@arcblock/did-connect-js 4.0.1-beta.6 → 4.0.2

package/dist/index.cjs

@@ -0,0 +1,2472 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  CloudflareKVStorage: () => kv_default,
+  VERSION: () => import_did_connect_core2.VERSION,
+  WalletAuthenticator: () => wallet_default,
+  WalletHandlers: () => wallet_default2,
+  attachExpress: () => attachExpress,
+  attachHono: () => attachHono,
+  createHonoRequest: () => createHonoRequest,
+  createHonoResponse: () => createHonoResponse,
+  isExpressApp: () => isExpressApp,
+  isHonoApp: () => isHonoApp,
+  parseWalletUA: () => parseWalletUA,
+  prepareBaseUrl: () => prepareBaseUrl
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/authenticator/wallet.ts
+var import_node_querystring = __toESM(require("node:querystring"), 1);
+var import_did = require("@arcblock/did");
+var import_rsa = __toESM(require("@ocap/mcrypto/lib/crypter/rsa"), 1);
+var import_util = require("@ocap/util");
+var import_wallet2 = require("@ocap/wallet");
+var import_debug2 = __toESM(require("debug"), 1);
+
+// src/utils/helpers.ts
+function pick(obj, keys) {
+  const result = {};
+  for (const k of keys) {
+    if (k in obj) result[k] = obj[k];
+  }
+  return result;
+}
+function omit(obj, keys) {
+  const result = {};
+  for (const k of Object.keys(obj)) {
+    if (!keys.includes(k)) result[k] = obj[k];
+  }
+  return result;
+}
+function isEqual(a, b) {
+  if (a === b) return true;
+  if (a == null || b == null) return false;
+  if (typeof a !== typeof b) return false;
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((v3, i) => isEqual(v3, b[i]));
+  }
+  if (typeof a === "object") {
+    const ka = Object.keys(a);
+    const kb = Object.keys(b);
+    if (ka.length !== kb.length) return false;
+    return ka.every((k) => isEqual(a[k], b[k]));
+  }
+  return false;
+}
+function isPlainObject(value) {
+  if (value == null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function random(min, max) {
+  return min + Math.floor(Math.random() * (max - min + 1));
+}
+function cloneDeep(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map((item) => cloneDeep(item));
+  const result = {};
+  for (const key of Object.keys(value)) {
+    result[key] = cloneDeep(value[key]);
+  }
+  return result;
+}
+function shuffle(arr) {
+  const a = [...arr];
+  for (let i = a.length - 1; i > 0; i--) {
+    const j = Math.floor(Math.random() * (i + 1));
+    [a[i], a[j]] = [a[j], a[i]];
+  }
+  return a;
+}
+
+// src/authenticator/base.ts
+var Jwt = __toESM(require("@arcblock/jwt"), 1);
+var import_wallet = require("@ocap/wallet");
+var import_debug = __toESM(require("debug"), 1);
+var debug = (0, import_debug.default)("@arcblock/did-connect-js:authenticator:base");
+var DEFAULT_CHAIN_INFO = { id: "none", host: "none", type: "arcblock" };
+var BaseAuthenticator = class {
+  _validateWallet(wallet, canSign = true) {
+    if (!wallet) {
+      throw new Error("WalletAuthenticator cannot work without wallet");
+    }
+    if (typeof wallet === "function") {
+      return wallet;
+    }
+    if ((0, import_wallet.isValid)(wallet, canSign)) {
+      if (!wallet.pk && wallet.publicKey) {
+        wallet.pk = wallet.publicKey;
+      }
+      if (!wallet.sk && wallet.secretKey) {
+        wallet.sk = wallet.secretKey;
+      }
+      return wallet;
+    }
+    if (canSign && !wallet.sk) {
+      throw new Error("WalletAuthenticator cannot work without wallet.sk");
+    }
+    if (!wallet.pk) {
+      throw new Error("WalletAuthenticator cannot work without wallet.pk");
+    }
+    if (!wallet.address) {
+      throw new Error("WalletAuthenticator cannot work without wallet.address");
+    }
+    try {
+      const fullWallet = (0, import_wallet.fromJSON)(wallet);
+      if (!fullWallet.pk && fullWallet.publicKey) {
+        fullWallet.pk = fullWallet.publicKey;
+      }
+      if (!fullWallet.sk && fullWallet.secretKey) {
+        fullWallet.sk = fullWallet.secretKey;
+      }
+      return fullWallet;
+    } catch (_err) {
+      return wallet;
+    }
+  }
+  /**
+   * Verify a DID auth response sent from DID Wallet
+   *
+   * @method
+   * @param {object} data
+   * @param {string} [locale=en]
+   * @param {boolean} [enforceTimestamp=true]
+   * @returns Promise<boolean>
+   */
+  async _verify(data, fieldPk, fieldInfo, locale = "en", enforceTimestamp = true) {
+    debug("verify", data, locale);
+    const errors2 = {
+      pkMissing: {
+        en: `${fieldPk} is required to complete auth`,
+        zh: `${fieldPk} \u53C2\u6570\u7F3A\u5931`
+      },
+      tokenMissing: {
+        en: `${fieldInfo} is required to complete auth`,
+        zh: "JWT Token \u53C2\u6570\u7F3A\u5931"
+      },
+      pkFormat: {
+        en: `${fieldPk} should be either base58 or base16 format`,
+        zh: `${fieldPk} \u65E0\u6CD5\u89E3\u6790`
+      },
+      tokenInvalid: {
+        en: "Invalid JWT token",
+        zh: "\u7B7E\u540D\u65E0\u6548"
+      },
+      timeInvalid: {
+        en: "JWT token expired, make sure your device time in sync with network",
+        zh: "\u7B7E\u540D\u4E2D\u7684\u65F6\u95F4\u6233\u65E0\u6548\uFF0C\u8BF7\u786E\u4FDD\u8BBE\u5907\u548C\u7F51\u7EDC\u65F6\u95F4\u540C\u6B65"
+      }
+    };
+    const pk = data[fieldPk];
+    const info = data[fieldInfo];
+    if (!pk) {
+      throw new Error(errors2.pkMissing[locale]);
+    }
+    if (!info) {
+      throw new Error(errors2.tokenMissing[locale]);
+    }
+    if (!pk) {
+      throw new Error(errors2.pkFormat[locale]);
+    }
+    if (!await Jwt.verify(info, pk)) {
+      const isValidSig = await Jwt.verify(info, pk, { tolerance: 0, enforceTimestamp: false });
+      if (enforceTimestamp) {
+        const error = isValidSig ? errors2.timeInvalid[locale] : errors2.tokenInvalid[locale];
+        throw new Error(error);
+      }
+    }
+    return Jwt.decode(info);
+  }
+};
+var base_default = BaseAuthenticator;
+
+// src/schema/index.ts
+var import_validator2 = require("@arcblock/validator");
+var v2 = __toESM(require("valibot"), 1);
+
+// src/schema/claims.ts
+var import_validator = require("@arcblock/validator");
+var import_mcrypto = require("@ocap/mcrypto");
+var v = __toESM(require("valibot"), 1);
+var isHttpUrl = (s) => {
+  try {
+    const url2 = new URL(s);
+    return ["http:", "https:"].includes(url2.protocol);
+  } catch {
+    return false;
+  }
+};
+var trustedIssuerSchema = v.union([
+  v.object({
+    did: (0, import_validator.vDID)(),
+    endpoint: v.pipe(v.string(), v.check(isHttpUrl, "Must be a valid HTTP/HTTPS URL"))
+  }),
+  (0, import_validator.vDID)()
+]);
+var optionalUrlSchema = v.optional(
+  v.pipe(
+    v.string(),
+    v.check((s) => {
+      if (s === "") return true;
+      try {
+        const url2 = new URL(s);
+        return ["http:", "https:"].includes(url2.protocol);
+      } catch {
+        return s.startsWith("/");
+      }
+    }, "Must be a valid URL")
+  ),
+  ""
+);
+var requirementSchema = v.object({
+  tokens: v.array(
+    v.object({
+      address: (0, import_validator.vDID)(),
+      value: (0, import_validator.vBNPositive)()
+    })
+  ),
+  assets: v.optional(
+    v.object({
+      address: v.optional(v.array((0, import_validator.vDID)())),
+      parent: v.optional(v.array((0, import_validator.vDID)())),
+      issuer: v.optional(v.array((0, import_validator.vDID)())),
+      amount: v.optional(v.pipe(v.number(), v.check((n) => n > 0, "Must be positive"), v.minValue(1)))
+    })
+  )
+});
+var targetTypeSchema = v.optional(
+  v.object({
+    key: v.optional(
+      v.picklist(Object.keys(import_mcrypto.types.KeyType).map((x) => x.toLowerCase())),
+      "ed25519"
+    ),
+    hash: v.optional(
+      v.picklist(Object.keys(import_mcrypto.types.HashType).map((x) => x.toLowerCase())),
+      "sha3"
+    ),
+    role: v.optional(
+      v.picklist(Object.keys(import_mcrypto.types.RoleType).map((x) => x.toLowerCase().split("_").pop())),
+      "account"
+    ),
+    encoding: v.optional(
+      v.picklist(Object.keys(import_mcrypto.types.EncodingType).map((x) => x.toLowerCase())),
+      "base58"
+    )
+  })
+);
+function withValidate(schema) {
+  return Object.assign(schema, {
+    validate: (data) => {
+      const { value, error } = (0, import_validator.vValidate)(schema, data);
+      if (error) error.toString = () => error.message;
+      return { value, error };
+    }
+  });
+}
+var profileItemValues = ["did", "fullName", "email", "phone", "signature", "avatar", "birthday", "url"];
+var claims_default = (chainInfo2) => {
+  const createStandardFields = (type, description) => ({
+    type: v.optional(v.literal(type), type),
+    description: v.optional(v.pipe(v.string(), v.minLength(1)), description),
+    chainInfo: v.optional(chainInfo2),
+    mfaCode: v.optional(v.array(v.optional(v.pipe(v.number(), v.minValue(10), v.maxValue(99)))), []),
+    meta: v.optional(v.any(), {})
+  });
+  const authPrincipal = withValidate(
+    v.object({
+      ...createStandardFields("authPrincipal", "Please continue with your account"),
+      target: v.optional(v.union([v.literal(""), (0, import_validator.vDID)()]), ""),
+      supervised: v.optional(v.boolean(), false),
+      targetType: targetTypeSchema
+    })
+  );
+  const keyPair = withValidate(
+    v.object({
+      ...createStandardFields("keyPair", "Please create account to continue."),
+      moniker: v.pipe(v.string(), v.regex(/^[a-zA-Z0-9][-a-zA-Z0-9_]{2,128}$/)),
+      declare: v.optional(v.boolean(), true),
+      migrateFrom: v.optional(v.union([v.literal(""), (0, import_validator.vDID)()]), ""),
+      targetType: targetTypeSchema
+    })
+  );
+  const encryptionKey = withValidate(
+    v.object({
+      ...createStandardFields("encryptionKey", "Please provide encryptionKey to continue."),
+      salt: v.string(),
+      delegation: v.optional(v.union([v.literal(""), v.string()]), "")
+    })
+  );
+  const profile = withValidate(
+    v.pipe(
+      v.looseObject({
+        ...createStandardFields("profile", "Please provide your profile to continue.")
