@medialane/sdk 0.198.0 → 0.199.0

package/dist/chunk-ZVANOWIB.cjs

@@ -0,0 +1,688 @@
+'use strict';
+
+var hmac_js = require('@noble/hashes/hmac.js');
+var sha2_js = require('@noble/hashes/sha2.js');
+var base = require('@scure/base');
+
+// src/server/origin.ts
+function isSameOrigin(req) {
+  const origin = req.headers.get("origin");
+  if (!origin) return true;
+  const host = req.headers.get("host");
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+
+// src/server/app-gateway.ts
+var ACCOUNT_SESSION_COOKIE = "ml_account_session";
+var SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var SIGN_IN_PATHS = /* @__PURE__ */ new Set(["auth/email/register-account", "auth/email/verify-code", "auth/siws/verify"]);
+var EDGE_CACHE_CONTROL = "public, s-maxage=30, stale-while-revalidate=120";
+var DROPPED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailers",
+  "transfer-encoding",
+  "upgrade",
+  "host",
+  "content-length",
+  "accept-encoding",
+  "cookie",
+  "x-api-key",
+  "x-app-id",
+  "x-app-secret",
+  "x-account-session",
+  "authorization"
+]);
+var DROPPED_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "content-length",
+  "content-encoding",
+  "set-cookie"
+]);
+function readCookie(req, name) {
+  const raw = req.headers.get("cookie");
+  if (!raw) return null;
+  for (const part of raw.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq !== -1 && part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim() || null;
+  }
+  return null;
+}
+function sessionCookie(value, maxAge = SESSION_MAX_AGE_SECONDS) {
+  const secure = process.env.NODE_ENV === "production" ? "; Secure" : "";
+  return `${ACCOUNT_SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
+}
+function json(body, status) {
+  return Response.json(body, { status });
+}
+function createAppGateway(config) {
+  const doFetch = config.fetchImpl ?? fetch;
+  const base = config.backendUrl.replace(/\/$/, "");
+  return async function appGateway(req, path) {
+    if (!isSameOrigin(req)) return json({ error: "Cross-origin requests are not allowed" }, 403);
+    if (!config.apiKey) return json({ error: "Service unavailable" }, 500);
+    if (path.some((s) => s === "." || s === ".." || s === "")) return json({ error: "Invalid path" }, 400);
+    const joined = path.join("/");
+    const method = req.method.toUpperCase();
+    if (!(config.allow[method] ?? []).some((re) => re.test(joined))) {
+      return json({ error: `Path not allowed: ${method} /v1/${joined}` }, 403);
+    }
+    const headers2 = new Headers();
+    req.headers.forEach((v, k) => {
+      if (!DROPPED_REQUEST_HEADERS.has(k.toLowerCase())) headers2.set(k, v);
+    });
+    headers2.set("x-api-key", config.apiKey);
+    headers2.set("x-app-id", config.appId);
+    if (config.appSecret) headers2.set("x-app-secret", config.appSecret);
+    const session = readCookie(req, ACCOUNT_SESSION_COOKIE);
+    if (session) headers2.set("x-account-session", session);
+    const search = new URL(req.url).search;
+    const target = `${base}/v1/${path.map(encodeURIComponent).join("/")}${search}`;
+    const hasBody = method !== "GET" && method !== "HEAD";
+    let res;
+    try {
+      res = await doFetch(target, {
+        method,
+        headers: headers2,
+        body: hasBody ? await req.arrayBuffer() : void 0,
+        cache: "no-store",
+        redirect: "manual",
+        signal: AbortSignal.timeout(config.timeoutMs ?? 55e3)
+      });
+    } catch (e) {
+      if (e instanceof DOMException && e.name === "TimeoutError") {
+        return json({ error: "The service took too long to respond" }, 504);
+      }
+      return json({ error: "Service unavailable" }, 502);
+    }
+    const out = new Headers();
+    res.headers.forEach((v, k) => {
+      if (!DROPPED_RESPONSE_HEADERS.has(k.toLowerCase())) out.set(k, v);
+    });
+    if (method === "POST" && res.ok && SIGN_IN_PATHS.has(joined)) {
+      const text = await res.text();
+      let body = null;
+      try {
