@oasisprotocol/privana-sdk 0.5.10 → 0.6.0

package/dist/{chunk-KCXYYUUG.cjs → chunk-VNECVPMU.cjs}

@@ -245,12 +245,21 @@ var SIWE_MESSAGE_VALIDITY_MS = 24 * 60 * 60 * 1e3;
 function buildSiweStatement(chainId) {
   return `Sign in to Privana on chain ${chainId}`;
 }
+function pickSiweDomain(response) {
+  const allowed = response.domains;
+  if (!allowed?.length) throw new Error("SIWE domain response contains no domains");
+  const primary = allowed[0];
+  if (typeof window === "undefined" || !window.location?.host) return primary;
+  const host = window.location.host.toLowerCase();
+  return allowed.some((domain) => domain.toLowerCase() === host) ? host : primary;
+}
 async function buildSiweLoginMessage(api, params) {
   const { address, chainId, apiUrl } = params;
-  const [{ domain }, { nonce }] = await Promise.all([
+  const [domainResponse, { nonce }] = await Promise.all([
     api.getSiweDomain(),
     api.getSiweNonce(address)
   ]);
+  const domain = pickSiweDomain(domainResponse);
   const issuedAt = /* @__PURE__ */ new Date();
   const expirationTime = new Date(issuedAt.getTime() + SIWE_MESSAGE_VALIDITY_MS);
   const uri = typeof window !== "undefined" && window.location.origin ? window.location.origin : apiUrl;
@@ -584,7 +593,7 @@ var PrivanaClient = class _PrivanaClient {
     return this.http.get(`/v1/accounting/withdraw/${index}`);
   }
   async getSiweDomain() {
-    return this.http.get("/v1/accounting/auth/domain");
+    return this.http.get("/v1/accounting/auth/domains");
   }
   async getSiweNonce(userAddress) {
     const user = normalizeAddress(userAddress);
@@ -1368,7 +1377,7 @@ async function ctrlHydrateViaRefresh(ctrl, record, address) {
   }
 }
 
-// src/sdk/hooks/private-read-token-store.ts
+// src/sdk/utils/private-read-token-store.ts
 var cache = /* @__PURE__ */ new Map();
 function createScopeKey(apiUrl, chainId, address) {
   return `${apiUrl.replace(/\/$/, "")}:${chainId}:${address.toLowerCase()}`;
@@ -1993,395 +2002,129 @@ function useSafePrivanaContext() {
   return react.useContext(PrivanaContext);
 }
 
-// src/sdk/hooks/browser-storage.ts
-function storageCandidate(name) {
-  try {
-    if (typeof window === "undefined") return void 0;
-    return window[name] ?? void 0;
-  } catch {
-    return void 0;
-  }
-}
-function storageCandidates() {
-  return [storageCandidate("localStorage"), storageCandidate("sessionStorage")].filter(
-    (storage) => storage !== void 0
-  );
-}
-function canUseBrowserStorage() {
-  const probeKey = "privana:storage-probe";
-  for (const storage of storageCandidates()) {
+// src/sdk/utils/deposit-finality.ts
+async function checkDepositWithFinalityRetry({
+  checkDeposit,
+  isStale,
+  onRetry,
+  timeoutMs,
+  retryIntervalMs,
+  startedAt = Date.now(),
+  now = Date.now,
+  sleep = defaultSleep
+}) {
+  while (true) {
+    if (isStale()) return { kind: "stale" };
     try {
-      storage.setItem(probeKey, "1");
-      storage.removeItem(probeKey);
-      return true;
-    } catch {
+      const response = await checkDeposit();
+      if (!isInsufficientFinalityMessage(response.detail) || response.status !== "error") {
+        return { kind: "response", response };
+      }
+      if (response.detail) onRetry(response.detail);
+    } catch (error) {
+      if (isStale()) return { kind: "stale" };
+      if (!isInsufficientFinalityError(error)) throw error;
+      onRetry(
+        error instanceof AccountingApiError && error.detail ? error.detail : error instanceof Error ? error.message : String(error)
+      );
     }
+    if (now() - startedAt > timeoutMs) return { kind: "timeout" };
+    await sleep(retryIntervalMs);
   }
-  return false;
 }
-function setBrowserStorageItem(key, value) {
