@ultraos/wallet-sdk 0.3.2 → 0.6.1

package/CHANGELOG.md

@@ -0,0 +1,67 @@
+# Changelog
+
+All notable changes to `@ultraos/wallet-sdk` are documented in this file.
+
+## 0.6.1
+
+### Fixed
+
+- `environment: 'testnet'` with the Web Wallet provider now rejects immediately with the new
+  `SdkErrorCode.WEB_WALLET_UNAVAILABLE` (4302) instead of opening a popup to the decommissioned
+  `web-wallet.staging.ultra.io`. Testnet is supported through the browser extension; `getChainId()` still answers
+  locally.
+- Web Wallet JSON-RPC errors (for example calling an extension-only method such as `getAccounts()` with the Web Wallet
+  provider) rejected with `undefined`. They now reject with the wallet's `{ status: 'error', code, message }`
+  (`UNKNOWN_ERROR` -32604 when the error has no code), and the SDK closes the popup so the next request is not left
+  waiting for a `ready` handshake that never comes.
+- Type declarations use explicit `.js` specifiers, so they resolve under TypeScript `moduleResolution: node16/nodenext`
+  (previously every export was reported missing).
+- The package now declares `"license": "LGPL-3.0-only"` and ships the `LICENSE` file.
+- CI publishing (`release:wallet-sdk` → `nx-release-publish`) now publishes the packaged `dist/libs/wallet-sdk` (via the
+  new `wallet-sdk:package` target) instead of the raw library folder.
+
+## 0.6.0
+
+0.4.0 and 0.5.0 were never published to npm; their changes (below) first shipped in 0.6.0.
+
+### Removed
+
+- `purchaseItem()` and the `PurchaseItemType` / `PurchaseItemResult` types. Neither wallet serves it any more: the
+  extension redesign deliberately removed Ultra-platform checkout dependencies and the Web Wallet never shipped the
+  route, so calls could only hang until the user closed the popup.
+- `addNetwork()`. The extension removed its dApp-callable route in the v4 security audit (N-N1): adding a network
+  without an explicit approval screen is a silent RPC-takeover vector. Users add custom networks in the wallet's
+  Settings → Networks; dApps can then call `switchNetwork()`.
+
+### Changed
+
+- Corrected the `ConnectResult.blockchainid` documentation: it is the connected account **name** (equal to
+  `selectedAccount.accountName`), not a network identifier.
+- Declared the `nonce` / `signedNonce` fields every wallet already returns from `connect({ nonce })`.
+- Marked the connect-time attestation surface (`ConnectAttestation`, `AttestationPayload`, `SignableAccount`,
+  `ConnectResult.attestation`, `ConnectParams.requireAttestation`) `@experimental`: only the browser extension issues it
+  and no Ultra service consumes it yet.
+- Published as a bundled ES module (`dist/index.mjs` + `exports` map), as in 0.3.2, now produced reproducibly by
+  `npm run build:wallet-sdk`.
+
+## 0.5.0
+
+### Added
+
+- `requireAttestation?: boolean` on `ConnectParams`. When set, a dApp signals that it needs a connect-time identity
+  attestation; if the wallet supports attestation but the origin hasn't yet consented, the wallet prompts for consent
+  via the existing connect prompt (no separate signature dialog) and resolves `connect()` with a populated
+  `ConnectResult.attestation`. Strictly additive and pass-through — the SDK forwards the flag to the wallet verbatim and
+  performs no logic on it; wallets without attestation support ignore it. Omitting it preserves existing behavior. See
+  the RFC:
+  <https://github.com/ultraio/ultra-tool-kit/blob/feature/ai-enhancement/docs/proposals/wallet-native-attestation.md>
+
+## 0.4.0
+
+### Added
+
+- `ConnectAttestation` type and an optional `attestation` field on `ConnectResult`. When the connected wallet supports
+  silent connect-time identity attestation, `connect()` now surfaces it; otherwise `attestation` is `undefined`. This is
+  a strictly additive, type-only change — the SDK passes the value through verbatim and performs no verification. See
+  the RFC:
+  <https://github.com/ultraio/ultra-tool-kit/blob/feature/ai-enhancement/docs/proposals/wallet-native-attestation.md>

