@bwalletx/connect 0.0.0-stage → 0.1.0

package/dist/server.cjs

@@ -0,0 +1,150 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  CHALLENGE_LIFETIME_MS: () => CHALLENGE_LIFETIME_MS,
+  LOGIN_PROTOCOL: () => LOGIN_PROTOCOL,
+  createChallenge: () => createChallenge,
+  isIdentityKey: () => isIdentityKey,
+  loginMessage: () => loginMessage,
+  memoryStore: () => memoryStore,
+  originAllowed: () => originAllowed,
+  verifySignIn: () => verifySignIn
+});
+module.exports = __toCommonJS(server_exports);
+var import_sdk = require("@bsv/sdk");
+var LOGIN_PROTOCOL = [2, "bwallet sign in"];
+var CHALLENGE_LIFETIME_MS = 2 * 60 * 1e3;
+var warned = false;
+function memoryStore(opts = {}) {
+  if (!opts.quiet && !warned) {
+    warned = true;
+    console.warn("[@bwalletx/connect] Using the in-memory nonce store. It is for development only; pass a shared store (Redis, database) in production.");
+  }
+  const m = /* @__PURE__ */ new Map();
+  return {
+    put(nonce, c) {
+      const now = Date.now();
+      for (const [k, v] of m) if (v.expiresAt < now) m.delete(k);
+      m.set(nonce, c);
+    },
+    take(nonce) {
+      const c = m.get(nonce) ?? null;
+      m.delete(nonce);
+      return c;
+    }
+  };
+}
+var defaultStore = null;
+var storeOrDefault = (s) => s ?? (defaultStore ??= memoryStore());
+function isIdentityKey(x) {
+  if (typeof x !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;
+  try {
+    import_sdk.PublicKey.fromString(x);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalOrigin(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) {
+    throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  }
+  return u.origin;
+}
+function loginMessage(origin, nonce, expiresAt) {
+  return [
+    `Sign in to ${new URL(origin).host} with bWallet`,
+    "",
+    "This proves you hold this wallet. It does not spend anything.",
+    "",
+    `Origin: ${origin}`,
+    `Nonce: ${nonce}`,
+    `Expires: ${new Date(expiresAt).toISOString()}`
+  ].join("\n");
+}
+function randomNonce() {
+  const b = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createChallenge(opts) {
+  if (!isIdentityKey(opts.identityKey)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
+  const origin = normalOrigin(opts.origin);
+  const nonce = randomNonce();
+  const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
+  const message = loginMessage(origin, nonce, expiresAt);
+  await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });
+  return { nonce, message, protocolID: LOGIN_PROTOCOL, keyID: nonce, expiresAt };
+}
+async function verifySignIn(opts) {
+  if (typeof opts.nonce !== "string" || opts.nonce.length > 64) return null;
+  const c = await storeOrDefault(opts.store).take(opts.nonce);
+  if (!c || Date.now() > c.expiresAt) return null;
+  let origin;
+  try {
+    origin = normalOrigin(opts.origin);
+  } catch {
+    return null;
+  }
+  if (c.origin !== origin) return null;
+  if (!isIdentityKey(opts.identityKey)) return null;
+  const identityKey = opts.identityKey.toLowerCase();
+  if (c.identityKey !== identityKey) return null;
+  const sig = opts.signature;
+  if (!Array.isArray(sig) || sig.length < 8 || sig.length > 80 || !sig.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+    return null;
+  }
+  try {
+    const { valid } = await new import_sdk.ProtoWallet("anyone").verifySignature({
+      protocolID: LOGIN_PROTOCOL,
+      keyID: opts.nonce,
+      counterparty: identityKey,
+      data: Array.from(new TextEncoder().encode(c.message)),
+      signature: sig
+    });
+    return valid ? identityKey : null;
+  } catch {
+    return null;
+  }
+}
+function originAllowed(requestOrigin, origin) {
+  try {
+    return !!requestOrigin && requestOrigin === normalOrigin(origin);
+  } catch {
+    return false;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CHALLENGE_LIFETIME_MS,
+  LOGIN_PROTOCOL,
+  createChallenge,
+  isIdentityKey,
+  loginMessage,
+  memoryStore,
+  originAllowed,
+  verifySignIn
