@wishknish/knishio-client-ts 1.2.0 → 1.3.0

package/dist/index.js

@@ -56,8 +56,13 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -2923,24 +2928,6 @@ var AtomMeta = class _AtomMeta {
     this.merge({ shadowWalletClaim: Number(shadowWalletClaim) });
     return this;
   }
-  /**
-   * Set signing wallet metadata
-   * @param signingWallet - Wallet used for signing
-   * @return This instance for chaining
-   */
-  setSigningWallet(signingWallet) {
-    this.merge({
-      signingWallet: JSON.stringify({
-        tokenSlug: signingWallet.token,
-        bundleHash: signingWallet.bundle,
-        address: signingWallet.address,
-        position: signingWallet.position,
-        pubkey: signingWallet.pubkey,
-        characters: signingWallet.characters
-      })
-    });
-    return this;
-  }
   /**
    * Add policy metadata
    * @param policy - Policy object to add
@@ -4780,7 +4767,6 @@ var Rule = class _Rule {
 
 // src/libraries/CheckMolecule.ts
 init_exception();
-init_Dot();
 var CheckMolecule = class _CheckMolecule {
   molecule;
   /**
@@ -4868,12 +4854,13 @@ var CheckMolecule = class _CheckMolecule {
   /**
    * Validate isotope U atoms
    * @return True if valid
-   * @throws WrongTokenTypeException if token is not AUTH
+   * @throws WrongTokenTypeException if token is neither AUTH (fresh login) nor USER (re-login
+   *   signed from the ContinuID pointer)
    * @throws AtomIndexException if index is not 0
    */
   isotopeU() {
     for (const atom of this.molecule.getIsotopes("U")) {
-      if (atom.token !== "AUTH") {
+      if (atom.token !== "AUTH" && atom.token !== "USER") {
         throw new WrongTokenTypeException(`Check::isotopeU() - "${atom.token}" is not a valid Token slug for "${atom.isotope}" isotope Atoms!`);
       }
       if (atom.index !== 0) {
@@ -5262,16 +5249,7 @@ var CheckMolecule = class _CheckMolecule {
     if (!signingAtom) {
       throw new SignatureMismatchException();
     }
-    let signingAddress = signingAtom.walletAddress;
-    const signingWallet = Dot.get(signingAtom.aggregatedMeta(), "signingWallet");
-    if (signingWallet) {
-      const parsedWallet = JSON.parse(signingWallet);
-      const walletAddress = Dot.get(parsedWallet, "address");
-      if (walletAddress) {
-        signingAddress = walletAddress;
-      }
-    }
-    if (address !== signingAddress) {
+    if (address !== signingAtom.walletAddress) {
       throw new SignatureMismatchException();
     }
     return true;
@@ -5606,18 +5584,7 @@ var Molecule = class _Molecule {
     if (!signingAtom) {
       throw new SignatureMalformedException("No atoms available for signing!");
     }
-    let signingPosition = signingAtom.position;
-    const signingWalletMeta = signingAtom.aggregatedMeta ? signingAtom.aggregatedMeta() : null;
-    const signingWalletJson = signingWalletMeta?.signingWallet;
-    if (signingWalletJson) {
-      try {
-        const parsedSigningWallet = JSON.parse(signingWalletJson);
-        if (parsedSigningWallet.position) {
-          signingPosition = parsedSigningWallet.position;
-        }
-      } catch {
-      }
-    }
+    const signingPosition = signingAtom.position;
     if (!signingPosition) {
       throw new SignatureMalformedException("Signing wallet must have a position!");
     }
@@ -6020,9 +5987,7 @@ var Molecule = class _Molecule {
     const atomMeta = new AtomMeta({
       rule: JSON.stringify(rules)
     });
-    if (policy && Object.keys(policy).length > 0) {
-      atomMeta.addPolicy(policy);
-    }
+    atomMeta.addPolicy(policy ?? {});
     this.addAtom(Atom.create({
       isotope: "R",
       wallet: this.sourceWallet,
@@ -6275,12 +6240,10 @@ var Molecule = class _Molecule {
    * Matches JavaScript SDK Molecule.initWithdrawBuffer implementation exactly
    *
    * @param recipients - Map of recipientBundle → amount
-   * @param signingWallet - Optional signing wallet for reconciliation
    * @return This molecule instance for chaining
    */
   initWithdrawBuffer({
-    recipients,
-    signingWallet = null
+    recipients
   }) {
     if (!this.sourceWallet) {
       throw new Error("Source wallet required for buffer withdrawal");
@@ -6292,15 +6255,10 @@ var Molecule = class _Molecule {
     if (Number(this.sourceWallet.balance) - amount < 0) {
       throw new BalanceInsufficientException();
     }
-    const firstAtomMeta = new AtomMeta();
-    if (signingWallet) {
