@bwalletx/connect 0.4.1 → 0.5.0

package/dist/react.js

@@ -9,12 +9,13 @@ import {
   pay,
   pickWallet,
   tip
-} from "./chunk-FUQ46RJV.js";
+} from "./chunk-GF6GUDZL.js";
 import {
   clearPairing,
   defineBwalletxSignin,
   signInWithBwalletX
-} from "./chunk-NNMUSWPG.js";
+} from "./chunk-CVLXFNAG.js";
+import "./chunk-MWD4BCO5.js";
 
 // src/react.ts
 import {

package/dist/react.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/react.ts"],"sourcesContent":["/**\n * React wrapper for <bwalletx-signin>. React is an optional peer dependency; the button itself is\n * the web component, so markup and behaviour are identical everywhere.\n *\n *   import { BwalletxSignin } from '@bwalletx/connect/react';\n *   <BwalletxSignin challengeUrl=\"/auth/bwalletx/challenge\" verifyUrl=\"/auth/bwalletx/verify\"\n *     onSignedIn={(d) => router.refresh()} />\n */\nimport {\n  createContext,\n  createElement,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type CSSProperties,\n  type ReactElement,\n  type ReactNode,\n} from 'react';\nimport type { WalletInterface } from '@bsv/sdk';\nimport { clearPairing } from './pair.js';\nimport { signInWithBwalletX, type Challenge } from './signin.js';\nimport { pairingModal } from './modal.js';\nimport { pickWallet } from './modal.js';\nimport { discoverWallets, type ConnectedWallet, type WalletOption } from './wallets.js';\nimport { PaymentError, buyToken, pay, tip, type BuyTokenRequest, type PayOptions, type PayRequest, type PayResult } from './pay.js';\nimport { defineBwalletxSignin, type SigninBrand, type SigninLabel, type SigninSize, type SigninTheme } from './element.js';\n\nexport interface SignedInDetail {\n  identityKey: string;\n  method: string;\n  nonce: string;\n  signature: number[];\n  response: unknown;\n}\n\nexport interface BwalletxSigninProps {\n  size?: SigninSize;\n  theme?: SigninTheme;\n  label?: SigninLabel;\n  brand?: SigninBrand;\n  /** true/undefined = default, false = hidden, string = custom text. */\n  subtitle?: boolean | string;\n  fullWidth?: boolean;\n  loading?: boolean;\n  disabled?: boolean;\n  challengeUrl?: string;\n  verifyUrl?: string;\n  getUrl?: string;\n  webUrl?: string;\n  href?: string;\n  authorizeUrl?: string;\n  clientId?: string;\n  redirectUri?: string;\n  scope?: string;\n  discoverMs?: number;\n  'aria-label'?: string;\n  className?: string;\n  style?: CSSProperties;\n  id?: string;\n  /** Every click. Call e.preventDefault() to skip the built-in flow. */\n  onClick?: (e: CustomEvent<{ element: HTMLElement }>) => void;\n  onSignedIn?: (d: SignedInDetail) => void;\n  onNotFound?: () => void;\n  onError?: (error: unknown) => void;\n}\n\nexport function BwalletxSignin(props: BwalletxSigninProps): ReactElement {\n  const ref = useRef<HTMLElement>(null);\n  const cb = useRef(props);\n  cb.current = props;\n\n  useEffect(() => {\n    defineBwalletxSignin();\n    const el = ref.current;\n    if (!el) return;\n    const on: [string, EventListener][] = [\n      ['bwalletx-signin', (e) => cb.current.onClick?.(e as CustomEvent<{ element: HTMLElement }>)],\n      ['bwalletx-signed-in', (e) => cb.current.onSignedIn?.((e as CustomEvent<SignedInDetail>).detail)],\n      ['bwalletx-not-found', () => cb.current.onNotFound?.()],\n      ['bwalletx-error', (e) => cb.current.onError?.