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { ProtoWallet, PublicKey, type WalletProtocol } from '@bsv/sdk';\n\n/** Security level 2, a protocol name used for nothing else. Keep it constant. */\nexport const LOGIN_PROTOCOL: WalletProtocol = [2, 'bwallet sign in'];\nexport const CHALLENGE_LIFETIME_MS = 2 * 60 * 1000;\n\nexport interface PendingChallenge {\n  identityKey: string;\n  origin: string;\n  message: string;\n  expiresAt: number;\n}\n\n/**\n * Where challenges wait between the two routes. Use Redis or a database table in production.\n * `take` must read and delete in one step, so each nonce can be tried once.\n */\nexport interface NonceStore {\n  put(nonce: string, c: PendingChallenge): Promise<void> | void;\n  take(nonce: string): Promise<PendingChallenge | null> | PendingChallenge | null;\n}\n\nlet warned = false;\n\n/**\n * In-memory store. For development and tests only: it is lost on restart and not shared between\n * server processes or serverless instances. Expired entries are pruned on each put.\n */\nexport function memoryStore(opts: { quiet?: boolean } = {}): NonceStore {\n  if (!opts.quiet && !warned) {\n    warned = true;\n    console.warn('[@bwalletx/connect] Using the in-memory nonce store. It is for development only; pass a shared store (Redis, database) in production.');\n  }\n  const m = new Map<string, PendingChallenge>();\n  return {\n    put(nonce, c) {\n      const now = Date.now();\n      for (const [k, v] of m) if (v.expiresAt < now) m.delete(k);\n      m.set(nonce, c);\n    },\n    take(nonce) {\n      const c = m.get(nonce) ?? null;\n      m.delete(nonce);\n      return c;\n    },\n  };\n}\n\nlet defaultStore: NonceStore | null = null;\nconst storeOrDefault = (s?: NonceStore) => s ?? (defaultStore ??= memoryStore());\n\nexport function isIdentityKey(x: unknown): x is string {\n  if (typeof x !== 'string' || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;\n  try {\n    PublicKey.fromString(x);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction normalOrigin(origin: string): string {\n  const u = new URL(origin);\n  if (u.origin === 'null' || u.origin !== origin.replace(/\\/$/, '')) {\n    throw new Error(`origin must be scheme://host[:port], got ${origin}`);\n  }\n  return u.origin;\n}\n\n/** The text the user signs. Lines joined with \\n, no trailing newline. */\nexport function loginMessage(origin: string, nonce: string, expiresAt: number): string {\n  return [\n    `Sign in to ${new URL(origin).host} with bWallet`,\n    '',\n    'This proves you hold this wallet. It does not spend anything.',\n    '',\n    `Origin: ${origin}`,\n    `Nonce: ${nonce}`,\n    `Expires: ${new Date(expiresAt).toISOString()}`,\n  ].join('\\n');\n}\n\nfunction randomNonce(): string {\n  const b = new Uint8Array(16);\n  globalThis.crypto.getRandomValues(b);\n  let s = '';\n  for (const x of b) s += String.fromCharCode(x);\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport interface CreateChallengeOptions {\n  /** YOUR site's origin from config, e.g. \"https://example.com\". Never take it from the request. */\n  origin: string;\n  /** The identity key the browser claims. Checked again at verify. */\n  identityKey: unknown;\n  /** Default: a process-wide in-memory store (dev only). */\n  store?: NonceStore;\n}\n\nexport interface ChallengeResponse {\n  nonce: string;\n  message: string;\n  protocolID: WalletProtocol;\n  keyID: string;\n  expiresAt: number;\n}\n\n/** Step 1. Throws if identityKey is not a valid compressed public key. Send the result to the browser. */\nexport async function createChallenge(opts: CreateChallengeOptions): Promise<ChallengeResponse> {\n  if (!isIdentityKey(opts.identityKey)) throw new Error('identityKey must be a compressed public key (66 hex chars)');\n  const origin = normalOrigin(opts.origin);\n  const nonce = randomNonce();\n  const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;\n  const message = loginMessage(origin, nonce, expiresAt);\n  await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });\n  return { nonce, message, protocolID: LOGIN_PROTOCOL, keyID: nonce, expiresAt };\n}\n\nexport interface VerifySignInOptions {\n  /** YOUR site's origin from config. Must equal the origin the challenge was made for. */\n  origin: string;\n  /** From the request body. */\n  identityKey: unknown;\n  nonce: unknown;\n  signature: unknown;\n  store?: NonceStore;\n}\n\n/**\n * Step 2. Returns the proven identity key (lowercase hex), or null.