veilioexchange 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+## 0.3.0
+
+### Added
+- **Auction lifecycle (EVM, VeilNFTV4):** `settleAuction`, `finalizeSettlement`, `requestRefund(auctionId, evidenceHash)`,
+  `withdrawRefund`, `getPendingRefund`, `isNftAuction`, `waitForTransaction`. `finalizeSettlement` is the
+  completion path for NFT auctions (`acceptDataset` is blocked on-chain for NFTs); `claimAsset` now throws a
+  clear error for NFT auctions instead of sending a transaction that reverts.
+- **Base Sepolia auctions:** `createVeilioAgent({ chainId: 84532 })` picks the Base Sepolia auction and Services
+  escrow defaults from `VEILIO_DEPLOYMENTS`. New exports: `VEILIO_SUPPORTED_CHAIN_IDS`, `getVeilioDeployment`,
+  `assertVeilioChainId`, `veilAuctionAbi`.
+- **Off-chain Services API helper:** `createVeilioServicesApi({ apiBaseUrl, signer })` with `notifyDeposit`,
+  `submit` (requires `deliveryTxHash`, the on-chain `submitDelivery` tx), `requestRevision`, `approve`,
+  `cancel`, each signed with `signServiceAuth`. It never sends a `network` field; the server derives the
+  chain from the order. Session-authenticated reads: `getOrder`, `getPaymentRequest`, `listConversations`,
+  `getConversationMessages`, `getSession`, `getSessionHeaders`.
+- **Read session auth:** `signServiceSession`, `isServiceSessionFresh`, `encodeServiceAuthHeader`,
+  `SERVICE_AUTH_HEADER` (`x-veilio-auth`), `SERVICE_SESSION_MAX_AGE_MS` (30 min).
+- **Solana auction client:** `settleAuction`, `requestRefund`, `finalizeInspectionTimeout`, `finalizeRefundTimeout`.
+- **Solana escrow:** `platformReviewer` / `platformFeeRecipient` client options used as defaults by `deposit()`.
+
+### Changed
+- Every agent write (`commitBid`, `revealBid`, lifecycle calls) now checks `walletClient.chain` against the
+  agent's `chainId` and throws `CHAIN_MISMATCH` before sending.
+- `PreparedBid.chainId` is the agent's actual chain (was always 97).
+- `createVeilioAgent().services` uses the agent's `chainId` (was always 97).
+- `revealBid` rejects reveals after `revealEndTime` with a hint to call `settleAuction`.
+- `getAuctionResult` adds `chainId` and `winningBid`; `winningBidBnb` is kept as a deprecated alias.
+- Solana `deposit()`: `reviewer` / `feeRecipient` are now optional (default to the platform options) and a
+  reviewer equal to the buyer or seller is rejected. The deployed program still accepts any buyer-chosen
+  reviewer; see the README security note.
+- Solana `reveal_bid` instruction marks the bidder account writable (it receives the over-deposit refund).
+
+## 0.2.0
+
+- Previous published release.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 VEILIO
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 VEILIO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,113 +1,225 @@
-# veilioexchange
-
-TypeScript SDK for **VEILIO**: sealed-bid auctions for digital assets and milestone service escrow, built on [viem](https://viem.sh).
-
-- **Networks:** BNB Smart Chain Testnet (97) and Base Sepolia (84532). Testnet only.
-- **Formats:** ESM and CommonJS, with TypeScript types.
-- **Runtime:** Node.js 18+ or any modern browser.
-
-```sh
-npm install veilioexchange viem
-```
-
-`viem` is a peer dependency, so your app and the SDK share one copy.
