@zubari/sdk 0.5.3 → 0.5.4

package/dist/wallet/index.mjs

@@ -148,11 +148,11 @@ var USDT_ADDRESSES = {
   }
 };
 var DERIVATION_PATHS = {
-  bitcoin: "m/44'/0'/0'/0",
+  bitcoin: "m/84'/0'/0'/0",
   ethereum: "m/44'/60'/0'/0",
-  ton: "m/44'/607'/0'/0",
+  ton: "m/44'/607'/0'",
   tron: "m/44'/195'/0'/0",
-  solana: "m/44'/501'/0'/0",
+  solana: "m/44'/501'/0'",
   spark: "m/44'/998'/0'/0"
 };
 function getNetworkConfig(network, isTestnet = false) {
@@ -230,9 +230,28 @@ var WdkApiClient = class {
   constructor(config) {
     this.config = {
       baseUrl: config.baseUrl,
-      timeout: config.timeout || 3e4
+      timeout: config.timeout || 3e4,
+      authToken: config.authToken
     };
   }
+  /**
+   * Set or update the auth token for authenticated requests
+   */
+  setAuthToken(token) {
+    this.config.authToken = token;
+  }
+  /**
+   * Build headers for API requests, including Authorization when available
+   */
+  getHeaders() {
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (this.config.authToken) {
+      headers["Authorization"] = `Bearer ${this.config.authToken}`;
+    }
+    return headers;
+  }
   /**
    * Generate a new BIP-39 seed phrase using Tether WDK
    */
@@ -240,9 +259,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/generate-seed`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        }
+        headers: this.getHeaders()
       });
       return await response.json();
     } catch (error) {
@@ -259,9 +276,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/validate-seed`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: this.getHeaders(),
         body: JSON.stringify({ seed })
       });
       return await response.json();
@@ -279,9 +294,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/derive-address`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: this.getHeaders(),
         body: JSON.stringify({ seed, chain, network })
       });
       return await response.json();
@@ -299,9 +312,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/derive-all`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: this.getHeaders(),
         body: JSON.stringify({ seed, network })
       });
       return await response.json();
@@ -319,9 +330,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/send`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: this.getHeaders(),
         body: JSON.stringify({ seed, chain, to, amount, network })
       });
       return await response.json();
@@ -340,9 +349,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/history`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: this.getHeaders(),
         body: JSON.stringify({ seed, chain, network, limit })
       });
       return await response.json();
@@ -361,9 +368,7 @@ var WdkApiClient = class {
     try {
       const response = await fetch(`${this.config.baseUrl}/api/wallets/wdk/tx-status`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers: this.getHeaders(),
         body: JSON.stringify({ txHash, chain, network })
       });
       return await response.json();
@@ -377,22 +382,23 @@ var WdkApiClient = class {
 };
 var DEFAULT_API_URL = process.env.NEXT_PUBLIC_API_URL || "https://ckgwifsxka.us-east-2.awsapprunner.com";
 var wdkApiClient = null;
-function getWdkApiClient(baseUrl) {
+function getWdkApiClient(baseUrl, authToken) {
   if (!wdkApiClient || baseUrl && wdkApiClient["config"].baseUrl !== baseUrl) {
     wdkApiClient = new WdkApiClient({
-      baseUrl: baseUrl || DEFAULT_API_URL
+      baseUrl: baseUrl || DEFAULT_API_URL,
+      authToken
     });
   }
   return wdkApiClient;