\n * The nonce is deleted before anything is checked, so each challenge can be tried once.\n */\nexport async function verifySignIn(opts: VerifySignInOptions): Promise<string | null> {\n  if (typeof opts.nonce !== 'string' || opts.nonce.length > 64) return null;\n  const c = await storeOrDefault(opts.store).take(opts.nonce);\n  if (!c || Date.now() > c.expiresAt) return null;\n  let origin: string;\n  try {\n    origin = normalOrigin(opts.origin);\n  } catch {\n    return null;\n  }\n  if (c.origin !== origin) return null;\n  if (!isIdentityKey(opts.identityKey)) return null;\n  const identityKey = opts.identityKey.toLowerCase();\n  if (c.identityKey !== identityKey) return null;\n\n  const sig = opts.signature;\n  if (!Array.isArray(sig) || sig.length < 8 || sig.length > 80 || !sig.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {\n    return null;\n  }\n  try {\n    const { valid } = await new ProtoWallet('anyone').verifySignature({\n      protocolID: LOGIN_PROTOCOL,\n      keyID: opts.nonce,\n      counterparty: identityKey,\n      data: Array.from(new TextEncoder().encode(c.message)),\n      signature: sig as number[],\n    });\n    return valid ? identityKey : null;\n  } catch {\n    return null; // @bsv/sdk throws on a bad signature instead of returning valid: false\n  }\n}\n\n/** True when a request's Origin header is exactly your configured origin. Check it on both routes. */\nexport function originAllowed(requestOrigin: string | null | undefined, origin: string): boolean {\n  try {\n    return !!requestOrigin && requestOrigin === normalOrigin(origin);\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAA4D;AAGrD,IAAM,iBAAiC,CAAC,GAAG,iBAAiB;AAC5D,IAAM,wBAAwB,IAAI,KAAK;AAkB9C,IAAI,SAAS;AAMN,SAAS,YAAY,OAA4B,CAAC,GAAe;AACtE,MAAI,CAAC,KAAK,SAAS,CAAC,QAAQ;AAC1B,aAAS;AACT,YAAQ,KAAK,uIAAuI;AAAA,EACtJ;AACA,QAAM,IAAI,oBAAI,IAA8B;AAC5C,SAAO;AAAA,IACL,IAAI,OAAO,GAAG;AACZ,YAAM,MAAM,KAAK,IAAI;AACrB,iBAAW,CAAC,GAAG,CAAC,KAAK,EAAG,KAAI,EAAE,YAAY,IAAK,GAAE,OAAO,CAAC;AACzD,QAAE,IAAI,OAAO,CAAC;AAAA,IAChB;AAAA,IACA,KAAK,OAAO;AACV,YAAM,IAAI,EAAE,IAAI,KAAK,KAAK;AAC1B,QAAE,OAAO,KAAK;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAI,eAAkC;AACtC,IAAM,iBAAiB,CAAC,MAAmB,MAAM,iBAAiB,YAAY;AAEvE,SAAS,cAAc,GAAyB;AACrD,MAAI,OAAO,MAAM,YAAY,CAAC,yBAAyB,KAAK,CAAC,EAAG,QAAO;AACvE,MAAI;AACF,yBAAU,WAAW,CAAC;AACtB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,QAAwB;AAC5C,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,MAAI,EAAE,WAAW,UAAU,EAAE,WAAW,OAAO,QAAQ,OAAO,EAAE,GAAG;AACjE,UAAM,IAAI,MAAM,4CAA4C,MAAM,EAAE;AAAA,EACtE;AACA,SAAO,EAAE;AACX;AAGO,SAAS,aAAa,QAAgB,OAAe,WAA2B;AACrF,SAAO;AAAA,IACL,cAAc,IAAI,IAAI,MAAM,EAAE,IAAI;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,YAAY,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC;AAAA,EAC/C,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,cAAsB;AAC7B,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,aAAW,OAAO,gBAAgB,CAAC;AACnC,MAAI,IAAI;AACR,aAAW,KAAK,EAAG,MAAK,OAAO,aAAa,CAAC;AAC7C,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAoBA,eAAsB,gBAAgB,MAA0D;AAC9F,MAAI,CAAC,cAAc,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4DAA4D;AAClH,QAAM,SAAS,aAAa,KAAK,MAAM;AACvC,QAAM,QAAQ,YAAY;AAC1B,QAAM,YAAY,KAAK,IAAI,IAAI;AAC/B,QAAM,UAAU,aAAa,QAAQ,OAAO,SAAS;AACrD,QAAM,eAAe,KAAK,KAAK,EAAE,IAAI,OAAO,EAAE,aAAa,KAAK,YAAY,YAAY,GAAG,QAAQ,SAAS,UAAU,CAAC;AACvH,SAAO,EAAE,OAAO,SAAS,YAAY,gBAAgB,OAAO,OAAO,UAAU;AAC/E;AAgBA,eAAsB,aAAa,MAAmD;AACpF,MAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,GAAI,QAAO;AACrE,QAAM,IAAI,MAAM,eAAe,KAAK,KAAK,EAAE,KAAK,KAAK,KAAK;AAC1D,MAAI,CAAC,KAAK,KAAK,IAAI,IAAI,EAAE,UAAW,QAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,aAAa,KAAK,MAAM;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,EAAE,WAAW,OAAQ,QAAO;AAChC,MAAI,CAAC,cAAc,KAAK,WAAW,EAAG,QAAO;AAC7C,QAAM,cAAc,KAAK,YAAY,YAAY;AACjD,MAAI,EAAE,gBAAgB,YAAa,QAAO;AAE1C,QAAM,