-  let stored = false;
-  for (const storage of storageCandidates()) {
-    try {
-      storage.setItem(key, value);
-      stored = true;
-    } catch {
-    }
+function isInsufficientFinalityError(error) {
+  if (error instanceof AccountingApiError) {
+    return isInsufficientFinalityMessage(error.detail) || isInsufficientFinalityMessage(error.message);
   }
-  return stored;
+  return error instanceof Error && isInsufficientFinalityMessage(error.message);
 }
-function getBrowserStorageItem(key) {
-  for (const storage of storageCandidates()) {
-    try {
-      const value = storage.getItem(key);
-      if (value !== null) return value;
-    } catch {
-    }
-  }
-  return null;
+function isInsufficientFinalityMessage(message) {
+  return message?.includes("Insufficient finality") ?? false;
 }
-function removeBrowserStorageItem(key) {
-  for (const storage of storageCandidates()) {
-    try {
-      storage.removeItem(key);
-    } catch {
-    }
-  }
+function defaultSleep(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
-function canUseSharedBrowserStorage() {
-  const storage = storageCandidate("localStorage");
-  if (!storage) return false;
-  const probeKey = "privana:shared-storage-probe";
+var INITIAL_AUTH_BACKOFF_MS = 5e3;
+var MAX_AUTH_BACKOFF_MS = 6e4;
+var privateReadFailureCache = /* @__PURE__ */ new Map();
+var privateReadInflight = /* @__PURE__ */ new Map();
+async function executeHostedAuthPrivateReadRequest({
+  client,
+  hostedAuthSession,
+  refreshHostedAuthSession,
+  request
+}) {
+  const ensureHostedAuth = async (forceRefresh) => {
+    if (!hostedAuthSession) {
+      throw new HostedAuthRequiredError();
+    }
+    if (!forceRefresh && isHostedAuthSessionActive(hostedAuthSession)) {
+      client.clearPrivateReadToken();
+      client.setBearerToken(hostedAuthSession.accessToken);
+      return hostedAuthSession.accessToken;
+    }
+    const refreshed = await refreshHostedAuthSession();
+    client.clearPrivateReadToken();
+    client.setBearerToken(refreshed.accessToken);
+    return refreshed.accessToken;
+  };
+  await ensureHostedAuth(false);
   try {
-    storage.setItem(probeKey, "1");
-    storage.removeItem(probeKey);
-    return true;
-  } catch {
-    return false;
+    return await request(client);
+  } catch (error) {
+    if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
+      throw error;
+    }
+    await ensureHostedAuth(true);
+    return request(client);
   }
 }
-function setSharedBrowserStorageItem(key, value) {
-  const storage = storageCandidate("localStorage");
-  if (!storage) return false;
-  try {
-    storage.setItem(key, value);
-  } catch {
-    return false;
-  }
-  try {
-    storageCandidate("sessionStorage")?.removeItem(key);
-  } catch {
-  }
-  return true;
+function clearPrivateReadScope(scopeKey, client) {
+  deleteCachedPrivateReadToken(scopeKey);
+  privateReadFailureCache.delete(scopeKey);
+  client.clearPrivateReadToken();
 }
-function getSharedBrowserStorageItem(key) {
+async function executeSiwePrivateReadRequest({
+  client,
+  scopeKey,
+  getToken,
+  request
+}) {
+  const run = (token2) => request(client.withPrivateReadToken(token2));
+  const token = await getToken(false);
   try {
-    return storageCandidate("localStorage")?.getItem(key) ?? null;
-  } catch {
-    return null;
-  }
-}
-function removeSharedBrowserStorageItem(key) {
-  for (const storage of storageCandidates()) {
-    try {
-      storage.removeItem(key);
-    } catch {
+    return await run(token);
+  } catch (error) {
+    if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
+      throw error;
     }
+    clearPrivateReadScope(scopeKey, client);
+    return run(await getToken(true));
   }
 }
-
-// src/sdk/hooks/pending-lock.ts