 }
 var DERIVATION_PATHS2 = {
-  ethereum: "m/44'/60'/0'/0/0",
-  bitcoin_mainnet: "m/84'/0'/0'/0/0",
+  ethereum: `${DERIVATION_PATHS.ethereum}/0`,
+  bitcoin_mainnet: `${DERIVATION_PATHS.bitcoin}/0`,
   bitcoin_testnet: "m/84'/1'/0'/0/0",
-  ton: "m/44'/607'/0'/0'/0'",
-  tron: "m/44'/195'/0'/0/0",
-  solana: "m/44'/501'/0'/0'",
-  spark: "m/44'/998'/0'/0/0"
+  ton: `${DERIVATION_PATHS.ton}/0'/0'`,
+  tron: `${DERIVATION_PATHS.tron}/0`,
+  solana: `${DERIVATION_PATHS.solana}/0'`,
+  spark: `${DERIVATION_PATHS.spark}/0`
 };
 function deriveEthereumAddress(seed) {
   const hdNode = HDNodeWallet.fromPhrase(seed, void 0, DERIVATION_PATHS2.ethereum);
@@ -905,11 +911,6 @@ var ZubariWdkService = class {
   async sendTransaction(seed, chain, to, amount) {
     await this.initialize();
     const startTime = Date.now();
-    console.log(`[ZubariWdkService] Sending ${chain} transaction`, {
-      to: `${to.slice(0, 10)}...${to.slice(-6)}`,
-      amount,
-      network: this.config.network
-    });
     try {
       const response = await fetch(`${this.config.apiUrl}/api/wallets/wdk/send`, {
         method: "POST",
@@ -929,10 +930,6 @@ var ZubariWdkService = class {
             console.warn(`[ZubariWdkService] Invalid ${chain} tx hash format:`, txHash);
           }
         }
-        console.log(`[ZubariWdkService] ${chain} transaction ${data.success ? "SUCCESS" : "FAILED"}`, {
-          txHash: txHash ? `${txHash.slice(0, 16)}...` : "N/A",
-          elapsed: `${elapsed}ms`
-        });
         if (!data.success) {
           const errorCode2 = parseChainError(chain, data.error || "");
           return {
@@ -955,12 +952,6 @@ var ZubariWdkService = class {
       const errorData = await response.json().catch(() => ({}));
       const errorMessage = errorData.error || `HTTP ${response.status}`;
       const errorCode = parseChainError(chain, errorMessage);
-      console.error(`[ZubariWdkService] ${chain} transaction FAILED`, {
-        status: response.status,
-        error: errorMessage,
-        errorCode,
-        elapsed: `${elapsed}ms`
-      });
       return {
         success: false,
         error: errorMessage,
@@ -968,14 +959,8 @@ var ZubariWdkService = class {
         chain
       };
     } catch (error) {
-      const elapsed = Date.now() - startTime;
       const errorMessage = error instanceof Error ? error.message : "Transaction failed";
       const errorCode = parseChainError(chain, errorMessage);
-      console.error(`[ZubariWdkService] ${chain} transaction ERROR`, {
-        error: errorMessage,
-        errorCode,
-        elapsed: `${elapsed}ms`
-      });
       return {
         success: false,
         error: errorMessage,
@@ -1021,15 +1006,22 @@ var ZubariWdkService = class {
   // Private Helper Methods
   // ==========================================
   getDerivationPath(chain) {
-    const paths = {
-      bitcoin: this.config.network === "testnet" ? "m/84'/1'/0'/0/0" : "m/84'/0'/0'/0/0",
-      ethereum: "m/44'/60'/0'/0/0",
-      ton: "m/44'/607'/0'/0'/0'",
-      tron: "m/44'/195'/0'/0/0",
-      solana: "m/44'/501'/0'/0'",
-      spark: "m/44'/998'/0'/0/0"
-    };
-    return paths[chain];
+    const basePath = DERIVATION_PATHS[chain];
+    if (chain === "bitcoin" && this.config.network === "testnet") {
+      return "m/84'/1'/0'/0/0";
+    }
+    switch (chain) {
+      case "ton":
+        return `${basePath}/0'/0'`;
+      case "solana":
+        return `${basePath}/0'`;
+      case "bitcoin":
+      case "ethereum":
+      case "tron":
+      case "spark":
+      default:
+        return `${basePath}/0`;