-
-## Auctions
-
-```ts
-import { createPublicClient, createWalletClient, http } from 'viem';
-import { bscTestnet } from 'viem/chains';
-import { privateKeyToAccount } from 'viem/accounts';
-import { createVeilioAgent } from 'veilioexchange';
-
-const account = privateKeyToAccount(process.env.AGENT_PRIVATE_KEY as `0x${string}`);
-const publicClient = createPublicClient({ chain: bscTestnet, transport: http() });
-const walletClient = createWalletClient({ account, chain: bscTestnet, transport: http() });
-
-const agent = createVeilioAgent({
-  publicClient,
-  walletClient,
-  account: account.address,
-  apiBaseUrl: 'https://your-veilio-host', // needed for searchAssets / getAssetDetails
-});
-
-const { auctions } = await agent.listAuctions({ limit: 20 });
-const auctionId = auctions[0].id;
-
-// Sealed bid: random 32-byte secret + keccak256 commitment, computed locally.
-const bid = agent.prepareBid(auctionId, '0.05'); // max bid in BNB
-// Store `bid` (including bid.secret) somewhere durable and encrypted.
-// If the secret is lost the bid can never be revealed.
-
-await agent.commitBid(bid, '0.08');   // deposit >= max bid; over-deposit to hide your ceiling
-await agent.revealBid(bid);           // during the Revealing window
-
-const result = await agent.getAuctionResult(auctionId);
-if (result.isWinner) await agent.claimAsset(auctionId);
-```
-
-## Services escrow
-
-```ts
-import { createVeilioServicesClient, signServiceAuth } from 'veilioexchange';
-
-const services = createVeilioServicesClient({
-  publicClient,
-  walletClient,
-  account: account.address,
-  chainId: 97, // or 84532 for Base Sepolia (use matching viem clients)
-});
-
-const orderId = 'srv-order-uuid-101';
-
-const deposit = await services.deposit({
-  orderId,
-  seller: '0xSeller...',
-  deadline: Math.floor(Date.now() / 1000) + 3 * 86400,
-  amount: '0.25',
-});
-await deposit.wait();
-
-const order = await services.getOrder(orderId);      // status: 'Funded'
-await (await services.submitDelivery(orderId, 'ipfs://QmProof')).wait(); // seller
-await (await services.releaseFunds(orderId)).wait(); // buyer; 5% fee on release
-
-// Fee-free exits: services.refund(orderId, reason), services.refundTimeout(orderId),
-// services.dispute(orderId, reason)
-```
-
-### Signed API calls
-
-Off-chain order actions on the VEILIO API carry an EIP-191 signature:
-
-```ts
-const auth = await signServiceAuth(account, 'verify-deposit', orderId);
-
-await fetch(`https://your-veilio-host/api/orders/${orderId}/verify-deposit`, {
-  method: 'POST',
-  headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({ txHash: deposit.txHash, network: 'bnb:97', auth }),
-});
-```
-
-## Contract addresses
-
-Defaults live in `VEILIO_DEPLOYMENTS`. Every client takes a `contractAddress` option to point at your own deployment.
-
-| Network | Auction | Service escrow |
-|---|---|---|
-| BNB Testnet (97) | `0xc12EcD53B9dAE1753409B87f10Bf00684BF7d8B1` | `0x794f1610B5588a55B19D8c82e4381448a388C965` |
-| Base Sepolia (84532) | `0x2a56D1a2C8Ffc63b0b009fceEa9d8d182A17A025` | `0x13C16c508780639E86cA9d4322Ba9739C15e78Af` |
-
-## Errors
-
-Failures are thrown as `VeilioSdkError` with a typed `code` (`INVALID_INPUT`, `CHAIN_MISMATCH`, `WALLET_REQUIRED`, `TRANSACTION_REVERTED`, ...) and a `retryable` flag.
-
-## Security
-
-- Use a dedicated testnet wallet for agents and load its key from the environment. Never commit it.
-- Bid deposits and bidder addresses are public on-chain; only the bid value is sealed until reveal.
-
-## License
-
-MIT
+# veilioexchange
+
+TypeScript SDK for **VEILIO**: sealed-bid auctions for digital assets and milestone service escrow, built on [viem](https://viem.sh).