((e as CustomEvent<{ error: unknown }>).detail.error)],\n    ];\n    for (const [t, f] of on) el.addEventListener(t, f);\n    return () => { for (const [t, f] of on) el.removeEventListener(t, f); };\n  }, []);\n\n  const p = props;\n  const flag = (v: boolean | undefined) => (v ? '' : undefined);\n  return createElement('bwalletx-signin', {\n    ref,\n    id: p.id,\n    class: p.className,\n    style: p.style,\n    size: p.size,\n    theme: p.theme,\n    label: p.label,\n    brand: p.brand,\n    subtitle: p.subtitle === false ? 'off' : typeof p.subtitle === 'string' ? p.subtitle : undefined,\n    'full-width': flag(p.fullWidth),\n    loading: flag(p.loading),\n    disabled: flag(p.disabled),\n    'challenge-url': p.challengeUrl,\n    'verify-url': p.verifyUrl,\n    'get-url': p.getUrl,\n    'web-url': p.webUrl,\n    href: p.href,\n    'authorize-url': p.authorizeUrl,\n    'client-id': p.clientId,\n    'redirect-uri': p.redirectUri,\n    scope: p.scope,\n    'discover-ms': p.discoverMs,\n    'aria-label': p['aria-label'],\n  });\n}\n\nexport default BwalletxSignin;\n\nexport type BwalletXStatus = 'idle' | 'restoring' | 'connecting' | 'connected' | 'error';\n\nexport interface BwalletXState {\n  status: BwalletXStatus;\n  identityKey: string | null;\n  handle: string | null;\n  paymail: string | null;\n  /** The BRC-100 wallet. null until connect() (a session restored from the cookie has no wallet yet). */\n  wallet: WalletInterface | null;\n  /** Which option connected (e.g. 'com.bwalletx.extension', 'bwalletx-pairing', 'handcash'). */\n  walletId: string | null;\n  /** True while the transitional HandCash adapter is in use. */\n  transitional: boolean;\n  /** The server session (verifyUrl/sessionUrl) is in place. */\n  signedIn: boolean;\n  error: Error | null;\n}\n\nexport interface BwalletXContextValue extends BwalletXState {\n  /** Find wallets, show the picker if there is a choice, connect, and sign in if verifyUrl is set. */\n  connect(opts?: { walletId?: string }): Promise<ConnectedWallet | null>;\n  disconnect(): Promise<void>;\n  /** The wallets found on the last connect() (or listWallets()). */\n  wallets: WalletOption[];\n  listWallets(): Promise<WalletOption[]>;\n  pay(req: PayRequest): Promise<PayResult>;\n  tip(req: PayRequest): Promise<PayResult>;\n  buyToken(req: BuyTokenRequest): Promise<PayResult>;\n}\n\nexport interface BwalletXProviderProps {\n  children?: ReactNode;\n  /** POST { identityKey } → challenge. With verifyUrl, connect() also signs in. */\n  challengeUrl?: string;\n  /** POST { identityKey, nonce, signature } → { identityKey, handle?, paymail? } and sets the cookie. */\n  verifyUrl?: string;\n  /** POST to clear the cookie on disconnect(). */\n  logoutUrl?: string;\n  /** GET → { identityKey, handle?, paymail? } to restore a session on load. */\n  sessionUrl?: string;\n  /** Offer phone pairing with the built-in QR modal. Default true. */\n  pairing?: boolean;\n  /** Show the built-in picker when more than one wallet is available. Default true. */\n  picker?: boolean;\n  /** Extra options, e.g. [handcashAdapter({ login })]. */\n  extraWallets?: WalletOption[];\n  /** Probe desktop wallets on localhost. Default false. */\n  probeLocal?: boolean;\n  discoverMs?: number;\n  payOptions?: PayOptions;\n  onError?: (e: Error) => void;\n}\n\nconst empty: BwalletXState = {\n  status: 'idle', identityKey: null, handle: null, paymail: null, wallet: null, walletId: null, transitional: false, signedIn: false, error: null,\n};\n\nconst Ctx = createContext<BwalletXContextValue | null>(null);\n\nasync function postJson(url: string, body: unknown): Promise<Record<string, unknown>> {\n  const r = await fetch(url, { method: 'POST', credentials: 'same-origin', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });\n  const j = (await r.json().catch(() => ({}))) as Record<string, unknown>;\n  if (!r.ok) throw Object.assign(new Error(String(j.error ?? `${url} answered ${r.status}`)), { status: r.status, code: j.code });\n  return j;\n}\n\n/** Holds the connected wallet and session for the tree. Renders nothing itself; SSR-safe. */\nexport function BwalletXProvider(p: BwalletXProviderProps): ReactElement {\n  const [state, setState] = useState<BwalletXState>(empty);\n  const [wallets, setWallets] = useState<WalletOption[]>([]);\n  const props = useRef(p);\n  props.current = p;\n  const payer = useRef<ConnectedWallet['payer']>(null);\n\n  const fail = useCallback((e: unknown) => {\n    const err = e instanceof Error ? e : new Error(String(e));\n    setState((s) => ({ ...s, status: 'error', error: err }));\n    props.current.onError?.(err);\n    return err;\n  }, []);\n\n  useEffect(() => {\n    const url = p.sessionUrl;\n    if (!url) return;\n    let live = true;\n    setState((s) => ({ ...s, status: 'restoring' }));\n    fetch(url, { credentials: 'same-origin' })\n      .then((r) => r.json())\n      .then((j: { identityKey?: string | null; handle?: string; paymail?: string }) => {\n        if (!live) return;\n        setState((s) =>\n          j.identityKey\n            ? { ...s, status: 'connected', identityKey: j.identityKey, handle: j.handle ?? null, paymail: j.paymail ?? null, signedIn: true }\n            : { ...s, status: s.status === 'restoring' ? 'idle' : s.status },\n        );\n      })\n      .catch(() => live && setState((s) => ({ ...s, status: s.status === 'restoring' ? 'idle' : s.status })));\n    return () => {\n      live = false;\n    };\n  }, [p.sessionUrl]);\n\n  const listWallets = useCallback(async () => {\n    const c = props.current;\n    const list = await discoverWallets({\n      ms: c.discoverMs,\n      probeLocal: c.probeLocal,\n      extra: c.extraWallets,\n      pairing: c.pairing === false ? undefined : () => pairingModal(),\n    });\n    setWallets(list);\n    return list;\n  }, []);\n\n  const connect = useCallback(\n    async (opts: { walletId?: string } = {}) => {\n      const c = props.current;\n      setState((s) => ({ ...s, status: 'connecting', error: null }));\n      try {\n        const list = await listWallets();\n        let choice: WalletOption | null | undefined = opts.walletId ? list.find((w) => w.id === opts.walletId) : undefined;\n        if (!choice) {\n          const direct = list.filter((w) => w.kind !== 'pairing');\n          choice = c.picker !== false && list.length > 1 ? await pickWallet(list) : (direct[0] ?? list[0] ?? null);\n        }\n        if (!choice) {\n          if (!list.length) throw Object.assign(new Error('No wallet found. Get bWalletX at bwalletx.com.'), { code: 'NOT_FOUND' });\n          setState((s) => ({ ...s, status: s.identityKey ? 