHex}`;
+}
+function parseRecoveryKey(input) {
+  const trimmed = input.trim();
+  if (!trimmed.startsWith(PREFIX)) {
+    const { privateKeyHex, publicKeyHex } = keyPair(trimmed);
+    return { walletAddress: computeAccountAddress(publicKeyHex, 0), privateKey: privateKeyHex };
+  }
+  const parts = trimmed.slice(PREFIX.length).split(":");
+  const [walletAddress, privateKey] = parts;
+  if (parts.length !== 2 || !walletAddress || !privateKey || !ADDRESS.test(walletAddress) || BigInt(walletAddress) === 0n) {
+    throw new InvalidRecoveryKeyError();
+  }
+  return { walletAddress: canonicalAddress(walletAddress), privateKey: keyPair(privateKey).privateKeyHex };
+}
+
+// src/wallet/guardian-status.ts
+function describeGuardianStatus(guardians) {
+  if (guardians.length === 0) return { kind: "none" };
+  return { kind: "active", guardian: guardians[0] };
+}
+function describeRecoveryAction(escape) {
+  if (escape.escapeType !== "Owner") return "none";
+  if (escape.status === "Ready") return "complete";
+  if (escape.status === "Expired") return "start";
+  return "none";
+}
+function normalizeWalletAddress(address) {
+  return chunk3HPMEDYH_cjs.normalizeAddress("STARKNET", address);
+}
+function isValidStarknetAddress(address) {
+  try {
+    starknet.validateAndParseAddress(address.trim());
+    return true;
+  } catch {
+    return false;
+  }
+}
+var CONTRACT_NOT_FOUND = 20;
+async function isDeployed(provider, address) {
+  try {
+    await provider.getClassHashAt(normalizeWalletAddress(address));
+    return true;
+  } catch (err) {
+    if (err?.code === CONTRACT_NOT_FOUND) return false;
+    throw err;
+  }
+}
+
+// src/wallet/self-fund-consent.ts
+function createSelfFundConsent(estimateFee) {
+  let handler = null;
+  return {
+    registerHandler(next) {
+      handler = next;
+    },
+    async request({ address, calls }) {
+      if (!handler) return false;
+      const feeEstimate = address && calls ? estimateFee(address, calls).catch(() => null) : Promise.resolve(null);
+      return handler(feeEstimate);
+    }
+  };
+}
+
+// src/wallet/device-keys.ts
+var DATABASE = "medialane-wallet";
+var STORE = "device-keys";
+function open() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DATABASE, 1);
+    request.onupgradeneeded = () => request.result.createObjectStore(STORE);
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+async function run(mode, act) {
+  const db = await open();
+  try {
+    return await new Promise((resolve, reject) => {
+      const request = act(db.transaction(STORE, mode).objectStore(STORE));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+var indexedDbDeviceKeys = {
+  async save(credentialId, key) {
+    await run("readwrite", (store) => store.put(key, credentialId));
+  },
+  async load(credentialId) {
+    return await run("readonly", (store) => store.get(credentialId)) ?? null;
+  }
+};
+
+// src/wallet/passkey.ts
+var encodeBase64 = (buf) => {
+  const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+};
+var decodeBase64 = (value) => {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+};
+function isPasskeyCancellation(err) {
+  const name = err?.name;
+  return name === "NotAllowedError" || name === "AbortError";
+}
+function createPasskeyOwner(config) {
+  const randomBytes = config.randomBytes ?? ((length) => crypto.getRandomValues(new Uint8Array(length)));
+  const credentialsApi = () => {
+    const api = config.credentials ?? (typeof navigator === "undefined" ? void 0 : navigator.credentials);
+    if (!api) throw new chunk3HPMEDYH_cjs.PasskeyUnsupportedError("no-webauthn");
+    return api;
+  };
+  async function registerPasskey() {
+    let credential;
+    try {
+      credential = await credentialsApi().create({
+        publicKey: {
+          challenge: randomBytes(32),
+          rp: { name: config.relyingPartyName, id: config.relyingPartyId() },
+          user: await config.passkeyUser(),
+          excludeCredentials: config.knownCredentials(),
+          pubKeyCredParams: [
+            { type: "public-key", alg: -7 },
+            { type: "public-key", alg: -257 }
+          ],
+          authenticatorSelection: {
+            authenticatorAttachment: "platform",
+            residentKey: "required",
+            userVerification: "required"
+          },