package/LICENSE

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+Everyone is permitted to copy and distribute verbatim copies
+of this license document, but changing it is not allowed.
+
+
+This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+0. Additional Definitions.
+
+As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+"The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+1. Exception to Section 3 of the GNU GPL.
+
+You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+2. Conveying Modified Versions.
+
+If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+a) under this License, provided that you make a good faith effort to
+ensure that, in the event an Application does not supply the
+function or data, the facility still operates, and performs
+whatever part of its purpose remains meaningful, or
+
+b) under the GNU GPL, with none of the additional permissions of
+this License applicable to that copy.
+
+3. Object Code Incorporating Material from Library Header Files.
+
+The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+a) Give prominent notice with each copy of the object code that the
+Library is used in it and that the Library and its use are
+covered by this License.
+
+b) Accompany the object code with a copy of the GNU GPL and this license
+document.
+
+4. Combined Works.
+
+You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+a) Give prominent notice with each copy of the Combined Work that
+the Library is used in it and that the Library and its use are
+covered by this License.
+
+b) Accompany the Combined Work with a copy of the GNU GPL and this license
+document.
+
+c) For a Combined Work that displays copyright notices during
+execution, include the copyright notice for the Library among
+these notices, as well as a reference directing the user to the
+copies of the GNU GPL and this license document.
+
+d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+e) Provide Installation Information, but only if you would otherwise
+be required to provide such information under section 6 of the
+GNU GPL, and only to the extent that such information is
+necessary to install and execute a modified version of the
+Combined Work produced by recombining or relinking the
+Application with a modified version of the Linked Version. (If
+you use option 4d0, the Installation Information must accompany
+the Minimal Corresponding Source and Corresponding Application
+Code. If you use option 4d1, you must provide the Installation
+Information in the manner specified by section 6 of the GNU GPL
+for conveying Corresponding Source.)
+
+5. Combined Libraries.
+
+You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+a) Accompany the combined library with a copy of the same work based
+on the Library, uncombined with any other library facilities,
+conveyed under the terms of this License.
+
+b) Give prominent notice with the combined library that part of it
+is a work based on the Library, and explaining where to find the
+accompanying uncombined form of the same work.
+
+6. Revised Versions of the GNU Lesser General Public License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

package/README.md

@@ -7,8 +7,8 @@ browser extension or via a web fallback.
 
 - Automatically detects and uses the Ultra Wallet Extension if available.
 - Falls back to a Web Wallet if the extension is not installed.
-- Connect, sign messages, sign transactions, and initiate purchases with a simple API.
-- Environment support: `mainnet`, `testnet`, or custom wallet URLs.
+- Connect, sign messages and sign transactions with a simple API.
+- Environment support: `mainnet`, `testnet` (browser extension only), or a custom Web Wallet URL.
 
