@bwalletx/connect 0.3.0 → 0.4.1

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 import { WalletInterface, WalletProtocol } from '@bsv/sdk';
+import { f as PairingOptions, W as WalletOption } from './wallets-VOKIKBbO.js';
+export { g as BRC29_PROTOCOL, i as Brc29Remittance, B as BuyTokenRequest, C as ConnectedWallet, D as DiscoverWalletsOptions, H as HandCashAdapterOptions, L as LegacyPayer, j as PairConnectionOptions, k as PairStorage, l as PairedWallet, b as PayOptions, m as PayOutput, P as PayRequest, a as PayResult, n as PaySource, c as PaymentError, o as PaymentErrorCode, S as SocketFactory, q as SocketLike, T as TokenQuote, r as WalletKind, s as amountInSats, d as brc100Option, t as buyToken, u as clearPairing, e as discoverWallets, h as handcashAdapter, v as isIdentityKeyHex, w as isPaymail, x as pairBwalletX, p as pairingOption, y as pay, z as resolvePaymailP2P, A as restorePairing, E as tip } from './wallets-VOKIKBbO.js';
 export { AuthorizeParams, GET_URL, SIGNIN_CSS, SIGNIN_TAG, SigninBrand, SigninLabel, SigninSize, SigninTheme, WEB_WALLET_URL, buildAuthorizeUrl, defineBwalletxSignin, markSvg, signinText } from './element.js';
 
 /** Ids bWalletX announces in BRC-100 wallet discovery. */
@@ -24,67 +26,6 @@ declare function discoverBwalletX(ms?: number): Promise<FoundWallet | null>;
  */
 declare function findBwalletX(ms?: number): Promise<WalletInterface | null>;
 
-/** localStorage-shaped storage. Methods may be sync or async. */
-interface PairStorage {
-    getItem(key: string): string | null | Promise<string | null>;
-    setItem(key: string, value: string): void | Promise<void>;
-    removeItem(key: string): void | Promise<void>;
-}
-/** The minimum of the browser WebSocket API this package uses (the `ws` package also fits). */
-interface SocketLike {
-    readonly readyState: number;
-    onopen: ((ev: unknown) => void) | null;
-    onmessage: ((ev: {
-        data: unknown;
-    }) => void) | null;
-    onerror: ((ev: unknown) => void) | null;
-    onclose: ((ev: unknown) => void) | null;
-    send(data: string): void;
-    close(): void;
-}
-type SocketFactory = (url: string) => SocketLike;
-interface PairConnectionOptions {
-    /** Where the pairing is kept so it survives a reload. Default: localStorage, else memory only. */
-    storage?: PairStorage | null;
-    /** Storage key. Default 'bwalletx.connect.pairing.v1'. */
-    storageKey?: string;
-    /** Opens a socket. Default: the global WebSocket. Pass one to run in Node or to test. */
-    socket?: SocketFactory;
-    /** Per-call timeout in ms. Default 120000. */
-    callTimeoutMs?: number;
-}
-interface PairingOptions extends PairConnectionOptions {
-    /** Show this link as a QR code, and as text to copy (web.bwalletx.com takes it pasted). */
-    onLink: (link: string) => void;
-    /** Show this 4-digit code. The wallet shows the same one; the user checks they match. */
-    onCode: (code: string) => void;
-    signal?: AbortSignal;
-    /** Relay host. Default relay.bwallet.space. */
-    relay?: string;
-    /** This page's origin, as the relay will see it. Default location.origin. */
-    origin?: string;
-}
-/** A BRC-100 wallet whose every call goes, end-to-end encrypted, to the paired phone or web wallet. */
-type PairedWallet = WalletInterface & {
-    /** Close the relay connection. The pairing stays stored; the next call reconnects. */
-    close(): void;
-    /** Tell the wallet to unpair, close, and delete the stored pairing. */
-    forget(): Promise<void>;
-};
-/**
- * Pair with bWalletX on a phone (scan the QR) or web.bwalletx.com (paste the link).
- * Resolves with a wallet once the user taps Connect. The pairing is stored (see `storage`) so
- * `restorePairing()` can reconnect after a reload without a new QR.