MAAM,KAAK;AACjB,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,KAAK,IAAI,SAAS,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,OAAO,UAAU,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,GAAG;AAC5H,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI,uBAAY,QAAQ,EAAE,gBAAgB;AAAA,MAChE,YAAY;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,cAAc;AAAA,MACd,MAAM,MAAM,KAAK,IAAI,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;AAAA,MACpD,WAAW;AAAA,IACb,CAAC;AACD,WAAO,QAAQ,cAAc;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,cAAc,eAA0C,QAAyB;AAC/F,MAAI;AACF,WAAO,CAAC,CAAC,iBAAiB,kBAAkB,aAAa,MAAM;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/server.d.cts

@@ -0,0 +1,64 @@
+import { WalletProtocol } from '@bsv/sdk';
+
+/** Security level 2, a protocol name used for nothing else. Keep it constant. */
+declare const LOGIN_PROTOCOL: WalletProtocol;
+declare const CHALLENGE_LIFETIME_MS: number;
+interface PendingChallenge {
+    identityKey: string;
+    origin: string;
+    message: string;
+    expiresAt: number;
+}
+/**
+ * Where challenges wait between the two routes. Use Redis or a database table in production.
+ * `take` must read and delete in one step, so each nonce can be tried once.
+ */
+interface NonceStore {
+    put(nonce: string, c: PendingChallenge): Promise<void> | void;
+    take(nonce: string): Promise<PendingChallenge | null> | PendingChallenge | null;
+}
+/**
+ * In-memory store. For development and tests only: it is lost on restart and not shared between
+ * server processes or serverless instances. Expired entries are pruned on each put.
+ */
+declare function memoryStore(opts?: {
+    quiet?: boolean;
+}): NonceStore;
+declare function isIdentityKey(x: unknown): x is string;
+/** The text the user signs. Lines joined with \n, no trailing newline. */
+declare function loginMessage(origin: string, nonce: string, expiresAt: number): string;
+interface CreateChallengeOptions {
+    /** YOUR site's origin from config, e.g. "https://example.com". Never take it from the request. */
+    origin: string;
+    /** The identity key the browser claims. Checked again at verify. */
+    identityKey: unknown;
+    /** Default: a process-wide in-memory store (dev only). */
+    store?: NonceStore;
+}
+interface ChallengeResponse {
+    nonce: string;
+    message: string;
+    protocolID: WalletProtocol;
+    keyID: string;
+    expiresAt: number;
+}
+/** Step 1. Throws if identityKey is not a valid compressed public key. Send the result to the browser. */
+declare function createChallenge(opts: CreateChallengeOptions): Promise<ChallengeResponse>;
+interface VerifySignInOptions {
+    /** YOUR site's origin from config. Must equal the origin the challenge was made for. */
+    origin: string;
+    /** From the request body. */
+    identityKey: unknown;
+    nonce: unknown;
+    signature: unknown;
+    store?: NonceStore;
+}
+/**
+ * Step 2. Returns the proven identity key (lowercase hex), or null.
+ * The nonce is deleted before anything is checked, so each challenge can be tried once.
+ */
+declare function verifySignIn(opts: VerifySignInOptions): Promise<string | null>;
+/** True when a request's Origin header is exactly your configured origin. Check it on both routes. */
+declare function originAllowed(requestOrigin: string | null | undefined, origin: string): boolean;
+
+export { CHALLENGE_LIFETIME_MS, type ChallengeResponse, type CreateChallengeOptions, LOGIN_PROTOCOL, type NonceStore, type PendingChallenge, type VerifySignInOptions, createChallenge, isIdentityKey, loginMessage, memoryStore, originAllowed, verifySignIn };

package/dist/server.d.ts

@@ -0,0 +1,64 @@
+import { WalletProtocol } from '@bsv/sdk';
+
+/** Security level 2, a protocol name used for nothing else. Keep it constant. */
+declare const LOGIN_PROTOCOL: WalletProtocol;
+declare const CHALLENGE_LIFETIME_MS: number;
+interface PendingChallenge {
+    identityKey: string;
+    origin: string;
+    message: string;
+    expiresAt: number;
+}
+/**
+ * Where challenges wait between the two routes. Use Redis or a database table in production.