+
+- **Networks:** BNB Smart Chain Testnet (97), Base Sepolia (84532) and Solana Devnet. Testnet only.
+- **Formats:** ESM and CommonJS, with TypeScript types.
+- **Runtime:** Node.js 18+ or any modern browser.
+
+```sh
+npm install veilioexchange viem
+```
+
+`viem` is a peer dependency, so your app and the SDK share one copy.
+
+## Auctions
+
+```ts
+import { createPublicClient, createWalletClient, http } from 'viem';
+import { bscTestnet } from 'viem/chains';
+import { privateKeyToAccount } from 'viem/accounts';
+import { createVeilioAgent } from 'veilioexchange';
+
+const account = privateKeyToAccount(process.env.AGENT_PRIVATE_KEY as `0x${string}`);
+const publicClient = createPublicClient({ chain: bscTestnet, transport: http() });
+const walletClient = createWalletClient({ account, chain: bscTestnet, transport: http() });
+
+const agent = createVeilioAgent({
+  publicClient,
+  walletClient,
+  account: account.address,
+  chainId: 97, // default; 84532 = Base Sepolia (use viem's baseSepolia clients)
+  apiBaseUrl: 'https://your-veilio-host', // needed for searchAssets / getAssetDetails
+});
+
+const { auctions } = await agent.listAuctions({ limit: 20 });
+const auctionId = auctions[0].id;
+
+// Sealed bid: random 32-byte secret + keccak256 commitment, computed locally.
+const bid = agent.prepareBid(auctionId, '0.05'); // max bid in BNB
+// Store `bid` (including bid.secret) somewhere durable and encrypted.
+// If the secret is lost the bid can never be revealed.
+
+await agent.commitBid(bid, '0.08');   // deposit >= max bid; over-deposit to hide your ceiling
+await agent.revealBid(bid);           // during the Revealing window
+
+// After revealEndTime anyone can settle; a winner moves the auction into Inspection.
+await agent.waitForTransaction(await agent.settleAuction(auctionId));
+
+const result = await agent.getAuctionResult(auctionId);
+if (result.isWinner) {
+  if (await agent.isNftAuction(auctionId)) {
+    // NFT auctions: acceptDataset is blocked on-chain. Once inspection ends,
+    // finalizeSettlement() delivers the NFT and pays the seller (anyone can call it).
+    await agent.finalizeSettlement(auctionId);
+  } else {
+    await agent.claimAsset(auctionId);                          // acceptDataset
+    // or dispute during inspection: agent.requestRefund(auctionId, 'ipfs://QmEvidence')
+  }
+}
+
+// Losing deposits, over-deposits, seller proceeds and approved refunds are pull payments:
+if ((await agent.getPendingRefund()) > 0n) await agent.withdrawRefund();
+```
+
+### Auction lifecycle (VeilNFTV4)
+
+| Step | Method | Who | When |
+|---|---|---|---|
+| Commit | `commitBid(bid, deposit)` | bidder | Bidding |
+| Reveal | `revealBid(bid)` | bidder | Revealing, before `revealEndTime` |
+| Settle | `settleAuction(id)` | anyone | after `revealEndTime` |
+| Accept (datasets only) | `claimAsset(id)` | winner | Inspection, before `inspectionEndTime` |
+| Dispute | `requestRefund(id, evidenceHash)` | winner | Inspection, before `inspectionEndTime` |
+| Complete (required for NFTs) | `finalizeSettlement(id)` | anyone | Inspection, after `inspectionEndTime` |
+| Withdraw | `withdrawRefund()` | anyone with `getPendingRefund() > 0` | any time |
+
+All write methods return the transaction hash; `waitForTransaction(hash)` waits and throws `TRANSACTION_REVERTED` on failure.
+Every write checks that `walletClient.chain` matches the agent's `chainId` and throws `CHAIN_MISMATCH` before sending otherwise.