- */
-declare function pairBwalletX(opts: PairingOptions): Promise<PairedWallet>;
-/**
- * The wallet from a pairing stored by an earlier `pairBwalletX`, or null if there is none.
- * It connects on the first call. The wallet must still have this site paired.
- */
-declare function restorePairing(opts?: PairConnectionOptions): Promise<PairedWallet | null>;
-/** Delete the stored pairing without telling the wallet. */
-declare function clearPairing(opts?: Pick<PairConnectionOptions, 'storage' | 'storageKey'>): Promise<void>;
-
 /** Security level 2, a protocol name used for nothing else. */
 declare const LOGIN_PROTOCOL: WalletProtocol;
 /** What your server's challenge route returns (createChallenge from '@bwalletx/connect/server'). */
@@ -146,4 +87,24 @@ declare function renderButton(el: HTMLElement | string, opts?: ButtonOptions): H
  */
 declare function inOrder<T>(handle: (frame: T) => Promise<void> | void, onError?: (e: unknown) => void): (frame: T) => Promise<void>;
 
-export { BWALLETX_RDNS, type ButtonOptions, type Challenge, type FoundBy, type FoundWallet, LOGIN_PROTOCOL, LOGO_URL, type PairConnectionOptions, type PairStorage, type PairedWallet, type PairingOptions, RDNS_EXTENSION, RDNS_MOBILE, type SignInMethod, type SignInOptions, type SignInResult, type SocketFactory, type SocketLike, clearPairing, connectBwalletX, discoverBwalletX, findBwalletX, inOrder, pairBwalletX, renderButton, restorePairing, signInWithBwalletX };
+/** An SVG QR code for `text` (error correction M). */
+declare function qrSvg(text: string): string;
+interface PairingModalOptions {
+    title?: string;
+    /** Called when the user closes the modal (the pairing is then aborted). */
+    onCancel?: () => void;
+}
+/**
+ * PairingOptions that show a QR modal. Pass to signInWithBwalletX({ pairing: pairingModal() }) or
+ * connectBwalletX. The modal opens when the link is ready and shows the match code. Call `close()`
+ * once pairing settles (useBwalletX does this for you); Cancel aborts the pairing.
+ */
+declare function pairingModal(o?: PairingModalOptions): PairingOptions & {
+    close(): void;
+};
+/** Show the picker; resolves with the chosen option, or null if closed. */
+declare function pickWallet(options: WalletOption[], o?: {
+    title?: string;
+}): Promise<WalletOption | null>;
+
+export { BWALLETX_RDNS, type ButtonOptions, type Challenge, type FoundBy, type FoundWallet, LOGIN_PROTOCOL, LOGO_URL, type PairingModalOptions, PairingOptions, RDNS_EXTENSION, RDNS_MOBILE, type SignInMethod, type SignInOptions, type SignInResult, WalletOption, connectBwalletX, discoverBwalletX, findBwalletX, inOrder, pairingModal, pickWallet, qrSvg, renderButton, signInWithBwalletX };

package/dist/index.js

@@ -1,3 +1,21 @@
+import {
+  BRC29_PROTOCOL,
+  PaymentError,
+  amountInSats,
+  brc100Option,
+  buyToken,
+  discoverWallets,
+  handcashAdapter,
+  isIdentityKeyHex,
+  isPaymail,
+  pairingModal,
+  pairingOption,
+  pay,
+  pickWallet,
+  qrSvg,
+  resolvePaymailP2P,
+  tip
+} from "./chunk-FUQ46RJV.js";
 import {
   BWALLETX_RDNS,
   GET_URL,
@@ -65,27 +83,43 @@ function renderButton(el, opts = {}) {
   return b;
 }
 export {
+  BRC29_PROTOCOL,
   BWALLETX_RDNS,
   GET_URL,
   LOGIN_PROTOCOL,
   LOGO_URL,
+  PaymentError,
   RDNS_EXTENSION,
   RDNS_MOBILE,
   SIGNIN_CSS,
   SIGNIN_TAG,
   WEB_WALLET_URL,
+  amountInSats,
+  brc100Option,
   buildAuthorizeUrl,
+  buyToken,
   clearPairing,
   connectBwalletX,
   defineBwalletxSignin,
   discoverBwalletX,
+  discoverWallets,
   findBwalletX,
+  handcashAdapter,
   inOrder,
+  isIdentityKeyHex,
+  isPaymail,
   markSvg,
   pairBwalletX,
+  pairingModal,
+  pairingOption,
+  pay,
+  pickWallet,
+  qrSvg,
   renderButton,
+  resolvePaymailP2P,