+        body = JSON.parse(text);
+      } catch {
+        body = null;
+      }
+      if (!body) return new Response(text, { status: res.status, headers: out });
+      const token = typeof body.accountToken === "string" ? body.accountToken : null;
+      delete body.accountToken;
+      delete body.token;
+      out.set("content-type", "application/json");
+      if (token) out.append("set-cookie", sessionCookie(token));
+      return new Response(JSON.stringify(body), { status: res.status, headers: out });
+    }
+    if (method === "GET" && res.ok && !session && (config.cacheableGets ?? []).some((re) => re.test(joined))) {
+      out.set("cache-control", EDGE_CACHE_CONTROL);
+    }
+    return new Response(res.body, { status: res.status, headers: out });
+  };
+}
+
+// src/server/app-session.ts
+function signedOut() {
+  const res = Response.json(null);
+  res.headers.append("set-cookie", sessionCookie("", 0));
+  return res;
+}
+function createAppSessionHandler(config) {
+  const doFetch = config.fetchImpl ?? fetch;
+  const base = config.backendUrl.replace(/\/$/, "");
+  return {
+    async GET(req) {
+      const session = readCookie(req, ACCOUNT_SESSION_COOKIE);
+      if (!session) return Response.json(null);
+      const res = await doFetch(`${base}/v1/users/me`, {
+        headers: {
+          "x-api-key": config.apiKey ?? "",
+          "x-app-id": config.appId,
+          ...config.appSecret ? { "x-app-secret": config.appSecret } : {},
+          "x-account-session": session
+        },
+        cache: "no-store"
+      });
+      if (res.status === 401 || res.status === 403) return signedOut();
+      if (!res.ok) return Response.json({ error: "Session check failed" }, { status: 502 });
+      return Response.json(await res.json());
+    },
+    async DELETE() {
+      return signedOut();
+    }
+  };
+}
+
+// src/server/ssrf-guard.ts
+var ALLOWED_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/jpg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+  "image/avif",
+  "image/bmp",
+  "image/tiff"
+]);
+var MAX_IMAGE_REDIRECTS = 5;
+var MAX_IMAGE_PROXY_BYTES = 15 * 1024 * 1024;
+function parseIpv4(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    bytes.push(n);
+  }
+  return bytes;
+}
+function isPrivateIpv4(bytes) {
+  const a = bytes[0];
+  const b = bytes[1];
+  const c = bytes[2];
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 0 && c === 0) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function expandIpv6(rawIp) {
+  let ip = rawIp;
+  let embeddedV4 = null;
+  const v4Tail = ip.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (v4Tail && ip.includes(":")) {
+    embeddedV4 = parseIpv4(v4Tail[1]);
+    if (!embeddedV4) return null;
+    ip = ip.slice(0, ip.length - v4Tail[1].length) + "0:0";
+  }
+  const sides = ip.split("::");
+  if (sides.length > 2) return null;
+  const head = sides[0] ? sides[0].split(":").filter(Boolean) : [];
+  const tail = sides.length === 2 && sides[1] ? sides[1].split(":").filter(Boolean) : [];
+  let groups;
+  if (sides.length === 1) {
+    groups = head;
+    if (groups.length !== 8) return null;
+  } else {
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0) return null;
+    groups = [...head, ...Array(missing).fill("0"), ...tail];
+  }
+  if (groups.length !== 8) return null;
+  const bytes = [];
+  for (const group of groups) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(group)) return null;
+    const n = parseInt(group, 16);
+    bytes.push(n >> 8 & 255, n & 255);
+  }
+  if (embeddedV4) {
+    bytes[12] = embeddedV4[0];
+    bytes[13] = embeddedV4[1];
+    bytes[14] = embeddedV4[2];
+    bytes[15] = embeddedV4[3];
+  }
+  return bytes;
+}
+function isPrivateIpv6(bytes) {
+  if (bytes.every((b) => b === 0)) return true;
+  if (bytes.slice(0, 15).every((b) => b === 0) && bytes[15] === 1) return true;
+  if ((bytes[0] & 254) === 252) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128) return true;
+  if (bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255) {