+A refund request on the EVM contracts has no timeout: it stays open until the VEILIO reviewer resolves it.
+
+## Services escrow
+
+```ts
+import { createVeilioServicesClient, signServiceAuth } from 'veilioexchange';
+
+const services = createVeilioServicesClient({
+  publicClient,
+  walletClient,
+  account: account.address,
+  chainId: 97, // or 84532 for Base Sepolia (use matching viem clients)
+});
+
+const orderId = 'srv-order-uuid-101';
+
+const deposit = await services.deposit({
+  orderId,
+  seller: '0xSeller...',
+  deadline: Math.floor(Date.now() / 1000) + 3 * 86400,
+  amount: '0.25',
+});
+await deposit.wait();
+
+const order = await services.getOrder(orderId);      // status: 'Funded'
+await (await services.submitDelivery(orderId, 'ipfs://QmProof')).wait(); // seller
+await (await services.releaseFunds(orderId)).wait(); // buyer; 5% fee on release
+
+// Fee-free exits: services.refund(orderId, reason), services.refundTimeout(orderId),
+// services.dispute(orderId, reason)
+```
+
+### Keeping the VEILIO app in sync (off-chain API)
+
+The escrow contract moves funds, but the order status in the VEILIO app only changes when the API
+is told about each step. `createVeilioServicesApi` signs every call with `signServiceAuth` (EIP-191):
+
+```ts
+import { createVeilioServicesApi } from 'veilioexchange';
+
+const api = createVeilioServicesApi({ apiBaseUrl: 'https://your-veilio-host', signer: account });
+
+await api.notifyDeposit({ orderId, txHash: deposit.txHash });              // buyer -> InProgress
+const delivery = await services.submitDelivery(orderId, 'ipfs://QmProof');  // seller, on-chain first
+await delivery.wait();
+await api.submit({ orderId, deliveryTxHash: delivery.txHash, description: 'v1 delivered', deliverableReferences: ['ipfs://QmProof'] });
+await api.requestRevision({ orderId, feedback: 'Please add the appendix' }); // buyer
+await api.approve({ orderId, releaseTxHash: release.txHash });            // buyer -> Completed
+await api.cancel({ orderId, reason: 'Mutual cancellation', txHash });     // funded orders need the refund tx
+```
+
+No `network` field is sent: the server derives the chain from the order. `submit` requires the
+confirmed on-chain `submitDelivery` transaction (`deliveryTxHash`); the server checks its
+`DeliverySubmitted` event. For custom requests, `signServiceAuth(account, action, orderId)` returns
+the `{ address, signature, timestamp, nonce }` payload.
+
+Reads use a 30-minute session signed once (`signServiceSession`) and sent in the `x-veilio-auth`
+header; the helper caches it and re-signs a minute before expiry. It never authorizes state changes.
+
+```ts
+const { order } = await api.getOrder(orderId);        // status, paymentStatus, network
+const { conversations } = await api.listConversations();
+await api.getPaymentRequest(paymentRequestId);
+await api.getConversationMessages(conversationId);
+const headers = await api.getSessionHeaders();        // for your own GET requests
+```
+
+## Solana Devnet
+
+Solana lives in its own entry point so EVM-only users never load `@solana/web3.js`:
+
+```sh
+npm install veilioexchange @solana/web3.js
+```
+
+```ts
+import { Connection, Keypair, clusterApiUrl } from '@solana/web3.js';
+import { createVeilioSolanaClient, keypairSigner } from 'veilioexchange/solana';
+
+const connection = new Connection(clusterApiUrl('devnet'), 'confirmed');
+const agentKey = Keypair.fromSecretKey(/* load your devnet key from a secret store */);
+
+const solana = createVeilioSolanaClient({
+  connection,
+  signer: keypairSigner(agentKey), // or a Phantom provider: window.phantom.solana
+  platformReviewer: 'VeilioReviewerWallet...',  // default dispute reviewer for deposit()
+  platformFeeRecipient: 'VeilioFeeWallet...',   // default fee recipient for deposit()
+});
+
+// Sealed-bid auction
+const auctions = await solana.listAuctions();
+const bid = solana.prepareBid(auctions[0].auctionId, '0.25'); // max bid in SOL
+// Store `bid` (salt included) in encrypted storage before committing.
