@bwalletx/connect 0.3.0 → 0.5.0

package/dist/chunk-QRXFL66W.js

@@ -0,0 +1,652 @@
+import {
+  ACCESS_CHALLENGE_LIFETIME_S,
+  ACCESS_PROTOCOL,
+  AccessError,
+  MAX_HOLDING_PROOFS,
+  atLeastRaw,
+  canonicalJson,
+  challengeBytes,
+  kindFor,
+  normaliseRequirement,
+  parseAccessChallenge,
+  tokenNeedRaw
+} from "./chunk-MWD4BCO5.js";
+
+// src/server.ts
+import { ProtoWallet as ProtoWallet2, PublicKey as PublicKey2 } from "@bsv/sdk";
+
+// src/nonce-stores.ts
+var ttlSeconds = (c) => Math.max(1, Math.ceil((c.expiresAt - Date.now()) / 1e3));
+function parse(v) {
+  if (v == null) return null;
+  try {
+    const c = typeof v === "string" ? JSON.parse(v) : v;
+    if (!c || typeof c.identityKey !== "string" || typeof c.message !== "string" || typeof c.expiresAt !== "number") return null;
+    return c.expiresAt < Date.now() ? null : c;
+  } catch {
+    return null;
+  }
+}
+function redisStore(opts) {
+  const { client } = opts;
+  const prefix = opts.prefix ?? "bwalletx:nonce:";
+  const getdel = client.getdel?.bind(client) ?? client.getDel?.bind(client);
+  if (!getdel) throw new Error("redisStore: the client needs getdel (or getDel). Redis 6.2+.");
+  return {
+    async put(nonce, c) {
+      const s = ttlSeconds(c);
+      if (opts.flavor === "ioredis") await client.set(prefix + nonce, JSON.stringify(c), "EX", s);
+      else await client.set(prefix + nonce, JSON.stringify(c), { ex: s, EX: s });
+    },
+    async take(nonce) {
+      return parse(await getdel(prefix + nonce));
+    }
+  };
+}
+function pgNonceTableSql(table = "bwalletx_nonces") {
+  const t = safeTable(table);
+  return `create table if not exists ${t} (
+  nonce text primary key,
+  challenge jsonb not null,
+  expires_at timestamptz not null
+);
+create index if not exists ${t.replace(".", "_")}_expires_idx on ${t} (expires_at);`;
+}
+function safeTable(t) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/.test(t)) throw new Error(`pgStore: bad table name ${t}`);
+  return t;
+}
+function pgStore(opts) {
+  const t = safeTable(opts.table ?? "bwalletx_nonces");
+  const rows = (r) => Array.isArray(r) ? r : r.rows;
+  return {
+    async put(nonce, c) {
+      await opts.query(`delete from ${t} where expires_at < now()`, []);
+      await opts.query(`insert into ${t} (nonce, challenge, expires_at) values ($1, $2, to_timestamp($3 / 1000.0))`, [
+        nonce,
+        JSON.stringify(c),
+        c.expiresAt
+      ]);
+    },
+    async take(nonce) {
+      const r = rows(await opts.query(`delete from ${t} where nonce = $1 returning challenge`, [nonce]));
+      const row = r[0];
+      return parse(row?.challenge);
+    }
+  };
+}
+
+// src/session.ts
+var MIN_SECRET_LENGTH = 32;
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+function b64u(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function unb64u(s) {
+  if (!/^[A-Za-z0-9_-]*$/.test(s)) throw new Error("bad base64url");
+  const b = atob(s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4));
+  return Uint8Array.from(b, (c) => c.charCodeAt(0));
+}
+function assertSecret(secret) {
+  if (typeof secret !== "string" || secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `[@bwalletx/connect] A session secret of at least ${MIN_SECRET_LENGTH} characters is required. Set it in an environment variable (e.g. BWALLETX_SESSION_SECRET). There is no default.`
+    );
+  }
+}
+var keys = /* @__PURE__ */ new Map();
+function hmacKey(secret) {
+  let k = keys.get(secret);
+  if (!k) {
+    k = globalThis.crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+    keys.set(secret, k);
+  }
+  return k;
+}
+async function signSession(claims, opts) {
+  assertSecret(opts.secret);