-var DEFAULT_LOCK_DURATION_SECONDS = 259200;
-var DEFAULT_ONRAMP_LOCK_BUFFER = 0.02;
-var BUFFER_SCALE = 1000000n;
-function applyLockBuffer(amount, buffer = DEFAULT_ONRAMP_LOCK_BUFFER) {
-  if (!Number.isFinite(buffer) || buffer < 0 || buffer >= 1) {
-    throw new Error(`Lock buffer must be in [0, 1), got ${buffer}`);
-  }
-  const shave = BigInt(Math.max(0, Math.ceil(buffer * Number(BUFFER_SCALE) - 1e-6)));
-  return amount * (BUFFER_SCALE - shave) / BUFFER_SCALE;
-}
-function clampLockAmount(amount, maxAmount) {
-  return maxAmount !== void 0 && maxAmount < amount ? maxAmount : amount;
-}
-function requireServiceAddress(serviceAddress) {
-  if (!serviceAddress) {
-    throw new Error("Service address not configured");
-  }
-  return serviceAddress;
-}
-function requireDepositLockOwner(walletAddress, beneficiary) {
-  if (!walletAddress) throw new Error("No wallet connected");
-  if (!beneficiary) throw new Error("No authenticated deposit account");
-  if (walletAddress.toLowerCase() !== beneficiary.toLowerCase()) {
-    throw new Error("Connected wallet does not match the authenticated deposit account");
-  }
-  return beneficiary;
-}
-function walletClientAccountAddress(walletClient) {
-  const account = walletClient.account;
-  if (!account) return void 0;
-  return typeof account === "string" ? account : account.address;
+function recordPrivateReadFailure(scopeKey) {
+  const previous = privateReadFailureCache.get(scopeKey);
+  const backoffMs = Math.min(
+    previous ? previous.backoffMs * 2 : INITIAL_AUTH_BACKOFF_MS,
+    MAX_AUTH_BACKOFF_MS
+  );
+  privateReadFailureCache.set(scopeKey, {
+    backoffMs,
+    retryAt: Date.now() + backoffMs
+  });
 }
-async function createSignedLockRequest({
-  client,
-  walletClient,
-  userAddress,
-  networkConfig,
-  serviceAddress,
-  tokenId,
-  amount,
-  lockDuration = DEFAULT_LOCK_DURATION_SECONDS
-}) {
-  if (amount <= 0n) {
-    throw new Error("Lock amount must be positive");
-  }
-  const signerAddress = walletClientAccountAddress(walletClient);
-  if (!signerAddress || signerAddress.toLowerCase() !== userAddress.toLowerCase()) {
-    throw new Error("Connected wallet does not match the authenticated deposit account");
+function ensureFailureBackoff(scopeKey) {
+  const failure = privateReadFailureCache.get(scopeKey);
+  if (!failure) return;
+  if (failure.retryAt <= Date.now()) {
+    privateReadFailureCache.delete(scopeKey);
+    return;
   }
-  const expiry = BigInt(Math.floor(Date.now() / 1e3) + lockDuration);
-  const { nonce } = await client.getLockNonce(userAddress);
-  const signature = await signLockMessage({
-    walletClient,
-    chainId: networkConfig.chainId,
-    verifyingContract: networkConfig.accountingContract,
-    message: {
-      serviceAddress,
-      tokenId,
-      amount,
-      expiry,
-      nonce: BigInt(nonce)
-    }
-  });
-  return {
-    service_address: serviceAddress,
-    token_id: tokenId,
-    amount: amount.toString(),
-    expiry: expiry.toString(),
-    nonce: String(nonce),
-    signature
-  };
-}
-var EXPIRY_SLACK_SECONDS = 60;
-function isSignedLockUsable(payload) {
-  const expiry = Number(payload.expiry);
-  if (!Number.isFinite(expiry)) return false;
-  return expiry > Math.floor(Date.now() / 1e3) + EXPIRY_SLACK_SECONDS;
-}
-var PostDepositLockError = class _PostDepositLockError extends Error {
-  constructor(message, reason, signedAmount, creditedAmount, options) {
-    super(message, options);
-    this.reason = reason;
-    this.signedAmount = signedAmount;
-    this.creditedAmount = creditedAmount;
-    this.name = "PostDepositLockError";
-    this.submissionMayHaveSucceeded = options?.submissionMayHaveSucceeded ?? false;