+      }),
+      // Rename fields → items (ignoreUndefined: true, override: true)
+      v.transform((obj) => {
+        const { fields, ...rest } = obj;
+        if (fields !== void 0) {
+          return { ...rest, items: fields };
+        }
+        return rest;
+      }),
+      v.rawTransform(({ dataset, addIssue, NEVER }) => {
+        const obj = dataset.value;
+        const items = obj.items ?? ["fullName"];
+        if (!Array.isArray(items) || items.length < 1) {
+          addIssue({ message: '"items" must contain at least 1 items' });
+          return NEVER;
+        }
+        const validSet = new Set(profileItemValues);
+        for (let i = 0; i < items.length; i++) {
+          if (!validSet.has(items[i])) {
+            addIssue({
+              message: `"items[${i}]" must be one of [${[...profileItemValues].join(", ")}]`
+            });
+            return NEVER;
+          }
+        }
+        return { ...obj, items };
+      })
+    )
+  );
+  const signature = withValidate(
+    v.object({
+      ...createStandardFields("signature", "Sign this transaction or message to continue."),
+      typeUrl: v.picklist([
+        "fg:x:delegation",
+        "fg:t:transaction",
+        "mime:text/plain",
+        "mime:text/html",
+        "eth:transaction",
+        "eth:standard-data",
+        "eth:personal-data",
+        "eth:typed-data",
+        "eth:legacy-data"
+      ]),
+      display: v.optional(v.union([v.literal(""), v.string()]), ""),
+      method: v.optional(
+        v.picklist(["none", ...Object.keys(import_mcrypto.types.HashType).map((x) => x.toLowerCase())]),
+        "sha3"
+      ),
+      digest: v.optional(v.union([v.literal(""), v.string()]), ""),
+      origin: v.optional(v.union([v.literal(""), v.string()]), ""),
+      nonce: v.optional(v.union([v.literal(""), v.string()]), ""),
+      requirement: v.optional(requirementSchema)
+    })
+  );
+  const prepareTx = withValidate(
+    v.object({
+      ...createStandardFields("prepareTx", "Prepare and sign this transaction to continue."),
+      display: v.optional(v.union([v.literal(""), v.string()]), ""),
+      partialTx: v.string(),
+      nonce: v.optional(v.union([v.literal(""), v.string()]), ""),
+      requirement: requirementSchema
+    })
+  );
+  const agreement = withValidate(
+    v.object({
+      ...createStandardFields("agreement", "Confirm your agreement to continue."),
+      uri: v.union([
+        v.literal(""),
+        v.pipe(v.string(), v.check(isHttpUrl, "Must be a valid HTTP/HTTPS URL"))
+      ]),
+      method: v.optional(
+        v.picklist(Object.keys(import_mcrypto.types.HashType).map((x) => x.toLowerCase())),
+        "sha2"
+      ),
+      digest: v.string()
+    })
+  );
+  const vcFilterSchema = v.object({
+    type: v.optional(v.pipe(v.array(v.pipe(v.string(), v.minLength(1))), v.minLength(1))),
+    target: v.optional((0, import_validator.vDID)()),
+    trustedIssuers: v.optional(v.pipe(v.array(trustedIssuerSchema), v.minLength(1))),
+    tag: v.optional(v.pipe(v.string(), v.check((s) => s === "" || s.length >= 1, "Must be non-empty or empty string")), ""),
+    ownerDid: v.optional(v.array((0, import_validator.vDID)()), []),
+    claimUrl: optionalUrlSchema,
+    acquireUrl: optionalUrlSchema
+  });
+  const verifiableCredential = withValidate(
+    v.object({
+      ...createStandardFields("verifiableCredential", "Please present a verifiable credential to continue."),
+      optional: v.optional(v.boolean(), false),
+      claimUrl: optionalUrlSchema,
+      acquireUrl: optionalUrlSchema,
+      // v1
+      item: v.optional(v.pipe(v.array(v.pipe(v.string(), v.minLength(1))), v.minLength(1))),
+      target: v.optional((0, import_validator.vDID)()),
+      trustedIssuers: v.optional(v.pipe(v.array(trustedIssuerSchema), v.minLength(1))),
+      tag: v.optional(v.pipe(v.string(), v.check((s) => s === "" || s.length >= 1, "Must be non-empty or empty string")), ""),
+      ownerDid: v.optional(v.array((0, import_validator.vDID)()), []),
+      // v2
+      filters: v.optional(v.array(vcFilterSchema))
+    })
+  );
+  const assetFilterSchema = v.object({
+    address: v.optional((0, import_validator.vDID)()),
+    trustedIssuers: v.optional(v.pipe(v.array(trustedIssuerSchema), v.minLength(1))),
+    trustedParents: v.optional(v.pipe(v.array((0, import_validator.vDID)()), v.minLength(1))),
+    tag: v.optional(v.pipe(v.string(), v.check((s) => s === "" || s.length >= 1, "Must be non-empty or empty string")), ""),
+    ownerDid: v.optional(v.array((0, import_validator.vDID)()), []),
+    consumed: v.optional(v.boolean()),
+    acquireUrl: optionalUrlSchema
+  });
+  const asset = withValidate(
+    v.object({
+      ...createStandardFields("asset", "Please present an on chain asset to continue."),
+      optional: v.optional(v.boolean(), false),
+      // v1
+      address: v.optional((0, import_validator.vDID)()),
+      trustedIssuers: v.optional(v.pipe(v.array(trustedIssuerSchema), v.minLength(1))),
+      trustedParents: v.optional(v.pipe(v.array((0, import_validator.vDID)()), v.minLength(1))),
+      tag: v.optional(v.pipe(v.string(), v.check((s) => s === "" || s.length >= 1, "Must be non-empty or empty string")), ""),
+      ownerDid: v.optional(v.array((0, import_validator.vDID)()), []),
+      consumed: v.optional(v.boolean()),
+      acquireUrl: optionalUrlSchema,
+      // v2
+      filters: v.optional(v.array(assetFilterSchema))
+    })
+  );
+  const assetOrVCFilterSchema = v.object({
+    type: v.optional(v.pipe(v.array(v.pipe(v.string(), v.minLength(1))), v.minLength(1))),
+    address: v.optional((0, import_validator.vDID)()),
+    trustedIssuers: v.optional(v.pipe(v.array(trustedIssuerSchema), v.minLength(1))),
+    trustedParents: v.optional(v.pipe(v.array((0, import_validator.vDID)()), v.minLength(1))),
+    tag: v.optional(v.pipe(v.string(), v.check((s) => s === "" || s.length >= 1, "Must be non-empty or empty string")), ""),
+    ownerDid: v.optional(v.array((0, import_validator.vDID)()), []),
+    consumed: v.optional(v.boolean()),
+    claimUrl: optionalUrlSchema,
+    acquireUrl: optionalUrlSchema
+  });
+  const assetOrVC = withValidate(
+    v.object({
+      ...createStandardFields("assetOrVC", "Please present NFT to continue."),
+      filters: v.pipe(v.array(assetOrVCFilterSchema), v.minLength(1)),
+      optional: v.optional(v.boolean(), false)
+    })
+  );
+  return {
+    authPrincipal,
+    profile,
+    signature,
+    prepareTx,
+    agreement,
+    verifiableCredential,
+    asset,
+    assetOrVC,
+    keyPair,
+    encryptionKey
+  };
+};
+
+// src/schema/index.ts
+var isHttpUrl2 = (s) => {
+  try {
+    const url2 = new URL(s);
+    return ["http:", "https:"].includes(url2.protocol);
+  } catch {
+    return false;
+  }
+};
+var chainInfoSchema = v2.pipe(
+  v2.object({
+    type: v2.optional(v2.picklist(["arcblock", "ethereum", "solona"]), "arcblock"),
+    id: v2.optional(v2.any()),
+    host: v2.optional(v2.any())
+  }),
+  v2.rawTransform(({ dataset, addIssue, NEVER }) => {
+    const obj = dataset.value;
+    let typeSchema;
+    switch (obj.type) {
+      case "arcblock":
+        typeSchema = v2.object({
+          type: v2.literal("arcblock"),
+          id: v2.optional(v2.string(), "none"),
+          host: v2.optional(
+            v2.pipe(
+              v2.string(),
+              v2.check(
+                (s) => s === "none" || isHttpUrl2(s),
+                "must be a valid uri with a scheme matching the http|https pattern"
+              )
+            ),
+            "none"
+          )
+        });
+        break;
+      case "ethereum":
+        typeSchema = v2.object({
+          type: v2.literal("ethereum"),
+          id: v2.pipe(v2.string(), v2.regex(/^[0-9]+$/, "fails to match the numbers pattern")),
+          host: v2.optional(v2.string())
+        });
+        break;
+      case "solona":
+        typeSchema = v2.object({
+          type: v2.literal("solona"),
+          id: v2.pipe(v2.string(), v2.regex(/^[0-9]+$/, "fails to match the numbers pattern")),
+          host: v2.optional(v2.string())
+        });
+        break;
+    }
+    const result = v2.safeParse(typeSchema, obj);
+    if (!result.success) {
+      for (const issue of result.issues) {
+        addIssue({ message: issue.message, path: issue.path });
+      }
+      return NEVER;
+    }
+    const output = {};
+    for (const [k, val] of Object.entries(result.output)) {
+      if (val !== void 0) output[k] = val;
+    }
+    return output;
+  })
+);
+var appInfoSchema = v2.looseObject({
+  name: v2.string(),
+  description: v2.string(),
+  icon: v2.pipe(v2.string(), v2.check(isHttpUrl2, "Must be a valid HTTP/HTTPS URL")),
+  link: v2.optional(v2.pipe(v2.string(), v2.check(isHttpUrl2, "Must be a valid HTTP/HTTPS URL"))),
+  path: v2.optional(v2.pipe(v2.string(), v2.check(isHttpUrl2, "Must be a valid HTTP/HTTPS URL")), "https://abtwallet.io/i/"),
+  publisher: v2.optional((0, import_validator2.vDID)()),
+  updateSubEndpoint: v2.optional(v2.boolean()),
+  subscriptionEndpoint: v2.optional(v2.string()),
+  nodeDid: v2.optional((0, import_validator2.vDID)()),
+  agentDid: v2.optional((0, import_validator2.vDID)())
+});
+function withValidate2(schema) {
+  return Object.assign(schema, {
+    validate: (data) => {
+      const { value, error } = (0, import_validator2.vValidate)(schema, data);
+      if (error) error.toString = () => error.message;
+      return { value, error };
+    },
+    validateAsync: (data) => {
+      const { value, error } = (0, import_validator2.vValidate)(schema, data);
+      return error ? Promise.reject(new Error(error.message)) : Promise.resolve(value);
+    }
+  });
+}
+var chainInfo = withValidate2(chainInfoSchema);
+var appInfo = withValidate2(appInfoSchema);
+var claims = claims_default(chainInfoSchema);
+
+// src/authenticator/wallet.ts
+var debug2 = (0, import_debug2.default)("@arcblock/did-connect-js:authenticator:wallet");
+var DEFAULT_TIMEOUT = 8e3;
+var MFA_CODE_COUNT = 3;
+var WalletAuthenticator = class _WalletAuthenticator extends base_default {
+  wallet;
+  appInfo;
+  memberAppInfo;
+  chainInfo;
+  delegator;
+  delegation;
+  baseUrl;
+  tokenKey;
+  timeout;
+  txEncoder;
+  static formatDisplay(display) {
+    if (!display) {
+      return "";
+    }
+    if (display?.type && display.content) {
+      return JSON.stringify(pick(display, ["type", "content"]));
+    }
+    try {
+      const parsed = JSON.parse(display);
+      if (parsed?.type && parsed.content) {
+        return display;
+      }
+      return "";
+    } catch (_err) {
+      return "";
+    }
+  }
+  /**
+   * Creates an instance of DID Authenticator.
