@yeying-community/web3-bs 1.0.11 → 1.0.13

package/dist/web3-bs.umd.js

@@ -694,8 +694,9 @@
     }
 
     const DEFAULT_SESSION_ID = 'default';
-    const DEFAULT_SESSION_TTL = 24 * 60 * 60 * 1000;
-    const DEFAULT_UCAN_TTL = 5 * 60 * 1000;
+    const DEFAULT_UCAN_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+    const DEFAULT_UCAN_TOKEN_TTL_MS = 40 * 60 * 1000;
+    const DEFAULT_UCAN_TOKEN_SKEW_MS = 60 * 1000;
     const DB_NAME = 'yeying-web3';
     const DB_STORE = 'ucan-sessions';
     const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
@@ -776,6 +777,30 @@
     function encodeJson(value) {
         return toBase64Url(textEncoder.encode(JSON.stringify(value)));
     }
+    function decodeBase64Url(input) {
+        if (!input)
+            return null;
+        const base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+        try {
+            if (typeof atob === 'function') {
+                return atob(padded);
+            }
+        }
+        catch {
+            // Try Node-compatible fallback below.
+        }
+        try {
+            const nodeBuffer = globalThis.Buffer;
+            if (nodeBuffer) {
+                return nodeBuffer.from(padded, 'base64').toString('utf8');
+            }
+        }
+        catch {
+            return null;
+        }
+        return null;
+    }
     function randomNonce(bytes = 16) {
         const buffer = new Uint8Array(bytes);
         crypto.getRandomValues(buffer);
@@ -784,8 +809,144 @@
             .join('');
     }
     function normalizeExpiry(exp, fallbackMs) {
+        if (typeof exp === 'number' && !Number.isNaN(exp))
+            return exp;
         return Date.now() + fallbackMs;
     }
+    function normalizeUcanExpiry(exp, fallbackMs) {
+        return normalizeExpiry(exp, fallbackMs);
+    }
+    function decodeUcanPayload(token) {
+        const parts = String(token || '').split('.');
+        if (parts.length < 2)
+            return null;
+        const decoded = decodeBase64Url(parts[1]);
+        if (!decoded)
+            return null;
+        try {
+            const payload = JSON.parse(decoded);
+            if (!payload || typeof payload !== 'object')
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    function getUcanTokenTiming(token, options = {}) {
+        const nowMs = options.nowMs ?? Date.now();
+        const payload = decodeUcanPayload(token);
+        const exp = typeof payload?.exp === 'number' ? payload.exp : null;
+        const nbf = typeof payload?.nbf === 'number' ? payload.nbf : null;
+        const payloadWithIat = payload;
+        const issuedAt = typeof payloadWithIat?.iat === 'number'
+            ? payloadWithIat.iat
+            : null;
+        const remainingMs = exp === null ? null : exp - nowMs;
+        const activeInMs = nbf === null ? 0 : Math.max(0, nbf - nowMs);
+        const expired = exp === null || (remainingMs !== null && remainingMs <= 0);
+        const notBefore = activeInMs > 0;
+        return {
+            valid: Boolean(payload && !expired && !notBefore),
+            payload,
+            exp,
+            nbf,
+            issuedAt,
+            nowMs,
+            remainingMs,
+            activeInMs,
+            expired,
+            notBefore,
+        };
+    }
+    function isUcanTokenFresh(tokenOrTiming, options = {}) {
+        const timing = typeof tokenOrTiming === 'string'
+            ? getUcanTokenTiming(tokenOrTiming, { nowMs: options.nowMs })
+            : tokenOrTiming;
+        if (!timing.valid)
+            return false;
+        const skewMs = Math.max(0, options.skewMs ?? DEFAULT_UCAN_TOKEN_SKEW_MS);
+        return typeof timing.remainingMs === 'number' && timing.remainingMs > skewMs;
+    }
+    function readErrorField(error, field) {
+        if (!error || typeof error !== 'object')
+            return undefined;
+        const value = error[field];
+        if (value !== undefined)
+            return value;
+        const nestedError = error.error;
+        if (nestedError && typeof nestedError === 'object') {
+            return nestedError[field];
+        }
+        return undefined;
+    }
+    function classifyUcanAuthError(error) {
+        const messageValue = readErrorField(error, 'message');
+        const codeValue = readErrorField(error, 'code');
+        const statusValue = readErrorField(error, 'status') ?? readErrorField(error, 'statusCode');
+        const message = typeof messageValue === 'string'
+            ? messageValue
+            : error instanceof Error