-    Object.setPrototypeOf(this, _PostDepositLockError.prototype);
-  }
-};
-async function submitPendingLock({
-  client,
-  payload,
-  creditedAmount,
-  beforeSubmit
-}) {
-  let signedAmount;
-  try {
-    signedAmount = BigInt(payload.amount);
-  } catch (err) {
-    throw new PostDepositLockError(
-      "Stored signed lock payload is malformed",
-      "submission-failed",
-      void 0,
-      creditedAmount,
-      { cause: err }
-    );
-  }
-  if (!isSignedLockUsable(payload)) {
-    throw new PostDepositLockError(
-      "Signed lock expired before the deposit was credited",
-      "expired",
-      signedAmount,
-      creditedAmount
-    );
-  }
-  if (creditedAmount !== void 0 && creditedAmount < signedAmount) {
-    throw new PostDepositLockError(
-      "Credited amount is below the signed lock amount",
-      "credited-below-signed",
-      signedAmount,
-      creditedAmount
-    );
-  }
-  try {
-    beforeSubmit?.();
-    return await client.lockFunds(payload);
-  } catch (err) {
-    throw new PostDepositLockError(
-      err instanceof Error ? err.message : "Lock submission failed",
-      "submission-failed",
-      signedAmount,
-      creditedAmount,
-      { cause: err }
-    );
-  }
-}
-function pendingLockKey(userAddress, correlationId) {
-  return `privana:pending-lock:${userAddress.toLowerCase()}:${correlationId}`;
-}
-function savePendingLock(userAddress, correlationId, payload) {
-  const record = { payload, savedAt: Date.now() };
-  const stored = setBrowserStorageItem(
-    pendingLockKey(userAddress, correlationId),
-    JSON.stringify(record)
-  );
-  if (!stored) {
-    throw new Error("Unable to persist signed lock for recovery");
-  }
-}
-function loadPendingLock(userAddress, correlationId) {
-  const key = pendingLockKey(userAddress, correlationId);
-  try {
-    const raw = getBrowserStorageItem(key);
-    if (!raw) return void 0;
-    const record = JSON.parse(raw);
-    if (!record?.payload?.signature) {
-      removeBrowserStorageItem(key);
-      return void 0;
-    }
-    return record.payload;
-  } catch {
-    return void 0;
-  }
-}
-function clearPendingLock(userAddress, correlationId) {
-  removeBrowserStorageItem(pendingLockKey(userAddress, correlationId));
-}
-
-// src/sdk/hooks/deposit-finality.ts
-async function checkDepositWithFinalityRetry({
-  checkDeposit,
-  isStale,
-  onRetry,
-  timeoutMs,
-  retryIntervalMs,
-  startedAt = Date.now(),
-  now = Date.now,
-  sleep = defaultSleep
-}) {
-  while (true) {
-    if (isStale()) return { kind: "stale" };
-    try {
-      const response = await checkDeposit();
-      if (!isInsufficientFinalityMessage(response.detail) || response.status !== "error") {
-        return { kind: "response", response };
-      }
-      if (response.detail) onRetry(response.detail);
-    } catch (error) {
-      if (isStale()) return { kind: "stale" };
-      if (!isInsufficientFinalityError(error)) throw error;
-      onRetry(
-        error instanceof AccountingApiError && error.detail ? error.detail : error instanceof Error ? error.message : String(error)
-      );
-    }
-    if (now() - startedAt > timeoutMs) return { kind: "timeout" };
-    await sleep(retryIntervalMs);
-  }
-}
-function isInsufficientFinalityError(error) {
-  if (error instanceof AccountingApiError) {
-    return isInsufficientFinalityMessage(error.detail) || isInsufficientFinalityMessage(error.message);
-  }
-  return error instanceof Error && isInsufficientFinalityMessage(error.message);
-}
-function isInsufficientFinalityMessage(message) {
-  return message?.includes("Insufficient finality") ?? false;
-}
-function defaultSleep(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-var INITIAL_AUTH_BACKOFF_MS = 5e3;