 ## 📦 Installation
 
@@ -44,7 +44,7 @@ await ultra.signTransaction({
   contract: 'eosio.token',
   action: 'transfer',
   data: { from: 'user', to: 'receiver', quantity: '1.00000000 UOS', memo: '' },
-  authorizations: ['user@active'],
+  // authorization defaults to the connected account's `active` permission
 });
 ```
 
@@ -55,7 +55,7 @@ You can pass options during initialization:
 ```ts
 new UltraWalletSDK({
   environment: 'testnet', // or 'mainnet', or provide custom URL
-  provider: 'web', // or 'extension', use a specific provider independetly of auto-detection
+  provider: 'web', // or 'extension', use a specific provider independently of auto-detection
 });
 ```
 
@@ -63,12 +63,23 @@ new UltraWalletSDK({
 
 ### Methods
 
-- `connect(): Promise<ConnectResult>`
-- `disconnect(): Promise<void>`
-- `signMessage(message: string): Promise<string>`
-- `signTransaction(transaction: BlockchainTransaction | BlockchainTransaction[]): Promise<SignTransactionResult>`
-- `getChainId(): Promise<string>`
-- `purchaseItem(itemType: PurchaseItemType, itemId: string): Promise<PurchaseItemResult>`
+All methods resolve to `UltraResponse<T>` (`{ status: 'success', data: T }`) and reject with
+`{ status, code, message }`.
+
+| Method                                                                                | Extension | Web Wallet |
+| ------------------------------------------------------------------------------------- | --------- | ---------- |
+| `connect(params?: ConnectParams)` / `disconnect()`                                    | ✅        | ✅         |
+| `signMessage(message: string)`                                                        | ✅        | ✅         |
+| `signTransaction(transaction, options?: { signOnly?: boolean })`                      | ✅        | ✅         |
+| `getChainId()`                                                                        | ✅        | ✅         |
+| `getAccounts()` / `getSelectedAccount()` / `getAvailableAuthorizations()`             | ✅        | —          |
+| `getNetwork()` / `getNetworks()` / `switchNetwork(chainId)`                           | ✅        | —          |
+| `on(event, cb)` / `off(event, cb)` — `accountChanged`, `networkChanged`, `disconnect` | ✅        | —          |
+| `dispose()`                                                                           | ✅        | ✅         |
+
+The Web Wallet is currently deployed for **mainnet** only.
+
+Full documentation: <https://developers.ultra.io/products/ultra-wallet-sdk/>
 
 ---
 

package/dist/index.mjs

@@ -1,9 +1,10 @@
-// src/lib/interfaces/error-enum.js
+// dist/libs/wallet-sdk/src/lib/interfaces/error-enum.js
 var SdkErrorCode;
 (function(SdkErrorCode2) {
   SdkErrorCode2[SdkErrorCode2["USER_REJECTED_REQUEST"] = 4001] = "USER_REJECTED_REQUEST";
   SdkErrorCode2[SdkErrorCode2["WALLET_HANDSHAKE_TIMEOUT"] = 4300] = "WALLET_HANDSHAKE_TIMEOUT";
   SdkErrorCode2[SdkErrorCode2["WALLET_WINDOW_UNAVAILABLE"] = 4301] = "WALLET_WINDOW_UNAVAILABLE";
+  SdkErrorCode2[SdkErrorCode2["WEB_WALLET_UNAVAILABLE"] = 4302] = "WEB_WALLET_UNAVAILABLE";
   SdkErrorCode2[SdkErrorCode2["REQUESTED_RESOURCE_NOT_AVAILABLE"] = 32002] = "REQUESTED_RESOURCE_NOT_AVAILABLE";
   SdkErrorCode2[SdkErrorCode2["UNKNOWN_ERROR"] = -32604] = "UNKNOWN_ERROR";
 })(SdkErrorCode || (SdkErrorCode = {}));
@@ -11,18 +12,12 @@ var SDK_ERROR_MESSAGE = {
   [SdkErrorCode.USER_REJECTED_REQUEST]: "The user rejected the request.",
   [SdkErrorCode.WALLET_HANDSHAKE_TIMEOUT]: "Timeout to connect with the web wallet.",
   [SdkErrorCode.WALLET_WINDOW_UNAVAILABLE]: "Wallet window blocked by browser or failed to open.",
+  [SdkErrorCode.WEB_WALLET_UNAVAILABLE]: "The Ultra Web Wallet is not available on this network. Use the Ultra Wallet browser extension.",
   [SdkErrorCode.REQUESTED_RESOURCE_NOT_AVAILABLE]: "Requested resource not available.",