+ * `take` must read and delete in one step, so each nonce can be tried once.
+ */
+interface NonceStore {
+    put(nonce: string, c: PendingChallenge): Promise<void> | void;
+    take(nonce: string): Promise<PendingChallenge | null> | PendingChallenge | null;
+}
+/**
+ * In-memory store. For development and tests only: it is lost on restart and not shared between
+ * server processes or serverless instances. Expired entries are pruned on each put.
+ */
+declare function memoryStore(opts?: {
+    quiet?: boolean;
+}): NonceStore;
+declare function isIdentityKey(x: unknown): x is string;
+/** The text the user signs. Lines joined with \n, no trailing newline. */
+declare function loginMessage(origin: string, nonce: string, expiresAt: number): string;
+interface CreateChallengeOptions {
+    /** YOUR site's origin from config, e.g. "https://example.com". Never take it from the request. */
+    origin: string;
+    /** The identity key the browser claims. Checked again at verify. */
+    identityKey: unknown;
+    /** Default: a process-wide in-memory store (dev only). */
+    store?: NonceStore;
+}
+interface ChallengeResponse {
+    nonce: string;
+    message: string;
+    protocolID: WalletProtocol;
+    keyID: string;
+    expiresAt: number;
+}
+/** Step 1. Throws if identityKey is not a valid compressed public key. Send the result to the browser. */
+declare function createChallenge(opts: CreateChallengeOptions): Promise<ChallengeResponse>;
+interface VerifySignInOptions {
+    /** YOUR site's origin from config. Must equal the origin the challenge was made for. */
+    origin: string;
+    /** From the request body. */
+    identityKey: unknown;
+    nonce: unknown;
+    signature: unknown;
+    store?: NonceStore;
+}
+/**
+ * Step 2. Returns the proven identity key (lowercase hex), or null.
+ * The nonce is deleted before anything is checked, so each challenge can be tried once.
+ */
+declare function verifySignIn(opts: VerifySignInOptions): Promise<string | null>;
+/** True when a request's Origin header is exactly your configured origin. Check it on both routes. */
+declare function originAllowed(requestOrigin: string | null | undefined, origin: string): boolean;
+
+export { CHALLENGE_LIFETIME_MS, type ChallengeResponse, type CreateChallengeOptions, LOGIN_PROTOCOL, type NonceStore, type PendingChallenge, type VerifySignInOptions, createChallenge, isIdentityKey, loginMessage, memoryStore, originAllowed, verifySignIn };

package/dist/server.js

@@ -0,0 +1,118 @@
+// src/server.ts
+import { ProtoWallet, PublicKey } from "@bsv/sdk";
+var LOGIN_PROTOCOL = [2, "bwallet sign in"];
+var CHALLENGE_LIFETIME_MS = 2 * 60 * 1e3;
+var warned = false;
+function memoryStore(opts = {}) {
+  if (!opts.quiet && !warned) {
+    warned = true;
+    console.warn("[@bwalletx/connect] Using the in-memory nonce store. It is for development only; pass a shared store (Redis, database) in production.");
+  }
+  const m = /* @__PURE__ */ new Map();
+  return {
+    put(nonce, c) {
+      const now = Date.now();
+      for (const [k, v] of m) if (v.expiresAt < now) m.delete(k);
+      m.set(nonce, c);
+    },
+    take(nonce) {
+      const c = m.get(nonce) ?? null;
+      m.delete(nonce);
+      return c;
+    }
+  };
+}
+var defaultStore = null;
+var storeOrDefault = (s) => s ?? (defaultStore ??= memoryStore());
+function isIdentityKey(x) {
+  if (typeof x !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;
+  try {
+    PublicKey.fromString(x);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalOrigin(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) {
+    throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  }
+  return u.origin;
+}
+function loginMessage(origin, nonce, expiresAt) {
+  return [
+    `Sign in to ${new URL(origin).host} with bWallet`,
+    "",
+    "This proves you hold this wallet. It does not spend anything.",
+    "",
+    `Origin: ${origin}`,
+    `Nonce: ${nonce}`,
+    `Expires: ${new Date(expiresAt).toISOString()}`
+  ].join("\n");
+}
+function randomNonce() {