+  if (typeof claims.sub !== "string" || !claims.sub) throw new Error("session needs a sub (identity key)");
+  const iat = Math.floor((opts.now ?? Date.now()) / 1e3);
+  const payload = { ...claims, sub: claims.sub, iat, exp: iat + (opts.maxAge ?? 7 * 24 * 3600) };
+  const body = b64u(enc.encode(JSON.stringify(payload)));
+  const sig = new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", await hmacKey(opts.secret), enc.encode(body)));
+  return `${body}.${b64u(sig)}`;
+}
+async function verifySession(token, opts) {
+  assertSecret(opts.secret);
+  if (typeof token !== "string" || token.length > 8192) return null;
+  const dot = token.indexOf(".");
+  if (dot < 1 || dot !== token.lastIndexOf(".")) return null;
+  const body = token.slice(0, dot);
+  try {
+    const sig = unb64u(token.slice(dot + 1));
+    const ok = await globalThis.crypto.subtle.verify("HMAC", await hmacKey(opts.secret), sig, enc.encode(body));
+    if (!ok) return null;
+    const p = JSON.parse(dec.decode(unb64u(body)));
+    if (!p || typeof p.sub !== "string" || typeof p.exp !== "number") return null;
+    if (Math.floor((opts.now ?? Date.now()) / 1e3) >= p.exp) return null;
+    return p;
+  } catch {
+    return null;
+  }
+}
+function serializeCookie(value, o) {
+  const parts = [`${o.name}=${value}`, `Path=${o.path ?? "/"}`, `Max-Age=${o.maxAge}`, "HttpOnly", `SameSite=${o.sameSite ?? "Lax"}`];
+  if (o.secure !== false) parts.push("Secure");
+  if (o.domain) parts.push(`Domain=${o.domain}`);
+  return parts.join("; ");
+}
+function readCookie(header, name) {
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const i = part.indexOf("=");
+    if (i > 0 && part.slice(0, i).trim() === name) return part.slice(i + 1).trim();
+  }
+  return null;
+}
+
+// src/verify-payment.ts
+import { P2PKH, Transaction, Utils } from "@bsv/sdk";
+var PaymentVerificationError = class extends Error {
+  constructor(code, message, txid) {
+    super(message);
+    this.code = code;
+    this.txid = txid;
+    this.name = "PaymentVerificationError";
+  }
+  code;
+  txid;
+};
+var isHex = (s) => /^([0-9a-fA-F]{2})+$/.test(s);
+var woc = (n) => `https://api.whatsonchain.com/v1/bsv/${n}`;
+function parseTx(input) {
+  const bytes = typeof input === "string" ? Utils.toArray(input, "hex") : Array.from(input);
+  const tries = [
+    () => Transaction.fromAtomicBEEF(bytes),
+    () => Transaction.fromBEEF(bytes),
+    () => Transaction.fromBinary(bytes)
+  ];
+  for (const t of tries) {
+    try {
+      return t();
+    } catch {
+    }
+  }
+  throw new PaymentVerificationError("BAD_TX", "Could not parse the transaction (expected a txid, raw tx, BEEF or Atomic BEEF).");
+}
+function expectedScript(e) {
+  if (!Number.isSafeInteger(e.satoshis) || e.satoshis < 0) throw new PaymentVerificationError("BAD_EXPECTED", "expected.satoshis must be a non-negative integer");
+  if (e.script) {
+    if (!isHex(e.script)) throw new PaymentVerificationError("BAD_EXPECTED", "expected.script must be hex");
+    return e.script.toLowerCase();
+  }
+  if (e.address) {
+    try {
+      return new P2PKH().lock(e.address).toHex();
+    } catch {
+      throw new PaymentVerificationError("BAD_EXPECTED", `Not a valid address: ${e.address}`);
+    }
+  }
+  throw new PaymentVerificationError("BAD_EXPECTED", "Each expected output needs a script or an address");
+}
+async function getJson(f, url, headers = {}) {
+  let r;
+  try {
+    r = await f(url, { headers });
+  } catch (e) {
+    throw new PaymentVerificationError("NETWORK", `Could not reach ${new URL(url).host}: ${e.message}`);
+  }
+  const text = await r.text();
+  let body = text;
+  try {
+    body = JSON.parse(text);
+  } catch {
+  }
+  return { status: r.status, body };
+}