+                ? error.message
+                : String(messageValue || error || '');
+        const status = typeof statusValue === 'number' ? statusValue : undefined;
+        const code = typeof codeValue === 'string' || typeof codeValue === 'number' ? codeValue : undefined;
+        const normalized = `${message} ${String(code || '')}`.toLowerCase();
+        if (/ucan.*expired|expired.*ucan|token.*expired|jwt.*expired|\bexp\b/.test(normalized)) {
+            return { type: 'expired', message, retryable: true, shouldRefresh: true, status, code };
+        }
+        if (/not.?before|\bnbf\b|not yet valid/.test(normalized)) {
+            return { type: 'not-before', message, retryable: true, shouldRefresh: false, status, code };
+        }
+        if (/invalid.*token|malformed.*token|bad.*ucan|invalid.*ucan/.test(normalized)) {
+            return { type: 'invalid-token', message, retryable: true, shouldRefresh: true, status, code };
+        }
+        if (status === 401 || /unauthori[sz]ed|unauthenticated/.test(normalized)) {
+            return { type: 'unauthorized', message, retryable: true, shouldRefresh: true, status, code };
+        }
+        if (status === 403 || /forbidden|permission denied|capability/.test(normalized)) {
+            return { type: 'forbidden', message, retryable: false, shouldRefresh: false, status, code };
+        }
+        return { type: 'unknown', message, retryable: false, shouldRefresh: false, status, code };
+    }
+    function isReplayableRequestBody(body) {
+        if (body == null)
+            return true;
+        if (typeof body === 'string')
+            return true;
+        if (typeof URLSearchParams !== 'undefined' && body instanceof URLSearchParams)
+            return true;
+        if (typeof FormData !== 'undefined' && body instanceof FormData)
+            return true;
+        if (typeof Blob !== 'undefined' && body instanceof Blob)
+            return true;
+        if (body instanceof ArrayBuffer)
+            return true;
+        if (ArrayBuffer.isView(body))
+            return true;
+        return false;
+    }
+    async function parseResponseJsonBody(response) {
+        const text = await response.text();
+        if (!text)
+            return null;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return { raw: text };
+        }
+    }
+    function shouldRetryUcanFetch(response, errorInfo) {
+        if (errorInfo.type === 'expired' || errorInfo.shouldRefresh) {
+            return true;
+        }
+        if (response.status === 401)
+            return true;
+        if (response.status === 403 && errorInfo.type === 'forbidden')
+            return false;
+        return false;
+    }
     function isSessionExpired(expiresAt, nowMs = Date.now()) {
         return typeof expiresAt === 'number' && nowMs >= expiresAt;
     }
@@ -882,7 +1043,7 @@
             buildDidKey(pair.publicKey),
         ]);
         const createdAt = Date.now();
-        const expiresAt = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
+        const expiresAt = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_SESSION_TTL_MS);
         const root = shouldKeepRootForSession(record?.root, did, createdAt) ? record?.root : undefined;
         await writeSessionRecord({
             id: sessionId,
@@ -1150,7 +1311,7 @@
         const domain = options.domain || (typeof window !== 'undefined' ? window.location.host : '127.0.0.1');
         const uri = options.uri || (typeof window !== 'undefined' ? window.location.origin : 'http://127.0.0.1');
         const nonce = options.nonce || randomNonce(8);
-        const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_SESSION_TTL);
+        const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_SESSION_TTL_MS);
         const nbf = options.notBeforeMs;
         const normalizedCapabilities = normalizeUcanCapabilities(options.capabilities);
         if (!normalizedCapabilities.length) {
@@ -1234,7 +1395,7 @@
         if (!normalizedCapabilities.length) {
             throw new Error('Missing UCAN capabilities');
         }
-        const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
+        const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TOKEN_TTL_MS);
         const payload = {
             iss: issuer.did,
             aud: options.audience,
@@ -1256,7 +1417,7 @@
         if (!normalizedCapabilities.length) {
             throw new Error('Missing UCAN capabilities');
         }
-        const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TTL);