+          extensions: { prf: { eval: { first: config.prfSalt } } }
+        }
+      });
+    } catch (err) {
+      if (isPasskeyCancellation(err)) throw new chunk3HPMEDYH_cjs.PasskeyCancelledError();
+      throw err;
+    }
+    const prf = credential.getClientExtensionResults().prf;
+    return {
+      credentialId: encodeBase64(credential.rawId),
+      prfFirst: prf?.results?.first ?? null
+    };
+  }
+  async function assertPasskey(credentialId, extensions) {
+    try {
+      return await credentialsApi().get({
+        publicKey: {
+          challenge: randomBytes(32),
+          rpId: config.relyingPartyId(),
+          allowCredentials: [{ type: "public-key", id: decodeBase64(credentialId) }],
+          userVerification: "required",
+          ...extensions ? { extensions } : {}
+        }
+      });
+    } catch (err) {
+      if (isPasskeyCancellation(err)) throw new chunk3HPMEDYH_cjs.PasskeyCancelledError();
+      throw err;
+    }
+  }
+  async function prfSecret(credentialId) {
+    const assertion = await assertPasskey(credentialId, {
+      prf: { eval: { first: config.prfSalt } }
+    });
+    const result = assertion.getClientExtensionResults().prf?.results?.first;
+    if (!result) throw new chunk3HPMEDYH_cjs.PasskeyUnsupportedError("no-prf");
+    return new Uint8Array(result);
+  }
+  const deviceKeys = config.deviceKeys ?? indexedDbDeviceKeys;
+  async function lockFor(registration) {
+    if (registration.prfFirst) {
+      return { aes: await deriveAesKey(new Uint8Array(registration.prfFirst), config.hkdfInfo) };
+    }
+    try {
+      return { aes: await deriveAesKey(await prfSecret(registration.credentialId), config.hkdfInfo) };
+    } catch (err) {
+      if (!(err instanceof chunk3HPMEDYH_cjs.PasskeyUnsupportedError) || err.reason !== "no-prf") throw err;
+    }
+    const aes = await generateDeviceKey();
+    await deviceKeys.save(registration.credentialId, aes);
+    return { aes, lock: "device" };
+  }
+  async function unlockFor(sealed) {
+    if (sealed.lock !== "device") return deriveAesKey(await prfSecret(sealed.credentialId), config.hkdfInfo);
+    await assertPasskey(sealed.credentialId);
+    const aes = await deviceKeys.load(sealed.credentialId);
+    if (!aes) throw new chunk3HPMEDYH_cjs.DeviceKeyMissingError();
+    return aes;
+  }
+  async function seal(aes, privateKeyHex) {
+    const iv = randomBytes(12);
+    const ciphertext = await sealPrivateKey(aes, iv, privateKeyHex);
+    return { iv: encodeBase64(iv), ciphertext: encodeBase64(ciphertext) };
+  }
+  return {
+    async createOwnerKey() {
+      const registration = await registerPasskey();
+      const { aes, lock } = await lockFor(registration);
+      const { privateKeyHex, publicKeyHex } = generateStarkKeyPair();
+      const { iv, ciphertext } = await seal(aes, privateKeyHex);
+      return {
+        sealed: {
+          credentialId: registration.credentialId,
+          ownerPubKey: publicKeyHex,
+          address: computeAccountAddress(publicKeyHex, 0),
+          iv,
+          ciphertext,
+          ...lock ? { lock } : {}
+        },
+        privateKeyHex
+      };
+    },
+    async unlockOwnerKey(sealed) {
+      const aes = await unlockFor(sealed);
+      return unsealPrivateKey(aes, decodeBase64(sealed.iv), decodeBase64(sealed.ciphertext));
+    },
+    async sealImportedOwnerKey(recovery) {
+      const { privateKeyHex, publicKeyHex } = starkKeyPairFromPrivateKey(recovery.privateKey);
+      const registration = await registerPasskey();
+      const { aes, lock } = await lockFor(registration);
+      const { iv, ciphertext } = await seal(aes, privateKeyHex);
+      return {
+        credentialId: registration.credentialId,
+        ownerPubKey: publicKeyHex,
+        address: recovery.walletAddress,
+        iv,
+        ciphertext,
+        ...lock ? { lock } : {}
+      };
+    }
+  };
+}
+function accountFor(provider, address, privateKeyHex) {
+  return new starknet.Account({ provider, address, signer: privateKeyHex, cairoVersion: "1" });
+}
+async function estimateSelfFundedFee(provider, address, calls) {
+  const account = new starknet.Account({ provider, address, signer: "0x1", cairoVersion: "1" });
+  const estimate = await account.estimateInvokeFee(calls);
+  const balanceRaw = await feeTokenBalance(provider, address, estimate.unit).catch(() => null);