+   *
+   * @class
+   * @param {object} config
+   * @param {WalletObject|Function} config.wallet - wallet instance {@see @ocap/wallet} or a function that returns wallet instance
+   * @param {WalletObject|Function} [config.delegator] - the party that authorizes `wallet` to perform actions on behalf of `wallet`
+   * @param {string|Function} [config.delegation] - the jwt token that proves delegation relationship
+   * @param {ApplicationInfo|Function} config.appInfo - application basic info or a function that returns application info
+   * @param {ChainInfo|Function} config.chainInfo - application chain info or a function that returns chain info
+   * @param {Number} [config.timeout=8000] - timeout in milliseconds when generating claim
+   * @param {object} [config.baseUrl] - url to assemble wallet request uri, can be inferred from request object
+   * @param {string} [config.tokenKey='_t_'] - query param key for `token`
+   */
+  constructor({
+    wallet,
+    appInfo: appInfo2,
+    memberAppInfo,
+    delegator,
+    delegation,
+    timeout = DEFAULT_TIMEOUT,
+    chainInfo: chainInfo2 = DEFAULT_CHAIN_INFO,
+    baseUrl = "",
+    tokenKey = "_t_",
+    txEncoder
+  }) {
+    super();
+    this.wallet = this._validateWallet(wallet, false);
+    this.appInfo = this._validateAppInfo(appInfo2);
+    this.memberAppInfo = this._validateAppInfo(memberAppInfo, true);
+    this.chainInfo = chainInfo2;
+    this.delegator = delegator;
+    this.delegation = delegation;
+    this.baseUrl = baseUrl;
+    this.tokenKey = tokenKey;
+    this.timeout = timeout;
+    this.txEncoder = txEncoder;
+    if (!this.appInfo.link) {
+      this.appInfo.link = this.baseUrl;
+    }
+  }
+  /**
+   * Generate a deep link url that can be displayed as QRCode for DID Wallet to consume
+   *
+   * @method
+   * @param {object} params
+   * @param {string} params.baseUrl - baseUrl inferred from request object
+   * @param {string} params.pathname - wallet callback pathname
+   * @param {string} params.token - action token
+   * @param {object} params.query - params that should be persisted in wallet callback url
+   * @returns {string}
+   */
+  uri({
+    baseUrl,
+    pathname = "",
+    token = "",
+    query = {}
+  } = {}) {
+    const params = { ...query, [this.tokenKey]: token };
+    const payload = {
+      action: "requestAuth",
+      url: encodeURIComponent(`${this.baseUrl || baseUrl}${pathname}?${import_node_querystring.default.stringify(params)}`)
+    };
+    const uri = `https://abtwallet.io/i/?${import_node_querystring.default.stringify(payload)}`;
+    debug2("uri", { token, pathname, uri, params, payload });
+    return uri;
+  }
+  /**
+   * Compute public url to return to wallet
+   *
+   * @method
+   * @param {string} pathname
+   * @param {object} params
+   * @returns {string}
+   */
+  getPublicUrl(pathname, params = {}, baseUrl = "") {
+    return `${this.baseUrl || baseUrl}${pathname}?${import_node_querystring.default.stringify(params)}`;
+  }
+  /**
+   * Sign a plain response, usually on auth success or error
+   *
+   * @method
+   * @param {object} params
+   * @param {object} params.response - response
+   * @param {string} params.errorMessage - error message, default to empty
+   * @param {string} params.successMessage - success message, default to empty
+   * @param {string} params.nextWorkflow - https://github.com/ArcBlock/ABT-DID-Protocol#concatenate-multiple-workflow
+   * @param {string} params.nextUrl - tell wallet do open this url in webview
+   * @param {object} params.cookies - key-value pairs to be set as cookie before open nextUrl
+   * @param {object} params.storages - key-value pairs to be set as localStorage before open nextUrl
+   * @param {string} baseUrl
+   * @param {object} request
+   * @returns {Promise<object>} { appPk, agentPk, authInfo }
+   */
+  async signResponse({
+    response = {},
+    errorMessage = "",
+    successMessage = "",
+    nextWorkflow = "",
+    nextUrl = "",
+    cookies = {},
+    storages = {}
+  }, baseUrl, request, extraParams = {}) {
+    const context = request.context || {};
+    const infoParams = { baseUrl, request, ...context, extraParams };
+    const [wallet, delegator, delegation] = await Promise.all([
+      this.getWalletInfo(infoParams),
+      this.getDelegator(infoParams),
+      this.getDelegation(infoParams)
+    ]);
+    const [appInfo2, memberAppInfo] = await Promise.all([
+      this.getAppInfo({ ...infoParams, wallet, delegator }, "appInfo"),
+      this.getAppInfo({ ...infoParams, wallet, delegator }, "memberAppInfo")
+    ]);
+    const didwallet = request.context.wallet;
+    const payload = {
+      appInfo: appInfo2,
+      memberAppInfo,
+      status: errorMessage ? "error" : "ok",
+      errorMessage: errorMessage || "",
+      successMessage: successMessage || "",
+      nextWorkflow: nextWorkflow || "",
+      nextUrl: nextUrl || "",
+      cookies: cookies || {},
+      storages: storages || "",
+      response
+    };
+    if (delegator) {
+      payload.iss = (0, import_util.toDid)(delegator.address);
+      payload.agentDid = (0, import_util.toDid)(wallet.address);
+      payload.verifiableClaims = [{ type: "certificate", content: delegation }];
+    }
+    const result = {
+      appPk: (0, import_util.toBase58)(wallet.pk),
+      authInfo: await wallet.signJWT(payload, true, didwallet ? didwallet.jwt : void 0)
+    };
+    if (delegator) {
+      result.appPk = (0, import_util.toBase58)(delegator.pk);
+      result.agentPk = (0, import_util.toBase58)(wallet.pk);
+    }
+    return result;
+  }
+  /**
+   * Sign a auth response that returned to wallet: tell the wallet the appInfo/chainInfo
+   *
+   * @method
+   * @param {object} params
+   * @param {object} params.claims - info required by application to complete the auth
+   * @param {string} params.pathname - pathname to assemble callback url
+   * @param {string} params.baseUrl - baseUrl
+   * @param {object} params.challenge - random challenge to be included in the body
+   * @param {object} params.extraParams - extra query params and locale
+   * @param {object} params.request
+   * @param {object} params.context
+   * @param {string} params.context.token - action token
+   * @param {number} params.context.currentStep - current step
+   * @param {string} [params.context.sharedKey] - shared key between app and wallet
+   * @param {string} [params.context.encryptionKey] - encryption key from wallet
+   * @param {Function} [params.context.mfaCode] - function used to generate mfa code
+   * @param {string} params.context.userDid - decoded from req.query, base58
+   * @param {string} params.context.userPk - decoded from req.query, base58
+   * @param {string} params.context.didwallet - DID Wallet os and version
+   * @returns {Promise<object>} { appPk, agentPk, sharedKey, authInfo }
+   */
+  async sign({
+    context,
+    request,
+    claims: claims2,
+    pathname = "",
+    baseUrl = "",
+    challenge = "",
+    extraParams = {}
+  }) {
+    const claimsInfo = await this.tryWithTimeout(
+      () => this.genRequestedClaims({
+        claims: claims2,
+        context: { baseUrl, request, ...context },
+        extraParams
+      })
+    );
+    if (claimsInfo.filter((x) => x.mfaCode && x.mfaCode.length > 0).length > 1) {
+      throw new Error("Multiple MFA is not supported when sending more than 1 claim");
+    }
+    const tmp = claimsInfo.find((x) => isEqual(this._isValidChainInfo(x.chainInfo), DEFAULT_CHAIN_INFO) === false);
+    const infoParams = { baseUrl, request, ...context, extraParams };
+    const [wallet, delegator, delegation, chainInfo2] = await Promise.all([
+      this.getWalletInfo(infoParams),
+      this.getDelegator(infoParams),
+      this.getDelegation(infoParams),
+      this.getChainInfo(infoParams, tmp?.chainInfo)
+    ]);
+    const [appInfo2, memberAppInfo] = await Promise.all([
+      this.getAppInfo({ ...infoParams, wallet, delegator }, "appInfo"),
+      this.getAppInfo({ ...infoParams, wallet, delegator }, "memberAppInfo")
+    ]);
+    const payload = {
+      action: "responseAuth",
+      challenge,
+      appInfo: appInfo2,
+      memberAppInfo,
+      chainInfo: chainInfo2,
+      requestedClaims: claimsInfo.map((x) => {
+        delete x.chainInfo;
+        return x;
+      }),
+      url: `${this.baseUrl || baseUrl}${pathname}?${import_node_querystring.default.stringify({ [this.tokenKey]: context.token })}`
+    };
+    if (delegator) {
+      payload.iss = (0, import_util.toDid)(delegator.address);
+      payload.agentDid = (0, import_util.toDid)(wallet.address);
+      payload.verifiableClaims = [{ type: "certificate", content: delegation }];
+    }
+    const version = context.didwallet ? context.didwallet.jwt : void 0;
+    const result = {
+      appPk: (0, import_util.toBase58)(wallet.pk),
+      authInfo: await wallet.signJWT(payload, true, version),
+      sensitive: claimsInfo.every((x) => ["keyPair", "encryptionKey"].includes(x.type))
+    };
+    if (result.sensitive && context.sharedKey && context.encryptionKey) {
+      try {
+        const pk = (0, import_util.fromBase58)(context.encryptionKey).toString("utf8");
+        result.sharedKey = import_rsa.default.encrypt(context.sharedKey, pk, "base58");
+      } catch (err) {
+        console.error("Failed to encrypt shared key", err);
+      }
+    }
+    if (delegator) {
+      result.appPk = (0, import_util.toBase58)(delegator.pk);
+      result.agentPk = (0, import_util.toBase58)(wallet.pk);
+    }
+    return result;
+  }
+  /**
+   * Determine chainInfo on the fly
+   *
+   * @param {object} params - contains the context of this request
+   * @param {object|undefined} [info=undefined] - chain info object or function
+   * @returns {Promise<ChainInfo>}
+   * @memberof WalletAuthenticator
+   */
+  async getChainInfo(params, info) {
+    if (info && this._isValidChainInfo(info)) {
+      return info;
+    }
+    if (typeof this.chainInfo === "function") {
+      const result = await this.tryWithTimeout(() => this.chainInfo(params));
+      if (this._isValidChainInfo(result)) {
+        return result;
+      }
+    }
+    if (this.chainInfo && this._isValidChainInfo(this.chainInfo)) {
+      return this.chainInfo;
+    }
+    return DEFAULT_CHAIN_INFO;
+  }
+  /**
+   * Determine appInfo/memberAppInfo on the fly
+   *
+   * @param {object} params - contains the context of this request
+   * @param {string} key - appInfo | memberAppInfo
+   * @returns {Promise<ApplicationInfo>}
+   * @memberof WalletAuthenticator
+   */
+  async getAppInfo(params, key = "appInfo") {
+    if (typeof this[key] === "function") {
+      const info = await this.tryWithTimeout(() => this[key](params));
+      if (info) {
+        if (!info.link) {
+          info.link = params.baseUrl;
+        }
+        if (!info.publisher) {
+          info.publisher = (0, import_util.toDid)(params.delegator ? params.delegator.address : params.wallet.address);
+        }
+      }
+      return this._validateAppInfo(info, key === "memberAppInfo");
+    }
+    if (this[key] && !this[key].publisher) {
+      this[key].publisher = (0, import_util.toDid)(params.delegator ? params.delegator.address : params.wallet.address);
