@yeying-community/web3-bs 1.0.13 → 1.0.15

package/README.md

@@ -22,7 +22,7 @@ npm install @yeying-community/web3-bs
 
 - `getProvider` / `requireProvider`
 - `watchProvider`
-- `requestAccounts` / `focusPendingApproval` / `getAccounts` / `getPreferredAccount` / `watchAccounts`
+- `requestAccounts` / `focusPendingApproval` / `getAccounts` / `getPreferredAccount` / `resolveWalletAccount` / `watchAccounts`
 - `getChainId` / `getBalance`
 - `onAccountsChanged` / `onChainChanged`
 - `classifyWalletError` / `isUserRejectedWalletAction` / `isWalletReconnectError`
@@ -30,6 +30,14 @@ npm install @yeying-community/web3-bs
 `requestAccounts` 默认会复用同一 provider 上尚未完成的连接请求，避免用户重复点击时触发多个钱包授权弹窗。
 当钱包已经存在待确认的连接、签名或解锁窗口时，可调用 `focusPendingApproval` 将该窗口重新拉到前台，而不是再发起一次新的请求。
 
+`resolveWalletAccount` 用于处理“应用传入期望地址”和“钱包当前地址”之间的关系：
+- 未传 `expectedAccount`：直接采用钱包当前地址，返回 `status: "wallet"`
+- 传了且与钱包当前地址一致：返回 `status: "matched"`
+- 传了但与钱包当前地址不一致：返回 `status: "mismatch"`
+- 钱包当前没有可用地址：返回 `status: "unavailable"`
+
+它只返回结构化决策结果，不负责弹窗、toast 或业务状态写入，适合在登录、授权、签名前由应用自行决定是继续使用当前钱包地址，还是要求用户切换钱包账户。
+
 ### 2) SIWE + JWT
 
 - `signMessage`

package/dist/auth/provider.d.ts

@@ -1,4 +1,4 @@
-import { Eip1193Provider, ProviderDiscoveryOptions, ProviderInfo, RequestAccountsOptions, AccountSelection, PreferredAccountOptions, WatchAccountsOptions, AccountsChangedHandler, WatchProviderOptions, ProviderChangedHandler, WalletErrorInfo, FocusPendingApprovalResult } from './types';
+import { Eip1193Provider, ProviderDiscoveryOptions, ProviderInfo, RequestAccountsOptions, AccountSelection, PreferredAccountOptions, ResolveWalletAccountOptions, WalletAccountResolution, WatchAccountsOptions, AccountsChangedHandler, WatchProviderOptions, ProviderChangedHandler, WalletErrorInfo, FocusPendingApprovalResult } from './types';
 export declare function isYeYingProvider(provider?: Eip1193Provider | null, info?: ProviderInfo): boolean;
 export declare function getProvider(options?: ProviderDiscoveryOptions): Promise<Eip1193Provider | null>;
 export declare function watchProvider(handler: ProviderChangedHandler, options?: WatchProviderOptions): () => void;
@@ -13,6 +13,7 @@ export declare function focusPendingApproval(provider?: Eip1193Provider): Promis
 export declare function getAccounts(provider?: Eip1193Provider): Promise<string[]>;
 export declare function getChainId(provider?: Eip1193Provider): Promise<string | null>;
 export declare function getPreferredAccount(options?: PreferredAccountOptions): Promise<AccountSelection>;
+export declare function resolveWalletAccount(options?: ResolveWalletAccountOptions): Promise<WalletAccountResolution>;
 export declare function watchAccounts(provider: Eip1193Provider, handler: AccountsChangedHandler, options?: WatchAccountsOptions): () => void;
 export declare function getBalance(provider?: Eip1193Provider, address?: string, blockTag?: string): Promise<string>;
 export declare function onAccountsChanged(provider: Eip1193Provider, handler: (accounts: string[]) => void): () => void;

package/dist/auth/types.d.ts

@@ -67,6 +67,35 @@ export interface PreferredAccountOptions extends RequestAccountsOptions {
     autoConnect?: boolean;
     preferStored?: boolean;
 }
+export interface ResolveWalletAccountOptions extends RequestAccountsOptions {
+    expectedAccount?: string | null;
+    autoConnect?: boolean;
+}
+export type WalletAccountResolution = {
+    status: 'wallet';
+    account: string;
+    walletAccount: string;
+    expectedAccount: null;
+    accounts: string[];
+} | {
+    status: 'matched';
+    account: string;
+    walletAccount: string;
+    expectedAccount: string;
+    accounts: string[];
+} | {
+    status: 'mismatch';
+    account: null;
+    walletAccount: string;
+    expectedAccount: string;
+    accounts: string[];
+} | {
+    status: 'unavailable';
+    account: null;
+    walletAccount: null;
+    expectedAccount: string | null;
+    accounts: string[];
+};
 export interface WatchAccountsOptions {
     storageKey?: string;
     preferStored?: boolean;