+async function checkStatus(o, f, txid) {
+  const mode = o.status ?? "woc";
+  if (mode === "none") return { state: "unchecked" };
+  if (mode === "arc") {
+    if (!o.arcUrl) throw new PaymentVerificationError("NETWORK", "status 'arc' needs arcUrl");
+    const { status: status2, body: body2 } = await getJson(f, `${o.arcUrl.replace(/\/$/, "")}/v1/tx/${txid}`, o.arcApiKey ? { Authorization: `Bearer ${o.arcApiKey}` } : {});
+    if (status2 === 404) return { state: "not-found", source: "arc" };
+    if (status2 >= 400) throw new PaymentVerificationError("NETWORK", `ARC answered ${status2}`, txid);
+    const b = body2;
+    const s = String(b.txStatus ?? "").toUpperCase();
+    if (s === "MINED" || s === "IMMUTABLE") return { state: "confirmed", confirmations: 1, source: "arc" };
+    if (s === "REJECTED" || s === "DOUBLE_SPEND_ATTEMPTED") return { state: "rejected", source: "arc", detail: b.extraInfo ?? s };
+    if (s === "UNKNOWN" || s === "") return { state: "not-found", source: "arc", detail: s };
+    return { state: "mempool", source: "arc", detail: s };
+  }
+  const { status, body } = await getJson(f, `${woc(o.network ?? "main")}/tx/hash/${txid}`);
+  if (status === 404) return { state: "not-found", source: "woc" };
+  if (status >= 400) throw new PaymentVerificationError("NETWORK", `WhatsOnChain answered ${status}`, txid);
+  const c = Number(body.confirmations ?? 0);
+  return c > 0 ? { state: "confirmed", confirmations: c, source: "woc" } : { state: "mempool", source: "woc" };
+}
+async function verifyPayment(o) {
+  const f = o.fetch ?? globalThis.fetch;
+  if (!o.expected?.length) throw new PaymentVerificationError("BAD_EXPECTED", "Pass at least one expected output");
+  const want = o.expected.map((e) => ({ script: expectedScript(e), satoshis: e.satoshis }));
+  let tx;
+  if (typeof o.tx === "string" && /^[0-9a-fA-F]{64}$/.test(o.tx)) {
+    const txid2 = o.tx.toLowerCase();
+    let r;
+    try {
+      r = await f(`${woc(o.network ?? "main")}/tx/${txid2}/hex`);
+    } catch (e) {
+      throw new PaymentVerificationError("NETWORK", `Could not reach WhatsOnChain: ${e.message}`, txid2);
+    }
+    if (r.status === 404) throw new PaymentVerificationError("TX_NOT_FOUND", `Transaction ${txid2} was not found`, txid2);
+    if (!r.ok) throw new PaymentVerificationError("NETWORK", `WhatsOnChain answered ${r.status}`, txid2);
+    tx = parseTx((await r.text()).trim());
+    if (tx.id("hex") !== txid2) throw new PaymentVerificationError("BAD_TX", "The fetched transaction does not match the txid", txid2);
+  } else {
+    if (typeof o.tx === "string" && !isHex(o.tx)) throw new PaymentVerificationError("BAD_TX", "tx must be a txid or hex");
+    tx = parseTx(o.tx);
+  }
+  const txid = tx.id("hex");
+  if (o.spv) {
+    let ok = false;
+    try {
+      ok = await tx.verify(o.spv);
+    } catch (e) {
+      throw new PaymentVerificationError("SPV_FAILED", `SPV check failed: ${e.message}`, txid);
+    }
+    if (!ok) throw new PaymentVerificationError("SPV_FAILED", "SPV check failed", txid);
+  }
+  const used = /* @__PURE__ */ new Set();
+  const matched = [];
+  for (const w of want) {
+    const vout = tx.outputs.findIndex(
+      (out, i) => !used.has(i) && out.lockingScript.toHex() === w.script && (out.satoshis ?? 0) >= w.satoshis
+    );
+    if (vout < 0) {
+      throw new PaymentVerificationError("OUTPUT_MISSING", `No output pays ${w.satoshis} sats to script ${w.script.slice(0, 16)}\u2026`, txid);
+    }
+    used.add(vout);
+    matched.push({ vout, satoshis: tx.outputs[vout].satoshis ?? 0, script: w.script });
+  }
+  const status = await checkStatus(o, f, txid);