   restorePairing,
   signInWithBwalletX,
-  signinText
+  signinText,
+  tip
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/button.ts"],"sourcesContent":["const CSS = `\n.bwx-signin{display:inline-flex;align-items:center;gap:12px;min-height:48px;padding:10px 22px 10px 10px;border:0;border-radius:12px;cursor:pointer;background:linear-gradient(180deg,#fcd34d,#f59e0b);color:#000;text-align:left;font:700 16px/1.2 system-ui,-apple-system,\"Segoe UI\",sans-serif;box-shadow:0 8px 24px rgba(245,158,11,.2)}\n.bwx-signin:hover{background:linear-gradient(180deg,#fde68a,#fbbf24)}\n.bwx-signin:focus-visible{outline:2px solid #ffd24d;outline-offset:3px}\n.bwx-signin:disabled{opacity:.6;cursor:wait}\n.bwx-signin .bwx-mark{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border-radius:50%;background:#000;flex:none}\n.bwx-signin small{display:block;font-size:11px;font-weight:500;color:rgba(0,0,0,.6)}`;\n\nexport const LOGO_URL = 'https://bwalletx.com/logo.svg';\n\nexport interface ButtonOptions {\n  /** Second line under the label. Default \"also works with bWallet\". false hides it. */\n  subtitle?: string | false;\n  onClick?: (button: HTMLButtonElement) => void;\n}\n\n/** Put the gold \"Sign in with bWalletX\" button into `el` (replacing its contents). */\nexport function renderButton(el: HTMLElement | string, opts: ButtonOptions = {}): HTMLButtonElement {\n  const host = typeof el === 'string' ? document.querySelector<HTMLElement>(el) : el;\n  if (!host) throw new Error(`renderButton: no element ${String(el)}`);\n  if (!document.getElementById('bwx-signin-css')) {\n    const style = document.createElement('style');\n    style.id = 'bwx-signin-css';\n    style.textContent = CSS;\n    document.head.appendChild(style);\n  }\n  const b = document.createElement('button');\n  b.type = 'button';\n  b.className = 'bwx-signin';\n  const mark = document.createElement('span');\n  mark.className = 'bwx-mark';\n  const img = document.createElement('img');\n  img.src = LOGO_URL;\n  img.alt = '';\n  img.width = 15;\n  img.height = 20;\n  mark.appendChild(img);\n  const label = document.createElement('span');\n  label.className = 'bwx-label';\n  label.textContent = 'Sign in with bWalletX';\n  const sub = opts.subtitle === undefined ? 'also works with bWallet' : opts.subtitle;\n  if (sub) {\n    const small = document.createElement('small');\n    small.textContent = sub;\n    label.appendChild(small);\n  }\n  b.append(mark, label);\n  if (opts.onClick) b.addEventListener('click', () => opts.onClick!(b));\n  host.replaceChildren(b);\n  return b;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQL,IAAM,WAAW;AASjB,SAAS,aAAa,IAA0B,OAAsB,CAAC,GAAsB;AAClG,QAAM,OAAO,OAAO,OAAO,WAAW,SAAS,cAA2B,EAAE,IAAI;AAChF,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4BAA4B,OAAO,EAAE,CAAC,EAAE;AACnE,MAAI,CAAC,SAAS,eAAe,gBAAgB,GAAG;AAC9C,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,KAAK;AACX,UAAM,cAAc;AACpB,aAAS,KAAK,YAAY,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,SAAS,cAAc,QAAQ;AACzC,IAAE,OAAO;AACT,IAAE,YAAY;AACd,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,YAAY;AACjB,QAAM,MAAM,SAAS,cAAc,KAAK;AACxC,MAAI,MAAM;AACV,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,MAAI,SAAS;AACb,OAAK,YAAY,GAAG;AACpB,QAAM,QAAQ,SAAS,cAAc,MAAM;AAC3C,QAAM,YAAY;AAClB,QAAM,cAAc;AACpB,QAAM,MAAM,KAAK,aAAa,SAAY,4BAA4B,KAAK;AAC3E,MAAI,KAAK;AACP,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,cAAc;AACpB,UAAM,YAAY,KAAK;AAAA,EACzB;AACA,IAAE,OAAO,MAAM,KAAK;AACpB,MAAI,KAAK,QAAS,GAAE,iBAAiB,SAAS,MAAM,KAAK,QAAS,CAAC,CAAC;AACpE,OAAK,gBAAgB,CAAC;AACtB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/button.ts"],"sourcesContent":["const CSS = `\n.bwx-signin{display:inline-flex;align-items:center;gap:12px;min-height:48px;padding:10px 22px 10px 10px;border:0;border-radius:12px;cursor:pointer;background:linear-gradient(180deg,#fcd34d,#f59e0b);color:#000;text-align:left;font:700 16px/1.2 system-ui,-apple-system,\"Segoe UI\",sans-serif;box-shadow:0 8px 24px rgba(245,158,11,.2)}\n.bwx-signin:hover{background:linear-gradient(180deg,#fde68a,#fbbf24)}\n.bwx-signin:focus-visible{outline:2px solid #ffd24d;outline-offset:3px}\n.bwx-signin:disabled{opacity:.6;cursor:wait}\n.bwx-signin .bwx-mark{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border-radius:50%;background:#000;flex:none}\n.bwx-signin small{display:block;font-size:11px;font-weight:500;color:rgba(0,0,0,.6)}`;\n\nexport const LOGO_URL = 'https://bwalletx.com/logo.svg';\n\nexport interface ButtonOptions {\n  /** Second line under the label. Default \"also works with bWallet\". false hides it. */\n  subtitle?: string | false;\n  onClick?: (button: HTMLButtonElement) => void;\n}\n\n/** Put the gold \"Sign in with bWalletX\" button into `el` (replacing its contents). */\nexport function renderButton(el: HTMLElement | string, opts: ButtonOptions = {}): HTMLButtonElement {\n  const host = typeof el === 'string' ? document.querySelector<HTMLElement>(el) : el;\n  if (!host) throw new Error(`renderButton: no element ${String(el)}`);\n  if (!document.getElementById('bwx-signin-css')) {\n    const style = document.createElement('style');\n    style.id = 'bwx-signin-css';\n    style.textContent = CSS;\n    document.head.appendChild(style);\n  }\n  const b = document.createElement('button');\n  b.type = 'button';\n  b.className = 'bwx-signin';\n  const mark = document.createElement('span');\n  mark.className = 'bwx-mark';\n  const img = document.createElement('img');\n  img.src = LOGO_URL;\n  img.alt = '';\n  img.width = 15;\n  img.height = 20;\n  mark.appendChild(img);\n  const label = document.createElement('span');\n  label.className = 'bwx-label';\n  label.textContent = 'Sign in with bWalletX';\n  const sub = opts.subtitle === undefined ? 'also works with bWallet' : opts.subtitle;\n  if (sub) {\n    const small = document.createElement('small');\n    small.textContent = sub;\n    label.appendChild(small);\n  }\n  b.append(mark, label);\n  if (opts.onClick) b.addEventListener('click', () => opts.onClick!(b));\n  host.replaceChildren(b);\n  return b;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQL,IAAM,WAAW;AASjB,SAAS,aAAa,IAA0B,OAAsB,CAAC,GAAsB;AAClG,QAAM,OAAO,OAAO,OAAO,WAAW,SAAS,cAA2B,EAAE,IAAI;AAChF,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4BAA4B,OAAO,EAAE,CAAC,EAAE;AACnE,MAAI,CAAC,SAAS,eAAe,gBAAgB,GAAG;AAC9C,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,KAAK;AACX,UAAM,cAAc;AACpB,aAAS,KAAK,YAAY,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,SAAS,cAAc,QAAQ;AACzC,IAAE,OAAO;AACT,IAAE,YAAY;AACd,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,YAAY;AACjB,QAAM,MAAM,SAAS,cAAc,KAAK;AACxC,MAAI,MAAM;AACV,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,MAAI,SAAS;AACb,OAAK,YAAY,GAAG;AACpB,QAAM,QAAQ,SAAS,cAAc,MAAM;AAC3C,QAAM,YAAY;AAClB,QAAM,cAAc;AACpB,QAAM,MAAM,KAAK,aAAa,SAAY,4BAA4B,KAAK;AAC3E,MAAI,KAAK;AACP,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,cAAc;AACpB,UAAM,YAAY,KAAK;AAAA,EACzB;AACA,IAAE,OAAO,MAAM,KAAK;AACpB,MAAI,KAAK,QAAS,GAAE,iBAAiB,SAAS,MAAM,KAAK,QAAS,CAAC,CAAC;AACpE,OAAK,gBAAgB,CAAC;AACtB,SAAO;AACT;","names":[]}

package/dist/next.cjs

@@ -0,0 +1,415 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/next.ts
+var next_exports = {};
+__export(next_exports, {
+  IdentityLinkConflictError: () => IdentityLinkConflictError,
+  createBwalletXAuth: () => createBwalletXAuth,
+  linkIdentity: () => linkIdentity,
+  memoryStore: () => memoryStore,