+    }
   }
   getChainSymbol(chain) {
     const symbols = {
@@ -1093,12 +1085,21 @@ function getZubariWdkService(config) {
 }
 
 // src/wallet/ZubariWallet.ts
-var ZubariWallet = class {
+var ZubariWallet = class _ZubariWallet {
   seed;
   config;
   accounts = /* @__PURE__ */ new Map();
   wdkService;
   initialized = false;
+  /** Mapping from NetworkType to SupportedChain (identity map, shared across methods) */
+  static CHAIN_MAP = {
+    ethereum: "ethereum",
+    bitcoin: "bitcoin",
+    ton: "ton",
+    tron: "tron",
+    solana: "solana",
+    spark: "spark"
+  };
   constructor(seed, config) {
     this.seed = seed;
     this.config = {
@@ -1131,15 +1132,7 @@ var ZubariWallet = class {
   async deriveAccount(network, index = 0) {
     const basePath = DERIVATION_PATHS[network];
     const derivationPath = `${basePath}/${index}`;
-    const chainMap = {
-      ethereum: "ethereum",
-      bitcoin: "bitcoin",
-      ton: "ton",
-      tron: "tron",
-      solana: "solana",
-      spark: "spark"
-    };
-    const chain = chainMap[network];
+    const chain = _ZubariWallet.CHAIN_MAP[network];
     if (!chain) {
       throw new Error(`Unsupported network: ${network}`);
     }
@@ -1191,15 +1184,7 @@ var ZubariWallet = class {
    */
   async getBalance(network) {
     const networkConfig = getNetworkConfig(network, this.config.network === "testnet");
-    const chainMap = {
-      ethereum: "ethereum",
-      bitcoin: "bitcoin",
-      ton: "ton",
-      tron: "tron",
-      solana: "solana",
-      spark: "spark"
-    };
-    const chain = chainMap[network];
+    const chain = _ZubariWallet.CHAIN_MAP[network];
     if (!chain) {
       throw new Error(`Unsupported network: ${network}`);
     }
@@ -1286,15 +1271,7 @@ var ZubariWallet = class {
    */
   async send(network, params) {
     const { to, amount } = params;
-    const chainMap = {
-      ethereum: "ethereum",
-      bitcoin: "bitcoin",
-      ton: "ton",
-      tron: "tron",
-      solana: "solana",
-      spark: "spark"
-    };
-    const chain = chainMap[network];
+    const chain = _ZubariWallet.CHAIN_MAP[network];
     if (!chain) {
       throw new Error(`Unsupported network: ${network}`);
     }
@@ -1599,7 +1576,10 @@ var KeyManager = class {
   static KEY_LENGTH = 256;
   static IV_LENGTH = 12;
   static SALT_LENGTH = 16;
-  static PBKDF2_ITERATIONS = 1e5;
+  // OWASP 2023 recommends 600,000 iterations for PBKDF2-SHA256 to resist
+  // brute-force attacks with modern GPU hardware.
+  // See: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+  static PBKDF2_ITERATIONS = 6e5;
   /**
    * Encrypt a seed phrase with a password
    */
@@ -1838,7 +1818,7 @@ var WebEncryptedStorageAdapter = class {
       {
         name: "PBKDF2",
         salt: salt.buffer,
-        iterations: 1e5,
+        iterations: 6e5,
         hash: "SHA-256"
       },
       keyMaterial,
@@ -2151,6 +2131,16 @@ var WalletManager = class _WalletManager {
   }
   /**
    * Lock wallet (clear seed from memory)
+   *
+   * SECURITY NOTE: JavaScript strings are immutable and cannot be overwritten
+   * in place. Setting `this.currentSeed = null` removes the reference, but
+   * the original string may persist in memory until garbage collected.
+   * There is no reliable way to zero out a JS string.
+   *
+   * TODO: In a future version, store the seed as a Uint8Array instead of a
+   * string. Uint8Array contents can be explicitly zeroed (e.g.,
+   * `seedBytes.fill(0)`) before releasing the reference, which provides
+   * stronger guarantees that sensitive material is scrubbed from memory.