package/dist/auth/ucan.d.ts

@@ -120,6 +120,32 @@ export type UcanAuthErrorInfo = {
     status?: number;
     code?: string | number;
 };
+export type ResolveUcanAuthorizationReason = 'missing_root' | 'expired' | 'not_before' | 'missing_account' | 'invalid_issuer' | 'issuer_mismatch' | 'capability_mismatch' | 'audience_mismatch' | 'service_host_mismatch';
+export type ResolveUcanAuthorizationOptions = {
+    sessionId?: string;
+    root?: UcanRootProof | null;
+    currentAccount?: string | null;
+    expectedCapabilities?: UcanCapability[];
+    expectedAudience?: string | null;
+    expectedServiceHosts?: Record<string, string | null | undefined>;
+    recoverAccountFromRoot?: boolean;
+    nowMs?: number;
+};
+export type ResolveUcanAuthorizationResult = {
+    status: 'authorized';
+    account: string;
+    root: UcanRootProof;
+    restoredAccount: boolean;
+    expiresAt: number;
+} | {
+    status: 'unauthorized';
+    reason: ResolveUcanAuthorizationReason;
+    root?: UcanRootProof | null;
+    account?: string | null;
+    expiresAt?: number;
+    expected?: string;
+    actual?: string;
+};
 export declare const DEFAULT_UCAN_SESSION_TTL_MS: number;
 export declare const DEFAULT_UCAN_TOKEN_TTL_MS: number;
 export declare const DEFAULT_UCAN_TOKEN_SKEW_MS: number;
@@ -132,6 +158,7 @@ export declare function normalizeUcanCapabilities(caps: UcanCapability[] | undef
     includeLegacyAliases?: boolean;
 }): UcanCapability[];
 export declare function normalizeUcanExpiry(exp: number | undefined, fallbackMs: number): number;
+export declare function parseUcanAccountFromIssuer(issuer?: string | null): string | null;
 export declare function decodeUcanPayload(token: string): UcanTokenPayload | null;
 export declare function getUcanTokenTiming(token: string, options?: {
     nowMs?: number;
@@ -145,6 +172,7 @@ export declare function createUcanSession(options?: CreateUcanSessionOptions): P
 export declare function clearUcanSession(id?: string): Promise<void>;
 export declare function storeUcanRoot(root: UcanRootProof, id?: string): Promise<void>;
 export declare function getStoredUcanRoot(id?: string): Promise<UcanRootProof | null>;
+export declare function resolveUcanAuthorization(options?: ResolveUcanAuthorizationOptions): Promise<ResolveUcanAuthorizationResult>;
 export declare function getOrCreateUcanRoot(options: CreateRootUcanOptions): Promise<UcanRootProof>;
 export declare function createRootUcan(options: CreateRootUcanOptions): Promise<UcanRootProof>;
 export declare function createDelegationUcan(options: CreateUcanTokenOptions): Promise<string>;