+  pgNonceTableSql: () => pgNonceTableSql,
+  pgStore: () => pgStore,
+  redisStore: () => redisStore,
+  signInOrLink: () => signInOrLink
+});
+module.exports = __toCommonJS(next_exports);
+
+// src/link.ts
+var IdentityLinkConflictError = class extends Error {
+  constructor(identityKey, otherUserId) {
+    super("This bWalletX identity is already linked to a different account. Sign in with that account, or unlink it there first.");
+    this.identityKey = identityKey;
+    this.otherUserId = otherUserId;
+    this.name = "IdentityLinkConflictError";
+  }
+  identityKey;
+  otherUserId;
+  code = "IDENTITY_LINKED_TO_OTHER_USER";
+};
+var norm = (k) => {
+  if (typeof k !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(k)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
+  return k.toLowerCase();
+};
+async function linkIdentity(userId, identityKey, cb) {
+  if (!userId) throw new Error("linkIdentity needs the current user id");
+  const key = norm(identityKey);
+  const owner = await cb.findUserByIdentityKey(key);
+  if (owner && owner !== userId) throw new IdentityLinkConflictError(key, owner);
+  if (owner === userId) return { status: "already-linked", userId, identityKey: key };
+  await cb.attach(userId, key);
+  return { status: "linked", userId, identityKey: key };
+}
+async function signInOrLink(identityKey, o) {
+  const key = norm(identityKey);
+  if (o.currentUserId) return linkIdentity(o.currentUserId, key, o);
+  const owner = await o.findUserByIdentityKey(key);
+  if (owner) return { status: "signed-in", userId: owner, identityKey: key };
+  if (!o.createUser) return { status: "unknown", userId: null, identityKey: key };
+  const userId = await o.createUser(key);
+  await o.attach(userId, key);
+  return { status: "created", userId, identityKey: key };
+}
+
+// src/server.ts
+var import_sdk = require("@bsv/sdk");
+
+// src/nonce-stores.ts
+var ttlSeconds = (c) => Math.max(1, Math.ceil((c.expiresAt - Date.now()) / 1e3));
+function parse(v) {
+  if (v == null) return null;
+  try {
+    const c = typeof v === "string" ? JSON.parse(v) : v;
+    if (!c || typeof c.identityKey !== "string" || typeof c.message !== "string" || typeof c.expiresAt !== "number") return null;
+    return c.expiresAt < Date.now() ? null : c;
+  } catch {
+    return null;
+  }
+}
+function redisStore(opts) {
+  const { client } = opts;
+  const prefix = opts.prefix ?? "bwalletx:nonce:";
+  const getdel = client.getdel?.bind(client) ?? client.getDel?.bind(client);
+  if (!getdel) throw new Error("redisStore: the client needs getdel (or getDel). Redis 6.2+.");
+  return {
+    async put(nonce, c) {
+      const s = ttlSeconds(c);
+      if (opts.flavor === "ioredis") await client.set(prefix + nonce, JSON.stringify(c), "EX", s);
+      else await client.set(prefix + nonce, JSON.stringify(c), { ex: s, EX: s });
+    },
+    async take(nonce) {
+      return parse(await getdel(prefix + nonce));
+    }
+  };
+}
+function pgNonceTableSql(table = "bwalletx_nonces") {
+  const t = safeTable(table);
+  return `create table if not exists ${t} (
+  nonce text primary key,
+  challenge jsonb not null,
+  expires_at timestamptz not null
+);
+create index if not exists ${t.replace(".", "_")}_expires_idx on ${t} (expires_at);`;
+}
+function safeTable(t) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/.test(t)) throw new Error(`pgStore: bad table name ${t}`);
+  return t;
+}
+function pgStore(opts) {
+  const t = safeTable(opts.table ?? "bwalletx_nonces");
+  const rows = (r) => Array.isArray(r) ? r : r.rows;
+  return {
+    async put(nonce, c) {
+      await opts.query(`delete from ${t} where expires_at < now()`, []);
+      await opts.query(`insert into ${t} (nonce, challenge, expires_at) values ($1, $2, to_timestamp($3 / 1000.0))`, [