+    }
+    return this[key];
+  }
+  async getWalletInfo(params) {
+    if (typeof this.wallet === "function") {
+      const result = await this.tryWithTimeout(() => this.wallet(params));
+      return this._validateWallet(result, false);
+    }
+    return this.wallet;
+  }
+  async getDelegator(params) {
+    if (typeof this.delegator === "function") {
+      const result = await this.tryWithTimeout(() => this.delegator(params));
+      return result ? this._validateWallet(result, false) : null;
+    }
+    return this.delegator;
+  }
+  async getDelegation(params) {
+    if (typeof this.delegation === "function") {
+      const result = await this.tryWithTimeout(() => this.delegation(params));
+      return result;
+    }
+    return this.delegation;
+  }
+  /**
+   * Verify a DID auth response sent from DID Wallet
+   *
+   * @method
+   * @param {object} data
+   * @param {string} [locale=en]
+   * @param {boolean} [enforceTimestamp=true]
+   * @returns Promise<boolean>
+   */
+  async verify(data, locale = "en", enforceTimestamp = true) {
+    const {
+      iss,
+      iat,
+      challenge = "",
+      action = "responseAuth",
+      requestedClaims
+    } = await this._verify(data, "userPk", "userInfo", locale, enforceTimestamp);
+    debug2("verify.context", { userPk: data.userPk, userDid: (0, import_did.toAddress)(iss), action, challenge });
+    debug2("verify.claims", requestedClaims);
+    return {
+      token: data.token,
+      userDid: (0, import_did.toAddress)(iss),
+      userPk: data.userPk,
+      claims: requestedClaims,
+      action,
+      challenge,
+      timestamp: iat
+    };
+  }
+  // ---------------------------------------
+  // Request claim related methods
+  // ---------------------------------------
+  genRequestedClaims({
+    claims: claims2,
+    context,
+    extraParams
+  }) {
+    return Promise.all(
+      Object.keys(claims2).map(async (x) => {
+        let name = x;
+        let claim = claims2[x];
+        if (Array.isArray(claims2[x])) {
+          [name, claim] = claims2[x];
+        }
+        if (!claims[name]) {
+          throw new Error(`Unsupported claim type ${name}`);
+        }
+        const fn = typeof this[name] === "function" ? name : "getClaimInfo";
+        const result = await this[fn]({ claim, context, extraParams });
+        if (result.mfa && typeof context.mfaCode === "function") {
+          result.mfaCode = [await context.mfaCode()];
+          while (result.mfaCode.length < MFA_CODE_COUNT) {
+            const noise = random(10, 99);
+            if (result.mfaCode.includes(noise) === false) {
+              result.mfaCode.push(noise);
+            }
+          }
+          result.mfaCode = shuffle(result.mfaCode);
+        }
+        const { value, error } = claims[name].validate(result);
+        if (error) {
+          throw new Error(`Invalid ${name} claim: ${error.message}`);
+        }
+        return value;
+      })
+    );
+  }
+  async getClaimInfo({
+    claim,
+    context,
+    extraParams
+  }) {
+    const { userDid, userPk, didwallet } = context;
+    const result = typeof claim === "function" ? await claim({
+      userDid: userDid ? (0, import_did.toAddress)(userDid) : "",
+      userPk: userPk || "",
+      didwallet,
+      extraParams,
+      context
+    }) : claim;
+    const infoParams = { ...context, ...extraParams };
+    const chainInfo2 = await this.getChainInfo(infoParams, result.chainInfo);
+    result.chainInfo = chainInfo2;
+    return result;
+  }
+  // Request wallet to sign something: transaction/text/html/image
+  async signature({
+    claim,
+    context,
+    extraParams
+  }) {
+    const {
+      data,
+      type = "mime:text/plain",
+      digest = "",
+      method = "sha3",
+      // set this to `none` to instruct wallet not to hash before signing
+      wallet,
+      sender,
+      display,
+      description: desc,
+      chainInfo: chainInfo2,
+      meta = {},
+      mfa = false,
+      nonce = "",
+      requirement = { tokens: [], assets: {} }
+    } = await this.getClaimInfo({
+      claim,
+      context,
+      extraParams
+    });
+    debug2("claim.signature", { data, digest, type, sender, context, nonce, requirement });
+    if (!data && !digest) {
+      throw new Error("Signature claim requires either data or digest to be provided");
+    }
+    const description = desc || "Sign this transaction to continue.";
+    if (type.endsWith("Tx")) {
+      if (!chainInfo2.host) {
+        throw new Error("Invalid chainInfo when trying to encoding transaction");
+      }
+      if (!this.txEncoder) {
+        throw new Error(
+          `Transaction encoding for "${type}" requires a txEncoder. Pass txEncoder to WalletAuthenticator or install @ocap/client.`
+        );
+      }
+      if (!data.pk) {
+        data.pk = context.userPk;
+      }
+      try {
+        const txBuffer = await this.txEncoder({
+          type,
+          data,
+          wallet: wallet || (0, import_wallet2.fromAddress)(sender || context.userDid),
+          chainHost: chainInfo2.host
+        });
+        return {
+          type: "signature",
+          description,
+          typeUrl: "fg:t:transaction",
+          origin: (0, import_util.toBase58)(txBuffer),
+          method,
+          display: _WalletAuthenticator.formatDisplay(display),
+          digest: "",
+          chainInfo: chainInfo2,
+          meta,
+          mfa,
+          nonce,
+          requirement
+        };
+      } catch (err) {
+        throw new Error(`Failed to encode transaction: ${err.message}`);
+      }
+    }
+    if (type === "fg:t:transaction") {
+      return {
+        type: "signature",
+        description,
+        typeUrl: "fg:t:transaction",
+        origin: (0, import_util.toBase58)(data),
+        display: _WalletAuthenticator.formatDisplay(display),
+        method,
+        digest: "",
+        chainInfo: chainInfo2,
+        meta,
+        mfa,
+        nonce,
+        requirement
+      };
+    }
+    return {
+      type: "signature",
+      description: desc || "Sign this message to continue.",
+      origin: data ? (0, import_util.toBase58)(data) : "",
+      typeUrl: type,
+      display: _WalletAuthenticator.formatDisplay(display),
+      method,
+      digest,
+      chainInfo: chainInfo2,
+      meta,
+      mfa,
+      nonce,
+      requirement
+    };
+  }
+  // Request wallet to complete and sign a partial tx to broadcasting
+  // Usually used in payment scenarios
+  // The wallet can leverage multiple input capabilities of the chain
+  async prepareTx({
+    claim,
+    context,
+    extraParams
+  }) {
+    const {
+      partialTx,
+      requirement = { tokens: [], assets: {} },
+      type,
+      display,
+      wallet,
+      sender,
+      description: desc,
+      chainInfo: chainInfo2,
+      meta = {},
+      mfa = false,
+      nonce = ""
+    } = await this.getClaimInfo({
+      claim,
+      context,
+      extraParams
+    });
+    debug2("claim.prepareTx", { partialTx, requirement, type, sender, context });
+    if (!partialTx || !requirement) {
+      throw new Error("prepareTx claim requires both partialTx and requirement to be provided");
+    }
+    const description = desc || "Prepare and sign this transaction to continue.";
+    if (type?.endsWith("Tx")) {
+      if (!chainInfo2.host) {
+        throw new Error("Invalid chainInfo when trying to encoding partial transaction");
+      }
+      if (!this.txEncoder) {
+        throw new Error(
+          `Transaction encoding for "${type}" requires a txEncoder. Pass txEncoder to WalletAuthenticator or install @ocap/client.`
+        );
+      }
+      if (!partialTx.pk) {
+        partialTx.pk = context.userPk;
+      }
+      try {
+        const txBuffer = await this.txEncoder({
+          type,
+          data: partialTx,
+          wallet: wallet || (0, import_wallet2.fromAddress)(sender || context.userDid),
+          chainHost: chainInfo2.host
+        });
+        return {
+          type: "prepareTx",
+          description,
+          partialTx: (0, import_util.toBase58)(txBuffer),
+          display: _WalletAuthenticator.formatDisplay(display),
+          requirement,
+          chainInfo: chainInfo2,
+          meta,
+          mfa,
+          nonce
+        };
+      } catch (err) {
+        throw new Error(`Failed to encode partial transaction: ${err.message}`);
+      }
+    }
+    return {
+      type: "prepareTx",
+      description,
+      partialTx: (0, import_util.toBase58)(partialTx),
+      requirement,
+      display: _WalletAuthenticator.formatDisplay(display),
+      chainInfo: chainInfo2,
+      meta,
+      mfa,
+      nonce
+    };
+  }
+  _validateAppInfo(info, allowEmpty = false) {
+    if (typeof info === "function") {
+      return info;
+    }
+    if (!info) {
+      if (allowEmpty === false) {
+        throw new Error("Wallet authenticator can not work with invalid appInfo: empty");
+      }
+      return null;
+    }
+    const { value, error } = appInfo.validate(info);
+    if (error) {
+      throw new Error(`Wallet authenticator can not work with invalid appInfo: ${error.message}`);
+    }
+    return value;
+  }
+  _isValidChainInfo(x) {
+    const { error } = chainInfo.validate(x);
+    return !error;
+  }
+  tryWithTimeout(asyncFn, label = "") {
+    if (typeof asyncFn !== "function") {
+      throw new Error("asyncFn must be a valid function when calling tryWithTimeout");
+    }
+    const timeout = Number(this.timeout) || DEFAULT_TIMEOUT;
+    const inferredLabel = label || asyncFn.name || asyncFn.toString();
+    const invocationStack = new Error(`Timeout at: ${inferredLabel}`).stack;
+    return new Promise(async (resolve, reject) => {
+      const timer = setTimeout(() => {
+        const error = new Error(`Async operation (${inferredLabel}) did not complete within ${timeout} ms`);
+        error.stack = invocationStack;
+        error.name = "TIMEOUT";
+        reject(error);
+      }, timeout);
+      try {
+        const result = await asyncFn();
+        resolve(result);
+      } catch (err) {
+        reject(err);
+      } finally {
+        clearTimeout(timer);
+      }
+    });
+  }
+};
+var wallet_default = WalletAuthenticator;
+
+// src/handlers/wallet.ts
+var import_debug4 = __toESM(require("debug"), 1);
+
+// src/adapters/detect.ts
+function isExpressApp(app) {
+  return typeof app?.set === "function" && typeof app?.engine === "function";
+}
+function isHonoApp(app) {
+  return typeof app?.fetch === "function" && !isExpressApp(app);
+}
+
+// src/adapters/express.ts
+function attachExpress({ app, prefix, action, handlers }) {
+  const pathname = `${prefix}/${action}/auth`;
+  const {
+    generateSession,
+    checkSession,
+    expireSession,
+    onAuthRequest,
+    onAuthResponse,
+    ensureContext,
+    ensureSignedJson
+  } = handlers;
+  app.get(`${prefix}/${action}/token`, generateSession);
+  app.post(`${prefix}/${action}/token`, generateSession);
+  app.get(`${prefix}/${action}/status`, ensureContext, checkSession);
+  app.get(`${prefix}/${action}/timeout`, ensureContext, expireSession);
+  app.get(pathname, ensureContext, ensureSignedJson, onAuthRequest);