package/dist/web3-bs.esm.js

@@ -73,6 +73,17 @@ function selectPreferredAccount(accounts, stored, preferStored) {
     }
     return accounts[0] || null;
 }
+function normalizeAccount(account) {
+    const normalized = (account || '').trim();
+    return normalized || null;
+}
+function isSameAccount(left, right) {
+    const normalizedLeft = normalizeAccount(left);
+    const normalizedRight = normalizeAccount(right);
+    return Boolean(normalizedLeft &&
+        normalizedRight &&
+        normalizedLeft.toLowerCase() === normalizedRight.toLowerCase());
+}
 function isYeYingProvider(provider, info) {
     if (!provider)
         return false;
@@ -336,6 +347,49 @@ async function getPreferredAccount(options = {}) {
     writeStoredAccount(storageKey, account);
     return { account, accounts };
 }
+async function resolveWalletAccount(options = {}) {
+    const provider = options.provider || (await requireProvider());
+    let accounts = await getAccounts(provider);
+    if (accounts.length === 0 && options.autoConnect) {
+        accounts = await requestAccounts({ provider });
+    }
+    const expectedAccount = normalizeAccount(options.expectedAccount);
+    const walletAccount = normalizeAccount(accounts[0]);
+    if (!walletAccount) {
+        return {
+            status: 'unavailable',
+            account: null,
+            walletAccount: null,
+            expectedAccount,
+            accounts,
+        };
+    }
+    if (!expectedAccount) {
+        return {
+            status: 'wallet',
+            account: walletAccount,
+            walletAccount,
+            expectedAccount: null,
+            accounts,
+        };
+    }
+    if (isSameAccount(expectedAccount, walletAccount)) {
+        return {
+            status: 'matched',
+            account: walletAccount,
+            walletAccount,
+            expectedAccount,
+            accounts,
+        };
+    }
+    return {
+        status: 'mismatch',
+        account: null,
+        walletAccount,
+        expectedAccount,
+        accounts,
+    };
+}
 function watchAccounts(provider, handler, options = {}) {
     const storageKey = options.storageKey || DEFAULT_ACCOUNT_STORAGE_KEY;
     const preferStored = options.preferStored !== false;
@@ -810,6 +864,73 @@ function normalizeExpiry(exp, fallbackMs) {
 function normalizeUcanExpiry(exp, fallbackMs) {
     return normalizeExpiry(exp, fallbackMs);
 }
+function normalizeEthAccount(account) {
+    return String(account || '').trim().toLowerCase();
+}
+function parseUcanAccountFromIssuer(issuer) {
+    const normalized = String(issuer || '').trim().toLowerCase();
+    const prefix = 'did:pkh:eth:';
+    if (!normalized.startsWith(prefix))
+        return null;
+    const account = normalized.slice(prefix.length);
+    return account || null;
+}
+function getUcanIssuerForAccount(account) {
+    return `did:pkh:eth:${normalizeEthAccount(account)}`;
+}
+function extractUcanStatementPayload(message) {
+    if (!message || typeof message !== 'string')
+        return null;
+    const marker = 'UCAN-AUTH';
+    const index = message.indexOf(marker);
+    if (index < 0)
+        return null;
+    const jsonStart = message.indexOf('{', index + marker.length);
+    const jsonEnd = message.lastIndexOf('}');
+    if (jsonStart < 0 || jsonEnd < jsonStart)
+        return null;
+    try {
+        const parsed = JSON.parse(message.slice(jsonStart, jsonEnd + 1));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function getUcanRootServiceHosts(root) {
+    const payload = extractUcanStatementPayload(root.siwe?.message);
+    const hosts = payload?.service_hosts;
+    if (!hosts || typeof hosts !== 'object' || Array.isArray(hosts)) {
+        return null;
+    }
+    return hosts;
+}
+function getServiceHostMismatch(root, expectedServiceHosts) {
+    if (!expectedServiceHosts)
+        return null;
+    const entries = Object.entries(expectedServiceHosts)
+        .map(([key, value]) => [key, String(value || '').trim()])
+        .filter(([, value]) => Boolean(value));
+    if (!entries.length)
+        return null;
+    const hosts = getUcanRootServiceHosts(root);
+    if (!hosts) {
+        return {
+            expected: entries.map(([key, value]) => `${key}:${value}`).join('|'),
+            actual: '',
+        };
+    }
+    for (const [key, expected] of entries) {
+        const actual = typeof hosts[key] === 'string' ? hosts[key].trim() : '';
+        if (actual !== expected) {
+            return { expected, actual };
+        }
+    }
+    return null;
+}
 function decodeUcanPayload(token) {
     const parts = String(token || '').split('.');
     if (parts.length < 2)
@@ -1237,6 +1358,105 @@ function capsEqual(a, b) {
 function isRootExpired(root, nowMs) {
     return Boolean(root.exp && nowMs > root.exp);
 }
+async function resolveUcanAuthorization(options = {}) {
+    const root = options.root === undefined
+        ? await getStoredUcanRoot(options.sessionId || DEFAULT_SESSION_ID)
+        : options.root;
+    const nowMs = options.nowMs ?? Date.now();
+    if (!root) {
+        return { status: 'unauthorized', reason: 'missing_root', root };
+    }
+    if (typeof root.exp !== 'number' || root.exp <= nowMs) {
+        return {
+            status: 'unauthorized',
+            reason: 'expired',
+            root,
+            expiresAt: root.exp,
+        };
+    }
+    if (typeof root.nbf === 'number' && root.nbf > nowMs) {
+        return {
+            status: 'unauthorized',
+            reason: 'not_before',
+            root,
+            expiresAt: root.exp,
+        };
+    }
+    const accountFromIssuer = parseUcanAccountFromIssuer(root.iss);
+    if (!accountFromIssuer) {
+        return {
+            status: 'unauthorized',
+            reason: 'invalid_issuer',
+            root,
+            expiresAt: root.exp,
+            actual: root.iss,
+        };
+    }
+    const currentAccount = normalizeEthAccount(options.currentAccount);
+    if (!currentAccount && !options.recoverAccountFromRoot) {
+        return {
+            status: 'unauthorized',
+            reason: 'missing_account',
+            root,
+            account: null,
+            expiresAt: root.exp,
+        };
+    }
+    const account = currentAccount || accountFromIssuer;
+    const expectedIssuer = getUcanIssuerForAccount(account);
+    if (root.iss !== expectedIssuer) {
+        return {
+            status: 'unauthorized',
+            reason: 'issuer_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: expectedIssuer,
+            actual: root.iss,
+        };
+    }
+    if (options.expectedCapabilities &&
+        !capsEqual(root.cap, options.expectedCapabilities)) {
+        return {
+            status: 'unauthorized',
+            reason: 'capability_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+        };
+    }
+    const expectedAudience = String(options.expectedAudience || '').trim();
+    if (expectedAudience && root.aud !== expectedAudience) {
+        return {
+            status: 'unauthorized',
+            reason: 'audience_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: expectedAudience,
+            actual: root.aud,
+        };
+    }
+    const serviceHostMismatch = getServiceHostMismatch(root, options.expectedServiceHosts);
+    if (serviceHostMismatch) {
+        return {
+            status: 'unauthorized',
+            reason: 'service_host_mismatch',
+            root,
+            account,
+            expiresAt: root.exp,
+            expected: serviceHostMismatch.expected,
+            actual: serviceHostMismatch.actual,
+        };
+    }
+    return {
+        status: 'authorized',
+        account,
+        root,
+        restoredAccount: !currentAccount && account === accountFromIssuer,
+        expiresAt: root.exp,
+    };
+}
 async function getOrCreateUcanRoot(options) {
     const provider = options.provider || (await requireProvider());
     const session = options.session || (await createUcanSession({ id: options.sessionId, provider }));
@@ -2471,5 +2691,5 @@ async function initDappSession(options) {
     return result;
 }
 