+        nonce,
+        JSON.stringify(c),
+        c.expiresAt
+      ]);
+    },
+    async take(nonce) {
+      const r = rows(await opts.query(`delete from ${t} where nonce = $1 returning challenge`, [nonce]));
+      const row = r[0];
+      return parse(row?.challenge);
+    }
+  };
+}
+
+// src/session.ts
+var MIN_SECRET_LENGTH = 32;
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function b64u(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function unb64u(s) {
+  if (!/^[A-Za-z0-9_-]*$/.test(s)) throw new Error("bad base64url");
+  const b = atob(s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4));
+  return Uint8Array.from(b, (c) => c.charCodeAt(0));
+}
+function assertSecret(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `[@bwalletx/connect] A session secret of at least ${MIN_SECRET_LENGTH} characters is required. Set it in an environment variable (e.g. BWALLETX_SESSION_SECRET). There is no default.`
+    );
+  }
+}
+var keys = /* @__PURE__ */ new Map();
+function hmacKey(secret) {
+  let k = keys.get(secret);
+  if (!k) {
+    k = globalThis.crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+    keys.set(secret, k);
+  }
+  return k;
+}
+async function signSession(claims, opts) {
+  assertSecret(opts.secret);
+  if (typeof claims.sub !== "string" || !claims.sub) throw new Error("session needs a sub (identity key)");
+  const iat = Math.floor((opts.now ?? Date.now()) / 1e3);
+  const payload = { ...claims, sub: claims.sub, iat, exp: iat + (opts.maxAge ?? 7 * 24 * 3600) };
+  const body2 = b64u(enc.encode(JSON.stringify(payload)));
+  const sig = new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", await hmacKey(opts.secret), enc.encode(body2)));
+  return `${body2}.${b64u(sig)}`;
+}
+async function verifySession(token, opts) {
+  assertSecret(opts.secret);
+  if (typeof token !== "string" || token.length > 8192) return null;
+  const dot = token.indexOf(".");
+  if (dot < 1 || dot !== token.lastIndexOf(".")) return null;
+  const body2 = token.slice(0, dot);
+  try {
+    const sig = unb64u(token.slice(dot + 1));
+    const ok = await globalThis.crypto.subtle.verify("HMAC", await hmacKey(opts.secret), sig, enc.encode(body2));
+    if (!ok) return null;
+    const p = JSON.parse(dec.decode(unb64u(body2)));
+    if (!p || typeof p.sub !== "string" || typeof p.exp !== "number") return null;
+    if (Math.floor((opts.now ?? Date.now()) / 1e3) >= p.exp) return null;
+    return p;
+  } catch {
+    return null;
+  }
+}
+function serializeCookie(value, o) {
+  const parts = [`${o.name}=${value}`, `Path=${o.path ?? "/"}`, `Max-Age=${o.maxAge}`, "HttpOnly", `SameSite=${o.sameSite ?? "Lax"}`];
+  if (o.secure !== false) parts.push("Secure");
+  if (o.domain) parts.push(`Domain=${o.domain}`);
+  return parts.join("; ");
+}
+function readCookie(header, name) {
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const i = part.indexOf("=");
+    if (i > 0 && part.slice(0, i).trim() === name) return part.slice(i + 1).trim();
+  }
+  return null;
+}
+
+// src/server.ts
+var LOGIN_PROTOCOL = [2, "bwallet sign in"];
+var CHALLENGE_LIFETIME_MS = 2 * 60 * 1e3;
+var warned = false;
+function memoryStore(opts = {}) {
+  const prod = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  if ((prod || !opts.quiet) && !warned) {
+    warned = true;
+    console.warn(
+      prod ? "[@bwalletx/connect] WARNING: the in-memory nonce store is running in production. It is not shared between instances and breaks on serverless. Use redisStore or pgStore." : "[@bwalletx/connect] Using the in-memory nonce store. It is for development only; pass a shared store (redisStore, pgStore) in production."