-var MAX_AUTH_BACKOFF_MS = 6e4;
-var privateReadFailureCache = /* @__PURE__ */ new Map();
-var privateReadInflight = /* @__PURE__ */ new Map();
-async function executeHostedAuthPrivateReadRequest({
-  client,
-  hostedAuthSession,
-  refreshHostedAuthSession,
-  request
-}) {
-  const ensureHostedAuth = async (forceRefresh) => {
-    if (!hostedAuthSession) {
-      throw new HostedAuthRequiredError();
-    }
-    if (!forceRefresh && isHostedAuthSessionActive(hostedAuthSession)) {
-      client.clearPrivateReadToken();
-      client.setBearerToken(hostedAuthSession.accessToken);
-      return hostedAuthSession.accessToken;
-    }
-    const refreshed = await refreshHostedAuthSession();
-    client.clearPrivateReadToken();
-    client.setBearerToken(refreshed.accessToken);
-    return refreshed.accessToken;
-  };
-  await ensureHostedAuth(false);
-  try {
-    return await request(client);
-  } catch (error) {
-    if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
-      throw error;
-    }
-    await ensureHostedAuth(true);
-    return request(client);
-  }
-}
-function clearPrivateReadScope(scopeKey, client) {
-  deleteCachedPrivateReadToken(scopeKey);
-  privateReadFailureCache.delete(scopeKey);
-  client.clearPrivateReadToken();
-}
-async function executeSiwePrivateReadRequest({
-  client,
-  scopeKey,
-  getToken,
-  request
-}) {
-  const run = (token2) => request(client.withPrivateReadToken(token2));
-  const token = await getToken(false);
-  try {
-    return await run(token);
-  } catch (error) {
-    if (!(error instanceof AccountingApiError) || error.statusCode !== 401) {
-      throw error;
-    }
-    clearPrivateReadScope(scopeKey, client);
-    return run(await getToken(true));
-  }
-}
-function recordPrivateReadFailure(scopeKey) {
-  const previous = privateReadFailureCache.get(scopeKey);
-  const backoffMs = Math.min(
-    previous ? previous.backoffMs * 2 : INITIAL_AUTH_BACKOFF_MS,
-    MAX_AUTH_BACKOFF_MS
-  );
-  privateReadFailureCache.set(scopeKey, {
-    backoffMs,
-    retryAt: Date.now() + backoffMs
-  });
-}
-function ensureFailureBackoff(scopeKey) {
-  const failure = privateReadFailureCache.get(scopeKey);
-  if (!failure) return;
-  if (failure.retryAt <= Date.now()) {
-    privateReadFailureCache.delete(scopeKey);
-    return;
-  }
-  throw new Error(
-    `Private-read authentication is temporarily paused after a recent failure. Retry in ${Math.ceil(
-      (failure.retryAt - Date.now()) / 1e3
-    )}s.`
-  );
+  throw new Error(
+    `Private-read authentication is temporarily paused after a recent failure. Retry in ${Math.ceil(
+      (failure.retryAt - Date.now()) / 1e3
+    )}s.`
+  );
 }
 function usePrivateReadRequest() {
   const wagmiContext = react.useContext(wagmi.WagmiContext);
@@ -2705,6 +2448,272 @@ function creditedAmountFromResponse(response, requestedAmount) {
 function isDefinitiveCandidateFailure(error) {
   return error instanceof AccountingApiError && error.statusCode === 400;
 }
+
+// src/sdk/utils/browser-storage.ts
+function storageCandidate(name) {
+  try {
+    if (typeof window === "undefined") return void 0;
+    return window[name] ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+function storageCandidates() {
+  return [storageCandidate("localStorage"), storageCandidate("sessionStorage")].filter(
+    (storage) => storage !== void 0
+  );
+}
+function canUseBrowserStorage() {
+  const probeKey = "privana:storage-probe";
+  for (const storage of storageCandidates()) {
+    try {
+      storage.setItem(probeKey, "1");
+      storage.removeItem(probeKey);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function setBrowserStorageItem(key, value) {
+  let stored = false;
+  for (const storage of storageCandidates()) {