+  if (status.state === "rejected") throw new PaymentVerificationError("REJECTED", `The network rejected ${txid}: ${status.detail ?? ""}`.trim(), txid);
+  if ((o.requireSeen || (o.minConfirmations ?? 0) > 0) && status.state !== "mempool" && status.state !== "confirmed") {
+    throw new PaymentVerificationError("NOT_SEEN", `The network has not seen ${txid} yet`, txid);
+  }
+  const conf = status.state === "confirmed" ? status.confirmations : 0;
+  if ((o.minConfirmations ?? 0) > conf) {
+    throw new PaymentVerificationError("NOT_SEEN", `${txid} has ${conf} confirmations, needs ${o.minConfirmations}`, txid);
+  }
+  return { ok: true, txid, matched, status };
+}
+
+// src/link.ts
+var IdentityLinkConflictError = class extends Error {
+  constructor(identityKey, otherUserId) {
+    super("This bWalletX identity is already linked to a different account. Sign in with that account, or unlink it there first.");
+    this.identityKey = identityKey;
+    this.otherUserId = otherUserId;
+    this.name = "IdentityLinkConflictError";
+  }
+  identityKey;
+  otherUserId;
+  code = "IDENTITY_LINKED_TO_OTHER_USER";
+};
+var norm = (k) => {
+  if (typeof k !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(k)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
+  return k.toLowerCase();
+};
+async function linkIdentity(userId, identityKey, cb) {
+  if (!userId) throw new Error("linkIdentity needs the current user id");
+  const key = norm(identityKey);
+  const owner = await cb.findUserByIdentityKey(key);
+  if (owner && owner !== userId) throw new IdentityLinkConflictError(key, owner);
+  if (owner === userId) return { status: "already-linked", userId, identityKey: key };
+  await cb.attach(userId, key);
+  return { status: "linked", userId, identityKey: key };
+}
+async function signInOrLink(identityKey, o) {
+  const key = norm(identityKey);
+  if (o.currentUserId) return linkIdentity(o.currentUserId, key, o);
+  const owner = await o.findUserByIdentityKey(key);
+  if (owner) return { status: "signed-in", userId: owner, identityKey: key };
+  if (!o.createUser) return { status: "unknown", userId: null, identityKey: key };
+  const userId = await o.createUser(key);
+  await o.attach(userId, key);
+  return { status: "created", userId, identityKey: key };
+}
+
+// src/access-server.ts
+import { ProtoWallet, PublicKey, Signature } from "@bsv/sdk";
+var bare = (tokenId) => tokenId.replace(/^bsv21:/, "");
+function oneSatResolver(o = {}) {
+  const base = (o.base ?? "https://api.1sat.app/1sat").replace(/\/$/, "");
+  const f = o.fetch ?? globalThis.fetch;
+  const t = o.timeoutMs ?? 12e3;
+  const call = async (path, init) => {
+    const res = await f(`${base}${path}`, { ...init, signal: AbortSignal.timeout(t), cache: "no-store" });
+    if (!res.ok) throw new Error(`1sat ${res.status} for ${path}`);
+    return res.json();
+  };
+  return {
+    async tokenBalance(tokenId, addresses) {
+      const sorted = [...new Set(addresses)].sort();
+      let total = 0n;
+      for (let i = 0; i < sorted.length; i += 100) {
+        const j = await call(`/bsv21/${bare(tokenId)}/p2pkh/balance`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(sorted.slice(i, i + 100))
+        });
+        const b = j?.balance ?? 0;
+        const s = typeof b === "number" ? String(Math.trunc(b)) : String(b).split(".")[0] || "0";
+        if (!/^\d+$/.test(s)) throw new Error("1sat returned a bad balance");
+        total += BigInt(s);
+      }
+      return total.toString();
+    },
+    async tokenSupply(tokenId) {
+      const j = await call(`/bsv21/${bare(tokenId)}`);
+      const tok = (j?.token ?? j) || {};
+      const v = tok.amt ?? tok.max ?? tok.supply;
+      const s = v === void 0 || v === null ? "" : String(v).split(".")[0];