+  return { feeRaw: estimate.overall_fee, unit: estimate.unit, balanceRaw };
+}
+async function feeTokenBalance(provider, address, unit) {
+  const token = chunk3HPMEDYH_cjs.getTokenBySymbol(unit === "FRI" ? "STRK" : "ETH");
+  if (!token) throw new Error(`No fee token for unit ${unit}`);
+  return erc20Balance(provider, token.address, address);
+}
+function selfFundedExecutor(deps) {
+  return {
+    async execute({ userAddress, privateKeyHex, calls }) {
+      const account = accountFor(deps.provider(), userAddress, privateKeyHex);
+      const { transaction_hash } = await account.execute(calls);
+      return { transactionHash: transaction_hash };
+    }
+  };
+}
+function sponsoredExecutor(deps) {
+  const fallback = deps.fallback ?? selfFundedExecutor(deps);
+  return {
+    async execute(input) {
+      const { userAddress, privateKeyHex, calls, intentIds } = input;
+      if (!intentIds?.length) {
+        const consented2 = await deps.consent.request({ address: userAddress, calls });
+        if (!consented2) throw new SponsoredCallRejectedError("This action can't be sponsored");
+        return fallback.execute(input);
+      }
+      const result = await executeSponsored(
+        { proxyUrl: deps.proxyUrl, fetchImpl: deps.fetchImpl },
+        {
+          address: userAddress,
+          signTypedData: async (data) => signWithPrivateKey(privateKeyHex, starknet.typedData.getMessageHash(data, userAddress))
+        },
+        { intentIds }
+      );
+      if (result.status === "sponsored") return { transactionHash: result.transactionHash };
+      const consented = await deps.consent.request({ address: userAddress, calls });
+      if (!consented) throw new SponsoredCallRejectedError(result.reason);
+      return fallback.execute(input);
+    }
+  };
+}
+async function describeFailure(res, fallback) {
+  const body = await res.json().catch(() => null);
+  throw new Error(body?.error || fallback);
+}
+async function deploySponsored(input) {
+  const doFetch = input.fetchImpl ?? fetch;
+  const base = input.proxyUrl.replace(/\/$/, "");
+  const buildRes = await doFetch(`${base}/build`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      ownerPubkey: input.ownerPubKey,
+      ownerAddress: input.ownerAddress,
+      salt: input.salt ?? "0x0"
+    })
+  });
+  if (!buildRes.ok) {
+    await describeFailure(buildRes, "We couldn't prepare your wallet deployment. Please try again.");
+  }
+  const { typedData, deployment, calls } = await buildRes.json();
+  const account = new starknet.Account({
+    provider: input.provider,
+    address: input.ownerAddress,
+    signer: input.privateKeyHex,
+    cairoVersion: "1"
+  });
+  const signature = starknet.stark.signatureToHexArray(await account.signMessage(typedData));
+  const executeRes = await doFetch(`${base}/execute`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ ownerAddress: input.ownerAddress, typedData, signature, deployment, calls })
+  });
+  if (!executeRes.ok) {
+    await describeFailure(executeRes, "We couldn't complete your wallet deployment. Please try again.");
+  }
+  const { transactionHash } = await executeRes.json();
+  return { transactionHash };
+}
+async function deploySelfFunded(input) {
+  const classHash = chunkH2NJB3AK_cjs.getCoordinates("STARKNET").mediaWalletClassHash;
+  if (!classHash) throw new Error("Media Wallet class hash is not configured");
+  const account = new starknet.Account({
+    provider: input.provider,
+    address: input.ownerAddress,
+    signer: input.privateKeyHex,
+    cairoVersion: "1"
+  });
+  const { transaction_hash } = await account.deployAccount({
+    classHash,
+    constructorCalldata: ownerConstructorCalldata(input.ownerPubKey),
+    addressSalt: 0,
+    contractAddress: input.ownerAddress
+  });
+  return { transactionHash: transaction_hash };
+}
+async function waitUntilDeployed(provider, address, timeoutMs = 9e4, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+  const deadline = Date.now() + timeoutMs;
+  let wait = 1e3;
+  for (; ; ) {
+    if (await isDeployed(provider, address).catch(() => false)) return;
+    if (Date.now() >= deadline) {
+      throw new Error(
+        "Your wallet was submitted but has not appeared on Starknet yet. Please try again in a moment."