   [SdkErrorCode.UNKNOWN_ERROR]: "Unknown error occurred."
 };
 
-// src/lib/interfaces/purchase-item.interface.js
-var PurchaseItemType;
-(function(PurchaseItemType2) {
-  PurchaseItemType2["UNIQ_FACTORY"] = "UniqFactory";
-  PurchaseItemType2["GAME_FACTORY"] = "GameFactory";
-})(PurchaseItemType || (PurchaseItemType = {}));
-
-// src/lib/interfaces/wallet-provider-response.interface.js
+// dist/libs/wallet-sdk/src/lib/interfaces/wallet-provider-response.interface.js
 var ResponseStatus;
 (function(ResponseStatus2) {
   ResponseStatus2["SUCCESS"] = "success";
@@ -30,13 +25,14 @@ var ResponseStatus;
   ResponseStatus2["ERROR"] = "error";
 })(ResponseStatus || (ResponseStatus = {}));
 
-// src/lib/config/ultra-wallet-sdk.config.js
+// dist/libs/wallet-sdk/src/lib/config/ultra-wallet-sdk.config.js
 var UltraWalletSdkConfig = Object.freeze({
   width: 420,
   height: 815,
   walletUrls: {
     mainnet: "https://web-wallet.ultra.io",
-    testnet: "https://web-wallet.staging.ultra.io"
+    // The testnet Web Wallet (web-wallet.staging.ultra.io) was decommissioned; testnet is extension-only.
+    testnet: null
   },
   networkInfo: {
     mainnet: {
@@ -51,13 +47,13 @@ var UltraWalletSdkConfig = Object.freeze({
 });
 var ultra_wallet_sdk_config_default = UltraWalletSdkConfig;
 
-// src/lib/utils/chain-validator.js
+// dist/libs/wallet-sdk/src/lib/utils/chain-validator.js
 function isValidChain(targetNetwork, walletChainId) {
   const { chainId } = ultra_wallet_sdk_config_default.networkInfo[targetNetwork] || {};
   return !chainId || chainId === walletChainId;
 }
 
-// src/lib/providers/extension-provider/extension.provider.js
+// dist/libs/wallet-sdk/src/lib/providers/extension-provider/extension.provider.js
 var HEARTBEAT_INTERVAL_MS = 2e3;
 var ExtensionProvider = class {
   /**
@@ -130,9 +126,6 @@ var ExtensionProvider = class {
   getChainId() {
     return this.walletProvider.getChainId();
   }
-  purchaseItem(itemType, itemId) {
-    return this.walletProvider.purchaseItem(itemType, itemId);
-  }
   getAccounts() {
     return this.walletProvider.getAccounts();
   }
@@ -171,9 +164,6 @@ var ExtensionProvider = class {
   getNetworks() {
     return this.walletProvider.getNetworks();
   }
-  addNetwork(params) {
-    return this.walletProvider.addNetwork(params);
-  }
   /**
    * Detach the window message listener and clear timers + maps. Safe to call
    * multiple times. Does NOT deregister each listener on the BG — the BG
@@ -253,10 +243,10 @@ var ExtensionProvider = class {
   }
 };
 
-// src/lib/common/client-messenger.js
+// dist/libs/wallet-sdk/src/lib/common/client-messenger.js
 import { JSONRPCClient } from "json-rpc-2.0";
 
-// src/lib/common/client-error.js
+// dist/libs/wallet-sdk/src/lib/common/client-error.js
 var ClientError = class extends Error {
   constructor(code, data) {
     super();
@@ -267,7 +257,7 @@ var ClientError = class extends Error {
   }
 };
 
-// src/lib/common/client-messenger.js
+// dist/libs/wallet-sdk/src/lib/common/client-messenger.js
 var ClientMessenger = class {
   constructor(windowManager) {
     this.pendingRequest = false;
@@ -293,6 +283,9 @@ var ClientMessenger = class {
     });
   }
   async sendRequest(requestMethod, requestParams) {
+    if (!this.windowManager.walletUrl) {
+      throw this.createErrorResponse(SdkErrorCode.WEB_WALLET_UNAVAILABLE);
+    }
     if (this.pendingRequest && !this.isWalletWindowClosed()) {
       throw this.createErrorResponse(SdkErrorCode.REQUESTED_RESOURCE_NOT_AVAILABLE);
     }
@@ -353,18 +346,13 @@ var ClientMessenger = class {
       try {
         result = await this.rpcClient.request(requestMethod, requestParams);
       } catch (error) {
-        const clientError = new ClientError(SdkErrorCode.UNKNOWN_ERROR, error);
-        throw {
-          status: ResponseStatus.ERROR,
-          ...clientError
-        };
-      } finally {