+    return isPrivateIpv4(bytes.slice(12));
+  }
+  if (bytes.slice(0, 12).every((b) => b === 0)) return isPrivateIpv4(bytes.slice(12));
+  if (bytes[0] === 0 && bytes[1] === 100 && bytes[2] === 255 && bytes[3] === 155 && bytes.slice(4, 12).every((b) => b === 0)) {
+    return isPrivateIpv4(bytes.slice(12));
+  }
+  if (bytes[0] === 32 && bytes[1] === 2) return isPrivateIpv4(bytes.slice(2, 6));
+  if (bytes[0] === 254 && (bytes[1] & 192) === 192) return true;
+  if (bytes[0] === 255) return true;
+  return false;
+}
+function parseNumber(part) {
+  if (/^0x[0-9a-f]+$/i.test(part)) return parseInt(part.slice(2), 16);
+  if (/^0[0-7]+$/.test(part)) return parseInt(part, 8);
+  if (/^\d+$/.test(part)) return parseInt(part, 10);
+  return null;
+}
+function normalizeNumericHostname(host) {
+  const parts = host.trim().split(".");
+  if (parts.length < 1 || parts.length > 4) return null;
+  const values = [];
+  for (const part of parts) {
+    const value = parseNumber(part);
+    if (value === null || value < 0) return null;
+    values.push(value);
+  }
+  const leading = values.slice(0, -1);
+  if (leading.some((v) => v > 255)) return null;
+  const tail = values[values.length - 1];
+  const tailBytes = 4 - leading.length;
+  if (tail > 2 ** (8 * tailBytes) - 1) return null;
+  const bytes = [...leading];
+  for (let i = tailBytes - 1; i >= 0; i--) bytes.push(tail >>> 8 * i & 255);
+  return bytes.join(".");
+}
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.azure.internal"
+]);
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (BLOCKED_HOSTNAMES.has(host)) return true;
+  if (host.endsWith(".local") || host.endsWith(".internal") || host.endsWith(".localhost")) return true;
+  const candidate = normalizeNumericHostname(host) ?? host;
+  const v4 = parseIpv4(candidate);
+  if (v4) return isPrivateIpv4(v4);
+  const v6 = expandIpv6(candidate);
+  if (v6) return isPrivateIpv6(v6);
+  return false;
+}
+function validateUrl(raw, options = {}) {
+  const requireHttps = options.requireHttps ?? true;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return { error: "Invalid url", status: 400 };
+  }
+  if (requireHttps && parsed.protocol !== "https:") {
+    return { error: "Only https URLs allowed", status: 400 };
+  }
+  if (!requireHttps && parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return { error: "Only http and https URLs allowed", status: 400 };
+  }
+  if (parsed.username || parsed.password) {
+    return { error: "URL credentials not allowed", status: 400 };
+  }
+  if (isPrivateHost(parsed.hostname)) {
+    return { error: "URL not allowed", status: 400 };
+  }
+  return { url: parsed };
+}
+function isPrivateOrInsecureUrl(raw, requireHttps = true) {
+  return "error" in validateUrl(raw, { requireHttps });
+}
+
+// src/server/image-proxy.ts
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (compatible; Medialane/1.0; +https://www.medialane.io)";
+function jsonError(message, status) {
+  return Response.json({ error: message }, { status });
+}
+async function readBodyWithCap(res, maxBytes) {
+  const declared = Number(res.headers.get("content-length") ?? 0);
+  if (declared > maxBytes) {
+    return { ok: false, error: "Image too large", status: 413 };
+  }
+  const reader = res.body?.getReader();
+  if (!reader) return { ok: false, error: "Empty response body", status: 502 };
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {
+      });
+      return { ok: false, error: "Image too large", status: 413 };
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { ok: true, body };
+}
+function createImageProxyHandler(config) {
+  const doFetch = config.fetchImpl ?? fetch;
+  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT;
+  const backendOrigin = config.backend ? new URL(config.backend.backendUrl).origin : null;
+  function headersFor(url) {
+    const headers2 = { "User-Agent": userAgent };
+    if (!config.backend || url.origin !== backendOrigin) return headers2;