+      );
+    }
+    await sleep(wait);
+    wait = Math.min(Math.round(wait * 1.5), 5e3);
+  }
+}
+async function deployWallet(deps, wallet) {
+  const sponsored = deps.deploySponsoredImpl ?? deploySponsored;
+  const selfFunded = deps.deploySelfFundedImpl ?? deploySelfFunded;
+  if (deps.deployProxyUrl) {
+    try {
+      await sponsored({
+        proxyUrl: deps.deployProxyUrl,
+        provider: deps.provider(),
+        fetchImpl: deps.fetchImpl,
+        ...wallet
+      });
+    } catch (sponsoredErr) {
+      try {
+        await selfFunded({ provider: deps.provider(), ...wallet });
+      } catch (selfFundedErr) {
+        const sponsored2 = sponsoredErr instanceof Error ? sponsoredErr.message : String(sponsoredErr);
+        const selfFunded2 = selfFundedErr instanceof Error ? selfFundedErr.message : String(selfFundedErr);
+        throw new Error(`Sponsored deploy failed: ${sponsored2}. Self-funded fallback failed: ${selfFunded2}`);
+      }
+    }
+  } else {
+    await selfFunded({ provider: deps.provider(), ...wallet });
+  }
+  await (deps.waitUntilDeployedImpl ?? waitUntilDeployed)(deps.provider(), wallet.ownerAddress);
+}
+async function completeDeployment(deps, onStep, options = {}) {
+  let sealed = options.forceNew ? null : deps.store.load();
+  if (sealed && await (deps.isDeployedImpl ?? isDeployed)(deps.provider(), sealed.address).catch(() => false)) {
+    sealed = null;
+  }
+  let privateKeyHex;
+  if (!sealed) {
+    onStep("creating-passkey");
+    const created = await deps.passkey.createOwnerKey();
+    sealed = created.sealed;
+    privateKeyHex = created.privateKeyHex;
+    deps.store.save(sealed);
+  } else {
+    privateKeyHex = await deps.passkey.unlockOwnerKey(sealed);
+  }
+  onStep("deploying");
+  await deployWallet(deps, { ownerAddress: sealed.address, ownerPubKey: sealed.ownerPubKey, privateKeyHex });
+  deps.store.notifyChange();
+  return { sealed };
+}
+function createDeploymentCoordinator(execute) {
+  let inFlight = null;
+  let currentStep = null;
+  const listeners = /* @__PURE__ */ new Set();
+  return {
+    run(onStep, options = {}) {
+      if (inFlight) {
+        if (options.forceNew) {
+          return Promise.reject(new Error("A wallet setup is already in progress."));
+        }
+        if (currentStep) onStep(currentStep);
+        listeners.add(onStep);
+        return inFlight.finally(() => listeners.delete(onStep));
+      }
+      listeners.add(onStep);
+      let started;
+      try {
+        started = execute((step) => {
+          currentStep = step;
+          for (const listener of listeners) listener(step);
+        }, options);
+      } catch (err) {
+        listeners.clear();
+        return Promise.reject(err);
+      }
+      const run2 = started.finally(() => {
+        inFlight = null;
+        currentStep = null;
+        listeners.clear();
+      });
+      inFlight = run2;
+      return run2;
+    },
+    isDeploying: () => inFlight !== null
+  };
+}
+function describeDevices(owners, thisDevicePubkey) {
+  const mine = computeOwnerGuid(thisDevicePubkey);
+  return owners.map((owner) => ({
+    guid: owner.guid,
+    type: owner.type,
+    isThisDevice: BigInt(owner.guid) === BigInt(mine)
+  }));
+}
+function canRemoveDevice(devices, guid) {
+  if (devices.length <= 1) return false;
+  return devices.some((device) => BigInt(device.guid) === BigInt(guid));
+}
+function createMediaWallet(config) {
+  const ttl = config.unlockTtlMs ?? 2e4;
+  const deployments = createDeploymentCoordinator((onStep, options) => {
+    const deps = {
+      store: config.store,
+      passkey: config.passkey,
+      provider: config.provider,
+      deployProxyUrl: config.deployProxyUrl,