+  app.post(pathname, ensureContext, ensureSignedJson, onAuthResponse);
+  app.get(`${pathname}/submit`, ensureContext, ensureSignedJson, onAuthResponse);
+  return { generateSession, expireSession, checkSession, onAuthRequest, onAuthResponse };
+}
+
+// src/adapters/hono.ts
+function parseCookieHeader(header) {
+  const cookies = {};
+  if (!header) return cookies;
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx > 0) {
+      const key = pair.slice(0, idx).trim();
+      const val = pair.slice(idx + 1).trim();
+      cookies[key] = decodeURIComponent(val);
+    }
+  }
+  return cookies;
+}
+function negotiateLanguage(acceptHeader, ...langs) {
+  if (!acceptHeader || langs.length === 0) return langs[0] || false;
+  const lower = acceptHeader.toLowerCase();
+  for (const lang of langs) {
+    const prefix = lang.toLowerCase().split("-")[0];
+    if (lower.includes(lang.toLowerCase()) || lower.includes(prefix)) {
+      return lang;
+    }
+  }
+  return langs[0] || false;
+}
+function createHonoRequest(c, bodyCache = {}) {
+  const url2 = new URL(c.req.url);
+  const rawHeaders = {};
+  if (c.req.raw?.headers) {
+    c.req.raw.headers.forEach((value, key) => {
+      rawHeaders[key.toLowerCase()] = value;
+    });
+  }
+  return {
+    body: bodyCache,
+    query: Object.fromEntries(url2.searchParams.entries()),
+    params: typeof c.req.param === "function" ? c.req.param() : {},
+    headers: rawHeaders,
+    cookies: parseCookieHeader(rawHeaders.cookie || ""),
+    protocol: url2.protocol.replace(":", ""),
+    originalUrl: url2.pathname + url2.search,
+    get(name) {
+      return rawHeaders[name.toLowerCase()];
+    },
+    acceptsLanguages(...langs) {
+      return negotiateLanguage(rawHeaders["accept-language"] || "", ...langs);
+    },
+    raw: c
+  };
+}
+function createHonoResponse() {
+  let result = null;
+  const response = {
+    jsonp(data) {
+      result = { statusCode: 200, body: data };
+    },
+    json(data) {
+      result = { statusCode: 200, body: data };
+    },
+    status(code) {
+      return {
+        json(data) {
+          result = { statusCode: code, body: data };
+        }
+      };
+    },
+    _getResult() {
+      return result;
+    }
+  };
+  return response;
+}
+function wrapHandler(middlewares, handler) {
+  return async (c) => {
+    let body = {};
+    try {
+      const text = await c.req.text();
+      if (text) {
+        const contentType = c.req.header("content-type") || "";
+        if (contentType.includes("json")) {
+          body = JSON.parse(text);
+        } else if (contentType.includes("urlencoded")) {
+          body = Object.fromEntries(new URLSearchParams(text).entries());
+        }
+      }
+    } catch {
+    }
+    const req = createHonoRequest(c, body);
+    const res = createHonoResponse();
+    for (const mw of middlewares) {
+      let nextCalled = false;
+      await mw(req, res, () => {
+        nextCalled = true;
+      });
+      if (!nextCalled) {
+        const r2 = res._getResult();
+        if (r2) return c.json(r2.body, r2.statusCode);
+        return c.json({ error: "Unknown error" }, 500);
+      }
+    }
+    await handler(req, res);
+    const r = res._getResult();
+    return c.json(r?.body ?? {}, r?.statusCode ?? 200);
+  };
+}
+function attachHono({ app, prefix, action, handlers }) {
+  const pathname = `${prefix}/${action}/auth`;
+  const {
+    generateSession,
+    checkSession,
+    expireSession,
+    onAuthRequest,
+    onAuthResponse,
+    ensureContext,
+    ensureSignedJson
+  } = handlers;
+  app.use(`${prefix}/${action}/*`, async (c, next) => {
+    c.header("Access-Control-Allow-Origin", "*");
+    c.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    c.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    if (c.req.method === "OPTIONS") {
+      return c.text("", 204);
+    }
+    await next();
+  });
+  app.get(`${prefix}/${action}/token`, wrapHandler([], generateSession));
+  app.post(`${prefix}/${action}/token`, wrapHandler([], generateSession));
+  app.get(`${prefix}/${action}/status`, wrapHandler([ensureContext], checkSession));
+  app.get(`${prefix}/${action}/timeout`, wrapHandler([ensureContext], expireSession));
+  app.get(pathname, wrapHandler([ensureContext, ensureSignedJson], onAuthRequest));
+  app.post(pathname, wrapHandler([ensureContext, ensureSignedJson], onAuthResponse));
+  app.get(`${pathname}/submit`, wrapHandler([ensureContext, ensureSignedJson], onAuthResponse));
+  return { generateSession, expireSession, checkSession, onAuthRequest, onAuthResponse };
+}
+
+// src/handlers/base.ts
+var import_node_events = require("node:events");
+
+// src/protocol.ts
+var import_jwt = require("@arcblock/jwt");
+var import_aes = __toESM(require("@ocap/mcrypto/lib/crypter/aes"), 1);
+var import_util2 = require("@ocap/util");
+var import_did_connect_core = require("@arcblock/did-connect-core");
+var VERSION = "1.0.0";
+var decrypt = (data, config = {}, dataKey = "userInfo") => {
+  try {
+    (0, import_jwt.decode)(data[dataKey]);
+    return data;
+  } catch {
+  }
+  if (config.sharedKey && data.version === VERSION) {
+    data[dataKey] = import_aes.default.decrypt((0, import_util2.fromBase58)(data[dataKey]), config.sharedKey, "buffer").toString("utf8");
+  }
+  return data;
+};
+var encrypt = (data, config = {}, dataKey = "authInfo") => {
+  const { clientVersion, sharedKey } = config || {};
+  if (data.sensitive && sharedKey && clientVersion === VERSION) {
+    data.version = VERSION;
+    data[dataKey] = import_aes.default.encrypt(data[dataKey], sharedKey, "base58");
+  }
+  delete data.sensitive;
+  return data;
+};
+var PROTECTED_KEYS = ["challenge", "nonce", "sharedKey", "encryptionKey"];
+var SESSION_STATUS = {
+  CREATED: "created",
+  SUCCEED: "succeed",
+  ERROR: "error",
+  BUSY: "busy",
+  SCANNED: "scanned",
+  FORBIDDEN: "forbidden"
+};
+
+// src/handlers/base.ts
+var BaseHandler = class extends import_node_events.EventEmitter {
+  authenticator;
+  tokenStorage;
+  pathTransformer;
+  onConnect;
+  /**
+   * Creates an instance of DID Auth Handlers.
+   *
+   * @class
+   * @param {object} config
+   * @param {function} config.pathTransformer - function to transform path when generate action;
+   * @param {object} config.tokenStorage - function to generate action token
+   * @param {object} config.authenticator - Authenticator instance that can to jwt sign/verify
+   * @param {function} [config.onConnect=noop] - function called when wallet selected did
+   */
+  constructor({
+    pathTransformer,
+    tokenStorage,
+    authenticator,
+    onConnect
+  }) {
+    super();
+    this.authenticator = authenticator;
+    this.tokenStorage = tokenStorage;
+    this.tokenStorage.on("create", (data) => this.emit("created", data));
+    this.tokenStorage.on("destroy", (token) => this.emit("deleted", { token }));
+    this.tokenStorage.on("update", async (data) => {
+      if (!data) {
+        return;
+      }
+      const payload = await this.tokenStorage.read(data.token);
+      this.emit("updated", omit(payload, PROTECTED_KEYS));
+    });
+    if (typeof pathTransformer === "function") {
+      this.pathTransformer = pathTransformer;
+    } else {
+      this.pathTransformer = (v3) => v3;
+    }
+    if (typeof onConnect === "function") {
+      this.onConnect = onConnect;
+    } else {
+      this.onConnect = () => {
+      };
+    }
+  }
+};
+var base_default2 = BaseHandler;
+
+// src/handlers/util.ts
+var import_did2 = require("@arcblock/did");
+var Mcrypto = __toESM(require("@ocap/mcrypto"), 1);
+var import_util3 = require("@ocap/util");
+var import_fast_json_stable_stringify = __toESM(require("fast-json-stable-stringify"), 1);
+var import_url = __toESM(require("url"), 1);
+
+// src/utils/sealed-box.ts
+var import_salsa = require("@noble/ciphers/salsa.js");
+var import_ed25519 = require("@noble/curves/ed25519.js");
+var import_blake2 = require("@noble/hashes/blake2.js");
+var import_utils = require("@noble/hashes/utils.js");
+var SIGMA = new Uint32Array([1634760805, 857760878, 2036477234, 1797285236]);
+function cryptoBoxBeforenm(sharedSecret) {
+  const k = new Uint32Array(sharedSecret.buffer, sharedSecret.byteOffset, 8);
+  const i = new Uint32Array(4);
+  const out = new Uint32Array(8);
+  (0, import_salsa.hsalsa)(SIGMA, k, i, out);
+  return new Uint8Array(out.buffer);
+}
+function seal(message, recipientPk) {
+  const ephSk = import_ed25519.x25519.utils.randomSecretKey();
+  const ephPk = import_ed25519.x25519.getPublicKey(ephSk);
+  const nonce = (0, import_blake2.blake2b)((0, import_utils.concatBytes)(ephPk, recipientPk), { dkLen: 24 });
+  const key = cryptoBoxBeforenm(import_ed25519.x25519.getSharedSecret(ephSk, recipientPk));
+  const encrypted = (0, import_salsa.xsalsa20poly1305)(key, nonce).encrypt(message);
+  return (0, import_utils.concatBytes)(ephPk, encrypted);
+}
+
+// src/handlers/util.ts
+var import_debug3 = __toESM(require("debug"), 1);
+var ABSOLUTE_URL_REGEX = /^[a-zA-Z][a-zA-Z\d+\-.]*?:/;
+var WINDOWS_PATH_REGEX = /^[a-zA-Z]:\\/;
+var isUrl = (input) => {
+  if (typeof input !== "string") {
+    return false;
+  }
+  if (WINDOWS_PATH_REGEX.test(input)) {
+    return false;
+  }
+  return ABSOLUTE_URL_REGEX.test(input);
+};
+var _debug = (0, import_debug3.default)("@arcblock/did-connect-js:handlers:util");
+var sha3 = Mcrypto.Hasher.SHA3.hash256;
+var SUPPORTED_LOCALES = ["en", "zh"];
+function normalizeLocale(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (typeof raw !== "string") return void 0;
+  const base = raw.trim().toLowerCase().replace("_", "-").split("-")[0];
+  return SUPPORTED_LOCALES.includes(base) ? base : void 0;
+}
+var getLocale = (req) => {
+  const queryLocale = normalizeLocale(req.query.locale);
+  if (queryLocale) return queryLocale;
+  const cookieLocale = normalizeLocale(req.cookies?.arc_lang);
+  if (cookieLocale) return cookieLocale;
+  const acceptedLocale = normalizeLocale(req.acceptsLanguages("en-US", "zh-CN"));
+  return acceptedLocale || "en";
+};
+var getSessionId = () => Date.now().toString();
+var noop = () => ({});
+var noTouch = (x) => x;
+var errors = {
+  tokenMissing: {
+    en: "Session Id is required to check status",
+    zh: "\u7F3A\u5C11\u4F1A\u8BDD ID \u53C2\u6570"
+  },
+  didMismatch: {
+    en: "Login user and wallet user mismatch, please relogin and try again",
+    zh: "\u767B\u5F55\u7528\u6237\u548C\u626B\u7801\u7528\u6237\u4E0D\u5339\u914D\uFF0C\u4E3A\u4FDD\u969C\u5B89\u5168\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55\u5E94\u7528"
+  },
+  mfaMismatch: {
+    en: "Dynamic verification code mismatch, please try again later",
+    zh: "\u52A8\u6001\u9A8C\u8BC1\u7801\u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u8BD5"
+  },
+  challengeMismatch: {
+    en: "Challenge mismatch",
+    zh: "\u968F\u673A\u6821\u9A8C\u7801\u4E0D\u5339\u914D"
+  },
+  token404: {
+    en: "Session not found or expired",
+    zh: "\u4F1A\u8BDD\u4E0D\u5B58\u5728\u6216\u5DF2\u8FC7\u671F"
+  },
+  didMissing: {
+    en: "userDid is required to start auth",
+    zh: "userDid \u53C2\u6570\u7F3A\u5931\uFF0C\u8BF7\u52FF\u5C1D\u8BD5\u8FDE\u63A5\u591A\u4E2A\u4E0D\u540C\u7684\u94B1\u5305"
+  },
+  pkMissing: {