+  const b = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createChallenge(opts) {
+  if (!isIdentityKey(opts.identityKey)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
+  const origin = normalOrigin(opts.origin);
+  const nonce = randomNonce();
+  const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
+  const message = loginMessage(origin, nonce, expiresAt);
+  await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });
+  return { nonce, message, protocolID: LOGIN_PROTOCOL, keyID: nonce, expiresAt };
+}
+async function verifySignIn(opts) {
+  if (typeof opts.nonce !== "string" || opts.nonce.length > 64) return null;
+  const c = await storeOrDefault(opts.store).take(opts.nonce);
+  if (!c || Date.now() > c.expiresAt) return null;
+  let origin;
+  try {
+    origin = normalOrigin(opts.origin);
+  } catch {
+    return null;
+  }
+  if (c.origin !== origin) return null;
+  if (!isIdentityKey(opts.identityKey)) return null;
+  const identityKey = opts.identityKey.toLowerCase();
+  if (c.identityKey !== identityKey) return null;
+  const sig = opts.signature;
+  if (!Array.isArray(sig) || sig.length < 8 || sig.length > 80 || !sig.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+    return null;
+  }
+  try {
+    const { valid } = await new ProtoWallet("anyone").verifySignature({
+      protocolID: LOGIN_PROTOCOL,
+      keyID: opts.nonce,
+      counterparty: identityKey,
+      data: Array.from(new TextEncoder().encode(c.message)),
+      signature: sig
+    });
+    return valid ? identityKey : null;
+  } catch {
+    return null;
+  }
+}
+function originAllowed(requestOrigin, origin) {
+  try {
+    return !!requestOrigin && requestOrigin === normalOrigin(origin);
+  } catch {
+    return false;
+  }
+}
+export {
+  CHALLENGE_LIFETIME_MS,
+  LOGIN_PROTOCOL,
+  createChallenge,
+  isIdentityKey,
+  loginMessage,
+  memoryStore,
+  originAllowed,
+  verifySignIn
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import { ProtoWallet, PublicKey, type WalletProtocol } from '@bsv/sdk';\n\n/** Security level 2, a protocol name used for nothing else. Keep it constant. */\nexport const LOGIN_PROTOCOL: WalletProtocol = [2, 'bwallet sign in'];\nexport const CHALLENGE_LIFETIME_MS = 2 * 60 * 1000;\n\nexport interface PendingChallenge {\n  identityKey: string;\n  origin: string;\n  message: string;\n  expiresAt: number;\n}\n\n/**\n * Where challenges wait between the two routes. Use Redis or a database table in production.\n * `take` must read and delete in one step, so each nonce can be tried once.\n */\nexport interface NonceStore {\n  put(nonce: string, c: PendingChallenge): Promise<void> | void;\n  take(nonce: string): Promise<PendingChallenge | null> | PendingChallenge | null;\n}\n\nlet warned = false;\n\n/**\n * In-memory store. For development and tests only: it is lost on restart and not shared between\n * server processes or serverless instances. Expired entries are pruned on each put.\n */\nexport function memoryStore(opts: { quiet?: boolean } = {}): NonceStore {\n  if (!opts.quiet && !warned) {\n    warned = true;\n    console.warn('[@bwalletx/connect] Using the in-memory nonce store. It is for development only; pass a shared store (Redis, database) in production.');\n  }\n  const m = new Map<string, PendingChallenge>();\n  return {\n    put(nonce, c) {\n      const now = Date.now();\n      for (const [k, v] of m) if (v.expiresAt < now) m.delete(k);\n      m.set(nonce, c);\n    },\n    take(nonce) {\n      const c = m.get(nonce) ?? null;\n      m.delete(nonce);\n      return c;\n    },\n  };\n}\n\nlet defaultStore: NonceStore | null = null;\nconst storeOrDefault = (s?: NonceStore) => s ?? (defaultStore ??= memoryStore());\n\nexport function isIdentityKey(x: unknown): x is string {\n  if (typeof x !== 'string' || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;\n  try {\n    PublicKey.fromString(x);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction normalOrigin(origin: string): string {\n  const u = new URL(origin);\n  if (u.origin === 'null' || u.origin !