@unicitylabs/sphere-sdk 0.17.2-dev.1 → 0.17.2-dev.3

package/dist/core/index.d.cts

@@ -112,6 +112,8 @@ interface NftMetadata {
     readonly external_url: string | null;
     readonly attributes: readonly NftAttribute[];
     readonly collection: string | null;
+    /** The collection the item claims: 1–64 bytes as even-length hex (decoded lowercase). Never verified here. */
+    readonly collection_id: string | null;
 }
 type NftContent = NftMetadata | NftMedia | NftLink;
 type NftSignatureStatus = 'unsigned' | 'valid' | 'invalid';

package/dist/core/index.d.ts

@@ -112,6 +112,8 @@ interface NftMetadata {
     readonly external_url: string | null;
     readonly attributes: readonly NftAttribute[];
     readonly collection: string | null;
+    /** The collection the item claims: 1–64 bytes as even-length hex (decoded lowercase). Never verified here. */
+    readonly collection_id: string | null;
 }
 type NftContent = NftMetadata | NftMedia | NftLink;
 type NftSignatureStatus = 'unsigned' | 'valid' | 'invalid';

package/dist/core/index.js

@@ -9784,7 +9784,8 @@ var NFT_MEDIA_TAG = 39053n;
 var NFT_LINK_TAG = 39054n;
 var NFT_SIGNED_TAG = 39055n;
 var NFT_FORMAT_VERSION = 1n;
-var METADATA_ARITY = 8;
+var NFT_DOCUMENT_MEDIA_TYPE = "application/vnd.unicity.nft+cbor";
+var METADATA_ARITY = 9;
 var MEDIA_ARITY = 3;
 var LINK_ARITY = 4;
 var SIGNED_ARITY = 4;
@@ -9792,12 +9793,15 @@ var CREATOR_BYTES = 33;
 var SIGNATURE_BYTES = 65;
 var MAX_URI_LENGTH = 2048;
 var LINK_SCHEMES = ["https://", "ipfs://", "ar://"];
-var SIGNED_DOMAIN = "NftSigned";
+var SIGNED_DOMAIN = new TextEncoder().encode("UNICITY_NFT_SIGNED");
 var MEDIA_TYPE_PATTERN = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/;
 var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
+var COLLECTION_ID_PATTERN = /^(?:[0-9a-f]{2}){1,64}$/i;
 var LONE_SURROGATE = /\p{Cs}/u;
 var CBOR_MAJOR_TYPE_MASK = 224;
 var ATTRIBUTE_VALUE_RULE = "must be non-empty text or an integer within \xB1(2^53 \u2212 1) \u2014 write decimals and larger numbers as text";
+var COLLECTION_ID_RULE = "must be null or 1\u201364 bytes as even-length hex (2\u2013128 characters)";
+var DOCUMENT_AS_MEDIA_RULE = `must not be ${NFT_DOCUMENT_MEDIA_TYPE}: a document link is a token's content, never media`;
 var UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 function refuse(field, rule, cause) {
   return new SphereError(`Invalid NFT ${field}: ${rule}`, "VALIDATION_ERROR", cause);
@@ -9809,6 +9813,7 @@ var fieldName = (prefix, name) => prefix === "" ? name : `${prefix}.${name}`;
 var isText = (value) => typeof value === "string" && value.length > 0 && !LONE_SURROGATE.test(value);
 var isBytes3 = (value, length) => value instanceof Uint8Array && (length === void 0 ? value.length > 0 : value.length === length);
 var isMediaType = (value) => typeof value === "string" && MEDIA_TYPE_PATTERN.test(value);
+var isCollectionId = (value) => typeof value === "string" && COLLECTION_ID_PATTERN.test(value);
 var isAttributeValue = (value) => typeof value === "number" ? Number.isSafeInteger(value) : isText(value);
 function hasSpaceOrControl(value) {
   for (let i = 0; i < value.length; i++) {
@@ -9851,8 +9856,9 @@ function checkLink(prefix, link) {
 function checkMediaRef(field, ref) {
   if (ref === null) return;
   if (ref?.kind === "media") return checkMedia(field, ref);
-  if (ref?.kind === "link") return checkLink(field, ref);