+await solana.commitBid(bid, '0.3');
+await solana.revealBid(bid);
+await solana.settleAuction(bid.auctionId);              // anyone, after reveal_end_time
+// Winner during inspection: solana.acceptDataset(id, seller) or solana.requestRefund(id, sha256Hex)
+// Anyone after inspection:  solana.finalizeInspectionTimeout(id)  (pays the seller)
+// Winner, reviewer silent for 7 days: solana.finalizeRefundTimeout(id)
+await solana.claimRefund(bid.auctionId);                // losing bidders reclaim deposits
+
+// Service escrow (reviewer / feeRecipient default to the platform options above)
+await solana.deposit({
+  orderId: 'ord-1739-abc12',     // up to 32 bytes, or 32-byte hex
+  seller: 'SellerBase58...',
+  amountSol: '1.5',
+  deadline: Math.floor(Date.now() / 1000) + 3 * 86400,
+});
+await solana.submitDelivery('ord-1739-abc12', 'ipfs://QmProof'); // seller
+await solana.releaseFunds('ord-1739-abc12');                     // buyer
+```
+
+Solana support needs Node.js 18+ (it uses `node:crypto`). Base58 addresses are case-sensitive; never lowercase them.
+
+> **Reviewer risk (Solana escrow).** The deployed escrow program stores whatever `reviewer` and
+> `feeRecipient` the buyer passes to `deposit`; there is no on-chain platform config yet. A reviewer
+> controlled by one party can resolve a dispute 100% in its favour. The SDK defaults both to
+> `platformReviewer` / `platformFeeRecipient` and rejects a reviewer equal to the buyer or seller,
+> but a buyer using another client can still pick any wallet. Sellers should check
+> `(await solana.getEscrowOrder(id))?.reviewer` before starting work.
+
+| Program (Devnet) | ID |
+|---|---|
+| Auction | `5Tw1iJGN1hhyRzepbD5eLoaRoZTEiKcqrh2HoZYhYEta` |
+| Service escrow | `5Vj4y8BT74PDe5VwLuDp9agTR5ak4vtZdwxnBfRW3R8s` |
+
+## Contract addresses
+
+Defaults live in `VEILIO_DEPLOYMENTS` (also `getVeilioDeployment(chainId)`) and are picked by `chainId`. Every client takes a `contractAddress` option to point at your own deployment. Both EVM auction addresses are `VeilNFTV4`.
+
+| Network | Auction | Service escrow |
+|---|---|---|
+| BNB Testnet (97) | `0xc12EcD53B9dAE1753409B87f10Bf00684BF7d8B1` | `0x794f1610B5588a55B19D8c82e4381448a388C965` |
+| Base Sepolia (84532) | `0xc12EcD53B9dAE1753409B87f10Bf00684BF7d8B1` | `0x794f1610B5588a55B19D8c82e4381448a388C965` |
+
+## Errors
+
+Failures are thrown as `VeilioSdkError` with a typed `code` (`INVALID_INPUT`, `CHAIN_MISMATCH`, `WALLET_REQUIRED`, `TRANSACTION_REVERTED`, ...) and a `retryable` flag.
+
+## Security
+
+- Use a dedicated testnet wallet for agents and load its key from the environment. Never commit it.
+- Bid deposits and bidder addresses are public on-chain; only the bid value is sealed until reveal.
+
+## License
+
+MIT

package/dist/cjs/auth.d.ts

@@ -28,4 +28,19 @@ export declare function createServiceAuthMessage(input: {
  * (e.g. 'accept-payment-request', 'verify-deposit', 'submit', 'revision', 'approve', 'cancel').