+        const exp = normalizeExpiry(undefined, options.expiresInMs ?? DEFAULT_UCAN_TOKEN_TTL_MS);
         const payload = {
             iss: issuer.did,
             aud: options.audience,
@@ -1267,30 +1428,84 @@
         };
         return await signUcanPayload(payload, issuer);
     }
+    async function getOrCreateInvocationUcan(options) {
+        if (options.ucan &&
+            isUcanTokenFresh(options.ucan, {
+                nowMs: options.nowMs,
+                skewMs: options.skewMs,
+            })) {
+            return options.ucan;
+        }
+        return await createInvocationUcan({
+            issuer: options.issuer,
+            sessionId: options.sessionId,
+            provider: options.provider,
+            audience: options.audience,
+            capabilities: options.capabilities,
+            expiresInMs: options.expiresInMs,
+            notBeforeMs: options.notBeforeMs,
+            proofs: options.proofs,
+        });
+    }
     async function authUcanFetch(input, init = {}, options = {}) {
         const fetcher = options.fetcher || fetch;
-        let token = options.ucan;
-        if (!token) {
-            if (!options.audience || !options.capabilities) {
+        const audience = options.audience;
+        const capabilities = options.capabilities;
+        const canRefresh = Boolean(audience && capabilities);
+        const canRetry = canRefresh && isReplayableRequestBody(init.body);
+        let token = options.ucan || '';
+        if (!token || (canRefresh && !isUcanTokenFresh(token, { skewMs: options.skewMs }))) {
+            if (!audience || !capabilities) {
                 throw new Error('Missing UCAN audience or capabilities');
             }
-            token = await createInvocationUcan({
+            token = await getOrCreateInvocationUcan({
+                ucan: options.ucan,
                 issuer: options.issuer,
                 sessionId: options.sessionId,
                 provider: options.provider,
-                audience: options.audience,
-                capabilities: options.capabilities,
+                audience,
+                capabilities,
                 expiresInMs: options.expiresInMs,
                 notBeforeMs: options.notBeforeMs,
                 proofs: options.proofs,
+                skewMs: options.skewMs,
             });
         }
-        const headers = new Headers(init.headers || {});
-        headers.set('Authorization', `Bearer ${token}`);
-        return fetcher(input, {
+        const makeHeaders = (bearer) => {
+            const headers = new Headers(init.headers || {});
+            headers.set('Authorization', `Bearer ${bearer}`);
+            return headers;
+        };
+        let response = await fetcher(input, {
             ...init,
-            headers,
+            headers: makeHeaders(token),
+        });
+        if (!canRetry || response.ok) {
+            return response;
+        }
+        const payload = await parseResponseJsonBody(response.clone()).catch(() => null);
+        const errorInfo = classifyUcanAuthError(payload || response.statusText || response);
+        if (!shouldRetryUcanFetch(response, errorInfo)) {
+            return response;
+        }
+        if (!audience || !capabilities) {
+            return response;
+        }
+        const refreshedToken = await createInvocationUcan({
+            issuer: options.issuer,
+            sessionId: options.sessionId,
+            provider: options.provider,
+            audience,
+            capabilities,
+            expiresInMs: options.expiresInMs,
+            notBeforeMs: options.notBeforeMs,
+            proofs: options.proofs,
+        });
+        response = await fetcher(input, {
+            ...init,
+            headers: makeHeaders(refreshedToken),
         });
+        return response;
     }
 
     const DEFAULT_BASE_URL = '/api/v1/public/auth/central';
@@ -1601,6 +1816,122 @@
         });
     }
 
+    /**
+     * 加密/解密 SDK API
+     *
+     * 调用钱包插件的 `yeying_encrypt` / `yeying_decrypt` / `yeying_getCipherSuites`
+     * EIP-1193 自定义方法。命名安全套件 + 静默执行 + 站点授权模型同 UCAN。
+     *
+     * 数据密码（password 参数）由 DApp 自行管理与钱包密码独立；
+     * plaintext 走 base64 字符串跨 message 边界传输。
+     */
+    class CipherError extends Error {
+        type;
+        code;
+        originalError;
+        constructor(message, type, code, originalError) {
+            super(message);
+            this.name = 'CipherError';
+            this.type = type;
+            this.code = code;