+      fetchImpl: config.fetchImpl
+    };
+    return completeDeployment(deps, onStep, options);
+  });
+  const unlockCache = /* @__PURE__ */ new Map();
+  const lock = (address) => {
+    const entry = unlockCache.get(address);
+    if (!entry) return;
+    clearTimeout(entry.timer);
+    unlockCache.delete(address);
+  };
+  const unlockOnce = (sealed) => {
+    const existing = unlockCache.get(sealed.address);
+    if (existing) return existing.promise;
+    const promise = config.passkey.unlockOwnerKey(sealed).catch((err) => {
+      lock(sealed.address);
+      throw err;
+    });
+    const timer = setTimeout(() => lock(sealed.address), ttl);
+    unlockCache.set(sealed.address, { promise, timer });
+    return promise;
+  };
+  const run2 = async (sealed, calls, userAddress, intentIds) => {
+    const privateKeyHex = await unlockOnce(sealed);
+    return config.executor.execute({
+      userAddress: userAddress ?? sealed.address,
+      privateKeyHex,
+      calls,
+      intentIds
+    });
+  };
+  const walletIntents = config.walletIntents ?? (async (params) => {
+    if (!config.backendUrl) throw new Error("This wallet has no backend url configured");
+    const created = await new chunk3HPMEDYH_cjs.ApiClient({ baseUrl: config.backendUrl }).intents.create("wallet-manage", params);
+    return created;
+  });
+  const manage = async (sealed, params) => {
+    const intent = await walletIntents(params);
+    const { transactionHash } = await run2(sealed, intent.calls, params.owner, [intent.id]);
+    return transactionHash;
+  };
+  return {
+    store: config.store,
+    passkey: config.passkey,
+    lock,
+    signerFor(sealed) {
+      return {
+        address: sealed.address,
+        signTypedData: async (data) => {
+          const privateKeyHex = await unlockOnce(sealed);
+          return signWithPrivateKey(privateKeyHex, starknet.typedData.getMessageHash(data, sealed.address));
+        },
+        execute: async (calls, opts) => {
+          const { transactionHash } = await run2(sealed, calls, void 0, opts?.intentIds);
+          return { txHash: transactionHash };
+        }
+      };
+    },
+    run: run2,
+    getGuardians: (address) => getGuardians(config.provider(), address),
+    getEscape: (address) => getEscape(config.provider(), address),
+    getEscapeSecurityPeriod: (address) => getEscapeSecurityPeriod(config.provider(), address),
+    getOwners: (address) => getOwners(config.provider(), address),
+    async isOwnerOf(accountAddress, devicePubkey) {
+      const owners = await getOwners(config.provider(), accountAddress);
+      const guid = BigInt(computeOwnerGuid(devicePubkey));
+      return owners.some((owner) => BigInt(owner.guid) === guid);
+    },
+    setFirstGuardian: (sealed, guardianPubkey) => manage(sealed, { owner: sealed.address, action: "set_first_guardian", pubkey: guardianPubkey }),
+    triggerEscapeOwner: (guardianSealed, targetAddress, newOwnerPubkey) => manage(guardianSealed, { owner: normalizeWalletAddress(targetAddress), action: "trigger_escape", newOwnerPubkey }),
+    completeEscapeOwner: (guardianSealed, targetAddress) => manage(guardianSealed, { owner: normalizeWalletAddress(targetAddress), action: "complete_escape" }),
+    cancelEscape: (sealed) => manage(sealed, { owner: sealed.address, action: "cancel_escape" }),
+    addDevice: (sealed, devicePubkey) => manage(sealed, { owner: sealed.address, action: "add_owner", pubkey: devicePubkey }),
+    removeDevice: (sealed, ownerGuid) => manage(sealed, { owner: sealed.address, action: "remove_owner", ownerGuid }),
+    completeDeployment: (onStep, options) => deployments.run(onStep, options),
+    isDeploying: () => deployments.isDeploying()