    */
   lock() {
     this.currentSeed = null;
@@ -2367,7 +2357,6 @@ var WalletManager = class _WalletManager {
   async saveAddressesToStorage(addresses) {
     try {
       await this.storage.setItem(STORAGE_KEYS.DERIVED_ADDRESSES, JSON.stringify(addresses));
-      console.log("Saved derived addresses to storage:", Object.keys(addresses));
     } catch (error) {
       console.warn("Failed to save addresses to storage:", error);
     }
@@ -2407,9 +2396,7 @@ var WalletManager = class _WalletManager {
       const stored = await this.storage.getItem(STORAGE_KEYS.DERIVED_ADDRESSES);
       if (stored) {
         const rawAddresses = JSON.parse(stored);
-        console.log("[WalletManager] Raw addresses from storage:", rawAddresses);
         const addresses = this.normalizeAddresses(rawAddresses);
-        console.log("[WalletManager] Normalized addresses:", addresses);
         await this.saveAddressesToStorage(addresses);
         return addresses;
       }
@@ -2434,11 +2421,8 @@ var WalletManager = class _WalletManager {
     if (storedAddresses && Object.keys(storedAddresses).length > 1) {
       const expectedEthAddress = _WalletManager.deriveAddress(this.currentSeed);
       if (storedAddresses.ethereum === expectedEthAddress) {
-        console.log("Using addresses from storage (verified by Ethereum address)");
         this.derivedAddresses = storedAddresses;
         return storedAddresses;
-      } else {
-        console.log("Stored addresses do not match current seed, re-deriving...");
       }
     }
     return await this.deriveAllAddressesWithWdk();
@@ -2450,9 +2434,7 @@ var WalletManager = class _WalletManager {
   getAddressForChain(chain) {
     const cachedValue = this.derivedAddresses[chain];
     if (cachedValue) {
-      console.log(`[WalletManager] getAddressForChain(${chain}) cached value:`, cachedValue, "type:", typeof cachedValue);
       const addr = this.normalizeAddress(cachedValue);
-      console.log(`[WalletManager] getAddressForChain(${chain}) normalized:`, addr);
       if (addr) {
         this.derivedAddresses[chain] = addr;
         return addr;
@@ -2579,10 +2561,8 @@ var WalletManager = class _WalletManager {
               const mempoolSpent = data.mempool_stats?.spent_txo_sum || 0;
               const satoshis = chainFunded - chainSpent + (mempoolFunded - mempoolSpent);
               balance = (satoshis / 1e8).toFixed(8);
-              console.log(`Bitcoin balance for ${address}: ${balance} BTC (${satoshis} sats) via ${apiUrl}`);
               break;
             }
-            console.log(`No transactions found on ${apiUrl}, trying next...`);
           }
         } catch (error) {
           console.warn(`Failed to fetch from ${apiUrl}:`, error);
@@ -2685,7 +2665,6 @@ var WalletManager = class _WalletManager {
           if (data.ok && data.result !== void 0) {
             const nanotons = BigInt(data.result);
             balance = (Number(nanotons) / 1e9).toFixed(9);
-            console.log(`TON balance for ${address}: ${balance} TON`);
           }
         }
       } catch (error) {
@@ -2742,7 +2721,6 @@ var WalletManager = class _WalletManager {
           const data = await response.json();
           if (data.success && data.balance !== void 0) {
             balance = (parseFloat(data.balance) / 1e8).toFixed(8);
-            console.log(`Spark balance for ${address}: ${balance} BTC`);
           }
         }
       } catch (error) {
@@ -2763,28 +2741,29 @@ var WalletManager = class _WalletManager {
     };
   }
   /**
-   * Fetch balances for all enabled chains
+   * Fetch balances for all enabled chains in parallel.
+   * Uses Promise.allSettled so that one chain failing does not block others.
    */
   async fetchAllBalances() {
-    const balances = [];
-    for (const chain of this.config.enabledChains) {
-      try {
-        const balance = await this.fetchBalanceForChain(chain);
-        balances.push(balance);
-      } catch (error) {
-        console.error(`Failed to fetch balance for ${chain}:`, error);
-        const networkConfig = this.getChainConfig(chain);
-        balances.push({
-          chain,
-          symbol: networkConfig.nativeCurrency.symbol,
-          balance: "0",
-          balanceUsd: 0,
-          address: this.getAddressForChain(chain) || "",
-          decimals: networkConfig.nativeCurrency.decimals
-        });
+    const results = await Promise.allSettled(
+      this.config.enabledChains.map((chain) => this.fetchBalanceForChain(chain))
+    );
+    return results.map((result, index) => {
+      const chain = this.config.enabledChains[index];
+      if (result.status === "fulfilled") {
+        return result.value;
       }
-    }
-    return balances;
+      console.error(`Failed to fetch balance for ${chain}:`, result.reason);
+      const networkConfig = this.getChainConfig(chain);
+      return {
+        chain,
+        symbol: networkConfig.nativeCurrency.symbol,
+        balance: "0",
+        balanceUsd: 0,
+        address: this.getAddressForChain(chain) || "",
+        decimals: networkConfig.nativeCurrency.decimals
+      };
+    });
   }
   /**
    * Get extended wallet state with multi-chain info
@@ -2838,7 +2817,6 @@ var WalletManager = class _WalletManager {
       });
       if (response.ok) {
         const data = await response.json();
-        console.log(`Transaction sent on ${chain}:`, data);
         let txHash = data.txHash || data.transactionHash || data.hash;
         if (txHash && typeof txHash === "object" && "hash" in txHash) {
           txHash = txHash.hash;