-  throw refuse(field, "must be an NftMedia, an NftLink or null");
+  if (ref?.kind !== "link") throw refuse(field, "must be an NftMedia, an NftLink or null");
+  checkLink(field, ref);
+  ensure(!isNftDocumentLink(ref), fieldName(field, "media_type"), DOCUMENT_AS_MEDIA_RULE);
 }
 function checkAttributes(attributes) {
   ensure(Array.isArray(attributes), "attributes", "must be an array \u2014 [] when there are none");
@@ -9869,6 +9875,7 @@ function checkMetadata(metadata) {
   checkOptionalText("external_url", metadata.external_url);
   checkAttributes(metadata.attributes);
   checkOptionalText("collection", metadata.collection);
+  ensure(metadata.collection_id === null || isCollectionId(metadata.collection_id), "collection_id", COLLECTION_ID_RULE);
 }
 function checkContent(content) {
   switch (content?.kind) {
@@ -9926,6 +9933,7 @@ function arrayCbor(items) {
   }
   return out;
 }
+var optionalHexBytes = (value) => CborSerializer.encodeNullable(value, (hex) => CborSerializer.encodeByteString(HexConverter.decode(hex.toLowerCase())));
 function metadataCbor(metadata) {
   return versioned(
     NFT_METADATA_TAG,
@@ -9935,7 +9943,8 @@ function metadataCbor(metadata) {
     mediaRefCbor(metadata.animation_url),
     optionalText(metadata.external_url),
     arrayCbor(metadata.attributes.map(attributeCbor)),
-    optionalText(metadata.collection)
+    optionalText(metadata.collection),
+    optionalHexBytes(metadata.collection_id)
   );
 }
 function encodeNftContent(content) {
@@ -9993,13 +10002,14 @@ function decodeMedia(body) {
   const [, mediaType, bytes] = versionedFields(body, MEDIA_ARITY);
   return { kind: "media", media_type: decodeText(mediaType), bytes: CborDeserializer.decodeByteString(bytes) };
 }
+var decodeHex = (item) => HexConverter.encode(CborDeserializer.decodeByteString(item));
 function decodeLink(body) {
   const [, mediaType, uri, digest] = versionedFields(body, LINK_ARITY);
   return {
     kind: "link",
     media_type: decodeText(mediaType),
     uri: decodeText(uri),
-    sha256: HexConverter.encode(CborDeserializer.decodeByteString(digest))
+    sha256: decodeHex(digest)
   };
 }
 function decodeMetadata(body) {
@@ -10012,7 +10022,8 @@ function decodeMetadata(body) {
     animation_url: decodeMediaRef("animation_url", fields[4]),
     external_url: decodeOptionalText(fields[5]),
     attributes: decodeAttributes(fields[6]),
-    collection: decodeOptionalText(fields[7])
+    collection: decodeOptionalText(fields[7]),
+    collection_id: CborDeserializer.decodeNullable(fields[8], decodeHex)
   };
 }
 var MEDIA_REF_DECODERS = /* @__PURE__ */ new Map([
@@ -10058,20 +10069,26 @@ function parseNftPayload(data) {
     return null;
   }
 }
-function nftSignedDigest(tokenIdCbor, recipientPredicateCbor, payload) {
+function isNftDocumentLink(content) {
+  return content?.kind === "link" && content.media_type === NFT_DOCUMENT_MEDIA_TYPE;
+}
+function nftSignedDigest(context, payload) {
   const preimage = CborSerializer.encodeArray(
-    CborSerializer.encodeTextString(SIGNED_DOMAIN),
-    tokenIdCbor,
-    recipientPredicateCbor,
+    CborSerializer.encodeByteString(SIGNED_DOMAIN),
+    CborSerializer.encodeUnsignedInteger(NFT_FORMAT_VERSION),
+    CborSerializer.encodeUnsignedInteger(NetworkId.fromId(context.networkId).id),
+    CborSerializer.encodeByteString(context.recipientPredicate),
+    CborSerializer.encodeByteString(context.tokenId),
+    CborSerializer.encodeByteString(context.tokenType),