+  };
+}
+
+// src/session/session-wallet.ts
+async function claimSessionWallet(api, walletAddress, deps) {
+  const saved = deps.loadOwner();
+  const resuming = saved !== null && normalizeWalletAddress(saved.address) === normalizeWalletAddress(walletAddress);
+  const sealed = resuming ? saved : { ...(await deps.createOwnerKey()).sealed, address: walletAddress };
+  if (!resuming) deps.saveOwner(sealed);
+  const { removeOwnerGuid } = await api.account.setupWalletKey({ newOwnerPubkey: sealed.ownerPubKey });
+  if (removeOwnerGuid) await deps.removeOwner(sealed, removeOwnerGuid);
+}
+
+exports.InvalidPairingPayloadError = InvalidPairingPayloadError;
+exports.InvalidRecoveryKeyError = InvalidRecoveryKeyError;
+exports.InvalidStarkPrivateKeyError = InvalidStarkPrivateKeyError;
+exports.SponsoredCallRejectedError = SponsoredCallRejectedError;
+exports.accountFor = accountFor;
+exports.allowsFallbackFunding = allowsFallbackFunding;
+exports.buildAddOwnerCall = buildAddOwnerCall;
+exports.buildCancelEscapeCall = buildCancelEscapeCall;
+exports.buildCompleteEscapeOwnerCall = buildCompleteEscapeOwnerCall;
+exports.buildDeployAccountParams = buildDeployAccountParams;
+exports.buildRemoveOwnerByGuidCall = buildRemoveOwnerByGuidCall;
+exports.buildRemoveOwnerCall = buildRemoveOwnerCall;
+exports.buildSetFirstGuardianCall = buildSetFirstGuardianCall;
+exports.buildTriggerEscapeOwnerCall = buildTriggerEscapeOwnerCall;
+exports.canRemoveDevice = canRemoveDevice;
+exports.claimSessionWallet = claimSessionWallet;
+exports.completeDeployment = completeDeployment;
+exports.computeAccountAddress = computeAccountAddress;
+exports.computeOwnerGuid = computeOwnerGuid;
+exports.createDeploymentCoordinator = createDeploymentCoordinator;
+exports.createMediaWallet = createMediaWallet;
+exports.createOwnerStore = createOwnerStore;
+exports.createPasskeyOwner = createPasskeyOwner;
+exports.createSelfFundConsent = createSelfFundConsent;
+exports.decodeEscapeAndStatus = decodeEscapeAndStatus;
+exports.decodeGuardiansInfo = decodeGuardiansInfo;
+exports.deploySelfFunded = deploySelfFunded;
+exports.deploySponsored = deploySponsored;
+exports.deriveAesKey = deriveAesKey;
+exports.deriveOwnerKeyPair = deriveOwnerKeyPair;
+exports.describeDevices = describeDevices;
+exports.describeGuardianStatus = describeGuardianStatus;
+exports.describeRecoveryAction = describeRecoveryAction;
+exports.encodePairingPayload = encodePairingPayload;
+exports.encodeRecoveryKey = encodeRecoveryKey;
+exports.erc20Balance = erc20Balance;
+exports.estimateSelfFundedFee = estimateSelfFundedFee;
+exports.executeSponsored = executeSponsored;
+exports.generateStarkKeyPair = generateStarkKeyPair;
+exports.getEscape = getEscape;
+exports.getEscapeSecurityPeriod = getEscapeSecurityPeriod;
+exports.getGuardians = getGuardians;
+exports.getOwners = getOwners;
+exports.indexedDbDeviceKeys = indexedDbDeviceKeys;
+exports.isDeployed = isDeployed;
+exports.isValidStarknetAddress = isValidStarknetAddress;
+exports.normalizeWalletAddress = normalizeWalletAddress;
+exports.ownerConstructorCalldata = ownerConstructorCalldata;
+exports.parseAccountAddress = parseAccountAddress;
+exports.parsePairingPayload = parsePairingPayload;
+exports.parseRecoveryKey = parseRecoveryKey;
+exports.sealPrivateKey = sealPrivateKey;
+exports.selfFundedExecutor = selfFundedExecutor;
+exports.signWithPrivateKey = signWithPrivateKey;
+exports.sponsoredExecutor = sponsoredExecutor;
+exports.starkKeyPairFromPrivateKey = starkKeyPairFromPrivateKey;
+exports.unsealPrivateKey = unsealPrivateKey;
+exports.waitUntilDeployed = waitUntilDeployed;
+//# sourceMappingURL=chunk-ZLMIHQWM.cjs.map
+//# sourceMappingURL=chunk-ZLMIHQWM.cjs.map