-        if (result?.status === ResponseStatus.SUCCESS) {
-          return result;
-        } else {
-          throw result;
-        }
+        walletWindow.close();
+        throw this.createRpcErrorResponse(error);
+      }
+      if (result?.status === ResponseStatus.SUCCESS) {
+        return result;
       }
+      throw result;
     });
   }
   async withWindowMonitoring(walletWindow, operation) {
@@ -390,13 +378,26 @@ var ClientMessenger = class {
     const msg = event.data;
     return msg?.jsonrpc === "2.0" && msg.method === "ready";
   }
+  createRpcErrorResponse(error) {
+    const { code, message } = error ?? {};
+    if (typeof code === "number") {
+      return {
+        status: ResponseStatus.ERROR,
+        code,
+        message: typeof message === "string" ? message : "",
+        data: error.data
+      };
+    }
+    const clientError = new ClientError(SdkErrorCode.UNKNOWN_ERROR);
+    return { status: ResponseStatus.ERROR, code: clientError.code, message: clientError.message, data: error };
+  }
   createErrorResponse(errorCode) {
     const { code, message } = new ClientError(errorCode);
     return { status: ResponseStatus.ERROR, code, message, data: null };
   }
 };
 
-// src/lib/common/window-manager.js
+// dist/libs/wallet-sdk/src/lib/common/window-manager.js
 var WindowManager = class {
   constructor(walletUrl) {
     this.walletWindow = null;
@@ -420,7 +421,7 @@ var WindowManager = class {
   }
 };
 
-// src/lib/providers/web-provider/web.provider.js
+// dist/libs/wallet-sdk/src/lib/providers/web-provider/web.provider.js
 var WebProvider = class {
   constructor(options) {
     this.options = options;
@@ -458,12 +459,6 @@ var WebProvider = class {
         return this.clientMessenger.sendRequest("getChainId", {});
     }
   }
-  purchaseItem(itemType, itemId) {
-    return this.clientMessenger.sendRequest("purchaseItem", {
-      itemType,
-      itemId
-    });
-  }
   getAccounts() {
     return this.clientMessenger.sendRequest("getAccounts", {});
   }
@@ -489,24 +484,25 @@ var WebProvider = class {
   getNetworks() {
     throw new Error("Not supported in web provider");
   }
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  addNetwork(_params) {
-    throw new Error("Not supported in web provider");
-  }
   dispose() {
   }
+  /**
+   * Built-in networks map to their configured Web Wallet URL (`null` when none is deployed);
+   * any other `environment` value is a custom Web Wallet URL.
+   */
   resolveWalletUrl() {
-    const env = ultra_wallet_sdk_config_default.walletUrls[this.options?.environment || "mainnet"];
-    return env || this.options.environment;
+    const environment = this.options?.environment || "mainnet";
+    const { walletUrls } = ultra_wallet_sdk_config_default;
+    return Object.prototype.hasOwnProperty.call(walletUrls, environment) ? walletUrls[environment] : environment;
   }
 };
 
-// src/lib/utils/detection.js
+// dist/libs/wallet-sdk/src/lib/utils/detection.js
 function isExtensionAvailable() {
   return typeof window !== "undefined" && "ultra" in window;
 }
 
-// src/lib/ultra-wallet-sdk.js
+// dist/libs/wallet-sdk/src/lib/ultra-wallet-sdk.js
 var UltraWalletSDK = class {
   /**
    * Constructs an UltraWalletClient instance.
@@ -534,9 +530,6 @@ var UltraWalletSDK = class {
   getChainId() {
     return this.provider.getChainId();
   }
-  purchaseItem(itemType, itemId) {
-    return this.provider.purchaseItem(itemType, itemId);
-  }
   getAccounts() {
     return this.provider.getAccounts();
   }
@@ -561,9 +554,6 @@ var UltraWalletSDK = class {
   getNetworks() {
     return this.provider.getNetworks();
   }
-  addNetwork(params) {
-    return this.provider.addNetwork(params);
-  }
   dispose() {
     this.provider.dispose();
   }
@@ -580,7 +570,6 @@ var UltraWalletSDK = class {
   }
 };
 export {
-  PurchaseItemType,
   ResponseStatus,
   SDK_ERROR_MESSAGE,
   SdkErrorCode,