+            this.originalError = originalError;
+        }
+    }
+    function wrapCipherError(err) {
+        const info = classifyWalletError(err);
+        throw new CipherError(info.message, info.type, info.code, err);
+    }
+    function bytesToBase64(bytes) {
+        if (typeof Buffer !== 'undefined') {
+            return Buffer.from(bytes).toString('base64');
+        }
+        let binary = '';
+        for (let i = 0; i < bytes.length; i += 1) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+    function base64ToBytes(b64) {
+        if (typeof Buffer !== 'undefined') {
+            return new Uint8Array(Buffer.from(b64, 'base64'));
+        }
+        const binary = atob(b64);
+        const out = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i += 1)
+            out[i] = binary.charCodeAt(i);
+        return out;
+    }
+    /**
+     * 用指定/默认套件加密数据
+     * @returns v1 格式密文 base64 字符串
+     */
+    async function encrypt(options) {
+        const provider = options.provider || (await requireProvider());
+        try {
+            const result = await provider.request({
+                method: 'yeying_encrypt',
+                params: [{
+                        data: options.data,
+                        password: options.password,
+                        suite: options.suite
+                    }]
+            });
+            if (!result || typeof result !== 'object' || typeof result.ciphertext !== 'string') {
+                throw new Error('Invalid encrypt response: missing ciphertext');
+            }
+            return result.ciphertext;
+        }
+        catch (err) {
+            wrapCipherError(err);
+        }
+    }
+    /**
+     * 解密 v1 格式密文
+     * @returns 明文 Uint8Array
+     */
+    async function decrypt(options) {
+        const provider = options.provider || (await requireProvider());
+        try {
+            const result = await provider.request({
+                method: 'yeying_decrypt',
+                params: [{
+                        ciphertext: options.ciphertext,
+                        password: options.password
+                    }]
+            });
+            if (!result || typeof result !== 'object' || typeof result.plaintext !== 'string') {
+                throw new Error('Invalid decrypt response: missing plaintext');
+            }
+            const { plaintext, encoding } = result;
+            if (encoding && encoding !== 'base64') {
+                throw new Error(`Unsupported plaintext encoding: ${encoding}`);
+            }
+            return base64ToBytes(plaintext);
+        }
+        catch (err) {
+            wrapCipherError(err);
+        }
+    }
+    /**
+     * 列出可用的命名安全套件
+     */
+    async function getSupportedCipherSuites(options = {}) {
+        const provider = options.provider || (await requireProvider());
+        try {
+            const result = await provider.request({
+                method: 'yeying_getCipherSuites',
+                params: []
+            });
+            if (!result || typeof result !== 'object' || !Array.isArray(result.suites)) {
+                throw new Error('Invalid getCipherSuites response: missing suites array');
+            }
+            return result.suites;
+        }
+        catch (err) {
+            wrapCipherError(err);
+        }
+    }
+
     function normalizeBaseUrl(baseUrl) {
         return baseUrl.replace(/\/+$/, '');
     }
@@ -1885,7 +2216,6 @@
     }
 
     const tokenCache = new Map();
-    const TOKEN_SKEW_MS = 5000;
     const DEFAULT_APP_ACTION = 'write';
     const LOOPBACK_HOST_ALIASES = new Set([
         'localhost',
@@ -2027,64 +2357,19 @@
         const caps = options.invocationCapabilities || fallbackCaps;
         return ensureAppCapability(caps, options);
     }
-    function isTokenValid(entry, nowMs) {
-        if (!entry.exp)
-            return false;
-        if (entry.nbf && nowMs < entry.nbf)
-            return false;
-        return entry.exp - TOKEN_SKEW_MS > nowMs;
-    }
-    function decodeBase64Url(input) {
-        if (!input)
-            return null;
-        const base64 = input.replace(/-/g, '+').replace(/_/g, '/');
-        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
-        try {
-            if (typeof atob === 'function') {
-                return atob(padded);
-            }
-        }
-        catch {
-            // ignore
-        }
-        try {
-            const nodeBuffer = globalThis.Buffer;
-            if (nodeBuffer) {