+    );
+  }
+  const m = /* @__PURE__ */ new Map();
+  return {
+    put(nonce, c) {
+      const now = Date.now();
+      for (const [k, v] of m) if (v.expiresAt < now) m.delete(k);
+      m.set(nonce, c);
+    },
+    take(nonce) {
+      const c = m.get(nonce) ?? null;
+      m.delete(nonce);
+      return c;
+    }
+  };
+}
+var defaultStore = null;
+var storeOrDefault = (s) => s ?? (defaultStore ??= memoryStore());
+function isIdentityKey(x) {
+  if (typeof x !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;
+  try {
+    import_sdk.PublicKey.fromString(x);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalOrigin(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) {
+    throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  }
+  return u.origin;
+}
+function loginMessage(origin, nonce, expiresAt) {
+  return [
+    `Sign in to ${new URL(origin).host} with bWallet`,
+    "",
+    "This proves you hold this wallet. It does not spend anything.",
+    "",
+    `Origin: ${origin}`,
+    `Nonce: ${nonce}`,
+    `Expires: ${new Date(expiresAt).toISOString()}`
+  ].join("\n");
+}
+function randomNonce() {
+  const b = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createChallenge(opts) {
+  if (!isIdentityKey(opts.identityKey)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
+  const origin = normalOrigin(opts.origin);
+  const nonce = randomNonce();
+  const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
+  const message = loginMessage(origin, nonce, expiresAt);
+  await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });
+  return { nonce, message, protocolID: LOGIN_PROTOCOL, keyID: nonce, expiresAt };
+}
+async function verifySignIn(opts) {
+  if (typeof opts.nonce !== "string" || opts.nonce.length > 64) return null;
+  const c = await storeOrDefault(opts.store).take(opts.nonce);
+  if (!c || Date.now() > c.expiresAt) return null;
+  let origin;
+  try {
+    origin = normalOrigin(opts.origin);
+  } catch {
+    return null;
+  }
+  if (c.origin !== origin) return null;
+  if (!isIdentityKey(opts.identityKey)) return null;
+  const identityKey = opts.identityKey.toLowerCase();
+  if (c.identityKey !== identityKey) return null;
+  const sig = opts.signature;
+  if (!Array.isArray(sig) || sig.length < 8 || sig.length > 80 || !sig.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+    return null;
+  }
+  try {
+    const { valid } = await new import_sdk.ProtoWallet("anyone").verifySignature({
+      protocolID: LOGIN_PROTOCOL,
+      keyID: opts.nonce,
+      counterparty: identityKey,
+      data: Array.from(new TextEncoder().encode(c.message)),
+      signature: sig
+    });
+    return valid ? identityKey : null;
+  } catch {
+    return null;
+  }
+}
+function originAllowed(requestOrigin, origin) {
+  try {
+    return !!requestOrigin && requestOrigin === normalOrigin(origin);
+  } catch {
+    return false;
+  }
+}
+
+// src/next.ts
+var json = (body2, status = 200, headers = {}) => new Response(JSON.stringify(body2), { status, headers: { "content-type": "application/json", "cache-control": "no-store", ...headers } });
+async function body(req) {
+  try {
+    const b = await req.json();
+    return b && typeof b === "object" ? b : null;
+  } catch {
+    return null;
+  }
+}
+function createBwalletXAuth(o) {
+  if (!o.store) throw new Error("createBwalletXAuth needs a nonce store (redisStore, pgStore; memoryStore for dev)");