  */
 export declare function signServiceAuth(signer: MessageSigner, action: string, orderId: string): Promise<ServiceAuthPayload>;
+export declare const SERVICE_SESSION_ACTION = "services-session";
+export declare const SERVICE_SESSION_SCOPE = "session";
+/** The server accepts a session for 30 minutes after its timestamp. */
+export declare const SERVICE_SESSION_MAX_AGE_MS: number;
+/** Header that carries the JSON-encoded session payload on GET requests. */
+export declare const SERVICE_AUTH_HEADER = "x-veilio-auth";
+/**
+ * Signs a reusable read/chat session (nonce not consumed by the server). It authorizes reads and
+ * chat only, never escrow state changes, which need `signServiceAuth` per request.
+ */
+export declare function signServiceSession(signer: MessageSigner): Promise<ServiceAuthPayload>;
+/** True while a session is at least one minute away from server-side expiry. */
+export declare function isServiceSessionFresh(auth: ServiceAuthPayload | null | undefined, address?: string): boolean;
+/** `{ 'x-veilio-auth': JSON }` header map for a session payload. */
+export declare function encodeServiceAuthHeader(auth: ServiceAuthPayload): Record<string, string>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cjs/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAGzC,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,GAAG,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CAC1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,MAAM,CAU1C;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAUT;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,CAAC,CAM7B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAGzC,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,GAAG,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CAC1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,MAAM,CAU1C;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAUT;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,CAAC,CAM7B;AAMD,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAC/C,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AACzD,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAErF;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAI5G;AAED,oEAAoE;AACpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExF"}

package/dist/cjs/auth.js

@@ -1,8 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE_AUTH_HEADER = exports.SERVICE_SESSION_MAX_AGE_MS = exports.SERVICE_SESSION_SCOPE = exports.SERVICE_SESSION_ACTION = void 0;
 exports.generateAuthNonce = generateAuthNonce;
 exports.createServiceAuthMessage = createServiceAuthMessage;
 exports.signServiceAuth = signServiceAuth;
+exports.signServiceSession = signServiceSession;
+exports.isServiceSessionFresh = isServiceSessionFresh;
+exports.encodeServiceAuthHeader = encodeServiceAuthHeader;
 const errors_js_1 = require("./errors.js");
 /** Random 16-hex-character nonce from a cryptographically secure source. */
 function generateAuthNonce() {
@@ -39,4 +43,32 @@ async function signServiceAuth(signer, action, orderId) {
     const signature = await signer.signMessage({ message });
     return { address: signer.address, signature, timestamp, nonce };
 }
+// ---------------------------------------------------------------------------
+// Read / chat session (matches the VEILIO server's lib/serviceAuth.ts scheme)
+// ---------------------------------------------------------------------------
+exports.SERVICE_SESSION_ACTION = 'services-session';
+exports.SERVICE_SESSION_SCOPE = 'session';
+/** The server accepts a session for 30 minutes after its timestamp. */
+exports.SERVICE_SESSION_MAX_AGE_MS = 30 * 60 * 1000;
+/** Header that carries the JSON-encoded session payload on GET requests. */
+exports.SERVICE_AUTH_HEADER = 'x-veilio-auth';
+/**
+ * Signs a reusable read/chat session (nonce not consumed by the server). It authorizes reads and
+ * chat only, never escrow state changes, which need `signServiceAuth` per request.