+      if (!/^\d+$/.test(s) || s === "0") throw new Error("1sat did not report a supply");
+      return s;
+    }
+  };
+}
+function bitSignResolver(o = {}) {
+  const base = (o.base ?? "https://bit-sign.online").replace(/\/$/, "");
+  const f = o.fetch ?? globalThis.fetch;
+  const tokens = o.tokens ?? oneSatResolver({ fetch: f });
+  return {
+    tokenBalance: (id, a) => tokens.tokenBalance(id, a),
+    tokenSupply: tokens.tokenSupply ? (id) => tokens.tokenSupply(id) : void 0,
+    async identity(identityKey, response) {
+      const res = await f(`${base}/api/access/verify`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ response, only: "identity" }),
+        signal: AbortSignal.timeout(o.timeoutMs ?? 12e3),
+        cache: "no-store"
+      });
+      const j = await res.json().catch(() => null);
+      if (!j?.identity || j.identityKey !== identityKey) throw new Error(`bit-sign ${res.status}`);
+      return { level: Number(j.identity.level) || 0, kyc: j.identity.kyc === true };
+    }
+  };
+}
+function normalOrigin(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  return u.origin;
+}
+function randomNonce() {
+  const b = new Uint8Array(18);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createAccessChallenge(o) {
+  const origin = normalOrigin(o.origin);
+  const require2 = normaliseRequirement(o.require);
+  let sub;
+  if (o.identityKey !== void 0 && o.identityKey !== null && o.identityKey !== "") {
+    if (!isIdentityKey(o.identityKey)) throw new AccessError("bad_request", "identityKey must be a compressed public key");
+    sub = o.identityKey.toLowerCase();
+  }
+  const iat = Math.floor((o.now ?? Date.now()) / 1e3);
+  const exp = iat + (o.lifetimeS ?? ACCESS_CHALLENGE_LIFETIME_S);
+  const nonce = randomNonce();
+  const c = { v: 1, kind: o.kind ?? kindFor(require2), origin, nonce, iat, exp, sub, require: require2 };
+  const challenge = canonicalJson(c);
+  await o.store.put(nonce, { identityKey: sub ?? "", origin, message: challenge, expiresAt: exp * 1e3 });
+  return { challenge, nonce, kind: c.kind, protocolID: ACCESS_PROTOCOL, keyID: nonce, exp };
+}
+var isByteArray = (s) => Array.isArray(s) && s.length >= 8 && s.length <= 80 && s.every((b) => Number.isInteger(b) && b >= 0 && b <= 255);
+function verifyHoldingProof(challenge, p) {
+  const proof = p;
+  if (!proof || typeof proof.pubkey !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(proof.pubkey) || !isByteArray(proof.signature)) return null;
+  try {
+    const pub = PublicKey.fromString(proof.pubkey);
+    const sig = Signature.fromDER(proof.signature);
+    return pub.verify(challengeBytes(challenge), sig) ? pub.toAddress() : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyAccess(o) {
+  const r = o.response;
+  if (!r || typeof r !== "object" || r.v !== 1) throw new AccessError("bad_request", "response must be { v: 1, challenge, identityKey, signature }");
+  const c = parseAccessChallenge(r.challenge);
+  const nowS = Math.floor((o.now ?? Date.now()) / 1e3);
+  const pending = await o.store.take(c.nonce);
+  if (!pending) throw new AccessError(nowS >= c.exp ? "expired" : "replay");
+  if (nowS >= c.exp || (o.now ?? Date.now()) > pending.expiresAt) throw new AccessError("expired");
+  if (pending.message !== r.challenge) throw new AccessError("replay", "challenge does not match the one issued");
+  let origin;
+  try {
+    origin = normalOrigin(o.origin);
+  } catch {
+    throw new AccessError("bad_request", "server origin is misconfigured");
+  }
+  if (c.origin !== origin || pending.origin !== origin) throw new AccessError("bad_request", "origin mismatch");
+  if (o.require && canonicalJson(normaliseRequirement(o.require)) !== canonicalJson(c.require)) {