     CborSerializer.encodeByteString(payload)
   );
   return new DataHasher(HashAlgorithm.SHA256).update(preimage).digest();
 }
-async function verifyNftSignature(signed, tokenIdCbor, recipientPredicateCbor) {
+async function verifyNftSignature(signed, context) {
   try {
     if (!SigningService.isPublicKeyValid(signed.creator)) return "invalid";
     const signature = Signature.decode(signed.signature);
-    const digest = await nftSignedDigest(tokenIdCbor, recipientPredicateCbor, signed.payload);
+    const digest = await nftSignedDigest(context, signed.payload);
     return await SigningService.verifyWithPublicKey(digest, signature, signed.creator) ? "valid" : "invalid";
   } catch {
     return "invalid";
@@ -10202,8 +10219,8 @@ function assertMintableData(data) {
 function nftRecipientCbor(pubkey) {
   return EncodedPredicate.fromPredicate(SignaturePredicate.create(pubkey)).toCBOR();
 }
-async function signPayload(deps, payload, tokenId, recipientPubkey) {
-  const digest = await nftSignedDigest(tokenId.toCBOR(), nftRecipientCbor(recipientPubkey), payload);
+async function signPayload(deps, payload, context) {
+  const digest = await nftSignedDigest(context, payload);
   const signature = await deps.signingService.sign(digest);
   return encodeNftSigned(deps.signingService.publicKey, payload, signature.encode());
 }
@@ -10212,31 +10229,41 @@ async function planNftMint(deps, params) {
   const tokenType = new TokenType(params.tokenType).bytes;
   const salt = TokenSalt.generate();
   const tokenId = await TokenId.fromSalt(deps.networkId, salt);
-  const data = params.sign ? await signPayload(deps, payload, tokenId, params.recipientPubkey) : payload;
+  const data = params.sign ? await signPayload(deps, payload, {
+    networkId: deps.networkId.id,
+    recipientPredicate: nftRecipientCbor(params.recipientPubkey),
+    tokenId: tokenId.bytes,
+    tokenType
+  }) : payload;
   assertMintableData(data);
   return { data, salt: salt.toBytes(), tokenType, tokenId: HexConverter.encode(tokenId.bytes) };
 }
-async function verifyAgainst(signed, tokenIdCbor, genesisRecipientCbor) {
+async function verifyAgainst(signed, genesisContext) {
   try {
-    return await verifyNftSignature(signed, tokenIdCbor, genesisRecipientCbor());
+    return await verifyNftSignature(signed, genesisContext());
   } catch {
     return "invalid";
   }
 }
-async function readNftData(data, tokenIdCbor, genesisRecipientCbor) {
+async function readNftData(data, genesisContext) {
   const parsed = parseNftPayload(data);
   if (parsed === null) return null;
   if (parsed.signed === null) return { content: parsed.content, creator: null, signature: "unsigned" };
   return {
     content: parsed.content,
     creator: HexConverter.encode(parsed.signed.creator),
-    signature: await verifyAgainst(parsed.signed, tokenIdCbor, genesisRecipientCbor)
+    signature: await verifyAgainst(parsed.signed, genesisContext)
   };
 }
 async function readTokenNft(token) {
   try {
     const { genesis } = token.sdkToken;
-    return await readNftData(genesis.data, genesis.tokenId.toCBOR(), () => genesis.recipient.toCBOR());
+    return await readNftData(genesis.data, () => ({
+      networkId: genesis.networkId.id,
+      recipientPredicate: genesis.recipient.toCBOR(),
+      tokenId: genesis.tokenId.bytes,
+      tokenType: genesis.tokenType.bytes
+    }));
   } catch {
     return null;
   }