+    en: "userPk is required to start auth",
+    zh: "userPk \u53C2\u6570\u7F3A\u5931\uFF0C\u8BF7\u52FF\u5C1D\u8BD5\u8FDE\u63A5\u591A\u4E2A\u4E0D\u540C\u7684\u94B1\u5305"
+  },
+  authClaim: {
+    en: "authPrincipal claim is not configured correctly",
+    zh: "authPrincipal \u58F0\u660E\u914D\u7F6E\u4E0D\u6B63\u786E"
+  },
+  userDeclined: {
+    en: "You have declined the authentication request",
+    zh: "\u6388\u6743\u8BF7\u6C42\u88AB\u62D2\u7EDD"
+  },
+  userBusy: {
+    en: "Busy processing another DID Connect request",
+    zh: "\u6B63\u5728\u5904\u7406\u5176\u4ED6\u8BF7\u6C42"
+  }
+};
+var preparePathname = (path, req) => {
+  const delimiter = path.replace(/\/retrieve$/, "").replace(/\/auth$/, "");
+  const fullPath = import_url.default.parse(req.originalUrl).pathname;
+  const [prefix] = fullPath.split(delimiter);
+  const cleanPath = [prefix, path].join("/").replace(/\/+/g, "/");
+  return cleanPath;
+};
+var getBaseUrl = (req) => {
+  if (req.headers["x-path-prefix"]) {
+    return `/${req.headers["x-path-prefix"]}/`.replace(/\/+/g, "/");
+  }
+  return "/";
+};
+var prepareBaseUrl = (req, params) => {
+  const pathPrefix = getBaseUrl(req).replace(/\/$/, "");
+  const [hostname = "", port = 80] = (req.get("x-forwarded-host") || req.get("x-real-hostname") || req.get("host") || "").split(":");
+  const finalPort = (params?.["x-real-port"] ?? null) || req.get("X-Real-Port") || port || "";
+  return import_url.default.format({
+    protocol: params?.["x-real-protocol"] || req.get("X-Real-protocol") || req.get("X-Forwarded-Proto") || req.protocol,
+    hostname,
+    port: Number(finalPort) === 80 ? "" : finalPort,
+    pathname: pathPrefix
+  });
+};
+var base64UrlUnescape = (str) => (str + "===".slice((str.length + 3) % 4)).replace(/-/g, "+").replace(/_/g, "/");
+var decodeEncKey = (str) => new Uint8Array(Buffer.from(base64UrlUnescape(str), "base64"));
+var getStepChallenge = () => (0, import_util3.stripHexPrefix)(Mcrypto.getRandomBytes(16)).toUpperCase();
+var parseWalletUA = (userAgent) => {
+  const ua = (userAgent || "").toString().toLowerCase();
+  let os = "";
+  let version = "";
+  if (ua.indexOf("android") > -1) {
+    os = "android";
+  } else if (ua.indexOf("iphone") > -1) {
+    os = "ios";
+  } else if (ua.indexOf("ipad") > -1) {
+    os = "ios";
+  } else if (ua.indexOf("ipod") > -1) {
+    os = "ios";
+  } else if (ua.indexOf("arcwallet") === 0) {
+    os = "web";
+  } else if (ua.indexOf("abtwallet") === 0) {
+    os = "web";
+  }
+  const match = ua.split(/\s+/).find((x) => x.startsWith("arcwallet/") || x.startsWith("abtwallet/"));
+  if (match) {
+    const tmp = match.split("/");
+    const coerced = tmp.length > 1 ? (tmp[1].match(/(\d+\.\d+\.\d+)/) || [])[1] : void 0;
+    if (coerced) {
+      version = coerced;
+    }
+  }
+  return { os, version, jwt: "1.1.0" };
+};
+var isDeepLink = (str) => str.startsWith("https://abtwallet.io/i/") || str.startsWith("https://didwallet.io/i/");
+var isConnectedOnly = (params, sessionUserDid = "") => {
+  if (typeof params.forceConnected === "string" && (0, import_did2.isValid)(params.forceConnected)) {
+    return params.forceConnected;
+  }
+  if (!sessionUserDid) {
+    return false;
+  }
+  if ((0, import_did2.isValid)(sessionUserDid) === false) {
+    return false;
+  }
+  if (params.connectedDid !== sessionUserDid) {
+    return false;
+  }
+  if (typeof params.forceConnected === "undefined") {
+    return true;
+  }
+  if (typeof params.forceConnected === "string") {
+    try {
+      return !!JSON.parse(params.forceConnected);
+    } catch {
+      return false;
+    }
+  }
+  return !!params.forceConnected;
+};
+function createHandlers({
+  action,
+  pathname,
+  claims: claims2,
+  onStart,
+  onConnect,
+  onAuth,
+  onDecline,
+  onComplete,
+  onExpire,
+  onError,
+  pathTransformer,
+  tokenStorage,
+  authenticator,
+  authPrincipal,
+  persistentDynamicClaims = false,
+  getSignParams = noop,
+  getPathName = noTouch,
+  options
+}) {
+  const { tokenKey, encKey, versionKey, cleanupDelay } = options;
+  const defaultSteps = (Array.isArray(claims2) ? claims2 : [claims2]).filter(Boolean);
+  if (defaultSteps.length > 0) {
+    const keys = Object.keys(defaultSteps[0]);
+    const firstClaim = defaultSteps[0][keys[0]];
+    if (Array.isArray(firstClaim)) {
+      if (firstClaim[0] === "authPrincipal") {
+        authPrincipal = false;
+      }
+    } else if (keys[0] === "authPrincipal") {
+      authPrincipal = false;
+    }
+  }
+  if (authPrincipal) {
+    let target = "";
+    let description = "Please continue with your account";
+    let chainInfo2;
+    let targetType;
+    if (typeof authPrincipal === "string") {
+      if ((0, import_did2.isValid)(authPrincipal)) {
+        target = authPrincipal;
+      } else {
+        description = authPrincipal;
+      }
+    }
+    if (typeof authPrincipal === "object") {
+      target = authPrincipal.target ?? target;
+      description = authPrincipal.description ?? description;
+      targetType = authPrincipal.targetType ?? targetType;
+      if (authPrincipal.chainInfo && authenticator._isValidChainInfo(authPrincipal.chainInfo)) {
+        chainInfo2 = authPrincipal.chainInfo;
+      }
+    }
+    const supervised = defaultSteps.length === 0;
+    defaultSteps.unshift({
+      authPrincipal: {
+        skippable: true,
+        description,
+        target,
+        chainInfo: chainInfo2,
+        targetType,
+        supervised
+      }
+    });
+  }
+  const canSkipConnect = defaultSteps[0]?.authPrincipal?.skippable;
+  const createExtraParams = (locale, params, extra = {}) => {
+    const finalParams = { ...params, ...extra || {} };
+    return {
+      locale,
+      action,
+      ...Object.keys(finalParams).filter((x) => !["userDid", "userInfo", "userSession", "appSession", "userPk", "token"].includes(x)).reduce((obj, x) => {
+        obj[x] = finalParams[x];
+        return obj;
+      }, {})
+    };
+  };
+  const createSessionUpdater = (token, params) => async (key, value, secure = false) => {
+    const getUpdate = (k, v3) => {
+      if (secure && params[encKey]) {
+        const encrypted = seal(Buffer.from((0, import_fast_json_stable_stringify.default)(v3)), decodeEncKey(params[encKey]));
+        return { [k]: Buffer.from(encrypted).toString("base64") };
+      }
+      return { [k]: v3 };
+    };
+    if (typeof key === "object") {
+      secure = value;
+      const keys = Object.keys(key);
+      const updates = Object.assign({}, ...keys.map((k) => getUpdate(k, key[k])));
+      return tokenStorage.update(token, updates);
+    }
+    return tokenStorage.update(token, omit(getUpdate(key, value), PROTECTED_KEYS));
+  };
+  const createMfaCodeGenerator = (token) => async () => {
+    const mfaCode = random(10, 99);
+    await tokenStorage.update(token, { mfaCode });
+    return mfaCode;
+  };
+  const onProcessError = ({
+    req,
+    res,
+    stage,
+    err
+  }) => {
+    const { token, store } = req.context || {};
+    if (token) {
+      tokenStorage.update(token, { status: SESSION_STATUS.ERROR, error: err.message, mfaCode: 0 });
+    }
+    res.jsonp({ error: err.message });
+    onError({ token, extraParams: store?.extraParams ?? {}, stage, err });
+  };
+  const _preparePathname = (str, req) => {
+    const auto = preparePathname(str, req);
+    const custom = pathTransformer(auto);
+    return custom;
+  };
+  const generateSession = async (req, res) => {
+    try {
+      const params = {
+        "x-real-port": req.get("x-real-port"),
+        "x-real-protocol": req.get("x-real-protocol"),
+        deviceDid: req.get("x-device-did"),
+        connectedDid: req.cookies?.connected_did ?? "",
+        connectedPk: req.cookies?.connected_pk ?? "",
+        ...req.body,
+        ...req.query,
+        ...req.params
+      };
+      params.forceConnected = isConnectedOnly(params, req.get("x-user-did"));
+      const token = sha3(getSessionId()).replace(/^0x/, "").slice(0, 8);
+      await tokenStorage.create(token, SESSION_STATUS.CREATED);
+      let sourceToken = params.sourceToken || "";
+      const sourceTokenState = sourceToken ? await tokenStorage.read(sourceToken) : null;
+      if (sourceTokenState) {
+        if ([SESSION_STATUS.SUCCEED].includes(sourceTokenState.status)) {
+          sourceToken = "";
+        } else {
+          await tokenStorage.update(sourceToken, { destToken: token });
+        }
+      }
+      const finalPath = _preparePathname(getPathName(pathname, req), req);
+      const baseUrl = prepareBaseUrl(req, params);
+      const uri = await authenticator.uri({ token, pathname: finalPath, baseUrl, query: {} });
+      const challenge = getStepChallenge();
+      const didwallet = parseWalletUA(req.query["user-agent"] || req.headers["user-agent"]);
+      const extraParams = createExtraParams(getLocale(req), params);
+      const hookParams = {
+        req,
+        request: req,
+        challenge,
+        baseUrl,
+        deepLink: uri,
+        extraParams,
+        updateSession: createSessionUpdater(token, extraParams),
+        didwallet
+      };
+      const [wallet, delegator] = await Promise.all([
+        authenticator.getWalletInfo({ baseUrl, request: req, extraParams }),
+        authenticator.getDelegator({ baseUrl, request: req, extraParams })
+      ]);
+      const [appInfo2, memberAppInfo] = await Promise.all([
+        authenticator.getAppInfo({ baseUrl, request: req, wallet, delegator, extraParams }, "appInfo"),
+        authenticator.getAppInfo({ baseUrl, request: req, wallet, delegator, extraParams }, "memberAppInfo")
+      ]);
+      await tokenStorage.update(token, {
+        currentStep: 0,
+        mfaSupported: !didwallet.os,
+        // If we are mobile (both webview and mobile browsers , os is truthy), mfa should be disabled
+        challenge,
+        sharedKey: getStepChallenge(),
+        // used for wallet to encrypt userInfo
+        extraParams: params,
+        appInfo: appInfo2,
+        memberAppInfo,
+        sourceToken
+      });
+      const extra = await onStart(hookParams);
+      res.jsonp({ token, status: SESSION_STATUS.CREATED, url: uri, appInfo: appInfo2, memberAppInfo, extra: extra || {} });
+    } catch (err) {
+      onProcessError({ req, res, stage: "generate-token", err });
+    }
+  };
+  const checkSession = async (req, res) => {
+    try {
+      const { locale, token, store, params } = req.context;
+      if (!token) {
+        res.status(400).json({ error: errors.tokenMissing[locale] });
+        return;
+      }
+      if (!store) {
+        res.status(400).json({ error: errors.token404[locale] });
+        return;
+      }
+      if (store.status === SESSION_STATUS.FORBIDDEN) {
+        res.status(403).json({ error: errors.didMismatch[locale] });
+        return;
+      }
+      if (store.status === SESSION_STATUS.SUCCEED) {
+        setTimeout(() => {
+          tokenStorage.delete(token).catch(console.error);
+        }, cleanupDelay);
+        const extraParams = createExtraParams(locale, params, store?.extraParams ?? {});
+        await onComplete({
+          req,
+          request: req,
+          userDid: store.did,
+          userPk: store.pk,