+    if (config.backend.apiKey) headers2["x-api-key"] = config.backend.apiKey;
+    headers2["x-app-id"] = config.backend.appId;
+    if (config.backend.appSecret) headers2["x-app-secret"] = config.backend.appSecret;
+    return headers2;
+  }
+  async function resolvesToPrivateHost(hostname) {
+    try {
+      const addresses = await config.resolveHostname(hostname);
+      if (addresses.length === 0) return true;
+      return addresses.some((address) => isPrivateHost(address));
+    } catch {
+      return true;
+    }
+  }
+  async function safeFetch(url, hopsLeft) {
+    if (hopsLeft < 0) throw new Error("Too many redirects");
+    if (await resolvesToPrivateHost(url.hostname)) {
+      throw new Error("Blocked: hostname resolves to a private address");
+    }
+    const res = await doFetch(url.toString(), {
+      redirect: "manual",
+      headers: headersFor(url)
+    });
+    if (res.status >= 300 && res.status < 400) {
+      const location = res.headers.get("location");
+      if (!location) throw new Error("Redirect with no Location header");
+      const next = new URL(location, url);
+      const validated = validateUrl(next.toString());
+      if ("error" in validated) throw new Error(`Redirect blocked: ${validated.error}`);
+      return safeFetch(validated.url, hopsLeft - 1);
+    }
+    return res;
+  }
+  return async function handleImageProxy(req) {
+    const raw = new URL(req.url).searchParams.get("url");
+    if (!raw) return jsonError("Missing url", 400);
+    const validated = validateUrl(raw);
+    if ("error" in validated) return jsonError(validated.error, validated.status);
+    let upstream;
+    try {
+      const isBackendImage = backendOrigin && /^\/media\/[^/]+\/[^/]+\/[^/]+\/image$/.test(validated.url.pathname);
+      upstream = await safeFetch(
+        isBackendImage ? new URL(validated.url.pathname, backendOrigin) : validated.url,
+        MAX_IMAGE_REDIRECTS
+      );
+    } catch {
+      return jsonError("Failed to fetch image", 502);
+    }
+    if (!upstream.ok) {
+      return jsonError(`Upstream returned ${upstream.status}`, upstream.status);
+    }
+    const contentType = upstream.headers.get("content-type") ?? "";
+    const baseType = contentType.split(";")[0].trim().toLowerCase();
+    if (!ALLOWED_IMAGE_CONTENT_TYPES.has(baseType)) {
+      return jsonError("Not an image", 400);
+    }
+    const capped = await readBodyWithCap(upstream, MAX_IMAGE_PROXY_BYTES);
+    if (!capped.ok) return jsonError(capped.error, capped.status);
+    return new Response(capped.body, {
+      status: 200,
+      headers: {
+        "Content-Type": contentType,
+        "X-Content-Type-Options": "nosniff",
+        "Content-Security-Policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox",
+        "Cache-Control": "public, max-age=86400, s-maxage=86400, stale-while-revalidate=604800",
+        "Access-Control-Allow-Origin": "*"
+      }
+    });
+  };
+}
+
+// src/server/backend-metadata.ts
+function endpoint(config, path) {
+  return `${config.backendUrl.replace(/\/$/, "")}/v1/metadata/${path}`;
+}
+function headers(config, extra) {
+  return { "x-api-key": config.apiKey, ...extra };
+}
+async function uploadJsonToBackend(config, json2) {
+  const res = await (config.fetchImpl ?? fetch)(endpoint(config, "upload"), {
+    method: "POST",
+    headers: headers(config, { "Content-Type": "application/json" }),
+    body: JSON.stringify(json2)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "Metadata upload failed");
+  return { cid: data.data.cid, uri: data.data.url };
+}
+async function uploadFileToBackend(config, file) {
+  const form = new FormData();
+  form.append("file", file, file.name);
+  const res = await (config.fetchImpl ?? fetch)(endpoint(config, "upload-file"), {
+    method: "POST",
+    headers: headers(config),
+    body: form
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "File upload failed");
+  return { cid: data.data.cid, uri: data.data.url };
+}