-export { CipherError, DEFAULT_UCAN_SESSION_TTL_MS, DEFAULT_UCAN_TOKEN_SKEW_MS, DEFAULT_UCAN_TOKEN_TTL_MS, WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, base64ToBytes, bytesToBase64, classifyUcanAuthError, classifyWalletError, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, decodeUcanPayload, decrypt, deriveAppIdFromHost, deriveAppIdFromLocation, encrypt, focusPendingApproval, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateInvocationUcan, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getSupportedCipherSuites, getUcanSession, getUcanTokenTiming, getWalletErrorCode, getWalletErrorMessage, initDappSession, initWebDavStorage, isUcanTokenFresh, isUserRejectedWalletAction, isWalletReconnectError, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, normalizeUcanExpiry, onAccountsChanged, onChainChanged, refreshAccessToken, requestAccounts, requireProvider, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts, watchProvider };
+export { CipherError, DEFAULT_UCAN_SESSION_TTL_MS, DEFAULT_UCAN_TOKEN_SKEW_MS, DEFAULT_UCAN_TOKEN_TTL_MS, WebDavClient, authCentralUcanFetch, authFetch, authUcanFetch, base64ToBytes, bytesToBase64, classifyUcanAuthError, classifyWalletError, clearAccessToken, clearCentralSessionToken, clearUcanSession, createAndIssueCentralUcan, createCentralSession, createDelegationUcan, createInvocationUcan, createRootUcan, createUcanSession, createWebDavClient, decodeUcanPayload, decrypt, deriveAppIdFromHost, deriveAppIdFromLocation, encrypt, focusPendingApproval, getAccessToken, getAccounts, getBalance, getCapabilityAction, getCapabilityResource, getCentralIssuerInfo, getCentralSessionToken, getChainId, getOrCreateInvocationUcan, getOrCreateUcanRoot, getPreferredAccount, getProvider, getStoredUcanRoot, getSupportedCipherSuites, getUcanSession, getUcanTokenTiming, getWalletErrorCode, getWalletErrorMessage, initDappSession, initWebDavStorage, isUcanTokenFresh, isUserRejectedWalletAction, isWalletReconnectError, isYeYingProvider, issueCentralUcan, loginWithChallenge, logout, normalizeAppHostnameForAppId, normalizeUcanCapabilities, normalizeUcanCapability, normalizeUcanExpiry, onAccountsChanged, onChainChanged, parseUcanAccountFromIssuer, refreshAccessToken, requestAccounts, requireProvider, resolveUcanAuthorization, resolveWalletAccount, setAccessToken, setCentralSessionToken, signMessage, storeUcanRoot, watchAccounts, watchProvider };
 //# sourceMappingURL=web3-bs.esm.js.map