+          extraParams,
+          updateSession: createSessionUpdater(token, extraParams)
+        });
+      }
+      res.status(200).json(
+        Object.keys(store).filter((x) => PROTECTED_KEYS.includes(x) === false).reduce((acc, key) => {
+          acc[key] = store[key];
+          return acc;
+        }, {})
+      );
+    } catch (err) {
+      onProcessError({ req, res, stage: "check-token-status", err });
+    }
+  };
+  const expireSession = async (req, res) => {
+    try {
+      const { locale, token, store } = req.context;
+      if (!token) {
+        res.status(400).json({ error: errors.tokenMissing[locale] });
+        return;
+      }
+      if (!store) {
+        res.status(400).json({ error: errors.token404[locale] });
+        return;
+      }
+      onExpire({ token, extraParams: store?.extraParams ?? {}, status: "expired" });
+      if (store.status !== SESSION_STATUS.SCANNED) {
+        await tokenStorage.delete(token);
+      }
+      res.status(200).json({ token });
+    } catch (err) {
+      onProcessError({ req, res, stage: "mark-token-timeout", err });
+    }
+  };
+  const checkUser = async ({ context, userDid, userPk }) => {
+    const { locale, token, store } = context;
+    const isConnected = store.currentStep > 0;
+    if (isConnected) {
+      if (!userDid) {
+        return errors.didMissing[locale];
+      }
+      if (!userPk) {
+        return errors.pkMissing[locale];
+      }
+      if (userDid !== store.did) {
+        await tokenStorage.update(token, { status: SESSION_STATUS.FORBIDDEN });
+        return errors.didMismatch[locale];
+      }
+    }
+    return false;
+  };
+  const onAuthRequest = async (req, res) => {
+    const { locale, token, store, params, didwallet } = req.context;
+    const extraParams = createExtraParams(locale, params, store?.extraParams ?? {});
+    const userDid = params.userDid || store.did || extraParams.connectedDid;
+    const userPk = params.userPk || store.pk || extraParams.connectedPk;
+    const error = await checkUser({ context: req.context, userDid, userPk });
+    if (error) {
+      return res.jsonp({ error });
+    }
+    if (params[versionKey] && store.clientVersion !== params[versionKey]) {
+      store.clientVersion = params[versionKey];
+      store.encryptionKey = params[encKey];
+      await tokenStorage.update(token, { clientVersion: params[versionKey], encryptionKey: params[encKey] });
+    }
+    try {
+      const steps = [...cloneDeep(defaultSteps)];
+      const shouldSkipConnect = canSkipConnect && !!extraParams.connectedDid;
+      if (shouldSkipConnect) {
+        steps[0].authPrincipal.supervised = false;
+      }
+      if (extraParams.forceConnected) {
+        let target = extraParams.connectedDid;
+        if (typeof extraParams.forceConnected === "string" && (0, import_did2.isValid)(extraParams.forceConnected)) {
+          target = extraParams.forceConnected;
+        }
+        if ((0, import_did2.isValid)(target)) {
+          steps[0].authPrincipal.target = target;
+        }
+      }
+      if (store.status !== SESSION_STATUS.SCANNED) {
+        await tokenStorage.update(token, { status: SESSION_STATUS.SCANNED, connectedWallet: didwallet });
+      }
+      if (store.dynamic || shouldSkipConnect) {
+        const newClaims = await onConnect({
+          req,
+          request: req,
+          userDid,
+          userPk,
+          didwallet,
+          challenge: store.challenge,
+          pathname: _preparePathname(getPathName(pathname, req), req),
+          baseUrl: prepareBaseUrl(req, extraParams),
+          extraParams,
+          updateSession: createSessionUpdater(token, extraParams)
+        });
+        if (newClaims) {
+          if (Array.isArray(newClaims)) {
+            steps.push(...newClaims);
+          } else {
+            steps.push(newClaims);
+          }
+        }
+      }
+      const signParams = await getSignParams(req);
+      const signedClaim = await authenticator.sign(
+        Object.assign(signParams, {
+          context: {
+            token,
+            userDid,
+            userPk,
+            didwallet,
+            ...pick(store, ["currentStep", "sharedKey", "encryptionKey"]),
+            mfaCode: store.mfaSupported ? createMfaCodeGenerator(token) : void 0
+          },
+          claims: steps[store.currentStep],
+          pathname: _preparePathname(getPathName(pathname, req), req),
+          baseUrl: prepareBaseUrl(req, extraParams),
+          extraParams,
+          challenge: store.challenge,
+          appInfo: store.appInfo,
+          memberAppInfo: store.memberAppInfo,
+          request: req
+        })
+      );
+      res.jsonp(encrypt(signedClaim, store));
+    } catch (err) {
+      onProcessError({ req, res, stage: "send-auth-claim", err });
+    }
+  };
+  const onAuthResponse = async (req, res) => {
+    const { locale, token, store, params, didwallet } = req.context;
+    try {
+      const {
+        userDid,
+        userPk,
+        action: userAction,
+        challenge: userChallenge,
+        claims: claimResponse,
+        timestamp
+      } = await authenticator.verify(decrypt(params, store), locale);
+      if (!store.did || !store.pk) {
+        await tokenStorage.update(token, { did: userDid, pk: userPk });
+      }
+      const extraParams = createExtraParams(locale, params, store?.extraParams ?? {});
+      const cbParams = {
+        step: store.currentStep,
+        req,
+        request: req,
+        userDid,
+        userPk,
+        challenge: store.challenge,
+        didwallet,
+        claims: claimResponse,
+        baseUrl: prepareBaseUrl(req, extraParams),
+        extraParams,
+        updateSession: createSessionUpdater(token, extraParams),
+        timestamp
+      };
+      const steps = [...defaultSteps];
+      const shouldSkipConnect = canSkipConnect && !!extraParams.connectedDid;
+      if (store.dynamic || shouldSkipConnect) {
+        const newClaims = await onConnect(cbParams);
+        if (newClaims) {
+          if (Array.isArray(newClaims)) {
+            steps.push(...newClaims);
+          } else {
+            steps.push(newClaims);
+          }
+        }
+      } else if (persistentDynamicClaims && Array.isArray(store.dynamicClaims)) {
+        steps.push(...store.dynamicClaims);
+      }
+      if (userAction === "declineAuth") {
+        await tokenStorage.update(token, {
+          status: SESSION_STATUS.ERROR,
+          error: errors.userDeclined[locale],
+          mfaCode: 0,
+          currentStep: steps.length - 1
+        });
+        const result = await onDecline(cbParams);
+        return res.jsonp({ ...result || {} });
+      }
+      if (userAction === "busy") {
+        await tokenStorage.update(token, {
+          status: SESSION_STATUS.BUSY,
+          error: errors.userBusy[locale],
+          mfaCode: 0,
+          currentStep: steps.length - 1
+        });
+        return res.jsonp({});
+      }
+      if (store.mfaCode && !claimResponse.some((x) => isEqual(x.mfaCode, [store.mfaCode]))) {
+        return onProcessError({ req, res, stage: "verify-mfa-code", err: new Error(errors.mfaMismatch[locale]) });
+      }
+      if (!userChallenge) {
+        return res.jsonp({ error: errors.challengeMismatch[locale] });
+      }
+      if (userChallenge !== store.challenge) {
+        return res.jsonp({ error: errors.challengeMismatch[locale] });
+      }
+      const error = await checkUser({ context: req.context, userDid, userPk });
+      if (error) {
+        return res.jsonp({ error });
+      }
+      const isConnected = store.currentStep > 0;
+      if (isConnected === false) {
+        const newClaims = await onConnect(cbParams);
+        if (newClaims) {
+          await tokenStorage.update(token, {
+            dynamic: !persistentDynamicClaims,
+            dynamicClaims: persistentDynamicClaims ? newClaims : void 0
+          });
+          if (Array.isArray(newClaims)) {
+            steps.push(...newClaims);
+          } else {
+            steps.push(newClaims);
+          }
+        }
+      }
+      const onLastStep = async (result) => {
+        let nextWorkflow = isUrl(extraParams.nw) ? extraParams.nw : "";
+        if (nextWorkflow && result?.nextWorkflowData) {
+          if (isPlainObject(result.nextWorkflowData) === false) {
+            const err = new Error(`expect nextWorkflowData should be a plain object, got: ${result.nextWorkflowData}`);
+            return onProcessError({ req, res, stage: "validate-next-workflow-data", err });
+          }
+          const tmp = new URL(nextWorkflow);
+          const merged = Object.assign(extraParams.previousWorkflowData || {}, result.nextWorkflowData);
+          const previousWorkflowData = (0, import_util3.toBase64)(JSON.stringify(merged));
+          if (previousWorkflowData.length > 8192) {
+            const err = new Error("base64 encoded nextWorkflowData should be less than 8192 characters");
+            return onProcessError({ req, res, stage: "append-next-workflow", err });
+          }
+          if (isDeepLink(nextWorkflow)) {
+            const actualUrl = decodeURIComponent(tmp.searchParams.get("url"));
+            const obj = new URL(actualUrl);
+            obj.searchParams.set("previousWorkflowData", previousWorkflowData);
+            tmp.searchParams.set("url", obj.href);
+          } else {
+            tmp.searchParams.set("previousWorkflowData", previousWorkflowData);
+          }
+          nextWorkflow = tmp.href;
+        }
+        const updates = {};
+        let actualNw = nextWorkflow || result?.nextWorkflow || "";
+        if (actualNw) {
+          if (isDeepLink(actualNw)) {
+            actualNw = new URL(actualNw).searchParams.get("url");
+          }
+          if (actualNw) {
+            updates.nextWorkflow = decodeURIComponent(actualNw);
+          }
+        }
+        if (result?.nextToken && result.nextWorkflow) {
+          try {
+            await tokenStorage.update(result.nextToken, { prevToken: token });
+          } catch (err) {
+            console.error("DIDAuth: failed to to update nextToken", err);
+            updates.status = SESSION_STATUS.SUCCEED;
+          }
+        } else {
+          if (store.prevToken) {
+            try {
+              await tokenStorage.update(store.prevToken, { status: SESSION_STATUS.SUCCEED });
+            } catch (err) {
+              console.error("DIDAuth: failed to to update prevToken", err);
+            }
+          }
+          updates.status = SESSION_STATUS.SUCCEED;
+        }
+        await tokenStorage.update(token, updates);
+        return res.jsonp({ ...Object.assign({ nextWorkflow }, result || {}) });
+      };
+      if (steps.length === 1) {
+        const result = await onAuth(cbParams);
+        return onLastStep(result);
+      }
+      if (isConnected && store.currentStep < steps.length) {
+        const result = await onAuth(cbParams);
+        const isLastStep = store.currentStep === steps.length - 1;
+        if (isLastStep) {
+          return onLastStep(result);
+        }
+      }
+      const nextStep = store.currentStep + 1;
+      const nextChallenge = getStepChallenge();