+  const cookieName = o.cookieName ?? "bwx_session";
+  const maxAge = o.maxAge ?? 7 * 24 * 3600;
+  const secure = o.secureCookie ?? o.origin.startsWith("https:");
+  const secret = () => {
+    const s = o.secret ?? (typeof process !== "undefined" ? process.env?.[o.secretEnv ?? "BWALLETX_SESSION_SECRET"] : void 0);
+    assertSecret(s);
+    return s;
+  };
+  const cookie = (v, age) => serializeCookie(v, { name: cookieName, maxAge: age, secure, sameSite: o.sameSite, domain: o.cookieDomain });
+  const badOrigin = (req) => !originAllowed(req.headers.get("origin"), o.origin);
+  const fromSource = async (source) => {
+    if (typeof source === "string") return readCookie(source, cookieName);
+    if (source instanceof Headers) return readCookie(source.get("cookie"), cookieName);
+    if (source && typeof source.headers?.get === "function") return readCookie(source.headers.get("cookie"), cookieName);
+    const { cookies } = await import("next/headers");
+    const jar = await cookies();
+    return jar.get(cookieName)?.value ?? null;
+  };
+  const auth = {
+    async challenge(req) {
+      secret();
+      if (badOrigin(req)) return json({ error: "origin not allowed" }, 403);
+      const b = await body(req);
+      try {
+        return json(await createChallenge({ origin: o.origin, identityKey: b?.identityKey, store: o.store }));
+      } catch (e) {
+        return json({ error: e.message }, 400);
+      }
+    },
+    async verify(req) {
+      const key = secret();
+      if (badOrigin(req)) return json({ error: "origin not allowed" }, 403);
+      const b = await body(req);
+      const identityKey = await verifySignIn({ origin: o.origin, identityKey: b?.identityKey, nonce: b?.nonce, signature: b?.signature, store: o.store });
+      if (!identityKey) return json({ error: "sign-in failed" }, 401);
+      let extra = {};
+      try {
+        const r = await o.onVerified?.(identityKey, req);
+        if (r === false) return json({ error: "not allowed" }, 403);
+        if (r) extra = r;
+      } catch (e) {
+        if (e instanceof IdentityLinkConflictError) return json({ error: e.message, code: e.code }, 409);
+        throw e;
+      }
+      const token = await signSession({ ...extra, sub: identityKey }, { secret: key, maxAge });
+      return json({ identityKey, uid: extra.uid, handle: extra.handle, paymail: extra.paymail }, 200, { "set-cookie": cookie(token, maxAge) });
+    },
+    async logout(req) {
+      if (badOrigin(req)) return json({ error: "origin not allowed" }, 403);
+      return json({ ok: true }, 200, { "set-cookie": cookie("", 0) });
+    },
+    async session(req) {
+      const s = await auth.getSession(req);
+      return s ? json({ identityKey: s.sub, uid: s.uid, handle: s.handle, paymail: s.paymail, exp: s.exp }) : json({ identityKey: null }, 200);
+    },
+    async getSession(source) {
+      const key = secret();
+      return verifySession(await fromSource(source), { secret: key });
+    },
+    async sessionCookie(claims) {
+      return cookie(await signSession(claims, { secret: secret(), maxAge }), maxAge);
+    },
+    clearCookie: () => cookie("", 0)
+  };
+  return auth;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdentityLinkConflictError,
+  createBwalletXAuth,
+  linkIdentity,
+  memoryStore,
+  pgNonceTableSql,
+  pgStore,
+  redisStore,
+  signInOrLink
+});
+//# sourceMappingURL=next.cjs.map