+    try {
+      storage.setItem(key, value);
+      stored = true;
+    } catch {
+    }
+  }
+  return stored;
+}
+function getBrowserStorageItem(key) {
+  for (const storage of storageCandidates()) {
+    try {
+      const value = storage.getItem(key);
+      if (value !== null) return value;
+    } catch {
+    }
+  }
+  return null;
+}
+function removeBrowserStorageItem(key) {
+  for (const storage of storageCandidates()) {
+    try {
+      storage.removeItem(key);
+    } catch {
+    }
+  }
+}
+function canUseSharedBrowserStorage() {
+  const storage = storageCandidate("localStorage");
+  if (!storage) return false;
+  const probeKey = "privana:shared-storage-probe";
+  try {
+    storage.setItem(probeKey, "1");
+    storage.removeItem(probeKey);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function setSharedBrowserStorageItem(key, value) {
+  const storage = storageCandidate("localStorage");
+  if (!storage) return false;
+  try {
+    storage.setItem(key, value);
+  } catch {
+    return false;
+  }
+  try {
+    storageCandidate("sessionStorage")?.removeItem(key);
+  } catch {
+  }
+  return true;
+}
+function getSharedBrowserStorageItem(key) {
+  try {
+    return storageCandidate("localStorage")?.getItem(key) ?? null;
+  } catch {
+    return null;
+  }
+}
+function removeSharedBrowserStorageItem(key) {
+  for (const storage of storageCandidates()) {
+    try {
+      storage.removeItem(key);
+    } catch {
+    }
+  }
+}
+
+// src/sdk/utils/pending-lock.ts
+var DEFAULT_LOCK_DURATION_SECONDS = 259200;
+var DEFAULT_ONRAMP_LOCK_BUFFER = 0.02;
+var BUFFER_SCALE = 1000000n;
+function applyLockBuffer(amount, buffer = DEFAULT_ONRAMP_LOCK_BUFFER) {
+  if (!Number.isFinite(buffer) || buffer < 0 || buffer >= 1) {
+    throw new Error(`Lock buffer must be in [0, 1), got ${buffer}`);
+  }
+  const shave = BigInt(Math.max(0, Math.ceil(buffer * Number(BUFFER_SCALE) - 1e-6)));
+  return amount * (BUFFER_SCALE - shave) / BUFFER_SCALE;
+}
+function clampLockAmount(amount, maxAmount) {
+  return maxAmount !== void 0 && maxAmount < amount ? maxAmount : amount;
+}
+function requireServiceAddress(serviceAddress) {
+  if (!serviceAddress) {
+    throw new Error("Service address not configured");
+  }
+  return serviceAddress;
+}
+function requireDepositLockOwner(walletAddress, beneficiary) {
+  if (!walletAddress) throw new Error("No wallet connected");
+  if (!beneficiary) throw new Error("No authenticated deposit account");
+  if (walletAddress.toLowerCase() !== beneficiary.toLowerCase()) {
+    throw new Error("Connected wallet does not match the authenticated deposit account");
+  }
+  return beneficiary;
+}
+function walletClientAccountAddress(walletClient) {
+  const account = walletClient.account;
+  if (!account) return void 0;
+  return typeof account === "string" ? account : account.address;
+}
+async function createSignedLockRequest({
+  client,
+  walletClient,
+  userAddress,
+  networkConfig,
+  serviceAddress,
+  tokenId,
+  amount,
+  lockDuration = DEFAULT_LOCK_DURATION_SECONDS
+}) {
+  if (amount <= 0n) {
+    throw new Error("Lock amount must be positive");
+  }
+  const signerAddress = walletClientAccountAddress(walletClient);
+  if (!signerAddress || signerAddress.toLowerCase() !== userAddress.toLowerCase()) {
+    throw new Error("Connected wallet does not match the authenticated deposit account");
+  }
+  const expiry = BigInt(Math.floor(Date.now() / 1e3) + lockDuration);
+  const { nonce } = await client.getLockNonce(userAddress);
+  const signature = await signLockMessage({
+    walletClient,
+    chainId: networkConfig.chainId,
+    verifyingContract: networkConfig.accountingContract,
+    message: {
+      serviceAddress,
+      tokenId,