+    throw new AccessError("bad_request", "challenge requirement does not match this gate");
+  }
+  if (!isIdentityKey(r.identityKey)) throw new AccessError("bad_request", "identityKey must be a compressed public key");
+  const identityKey = r.identityKey.toLowerCase();
+  if (c.sub && c.sub !== identityKey) throw new AccessError("wrong_account");
+  if (!isByteArray(r.signature)) throw new AccessError("invalid_signature");
+  let valid = false;
+  try {
+    ({ valid } = await new ProtoWallet("anyone").verifySignature({
+      protocolID: ACCESS_PROTOCOL,
+      keyID: c.nonce,
+      counterparty: identityKey,
+      data: challengeBytes(r.challenge),
+      signature: r.signature
+    }));
+  } catch {
+    valid = false;
+  }
+  if (!valid) throw new AccessError("invalid_signature");
+  const grant = { ok: true, identityKey, kind: c.kind, require: c.require, addresses: [], have: {} };
+  if (c.require.identityLevel || c.require.kyc) {
+    if (!o.resolver.identity) throw new AccessError("indexer_unavailable", "no identity resolver configured");
+    let id;
+    try {
+      id = await o.resolver.identity(identityKey, r);
+    } catch (e) {
+      throw new AccessError("indexer_unavailable", `identity lookup failed: ${e.message}`);
+    }
+    grant.have.identityLevel = id.level;
+    grant.have.kyc = id.kyc;
+    if (c.require.kyc && !id.kyc) throw new AccessError("kyc_required");
+    if (c.require.identityLevel && id.level < c.require.identityLevel) {
+      throw new AccessError("identity_level_too_low", void 0, { have: id.level, need: c.require.identityLevel });
+    }
+  }
+  if (c.require.token) {
+    const proofs = Array.isArray(r.holdings) ? r.holdings.slice(0, MAX_HOLDING_PROOFS) : [];
+    const addresses = /* @__PURE__ */ new Set();
+    for (const p of proofs) {
+      const a = verifyHoldingProof(r.challenge, p);
+      if (a) addresses.add(a);
+    }
+    grant.addresses = [...addresses].sort();
+    const check = await checkTokenHolding(c.require, grant.addresses, o.resolver);
+    grant.have.tokenRaw = check.have;
+    grant.have.needRaw = check.need;
+  }
+  return grant;
+}
+async function checkTokenHolding(require2, addresses, resolver) {
+  const t = require2.token;
+  if (!t) return { have: "0", need: "0" };
+  let supply;
+  if (t.minBps) {
+    if (!resolver.tokenSupply) throw new AccessError("indexer_unavailable", "no supply resolver configured");
+    try {
+      supply = await resolver.tokenSupply(t.id);
+    } catch (e) {
+      throw new AccessError("indexer_unavailable", `supply lookup failed: ${e.message}`);
+    }
+  }
+  const need = tokenNeedRaw(t, supply);
+  if (!addresses.length) throw new AccessError("insufficient_tokens", void 0, { have: "0", need });
+  let have;
+  try {
+    have = await resolver.tokenBalance(t.id, addresses);
+  } catch (e) {
+    throw new AccessError("indexer_unavailable", `balance lookup failed: ${e.message}`);
+  }
+  if (!atLeastRaw(have, need)) throw new AccessError("insufficient_tokens", void 0, { have, need });
+  return { have, need };
+}
+
+// src/server.ts
+var LOGIN_PROTOCOL = [2, "bwallet sign in"];
+var CHALLENGE_LIFETIME_MS = 2 * 60 * 1e3;
+var warned = false;
+function memoryStore(opts = {}) {
+  const prod = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  if ((prod || !opts.quiet) && !warned) {
+    warned = true;
+    console.warn(
+      prod ? "[@bwalletx/connect] WARNING: the in-memory nonce store is running in production. It is not shared between instances and breaks on serverless. Use redisStore or pgStore." : "[@bwalletx/connect] Using the in-memory nonce store. It is for development only; pass a shared store (redisStore, pgStore) in production."