+      await tokenStorage.update(token, { currentStep: nextStep, challenge: nextChallenge, mfaCode: 0 });
+      const signParams = await getSignParams(req);
+      try {
+        const nextSignedClaim = await authenticator.sign(
+          Object.assign(signParams, {
+            context: {
+              token,
+              userDid,
+              userPk,
+              didwallet,
+              ...pick(store, ["currentStep", "sharedKey", "encryptionKey"]),
+              mfaCode: store.mfaSupported ? createMfaCodeGenerator(token) : void 0
+            },
+            claims: steps[nextStep],
+            pathname: _preparePathname(getPathName(pathname, req), req),
+            baseUrl: prepareBaseUrl(req, extraParams),
+            extraParams,
+            challenge: nextChallenge,
+            appInfo: store.appInfo,
+            memberAppInfo: store.memberAppInfo,
+            request: req
+          })
+        );
+        return res.jsonp(encrypt(nextSignedClaim, store));
+      } catch (err) {
+        return onProcessError({ req, res, stage: "next-auth-claim", err });
+      }
+    } catch (err) {
+      onProcessError({ req, res, stage: "verify-auth-claim", err });
+    }
+  };
+  const ensureContext = async (req, _res, next) => {
+    const didwallet = parseWalletUA(req.query["user-agent"] || req.headers["user-agent"]);
+    const params = { ...req.body, ...req.query, ...req.params };
+    const token = params[tokenKey];
+    const locale = getLocale(req);
+    let store = null;
+    if (token) {
+      store = await tokenStorage.read(token);
+      if (params.previousWorkflowData) {
+        try {
+          store.extraParams.previousWorkflowData = JSON.parse((0, import_util3.fromBase64)(params.previousWorkflowData).toString());
+          await tokenStorage.update(token, { extraParams: store.extraParams });
+        } catch (e) {
+          console.warn("Could not parse previousWorkflowData", params.previousWorkflowData, e);
+        }
+      }
+      if (store?.destToken && typeof params.notrace === "undefined") {
+        const result = await tokenStorage.read(store.destToken);
+        if (result) {
+          store = result;
+        }
+      }
+    }
+    req.context = { locale, token, didwallet, params, store };
+    return next();
+  };
+  const ensureSignedJson = (req, res, next) => {
+    if (req.ensureSignedJson === void 0) {
+      req.ensureSignedJson = true;
+      const originJsonp = res.jsonp;
+      res.jsonp = async (payload) => {
+        if (payload.appPk && payload.authInfo) {
+          return originJsonp.call(res, payload);
+        }
+        const data = payload.response ? { response: payload.response } : { response: payload };
+        const fields = ["error", "errorMessage", "successMessage", "nextWorkflow", "nextUrl", "cookies", "storages"];
+        fields.forEach((x) => {
+          if (payload[x]) {
+            data[x] = payload[x];
+          }
+        });
+        data.errorMessage = data.error || data.errorMessage || "";
+        if (typeof data.response === "object") {
+          data.response = omit(data.response, fields);
+        }
+        const params = { ...req.body, ...req.query, ...req.params };
+        const token2 = params[tokenKey];
+        const store2 = token2 ? await tokenStorage.read(token2) : null;
+        const extraParams = store2?.extraParams ?? {};
+        const signedData = await authenticator.signResponse(data, prepareBaseUrl(req, extraParams), req, extraParams);
+        originJsonp.call(res, encrypt(signedData, store2));
+      };
+    }
+    const { token, store, locale } = req.context;
+    if (!token || !store) {
+      return res.jsonp({ error: errors.token404[locale] });
+    }
+    next();
+  };
+  return {
+    generateSession,
+    expireSession,
+    checkSession,
+    onAuthRequest,
+    onAuthResponse,
+    ensureContext,
+    ensureSignedJson,
+    createExtraParams
+  };
+}
+
+// src/handlers/wallet.ts
+var debug3 = (0, import_debug4.default)("@arcblock/did-connect-js:handlers:wallet");
+var noop2 = () => {
+};
+var WalletHandlers = class extends base_default2 {
+  options;
+  /**
+   * Creates an instance of DID Auth Handlers.
+   *
+   * @class
+   * @param {object} config
+   * @param {object} config.tokenStorage - function to generate action token
+   * @param {object} config.authenticator - Authenticator instance that can to jwt sign/verify
+   * @param {function} [config.pathTransformer=null] - how should we update pathname
+   * @param {function} [config.onConnect=noop] - function called before each auth request send back to app, used to check for permission, throw error to halt the auth process
+   * @param {object} [config.options={}] - custom options to define all handlers attached
+   * @param {string} [config.options.prefix='/api/did'] - url prefix for this group endpoints
+   * @param {number} [config.options.cleanupDelay=60000] - how long to wait before cleanup finished session
+   * @param {string} [config.options.tokenKey='_t_'] - query param key for `token`
+   * @param {string} [config.options.encKey='_ek_'] - query param key for encryption key
+   * @param {string} [config.options.versionKey='_v_'] - query param key for protocol `version`
+   */
+  constructor({
+    pathTransformer,
+    tokenStorage,
+    authenticator,
+    onConnect = noop2,
+    options = {}
+  }) {
+    super({ pathTransformer, tokenStorage, authenticator, onConnect });
+    this.options = {
+      prefix: "/api/did",
+      cleanupDelay: 6e4,
+      tokenKey: "_t_",
+      encKey: "_ek_",
+      versionKey: "_v_",
+      ...options
+    };
+  }
+  /**
+   * Attach routes and handlers for authenticator
+   * Now express app have route handlers attached to the following url
+   * - `GET /api/did/{action}/token` create new token
+   * - `GET /api/did/{action}/status` check for token status
+   * - `GET /api/did/{action}/timeout` expire a token
+   * - `GET /api/did/{action}/auth` create auth response
+   * - `POST /api/did/{action}/auth` process payment request
+   *
+   * @method
+   * @param {object} config
+   * @param {object} config.app - express instance to attach routes to
+   * @param {object} [config.claims] - claims for this request
+   * @param {string} config.action - action of this group of routes
+   * @param {function} [config.onStart=noop] - callback when a new action start
+   * @param {function} [config.onConnect=noop] - callback when a new action start
+   * @param {function} config.onAuth - callback when user completed auth in DID Wallet, and data posted back
+   * @param {function} [config.onDecline=noop] - callback when user has declined in wallet
+   * @param {function} [config.onComplete=noop] - callback when the whole auth process is done, action token is removed
+   * @param {function} [config.onExpire=noop] - callback when the action token expired
+   * @param {function} [config.onError=console.error] - callback when there are some errors
+   * @param {boolean|string|did} [config.authPrincipal=true] - whether should we do auth principal claim first
+   * @param {boolean} [config.persistentDynamicClaims=false] - whether should we persist dynamic claims
+   * @return void
+   */
+  attach({
+    app,
+    action,
+    claims: claims2 = void 0,
+    onStart = noop2,
+    onConnect,
+    onAuth,
+    onDecline = noop2,
+    onComplete = noop2,
+    onExpire = noop2,
+    onError = console.error,
+    authPrincipal = true,
+    persistentDynamicClaims = false
+  }) {
+    if (typeof onAuth !== "function") {
+      throw new Error("onAuth callback is required to attach did auth handlers");
+    }
+    if (typeof onDecline !== "function") {
+      throw new Error("onDecline callback is required to attach did auth handlers");
+    }
+    if (typeof onComplete !== "function") {
+      throw new Error("onComplete callback is required to attach did auth handlers");
+    }
+    const { prefix } = this.options;
+    const pathname = `${prefix}/${action}/auth`;
+    debug3("attach routes", { action, prefix, pathname });
+    const onConnectWrapped = async (...args) => {
+      if (typeof this.onConnect === "function") {
+        await this.onConnect(...args);
+      }
+      if (typeof onConnect === "function") {
+        return onConnect(...args);
+      }
+    };
+    const {
+      generateSession,
+      expireSession,
+      checkSession,
+      onAuthRequest,
+      onAuthResponse,
+      ensureContext,
+      ensureSignedJson
+    } = createHandlers({
+      action,
+      pathname,
+      claims: claims2,
+      onStart,
+      onConnect: onConnectWrapped,
+      // must be deterministic when returning dynamic claims
+      onAuth,
+      onDecline,
+      onComplete,
+      onExpire,
+      onError,
+      authPrincipal,
+      persistentDynamicClaims,
+      options: this.options,
+      pathTransformer: this.pathTransformer,
+      tokenStorage: this.tokenStorage,
+      authenticator: this.authenticator
+    });
+    const handlerFns = {
+      generateSession,
+      checkSession,
+      expireSession,
+      onAuthRequest,
+      onAuthResponse,
+      ensureContext,
+      ensureSignedJson
+    };
+    if (isHonoApp(app)) {
+      return attachHono({ app, prefix, action, handlers: handlerFns });
+    }
+    return attachExpress({ app, prefix, action, handlers: handlerFns });
+  }
+};
+var wallet_default2 = WalletHandlers;
+
+// src/storage/kv.ts
+var import_events = require("events");
+var CloudflareKVStorage = class extends import_events.EventEmitter {
+  kv;
+  ttl;
+  prefix;
+  constructor(kv, options = {}) {
+    super();
+    this.kv = kv;
+    this.ttl = options.ttl ?? 300;
+    this.prefix = options.prefix ?? "";
+  }
+  key(token) {
+    return `${this.prefix}${token}`;
+  }
+  async create(token, status = "created") {
+    const record = { token, status };
+    await this.kv.put(this.key(token), JSON.stringify(record), { expirationTtl: this.ttl });
+    this.emit("create", record);
+    return record;
+  }
+  async read(token) {
+    const raw = await this.kv.get(this.key(token));
+    if (!raw) return null;
+    return JSON.parse(raw);
+  }
+  async update(token, updates) {
+    const existing = await this.read(token);
+    if (!existing) return null;
+    delete updates.token;
+    const merged = { ...existing, ...updates };
+    await this.kv.put(this.key(token), JSON.stringify(merged), { expirationTtl: this.ttl });
+    this.emit("update", merged);
+    return merged;
+  }
+  async delete(token) {
+    const existing = await this.read(token);
+    if (existing) {
+      this.emit("destroy", existing);
+    }
+    await this.kv.delete(this.key(token));
+  }
+  async exist(token, did) {
+    const record = await this.read(token);
+    if (!record) return false;
+    if (did) return record.did === did;
+    return true;
+  }
+};
+var kv_default = CloudflareKVStorage;
+
+// src/index.ts
+var import_did_connect_core2 = require("@arcblock/did-connect-core");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CloudflareKVStorage,
+  VERSION,
+  WalletAuthenticator,
+  WalletHandlers,
+  attachExpress,
+  attachHono,
+  createHonoRequest,
+  createHonoResponse,
+  isExpressApp,
+  isHonoApp,
+  parseWalletUA,
+  prepareBaseUrl
+});