+      amount,
+      expiry,
+      nonce: BigInt(nonce)
+    }
+  });
+  return {
+    service_address: serviceAddress,
+    token_id: tokenId,
+    amount: amount.toString(),
+    expiry: expiry.toString(),
+    nonce: String(nonce),
+    signature
+  };
+}
+var EXPIRY_SLACK_SECONDS = 60;
+function isSignedLockUsable(payload) {
+  const expiry = Number(payload.expiry);
+  if (!Number.isFinite(expiry)) return false;
+  return expiry > Math.floor(Date.now() / 1e3) + EXPIRY_SLACK_SECONDS;
+}
+var PostDepositLockError = class _PostDepositLockError extends Error {
+  constructor(message, reason, signedAmount, creditedAmount, options) {
+    super(message, options);
+    this.reason = reason;
+    this.signedAmount = signedAmount;
+    this.creditedAmount = creditedAmount;
+    this.name = "PostDepositLockError";
+    this.submissionMayHaveSucceeded = options?.submissionMayHaveSucceeded ?? false;
+    Object.setPrototypeOf(this, _PostDepositLockError.prototype);
+  }
+};
+async function submitPendingLock({
+  client,
+  payload,
+  creditedAmount,
+  beforeSubmit
+}) {
+  let signedAmount;
+  try {
+    signedAmount = BigInt(payload.amount);
+  } catch (err) {
+    throw new PostDepositLockError(
+      "Stored signed lock payload is malformed",
+      "submission-failed",
+      void 0,
+      creditedAmount,
+      { cause: err }
+    );
+  }
+  if (!isSignedLockUsable(payload)) {
+    throw new PostDepositLockError(
+      "Signed lock expired before the deposit was credited",
+      "expired",
+      signedAmount,
+      creditedAmount
+    );
+  }
+  if (creditedAmount !== void 0 && creditedAmount < signedAmount) {
+    throw new PostDepositLockError(
+      "Credited amount is below the signed lock amount",
+      "credited-below-signed",
+      signedAmount,
+      creditedAmount
+    );
+  }
+  try {
+    beforeSubmit?.();
+    return await client.lockFunds(payload);
+  } catch (err) {
+    throw new PostDepositLockError(
+      err instanceof Error ? err.message : "Lock submission failed",
+      "submission-failed",
+      signedAmount,
+      creditedAmount,
+      { cause: err }
+    );
+  }
+}
+function pendingLockKey(userAddress, correlationId) {
+  return `privana:pending-lock:${userAddress.toLowerCase()}:${correlationId}`;
+}
+function savePendingLock(userAddress, correlationId, payload) {
+  const record = { payload, savedAt: Date.now() };
+  const stored = setBrowserStorageItem(
+    pendingLockKey(userAddress, correlationId),
+    JSON.stringify(record)
+  );
+  if (!stored) {
+    throw new Error("Unable to persist signed lock for recovery");
+  }
+}
+function loadPendingLock(userAddress, correlationId) {
+  const key = pendingLockKey(userAddress, correlationId);
+  try {
+    const raw = getBrowserStorageItem(key);
+    if (!raw) return void 0;
+    const record = JSON.parse(raw);
+    if (!record?.payload?.signature) {
+      removeBrowserStorageItem(key);
+      return void 0;
+    }
+    return record.payload;
+  } catch {
+    return void 0;
+  }
+}
+function clearPendingLock(userAddress, correlationId) {
+  removeBrowserStorageItem(pendingLockKey(userAddress, correlationId));
+}
 var BYTES32_PATTERN = /^0x[0-9a-fA-F]{64}$/;
 var PROVIDER_ASSET_CODE_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
 var TRANSAK_MINIMUM_TARGET_PERCENT = 105n;
@@ -6163,5 +6172,5 @@ exports.useSafePrivanaContext = useSafePrivanaContext;
 exports.useSiweAuth = useSiweAuth;
 exports.useTransakOnRamp = useTransakOnRamp;
 exports.waitForTransactionReceipt = waitForTransactionReceipt;
-//# sourceMappingURL=chunk-KCXYYUUG.cjs.map
-//# sourceMappingURL=chunk-KCXYYUUG.cjs.map
+//# sourceMappingURL=chunk-VNECVPMU.cjs.map
+//# sourceMappingURL=chunk-VNECVPMU.cjs.map