+    );
+  }
+  const m = /* @__PURE__ */ new Map();
+  return {
+    put(nonce, c) {
+      const now = Date.now();
+      for (const [k, v] of m) if (v.expiresAt < now) m.delete(k);
+      m.set(nonce, c);
+    },
+    take(nonce) {
+      const c = m.get(nonce) ?? null;
+      m.delete(nonce);
+      return c;
+    }
+  };
+}
+var defaultStore = null;
+var storeOrDefault = (s) => s ?? (defaultStore ??= memoryStore());
+function isIdentityKey(x) {
+  if (typeof x !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;
+  try {
+    PublicKey2.fromString(x);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalOrigin2(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) {
+    throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  }
+  return u.origin;
+}
+function loginMessage(origin, nonce, expiresAt) {
+  return [
+    `Sign in to ${new URL(origin).host} with bWallet`,
+    "",
+    "This proves you hold this wallet. It does not spend anything.",
+    "",
+    `Origin: ${origin}`,
+    `Nonce: ${nonce}`,
+    `Expires: ${new Date(expiresAt).toISOString()}`
+  ].join("\n");
+}
+function randomNonce2() {
+  const b = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createChallenge(opts) {
+  if (!isIdentityKey(opts.identityKey)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
+  const origin = normalOrigin2(opts.origin);
+  const nonce = randomNonce2();
+  const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
+  const message = loginMessage(origin, nonce, expiresAt);
+  await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });
+  return { nonce, message, protocolID: LOGIN_PROTOCOL, keyID: nonce, expiresAt };
+}
+async function verifySignIn(opts) {
+  if (typeof opts.nonce !== "string" || opts.nonce.length > 64) return null;
+  const c = await storeOrDefault(opts.store).take(opts.nonce);
+  if (!c || Date.now() > c.expiresAt) return null;
+  let origin;
+  try {
+    origin = normalOrigin2(opts.origin);
+  } catch {
+    return null;
+  }
+  if (c.origin !== origin) return null;
+  if (!isIdentityKey(opts.identityKey)) return null;
+  const identityKey = opts.identityKey.toLowerCase();
+  if (c.identityKey !== identityKey) return null;
+  const sig = opts.signature;
+  if (!Array.isArray(sig) || sig.length < 8 || sig.length > 80 || !sig.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+    return null;
+  }
+  try {
+    const { valid } = await new ProtoWallet2("anyone").verifySignature({
+      protocolID: LOGIN_PROTOCOL,
+      keyID: opts.nonce,
+      counterparty: identityKey,
+      data: Array.from(new TextEncoder().encode(c.message)),
+      signature: sig
+    });
+    return valid ? identityKey : null;
+  } catch {
+    return null;
+  }
+}
+function originAllowed(requestOrigin, origin) {
+  try {
+    return !!requestOrigin && requestOrigin === normalOrigin2(origin);
+  } catch {
+    return false;
+  }
+}
+
+export {
+  redisStore,
+  pgNonceTableSql,
+  pgStore,
+  MIN_SECRET_LENGTH,
+  assertSecret,
+  signSession,
+  verifySession,
+  serializeCookie,
+  readCookie,
+  PaymentVerificationError,
+  verifyPayment,
+  IdentityLinkConflictError,
+  linkIdentity,
+  signInOrLink,
+  oneSatResolver,
+  bitSignResolver,
+  createAccessChallenge,
+  verifyHoldingProof,
+  verifyAccess,
+  checkTokenHolding,
+  LOGIN_PROTOCOL,
+  CHALLENGE_LIFETIME_MS,
+  memoryStore,
+  isIdentityKey,
+  loginMessage,
+  createChallenge,
+  verifySignIn,
+  originAllowed
+};
+//# sourceMappingURL=chunk-QRXFL66W.js.map