-                return nodeBuffer.from(padded, 'base64').toString('utf8');
-            }
-        }
-        catch {
-            return null;
-        }
-        return null;
-    }
-    function decodeUcanPayload(token) {
-        const parts = token.split('.');
-        if (parts.length < 2)
-            return null;
-        const decoded = decodeBase64Url(parts[1]);
-        if (!decoded)
-            return null;
-        try {
-            return JSON.parse(decoded);
-        }
-        catch {
-            return null;
-        }
-    }
     async function getCachedInvocationToken(options) {
         const cacheKey = buildTokenCacheKey(options.issuer, options.audience, options.capabilities);
         const cached = tokenCache.get(cacheKey);
         const nowMs = Date.now();
-        if (cached && isTokenValid(cached, nowMs)) {
-            return cached.token;
-        }
-        const token = await createInvocationUcan({
+        const token = await getOrCreateInvocationUcan({
+            ucan: cached?.token,
             issuer: options.issuer,
             audience: options.audience,
             capabilities: options.capabilities,
             proofs: options.proofs,
             expiresInMs: options.expiresInMs,
+            skewMs: options.skewMs,
+            nowMs,
             notBeforeMs: options.notBeforeMs,
         });
         const payload = decodeUcanPayload(token);
@@ -2135,6 +2420,7 @@
             capabilities: invocationCaps,
             proofs: [root],
             expiresInMs: options.invocationExpiresInMs,
+            skewMs: options.invocationSkewMs,
             notBeforeMs: options.notBeforeMs,
         });
         const client = createWebDavClient({
@@ -2191,10 +2477,17 @@
         return result;
     }
 
+    exports.CipherError = CipherError;
+    exports.DEFAULT_UCAN_SESSION_TTL_MS = DEFAULT_UCAN_SESSION_TTL_MS;
+    exports.DEFAULT_UCAN_TOKEN_SKEW_MS = DEFAULT_UCAN_TOKEN_SKEW_MS;
+    exports.DEFAULT_UCAN_TOKEN_TTL_MS = DEFAULT_UCAN_TOKEN_TTL_MS;
     exports.WebDavClient = WebDavClient;
     exports.authCentralUcanFetch = authCentralUcanFetch;
     exports.authFetch = authFetch;
     exports.authUcanFetch = authUcanFetch;
+    exports.base64ToBytes = base64ToBytes;
+    exports.bytesToBase64 = bytesToBase64;
+    exports.classifyUcanAuthError = classifyUcanAuthError;
     exports.classifyWalletError = classifyWalletError;
     exports.clearAccessToken = clearAccessToken;
     exports.clearCentralSessionToken = clearCentralSessionToken;
@@ -2206,8 +2499,11 @@
     exports.createRootUcan = createRootUcan;
     exports.createUcanSession = createUcanSession;
     exports.createWebDavClient = createWebDavClient;
+    exports.decodeUcanPayload = decodeUcanPayload;
+    exports.decrypt = decrypt;
     exports.deriveAppIdFromHost = deriveAppIdFromHost;
     exports.deriveAppIdFromLocation = deriveAppIdFromLocation;
+    exports.encrypt = encrypt;
     exports.focusPendingApproval = focusPendingApproval;
     exports.getAccessToken = getAccessToken;
     exports.getAccounts = getAccounts;
@@ -2217,15 +2513,19 @@
     exports.getCentralIssuerInfo = getCentralIssuerInfo;
     exports.getCentralSessionToken = getCentralSessionToken;
     exports.getChainId = getChainId;
+    exports.getOrCreateInvocationUcan = getOrCreateInvocationUcan;
     exports.getOrCreateUcanRoot = getOrCreateUcanRoot;
     exports.getPreferredAccount = getPreferredAccount;
     exports.getProvider = getProvider;
     exports.getStoredUcanRoot = getStoredUcanRoot;
+    exports.getSupportedCipherSuites = getSupportedCipherSuites;
     exports.getUcanSession = getUcanSession;
+    exports.getUcanTokenTiming = getUcanTokenTiming;
     exports.getWalletErrorCode = getWalletErrorCode;
     exports.getWalletErrorMessage = getWalletErrorMessage;
     exports.initDappSession = initDappSession;
     exports.initWebDavStorage = initWebDavStorage;
+    exports.isUcanTokenFresh = isUcanTokenFresh;
     exports.isUserRejectedWalletAction = isUserRejectedWalletAction;
     exports.isWalletReconnectError = isWalletReconnectError;
     exports.isYeYingProvider = isYeYingProvider;
@@ -2235,6 +2535,7 @@
     exports.normalizeAppHostnameForAppId = normalizeAppHostnameForAppId;
     exports.normalizeUcanCapabilities = normalizeUcanCapabilities;
     exports.normalizeUcanCapability = normalizeUcanCapability;
+    exports.normalizeUcanExpiry = normalizeUcanExpiry;
     exports.onAccountsChanged = onAccountsChanged;
     exports.onChainChanged = onChainChanged;
     exports.refreshAccessToken = refreshAccessToken;