== origin.replace(/\\/$/, '')) {\n    throw new Error(`origin must be scheme://host[:port], got ${origin}`);\n  }\n  return u.origin;\n}\n\n/** The text the user signs. Lines joined with \\n, no trailing newline. */\nexport function loginMessage(origin: string, nonce: string, expiresAt: number): string {\n  return [\n    `Sign in to ${new URL(origin).host} with bWallet`,\n    '',\n    'This proves you hold this wallet. It does not spend anything.',\n    '',\n    `Origin: ${origin}`,\n    `Nonce: ${nonce}`,\n    `Expires: ${new Date(expiresAt).toISOString()}`,\n  ].join('\\n');\n}\n\nfunction randomNonce(): string {\n  const b = new Uint8Array(16);\n  globalThis.crypto.getRandomValues(b);\n  let s = '';\n  for (const x of b) s += String.fromCharCode(x);\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport interface CreateChallengeOptions {\n  /** YOUR site's origin from config, e.g. \"https://example.com\". Never take it from the request. */\n  origin: string;\n  /** The identity key the browser claims. Checked again at verify. */\n  identityKey: unknown;\n  /** Default: a process-wide in-memory store (dev only). */\n  store?: NonceStore;\n}\n\nexport interface ChallengeResponse {\n  nonce: string;\n  message: string;\n  protocolID: WalletProtocol;\n  keyID: string;\n  expiresAt: number;\n}\n\n/** Step 1. Throws if identityKey is not a valid compressed public key. Send the result to the browser. */\nexport async function createChallenge(opts: CreateChallengeOptions): Promise<ChallengeResponse> {\n  if (!isIdentityKey(opts.identityKey)) throw new Error('identityKey must be a compressed public key (66 hex chars)');\n  const origin = normalOrigin(opts.origin);\n  const nonce = randomNonce();\n  const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;\n  const message = loginMessage(origin, nonce, expiresAt);\n  await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });\n  return { nonce, message, protocolID: LOGIN_PROTOCOL, keyID: nonce, expiresAt };\n}\n\nexport interface VerifySignInOptions {\n  /** YOUR site's origin from config. Must equal the origin the challenge was made for. */\n  origin: string;\n  /** From the request body. */\n  identityKey: unknown;\n  nonce: unknown;\n  signature: unknown;\n  store?: NonceStore;\n}\n\n/**\n * Step 2. Returns the proven identity key (lowercase hex), or null.\n * The nonce is deleted before anything is checked, so each challenge can be tried once.\n */\nexport async function verifySignIn(opts: VerifySignInOptions): Promise<string | null> {\n  if (typeof opts.nonce !== 'string' || opts.nonce.length > 64) return null;\n  const c = await storeOrDefault(opts.store).take(opts.nonce);\n  if (!c || Date.now() > c.expiresAt) return null;\n  let origin: string;\n  try {\n    origin = normalOrigin(opts.origin);\n  } catch {\n    return null;\n  }\n  if (c.origin !== origin) return null;\n  if (!isIdentityKey(opts.identityKey)) return null;\n  const identityKey = opts.identityKey.toLowerCase();\n  if (c.identityKey !== identityKey) return null;\n\n  const sig = opts.signature;\n  if (!Array.isArray(sig) || sig.length < 8 || sig.length > 80 || !sig.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {\n    return null;\n  }\n  try {\n    const { valid } = await new ProtoWallet('anyone').verifySignature({\n      protocolID: LOGIN_PROTOCOL,\n      keyID: opts.nonce,\n      counterparty: identityKey,\n      data: Array.from(new TextEncoder().encode(c.message)),\n      signature: sig as number[],\n    });\n    return valid ? identityKey : null;\n  } catch {\n    return null; // @bsv/sdk throws on a bad signature instead of returning valid: false\n  }\n}\n\n/** True when a request's Origin header is exactly your configured origin. Check it on both routes. */\nexport function originAllowed(requestOrigin: string | null | undefined, origin: string): boolean {\n  try {\n    return !!requestOrigin && requestOrigin === normalOrigin(origin);\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";AAAA,SAAS,aAAa,iBAAsC;AAGrD,IAAM,iBAAiC,CAAC,GAAG,iBAAiB;AAC5D,IAAM,wBAAwB,IAAI,KAAK;AAkB9C,IAAI,SAAS;AAMN,SAAS,YAAY,OAA4B,CAAC,GAAe;AACtE,MAAI,CAAC,KAAK,SAAS,CAAC,QAAQ;AAC1B,aAAS;AACT,YAAQ,KAAK,uIAAuI;AAAA,EACtJ;AACA,QAAM,IAAI,oBAAI,IAA8B;AAC5C,SAAO;AAAA,IACL,IAAI,OAAO,GAAG;AACZ,YAAM,MAAM,KAAK,IAAI;AACrB,iBAAW,CAAC,GAAG,CAAC,KAAK,EAAG,KAAI,EAAE,YAAY,IAAK,GAAE,OAAO,CAAC;AACzD,QAAE,IAAI,OAAO,CAAC;AAAA,IAChB;AAAA,IACA,KAAK,OAAO;AACV,YAAM,IAAI,EAAE,IAAI,KAAK,KAAK;AAC1B,QAAE,OAAO,KAAK;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAI,eAAkC;AACtC,IAAM,iBAAiB,CAAC,MAAmB,MAAM,iBAAiB,YAAY;AAEvE,SAAS,cAAc,GAAyB;AACrD,MAAI,OAAO,MAAM,YAAY,CAAC,yBAAyB,KAAK,CAAC,EAAG,QAAO;AACvE,MAAI;AACF,cAAU,WAAW,CAAC;AACtB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,QAAwB;AAC5C,QAAM,IAAI,IAAI,IAAI,MAAM;AACxB,MAAI,EAAE,WAAW,UAAU,EAAE,WAAW,OAAO,QAAQ,OAAO,EAAE,GAAG;AACjE,UAAM,IAAI,MAAM,4CAA4C,MAAM,EAAE;AAAA,EACtE;AACA,SAAO,EAAE;AACX;AAGO,SAAS,aAAa,QAAgB,OAAe,WAA2B;AACrF,SAAO;AAAA,IACL,cAAc,IAAI,IAAI,MAAM,EAAE,IAAI;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,YAAY,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC;AAAA,EAC/C,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,cAAsB;AAC7B,QAAM,IAAI,IAAI,WAAW,EAAE;AAC3B,aAAW,OAAO,gBAAgB,CAAC;AACnC,MAAI,IAAI;AACR,aAAW,KAAK,EAAG,MAAK,OAAO,aAAa,CAAC;AAC7C,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAoBA,eAAsB,gBAAgB,MAA0D;AAC9F,MAAI,CAAC,cAAc,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4DAA4D;AAClH,QAAM,SAAS,aAAa,KAAK,MAAM;AACvC,QAAM,QAAQ,YAAY;AAC1B,QAAM,YAAY,KAAK,IAAI,IAAI;AAC/B,QAAM,UAAU,aAAa,QAAQ,OAAO,SAAS;AACrD,QAAM,eAAe,KAAK,KAAK,EAAE,IAAI,OAAO,EAAE,aAAa,KAAK,YAAY,YAAY,GAAG,QAAQ,SAAS,UAAU,CAAC;AACvH,SAAO,EAAE,OAAO,SAAS,YAAY,gBAAgB,OAAO,OAAO,UAAU;AAC/E;AAgBA,eAAsB,aAAa,MAAmD;AACpF,MAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,GAAI,QAAO;AACrE,QAAM,IAAI,MAAM,eAAe,KAAK,KAAK,EAAE,KAAK,KAAK,KAAK;AAC1D,MAAI,CAAC,KAAK,KAAK,IAAI,IAAI,EAAE,UAAW,QAAO;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,aAAa,KAAK,MAAM;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,EAAE,WAAW,OAAQ,QAAO;AAChC,MAAI,CAAC,cAAc,KAAK,WAAW,EAAG,QAAO;AAC7C,QAAM,cAAc,KAAK,YAAY,YAAY;AACjD,MAAI,EAAE,gBAAgB,YAAa,QAAO;AAE1C,QAAM,MAAM,KAAK;AACjB,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,KAAK,IAAI,SAAS,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,OAAO,UAAU,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,GAAG;AAC5H,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI,YAAY,QAAQ,EAAE,gBAAgB;AAAA,MAChE,YAAY;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,cAAc;AAAA,MACd,MAAM,MAAM,KAAK,IAAI,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;AAAA,MACpD,WAAW;AAAA,IACb,CAAC;AACD,WAAO,QAAQ,cAAc;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,cAAc,eAA0C,QAAyB;AAC/F,MAAI;AACF,WAAO,CAAC,CAAC,iBAAiB,kBAAkB,aAAa,MAAM;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@bwalletx/connect",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Sign in with bWalletX: wallet discovery, phone pairing and server-side challenge verification",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./server": {
+      "import": {
+        "types": "./dist/server.d.ts",
+        "default": "./dist/server.js"
+      },
+      "require": {
+        "types": "./dist/server.d.cts",
+        "default": "./dist/server.cjs"
+      }
+    },
+    "./browser": "./dist/bwalletx-connect.global.js",
+    "./package.json": "./package.json"
+  },
+  "unpkg": "./dist/bwalletx-connect.global.js",
+  "jsdelivr": "./dist/bwalletx-connect.global.js",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "bsv",
+    "brc-100",
+    "wallet",
+    "bwalletx",
+    "sign-in",
+    "authentication"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:live": "LIVE_RELAY=1 vitest run test/live-relay.test.ts",
+    "prepublishOnly": "pnpm typecheck && pnpm test && pnpm build"
+  },
+  "peerDependencies": {
+    "@bsv/sdk": ">=2.2.0 <4"
+  },
+  "devDependencies": {
+    "@bsv/sdk": "^2.8.11",
+    "@types/node": "^26.6.4",
+    "@types/ws": "^8.18.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.3",
+    "ws": "^8.22.0"
+  }
+}