-      firstAtomMeta.setSigningWallet(signingWallet);
-    }
     this.addAtom(Atom.create({
       isotope: "B",
       wallet: this.sourceWallet,
       value: -Number(this.sourceWallet.balance),
-      meta: firstAtomMeta,
       metaType: "walletBundle",
       metaId: this.sourceWallet.bundle
     }));
@@ -6735,7 +6693,7 @@ var AuthToken = class _AuthToken {
   static restore(snapshot, secret) {
     const wallet = new Wallet({
       secret,
-      token: "AUTH",
+      token: snapshot.wallet?.token ?? "AUTH",
       position: snapshot.wallet?.position ?? null,
       characters: snapshot.wallet?.characters ?? null,
       mlKemParameterSet: _AuthToken.resolveMlKemParameterSet(snapshot)
@@ -6818,6 +6776,7 @@ var AuthToken = class _AuthToken {
       encrypt: this.$__encrypt,
       ...this.$__wallet ? {
         wallet: {
+          token: this.$__wallet.token,
           position: this.$__wallet.position,
           characters: this.$__wallet.characters,
           mlKemParameterSet: this.$__wallet.mlKemParameterSet
@@ -8306,8 +8265,8 @@ var QueryContinuId = class extends Query {
    */
   constructor(graphQLClient, knishIOClient) {
     super(graphQLClient, knishIOClient);
-    this.$__query = gql`query ($bundle: String!) {
-      ContinuId(bundle: $bundle) {
+    this.$__query = gql`query ($bundle: String!, $token: String) {
+      ContinuId(bundle: $bundle, token: $token) {
         address,
         bundleHash,
         tokenSlug,
@@ -9593,7 +9552,7 @@ var ResponseProposeMolecule = class extends Response2 {
         code: "HASH_MISMATCH"
       });
     }
-    if (/ots.*position.*reuse|position.*already.*used|ots.*verification/.test(lc)) {
+    if (/ots.*(?:position|key).*reuse|position.*already.*(?:used|consumed)|ots.*verification/.test(lc)) {
       return new SignatureMismatchException(reason, {
         details: { reason },
         code: "OTS_VERIFICATION_FAILED"
@@ -9611,6 +9570,18 @@ var ResponseProposeMolecule = class extends Response2 {
         code: "VERIFICATION_FAILED"
       });
     }
+    if (/signer address mismatch/.test(lc)) {
+      return new SignatureMismatchException(reason, {
+        details: { reason },
+        code: "SIGNER_ADDRESS_MISMATCH"
+      });
+    }
+    if (/no accepted origin available/.test(lc)) {
+      return new AtomIndexException(reason, {
+        details: { reason },
+        code: "ORIGIN_PENDING"
+      });
+    }
     return null;
   }
   /**
@@ -10108,12 +10079,10 @@ var MutationWithdrawBufferToken = class extends MutationProposeMolecule {
    * Fills the molecule with buffer withdrawal data
    */
   fillMolecule({
-    recipients,
-    signingWallet
+    recipients
   }) {
     this.$__molecule.initWithdrawBuffer({
-      recipients,
-      signingWallet
+      recipients
     });
     this.$__molecule.sign({});
     this.$__molecule.check(this.$__molecule.sourceWallet);
@@ -11599,24 +11568,27 @@ var KnishIOClient = class {
       this.setCellSlug(cellSlug);
     }
     this.$__authInProcess = true;
-    let response;
-    if (secret) {
-      response = await this.requestProfileAuthToken({
-        secret,
-        encrypt
-      });
-    } else {
-      response = await this.requestGuestAuthToken({
-        cellSlug: cellSlug || this.getCellSlug(),
-        encrypt
-      });
-    }
-    if (this.$__authToken) {
-      this.log("info", `KnishIOClient::requestAuthToken() - Successfully retrieved auth token...`);
+    try {
+      let response;
+      if (secret) {
+        response = await this.requestProfileAuthToken({
+          secret,
+          encrypt
+        });
+      } else {
+        response = await this.requestGuestAuthToken({
+          cellSlug: cellSlug || this.getCellSlug(),
+          encrypt
+        });
+      }
+      if (this.$__authToken) {
+        this.log("info", `KnishIOClient::requestAuthToken() - Successfully retrieved auth token...`);
+      }
+      this.switchEncryption(encrypt);
+      return response;
+    } finally {
+      this.$__authInProcess = false;
     }
-    this.switchEncryption(encrypt);
-    this.$__authInProcess = false;
-    return response;
   }
   /**
    * Logging utility
@@ -11760,14 +11732,16 @@ var KnishIOClient = class {
   }
   /**
    * Query next ContinuId wallet
+   *
+   * @param token - Restricts the lookup to wallets of this token. Without it the validator falls
+   *   back to the bundle's newest wallet of ANY token when the bundle has no ContinuID pointer.