+async function uploadDirectoryToBackend(config, files) {
+  const res = await (config.fetchImpl ?? fetch)(endpoint(config, "upload-directory"), {
+    method: "POST",
+    headers: headers(config, { "Content-Type": "application/json" }),
+    body: JSON.stringify({ files })
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "Directory pin failed");
+  return data.data;
+}
+async function getBackendSignedUrl(config, kind = "image") {
+  const res = await (config.fetchImpl ?? fetch)(`${endpoint(config, "signed-url")}?kind=${kind}`, {
+    method: "GET",
+    headers: headers(config)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.data) throw new Error(data.error ?? "Failed to create upload URL");
+  return data.data.url;
+}
+
+// src/server/app-routes.ts
+var SEG = "[^/]+";
+var PUBLIC_ROUTES = {
+  GET: [
+    "orders",
+    `orders/${SEG}`,
+    `orders/token/${SEG}/${SEG}`,
+    `orders/user/${SEG}`,
+    `orders/received/${SEG}`,
+    "orders/counter-offers",
+    "tokens",
+    `tokens/owned/${SEG}`,
+    `tokens/${SEG}/${SEG}`,
+    `tokens/${SEG}/${SEG}/(history|comments|remixes)`,
+    `tokens/${SEG}/${SEG}/balances/${SEG}`,
+    "collections",
+    `collections/${SEG}`,
+    `collections/${SEG}/tokens`,
+    `collections/${SEG}/profile`,
+    "activities",
+    `activities/${SEG}`,
+    "search",
+    "metadata/resolve",
+    "creators",
+    `creators/${SEG}/profile`,
+    `creators/by-username/${SEG}`,
+    `creators/${SEG}/hidden`,
+    "coins",
+    "coins/prices",
+    "coins/claims",
+    `coins/${SEG}`,
+    `coins/${SEG}/guarantees`,
+    `pop/${SEG}/claim-info`,
+    "drops",
+    `drops/${SEG}`,
+    `drops/${SEG}/mints`,
+    `drops/${SEG}/state`,
+    "rewards",
+    "rewards/config",
+    "rewards/batch",
+    `rewards/${SEG}`,
+    `rewards/${SEG}/events`,
+    `club/${SEG}/${SEG}`,
+    `club/${SEG}/${SEG}/member/${SEG}`,
+    `tickets/${SEG}/${SEG}`,
+    `tickets/${SEG}/count`,
+    `ipnft/${SEG}/${SEG}`,
+    "stats",
+    "prices",
+    `remix-offers/${SEG}`,
+    "sponsorship/offers",
+    `sponsorship/offers/${SEG}`,
+    `sponsorship/offers/${SEG}/bids`,
+    "sponsorship/proposals",
+    `sponsorship/proposals/${SEG}`,
+    "sponsorship/licenses",
+    `sponsorship/licenses/${SEG}`,
+    "auth/email/exists",
+    `media/${SEG}/${SEG}/${SEG}/image`
+  ].map((p) => new RegExp(`^${p}$`)),
+  POST: [
+    "auth/email/(request-code|verify-code|register-account|confirm)",
+    "auth/siws/(nonce|verify)",
+    "users/register"
+  ].map((p) => new RegExp(`^${p}$`))
+};
+function isPublicAppRoute(method, path) {
+  if (path.split("/").some((s) => s === "." || s === ".." || s === "")) return false;
+  return (PUBLIC_ROUTES[method.toUpperCase()] ?? []).some((re) => re.test(path));
+}
+var IDENTITY_PREFIX = "siws_";
+var ACCOUNT_SESSION_PREFIX = "account_session_";
+var IDENTITY_DOMAIN = "siws-identity-v1";
+var ACCOUNT_SESSION_DOMAIN = "account-session-v1";
+var IDENTITY_TTL_SECONDS = 86400;
+var ACCOUNT_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+var CLOCK_SKEW_SECONDS = 60;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function toHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function sign(secret, domain, payload) {
+  return toHex(hmac_js.hmac(sha2_js.sha256, encoder.encode(secret), encoder.encode(`${domain}.${payload}`)));
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function signatureMatches(secret, domain, payload, provided) {
+  return constantTimeEquals(provided, sign(secret, domain, payload));
+}
+function encodePayload(value) {
+  return base.base64urlnopad.encode(encoder.encode(JSON.stringify(value)));
+}
+function decodePayload(payload) {
+  try {
+    return JSON.parse(decoder.decode(base.base64urlnopad.decode(payload)));
+  } catch {
+    return null;
+  }
+}
+function splitToken(raw, prefix) {
+  if (!raw.startsWith(prefix)) return null;
+  const inner = raw.slice(prefix.length);
+  const dot = inner.lastIndexOf(".");
+  if (dot === -1) return null;