+ */
+function signServiceSession(signer) {
+    return signServiceAuth(signer, exports.SERVICE_SESSION_ACTION, exports.SERVICE_SESSION_SCOPE);
+}
+/** True while a session is at least one minute away from server-side expiry. */
+function isServiceSessionFresh(auth, address) {
+    if (!auth?.signature)
+        return false;
+    if (address && auth.address.toLowerCase() !== address.toLowerCase())
+        return false;
+    return Date.now() - auth.timestamp < exports.SERVICE_SESSION_MAX_AGE_MS - 60 * 1000;
+}
+/** `{ 'x-veilio-auth': JSON }` header map for a session payload. */
+function encodeServiceAuthHeader(auth) {
+    return { [exports.SERVICE_AUTH_HEADER]: JSON.stringify(auth) };
+}
 //# sourceMappingURL=auth.js.map

package/dist/cjs/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":";;AAkBA,8CAUC;AAGD,4DAgBC;AAMD,0CAUC;AA9DD,2CAA6C;AAgB7C,4EAA4E;AAC5E,SAAgB,iBAAiB;IAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,0BAAc,CAAC;YACvB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,kFAAkF;SAC5F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,kFAAkF;AAClF,SAAgB,wBAAwB,CAAC,KAMxC;IACC,OAAO;QACL,kCAAkC;QAClC,WAAW,KAAK,CAAC,MAAM,EAAE;QACzB,aAAa,KAAK,CAAC,OAAO,EAAE;QAC5B,WAAW,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;QACxC,cAAc,KAAK,CAAC,SAAS,EAAE;QAC/B,UAAU,KAAK,CAAC,KAAK,EAAE;QACvB,uEAAuE;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,MAAc,EACd,OAAe;IAEf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":";;;AAkBA,8CAUC;AAGD,4DAgBC;AAMD,0CAUC;AAiBD,gDAEC;AAGD,sDAIC;AAGD,0DAEC;AA7FD,2CAA6C;AAgB7C,4EAA4E;AAC5E,SAAgB,iBAAiB;IAC/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,0BAAc,CAAC;YACvB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,kFAAkF;SAC5F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,kFAAkF;AAClF,SAAgB,wBAAwB,CAAC,KAMxC;IACC,OAAO;QACL,kCAAkC;QAClC,WAAW,KAAK,CAAC,MAAM,EAAE;QACzB,aAAa,KAAK,CAAC,OAAO,EAAE;QAC5B,WAAW,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;QACxC,cAAc,KAAK,CAAC,SAAS,EAAE;QAC/B,UAAU,KAAK,CAAC,KAAK,EAAE;QACvB,uEAAuE;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CACnC,MAAqB,EACrB,MAAc,EACd,OAAe;IAEf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAEjE,QAAA,sBAAsB,GAAG,kBAAkB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,SAAS,CAAC;AAC/C,uEAAuE;AAC1D,QAAA,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzD,4EAA4E;AAC/D,QAAA,mBAAmB,GAAG,eAAe,CAAC;AAEnD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,MAAqB;IACtD,OAAO,eAAe,CAAC,MAAM,EAAE,8BAAsB,EAAE,6BAAqB,CAAC,CAAC;AAChF,CAAC;AAED,gFAAgF;AAChF,SAAgB,qBAAqB,CAAC,IAA2C,EAAE,OAAgB;IACjG,IAAI,CAAC,IAAI,EAAE,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IAClF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,kCAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9E,CAAC;AAED,oEAAoE;AACpE,SAAgB,uBAAuB,CAAC,IAAwB;IAC9D,OAAO,EAAE,CAAC,2BAAmB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/cjs/deployments.js

@@ -15,8 +15,8 @@ exports.VEILIO_DEPLOYMENTS = {
     },
     baseSepolia: {
         chainId: 84532,
-        auction: '0x2a56D1a2C8Ffc63b0b009fceEa9d8d182A17A025',
-        serviceEscrow: '0x13C16c508780639E86cA9d4322Ba9739C15e78Af',
+        auction: '0xc12EcD53B9dAE1753409B87f10Bf00684BF7d8B1',
+        serviceEscrow: '0x794f1610B5588a55B19D8c82e4381448a388C965',
         serviceRegistry: '0x74a6Bf3ed462898F7b3E13e7F4d1c444570bCb88',
     },
 };