    */
   async queryContinuId({
-    bundle
+    bundle,
+    token = null
   }) {
     const query = this.createQuery(QueryContinuId);
-    return this.executeQuery(query, {
-      bundle
-    });
+    return this.executeQuery(query, token ? { bundle, token } : { bundle });
   }
   /**
    * Query metadata
@@ -12584,8 +12558,7 @@ var KnishIOClient = class {
   async withdrawBufferToken({
     tokenSlug,
     amount,
-    sourceWallet = null,
-    signingWallet = null
+    sourceWallet = null
   }) {
     this.log("info", `KnishIOClient::withdrawBufferToken() - Withdrawing ${amount} of ${tokenSlug} from buffer...`);
     if (!sourceWallet) {
@@ -12594,11 +12567,7 @@ var KnishIOClient = class {
     const mutation = await this.createMoleculeMutation({ mutationClass: MutationWithdrawBufferToken });
     const recipients = {};
     recipients[this.getBundle()] = amount;
-    const fillMoleculeParams = { recipients };
-    if (signingWallet) {
-      fillMoleculeParams.signingWallet = signingWallet;
-    }
-    await mutation.fillMolecule(fillMoleculeParams);
+    await mutation.fillMolecule({ recipients });
     const response = await this.executeQuery(mutation);
     if (!response) {
       throw new CodeException("Buffer token withdrawal failed");
@@ -12616,21 +12585,33 @@ var KnishIOClient = class {
     encrypt = false
   } = {}) {
     this.log("info", "KnishIOClient::requestGuestAuthToken() - Requesting guest auth token...");
-    const mutation = this.createQuery(MutationRequestAuthorizationGuest);
-    const response = await this.executeQuery(mutation, {
-      cellSlug: cellSlug || this.getCellSlug()
-    });
-    if (!response) {
-      throw new CodeException("Guest auth token request failed");
-    }
-    if (encrypt) {
-      this.switchEncryption(true);
+    const authInProcess = this.$__authInProcess;
+    this.$__authInProcess = true;
+    try {
+      const mutation = this.createQuery(MutationRequestAuthorizationGuest);
+      const response = await this.executeQuery(mutation, {
+        cellSlug: cellSlug || this.getCellSlug()
+      });
+      if (!response) {
+        throw new CodeException("Guest auth token request failed");
+      }
+      if (encrypt) {
+        this.switchEncryption(true);
+      }
+      return response;
+    } finally {
+      this.$__authInProcess = authInProcess;
     }
-    return response;
   }
   /**
    * Request profile authentication token
-   * Matches JavaScript SDK requestProfileAuthToken implementation
+   *
+   * A returning user (the bundle has a USER ContinuID pointer) signs from the USER wallet
+   * registered at that pointer, so validator 0.5.0+ marks the token proven and the identity keeps
+   * read/subscription access to permissioned and private cells. A first login — or a pointer this
+   * secret does not own — signs from a fresh AUTH wallet as before. A rejected pointer-signed
+   * login falls back to the AUTH login exactly once, so one call sends at most two
+   * authorization molecules (testnet allows 3 auths/min/IP).