+  return { payload: inner.slice(0, dot), signature: inner.slice(dot + 1) };
+}
+function withinLifetime(iat, exp) {
+  if (!iat || !exp) return false;
+  const now = Math.floor(Date.now() / 1e3);
+  return exp >= now && iat <= now + CLOCK_SKEW_SECONDS;
+}
+function issueSiwsToken(secret, chain, wallet, ttlSeconds = IDENTITY_TTL_SECONDS) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const payload = encodePayload({ sub: wallet, chain, iat, exp: iat + ttlSeconds });
+  return `${IDENTITY_PREFIX}${payload}.${sign(secret, IDENTITY_DOMAIN, payload)}`;
+}
+function verifySiwsToken(secret, raw) {
+  const parts = splitToken(raw, IDENTITY_PREFIX);
+  if (!parts) return null;
+  if (!signatureMatches(secret, IDENTITY_DOMAIN, parts.payload, parts.signature)) return null;
+  const data = decodePayload(parts.payload);
+  if (!data?.sub || !withinLifetime(data.iat, data.exp)) return null;
+  return { address: data.sub, chain: data.chain ?? "STARKNET" };
+}
+function issueAccountSessionToken(secret, accountId, ttlSeconds = ACCOUNT_SESSION_TTL_SECONDS) {
+  const iat = Math.floor(Date.now() / 1e3);
+  const payload = encodePayload({ accountId, iat, exp: iat + ttlSeconds });
+  return `${ACCOUNT_SESSION_PREFIX}${payload}.${sign(secret, ACCOUNT_SESSION_DOMAIN, payload)}`;
+}
+function verifyAccountSessionToken(secret, raw) {
+  const parts = splitToken(raw, ACCOUNT_SESSION_PREFIX);
+  if (!parts) return null;
+  if (!signatureMatches(secret, ACCOUNT_SESSION_DOMAIN, parts.payload, parts.signature)) return null;
+  const data = decodePayload(parts.payload);
+  if (!data?.accountId || !withinLifetime(data.iat, data.exp)) return null;
+  return data.accountId;
+}
+
+// src/utils/ipfs-gateway.ts
+var CID_PATH_PATTERN = /^(Qm[1-9A-HJ-NP-Za-km-z]{44,}|b[a-z2-7]{58,})(\/[\w.\-/]*)?$/;
+function isValidIpfsCidPath(cidPath) {
+  if (!CID_PATH_PATTERN.test(cidPath)) return false;
+  if (cidPath.split("/").includes("..")) return false;
+  return true;
+}
+var IPFS_SAFE_CONTENT_TYPE_PREFIXES = [
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "image/svg+xml",
+  "video/",
+  "audio/",
+  "model/",
+  "font/",
+  "application/json",
+  "application/octet-stream"
+];
+function resolveSafeImageContentType(contentType) {
+  return IPFS_SAFE_CONTENT_TYPE_PREFIXES.some((p) => contentType.startsWith(p)) ? contentType : "application/octet-stream";
+}
+var MAX_IPFS_GATEWAY_RESPONSE_BYTES = 25 * 1024 * 1024;
+
+exports.ACCOUNT_SESSION_COOKIE = ACCOUNT_SESSION_COOKIE;
+exports.ACCOUNT_SESSION_TTL_SECONDS = ACCOUNT_SESSION_TTL_SECONDS;
+exports.ALLOWED_IMAGE_CONTENT_TYPES = ALLOWED_IMAGE_CONTENT_TYPES;
+exports.IDENTITY_TTL_SECONDS = IDENTITY_TTL_SECONDS;
+exports.IPFS_SAFE_CONTENT_TYPE_PREFIXES = IPFS_SAFE_CONTENT_TYPE_PREFIXES;
+exports.MAX_IMAGE_PROXY_BYTES = MAX_IMAGE_PROXY_BYTES;
+exports.MAX_IMAGE_REDIRECTS = MAX_IMAGE_REDIRECTS;
+exports.MAX_IPFS_GATEWAY_RESPONSE_BYTES = MAX_IPFS_GATEWAY_RESPONSE_BYTES;
+exports.createAppGateway = createAppGateway;
+exports.createAppSessionHandler = createAppSessionHandler;
+exports.createImageProxyHandler = createImageProxyHandler;
+exports.getBackendSignedUrl = getBackendSignedUrl;
+exports.isPrivateHost = isPrivateHost;
+exports.isPrivateOrInsecureUrl = isPrivateOrInsecureUrl;
+exports.isPublicAppRoute = isPublicAppRoute;
+exports.isSameOrigin = isSameOrigin;
+exports.isValidIpfsCidPath = isValidIpfsCidPath;
+exports.issueAccountSessionToken = issueAccountSessionToken;
+exports.issueSiwsToken = issueSiwsToken;
+exports.readBodyWithCap = readBodyWithCap;
+exports.resolveSafeImageContentType = resolveSafeImageContentType;
+exports.uploadDirectoryToBackend = uploadDirectoryToBackend;
+exports.uploadFileToBackend = uploadFileToBackend;
+exports.uploadJsonToBackend = uploadJsonToBackend;
+exports.validateUrl = validateUrl;
+exports.verifyAccountSessionToken = verifyAccountSessionToken;
+exports.verifySiwsToken = verifySiwsToken;
+//# sourceMappingURL=chunk-ZVANOWIB.cjs.map
+//# sourceMappingURL=chunk-ZVANOWIB.cjs.map