    */
   async requestProfileAuthToken({
     secret,
@@ -12638,13 +12619,58 @@ var KnishIOClient = class {
   }) {
     this.log("info", "KnishIOClient::requestProfileAuthToken() - Requesting profile auth token...");
     this.setSecret(secret);
-    const wallet = new Wallet({
-      secret,
-      token: "AUTH",
-      mlKemParameterSet: this.getMlKemParameterSet()
-    });
+    const authInProcess = this.$__authInProcess;
+    this.$__authInProcess = true;
+    try {
+      const pointer = (await this.queryContinuId({
+        bundle: this.getBundle(),
+        token: "USER"
+      }))?.payload();
+      let pointerWallet = null;
+      if (pointer && pointer.token === "USER" && pointer.position) {
+        const wallet2 = new Wallet({
+          secret,
+          token: "USER",
+          position: pointer.position,
+          mlKemParameterSet: this.getMlKemParameterSet()
+        });
+        if (!pointer.address || wallet2.address === pointer.address) {
+          pointerWallet = wallet2;
+        } else {
+          this.log("warn", "KnishIOClient::requestProfileAuthToken() - ContinuID wallet address does not derive from this secret; signing from a fresh AUTH wallet");
+        }
+      }
+      if (pointerWallet) {
+        const response2 = await this.proposeProfileAuthorization(pointerWallet, encrypt);
+        if (response2.success()) {
+          this.log("info", "KnishIOClient::requestProfileAuthToken() - Auth token signed from the ContinuID pointer (proven)");
+          return this.acceptProfileAuthorization(response2, pointerWallet, encrypt);
+        }
+        this.log("warn", `KnishIOClient::requestProfileAuthToken() - Pointer-signed authorization rejected (${response2.reason()}); falling back once to an AUTH-wallet login`);
+      }
+      const wallet = new Wallet({
+        secret,
+        token: "AUTH",
+        mlKemParameterSet: this.getMlKemParameterSet()
+      });
+      const response = await this.proposeProfileAuthorization(wallet, encrypt);
+      if (!response.success()) {
+        throw new AuthorizationRejectedException_default(
+          `KnishIOClient::requestProfileAuthToken() - Authorization attempt rejected by ledger. Reason: ${response.reason()}`
+        );
+      }
+      this.log("info", `KnishIOClient::requestProfileAuthToken() - Auth token signed from a fresh AUTH wallet (${pointerWallet ? "fallback after the pointer-signed login was rejected" : "no usable ContinuID pointer"})`);
+      return this.acceptProfileAuthorization(response, wallet, encrypt);
+    } finally {
+      this.$__authInProcess = authInProcess;
+    }
+  }
+  /**
+   * Signs and proposes a profile authorization molecule from the given source wallet.
+   */
+  async proposeProfileAuthorization(wallet, encrypt) {
     const molecule = await this.createMolecule({
-      secret,
+      secret: this.getSecret(),
       sourceWallet: wallet
     });
     const mutation = await this.createMoleculeMutation({
@@ -12662,19 +12688,20 @@ var KnishIOClient = class {
     if (!response) {
       throw new CodeException("Profile auth token request failed");
     }
-    if (response.success()) {
-      const authToken = AuthToken.create({
-        token: response.token(),
-        expiresAt: response.expiresAt(),
-        encrypt: String(response.encrypt()) === "true",
-        pubkey: response.pubKey()
-      }, wallet);
-      this.setAuthToken(authToken);
-    } else {
-      throw new AuthorizationRejectedException_default(
-        `KnishIOClient::requestProfileAuthToken() - Authorization attempt rejected by ledger. Reason: ${response.reason()}`
-      );
-    }
+    return response;
+  }
+  /**
+   * Binds the accepted authorization's token to the wallet that signed it.
+   */
+  acceptProfileAuthorization(response, wallet, encrypt) {
+    const authToken = AuthToken.create({
+      token: response.token(),
+      expiresAt: response.expiresAt(),
+      encrypt: String(response.encrypt()) === "true",
+      pubkey: response.pubKey()
+    }, wallet);
+    this.setAuthToken(authToken);
+    this.lastMoleculeQuery = null;
     if (encrypt) {
       this.switchEncryption(true);
     }
@@ -14032,7 +14059,7 @@ function createDefaultSecretStorage(options = {}) {
 }
 
 // src/index.ts
-var SDK_VERSION = "1.2.0";
+var SDK_VERSION = "1.3.0";
 var SDK_NAME = "KnishIO-Client-TS";
 var COMPATIBLE_SERVER_VERSIONS = [4, 5];
 var SDK_INFO = {