'connected' : 'idle' }));\n          return null;\n        }\n        const cw = await choice.connect();\n        let { handle = null, paymail = null } = cw as { handle?: string | null; paymail?: string | null };\n        let signedIn = false;\n        if (cw.wallet && c.challengeUrl && c.verifyUrl) {\n          const r = await signInWithBwalletX({\n            wallet: cw.wallet,\n            challenge: (identityKey) => postJson(c.challengeUrl!, { identityKey }) as unknown as Promise<Challenge>,\n          });\n          const v = await postJson(c.verifyUrl, { identityKey: r.identityKey, nonce: r.nonce, signature: r.signature });\n          handle = (v.handle as string | undefined) ?? handle;\n          paymail = (v.paymail as string | undefined) ?? paymail;\n          signedIn = true;\n        }\n        payer.current = cw.payer;\n        setState({\n          status: 'connected',\n          identityKey: cw.identityKey,\n          handle,\n          paymail,\n          wallet: cw.wallet,\n          walletId: cw.optionId,\n          transitional: !!cw.transitional,\n          signedIn,\n          error: null,\n        });\n        return cw;\n      } catch (e) {\n        if ((e as Error)?.message === 'cancelled') {\n          setState((s) => ({ ...s, status: s.identityKey ? 'connected' : 'idle' }));\n          return null;\n        }\n        throw fail(e);\n      }\n    },\n    [fail, listWallets],\n  );\n\n  const disconnect = useCallback(async () => {\n    const c = props.current;\n    if (c.logoutUrl) await postJson(c.logoutUrl, {}).catch(() => {});\n    if (state.walletId === 'bwalletx-pairing') await clearPairing();\n    payer.current = null;\n    setState(empty);\n  }, [state.walletId]);\n\n  const need = () => {\n    if (!payer.current) throw new PaymentError('NOT_SUPPORTED', 'Connect a wallet first (connect()).');\n    return payer.current;\n  };\n\n  const value = useMemo<BwalletXContextValue>(\n    () => ({\n      ...state,\n      wallets,\n      connect,\n      disconnect,\n      listWallets,\n      pay: (req) => pay(need(), req, props.current.payOptions),\n      tip: (req) => tip(need(), req, props.current.payOptions),\n      buyToken: (req) => buyToken(need(), req),\n    }),\n    [state, wallets, connect, disconnect, listWallets],\n  );\n\n  return createElement(Ctx.Provider, { value }, p.children);\n}\n\n/** The wallet + session state. Must be inside <BwalletXProvider>. */\nexport function useBwalletX(): BwalletXContextValue {\n  const v = useContext(Ctx);\n  if (!v) throw new Error('useBwalletX() must be used inside <BwalletXProvider>');\n  return v;\n}\n\nexport { handcashAdapter, brc100Option, pairingOption, discoverWallets } from './wallets.js';\nexport type { WalletOption, ConnectedWallet, HandCashAdapterOptions } from './wallets.js';\nexport { PaymentError } from './pay.js';\nexport type { PayRequest, PayResult, BuyTokenRequest, PayOptions } from './pay.js';\n/** Alias with the casing used by <BwalletxSignin>. */\nexport const BwalletxProvider = BwalletXProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAQA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAiDA,SAAS,eAAe,OAA0C;AACvE,QAAM,MAAM,OAAoB,IAAI;AACpC,QAAM,KAAK,OAAO,KAAK;AACvB,KAAG,UAAU;AAEb,YAAU,MAAM;AACd,yBAAqB;AACrB,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAI;AACT,UAAM,KAAgC;AAAA,MACpC,CAAC,mBAAmB,CAAC,MAAM,GAAG,QAAQ,UAAU,CAA0C,CAAC;AAAA,MAC3F,CAAC,sBAAsB,CAAC,MAAM,GAAG,QAAQ,aAAc,EAAkC,MAAM,CAAC;AAAA,MAChG,CAAC,sBAAsB,MAAM,GAAG,QAAQ,aAAa,CAAC;AAAA,MACtD,CAAC,kBAAkB,CAAC,MAAM,GAAG,QAAQ,UAAW,EAAsC,OAAO,KAAK,CAAC;AAAA,IACrG;AACA,eAAW,CAAC,GAAG,CAAC,KAAK,GAAI,IAAG,iBAAiB,GAAG,CAAC;AACjD,WAAO,MAAM;AAAE,iBAAW,CAAC,GAAG,CAAC,KAAK,GAAI,IAAG,oBAAoB,GAAG,CAAC;AAAA,IAAG;AAAA,EACxE,GAAG,CAAC,CAAC;AAEL,QAAM,IAAI;AACV,QAAM,OAAO,CAAC,MAA4B,IAAI,KAAK;AACnD,SAAO,cAAc,mBAAmB;AAAA,IACtC;AAAA,IACA,IAAI,EAAE;AAAA,IACN,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,UAAU,EAAE,aAAa,QAAQ,QAAQ,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,IACvF,cAAc,KAAK,EAAE,SAAS;AAAA,IAC9B,SAAS,KAAK,EAAE,OAAO;AAAA,IACvB,UAAU,KAAK,EAAE,QAAQ;AAAA,IACzB,iBAAiB,EAAE;AAAA,IACnB,cAAc,EAAE;AAAA,IAChB,WAAW,EAAE;AAAA,IACb,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,IACR,iBAAiB,EAAE;AAAA,IACnB,aAAa,EAAE;AAAA,IACf,gBAAgB,EAAE;AAAA,IAClB,OAAO,EAAE;AAAA,IACT,eAAe,EAAE;AAAA,IACjB,cAAc,EAAE,YAAY;AAAA,EAC9B,CAAC;AACH;AAEA,IAAO,gBAAQ;AAuDf,IAAM,QAAuB;AAAA,EAC3B,QAAQ;AAAA,EAAQ,aAAa;AAAA,EAAM,QAAQ;AAAA,EAAM,SAAS;AAAA,EAAM,QAAQ;AAAA,EAAM,UAAU;AAAA,EAAM,cAAc;AAAA,EAAO,UAAU;AAAA,EAAO,OAAO;AAC7I;AAEA,IAAM,MAAM,cAA2C,IAAI;AAE3D,eAAe,SAAS,KAAa,MAAiD;AACpF,QAAM,IAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,QAAQ,aAAa,eAAe,SAAS,EAAE,gBAAgB,mBAAmB,GAAG,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC;AACtJ,QAAM,IAAK,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC1C,MAAI,CAAC,EAAE,GAAI,OAAM,OAAO,OAAO,IAAI,MAAM,OAAO,EAAE,SAAS,GAAG,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK,CAAC;AAC9H,SAAO;AACT;AAGO,SAAS,iBAAiB,GAAwC;AACvE,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,KAAK;AACvD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAyB,CAAC,CAAC;AACzD,QAAM,QAAQ,OAAO,CAAC;AACtB,QAAM,UAAU;AAChB,QAAM,QAAQ,OAAiC,IAAI;AAEnD,QAAM,OAAO,YAAY,CAAC,MAAe;AACvC,UAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACxD,aAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,SAAS,OAAO,IAAI,EAAE;AACvD,UAAM,QAAQ,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,UAAM,MAAM,EAAE;AACd,QAAI,CAAC,IAAK;AACV,QAAI,OAAO;AACX,aAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,YAAY,EAAE;AAC/C,UAAM,KAAK,EAAE,aAAa,cAAc,CAAC,EACtC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EACpB,KAAK,CAAC,MAA0E;AAC/E,UAAI,CAAC,KAAM;AACX;AAAA,QAAS,CAAC,MACR,EAAE,cACE,EAAE,GAAG,GAAG,QAAQ,aAAa,aAAa,EAAE,aAAa,QAAQ,EAAE,UAAU,MAAM,SAAS,EAAE,WAAW,MAAM,UAAU,KAAK,IAC9H,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,cAAc,SAAS,EAAE,OAAO;AAAA,MACnE;AAAA,IACF,CAAC,EACA,MAAM,MAAM,QAAQ,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,cAAc,SAAS,EAAE,OAAO,EAAE,CAAC;AACxG,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,EAAE,UAAU,CAAC;AAEjB,QAAM,cAAc,YAAY,YAAY;AAC1C,UAAM,IAAI,MAAM;AAChB,UAAM,OAAO,MAAM,gBAAgB;AAAA,MACjC,IAAI,EAAE;AAAA,MACN,YAAY,EAAE;AAAA,MACd,OAAO,EAAE;AAAA,MACT,SAAS,EAAE,YAAY,QAAQ,SAAY,MAAM,aAAa;AAAA,IAChE,CAAC;AACD,eAAW,IAAI;AACf,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU;AAAA,IACd,OAAO,OAA8B,CAAC,MAAM;AAC1C,YAAM,IAAI,MAAM;AAChB,eAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,cAAc,OAAO,KAAK,EAAE;AAC7D,UAAI;AACF,cAAM,OAAO,MAAM,YAAY;AAC/B,YAAI,SAA0C,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,IAAI;AACzG,YAAI,CAAC,QAAQ;AACX,gBAAM,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS;AACtD,mBAAS,EAAE,WAAW,SAAS,KAAK,SAAS,IAAI,MAAM,WAAW,IAAI,IAAK,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK;AAAA,QACrG;AACA,YAAI,CAAC,QAAQ;AACX,cAAI,CAAC,KAAK,OAAQ,OAAM,OAAO,OAAO,IAAI,MAAM,gDAAgD,GAAG,EAAE,MAAM,YAAY,CAAC;AACxH,mBAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,cAAc,cAAc,OAAO,EAAE;AACxE,iBAAO;AAAA,QACT;AACA,cAAM,KAAK,MAAM,OAAO,QAAQ;AAChC,YAAI,EAAE,SAAS,MAAM,UAAU,KAAK,IAAI;AACxC,YAAI,WAAW;AACf,YAAI,GAAG,UAAU,EAAE,gBAAgB,EAAE,WAAW;AAC9C,gBAAM,IAAI,MAAM,mBAAmB;AAAA,YACjC,QAAQ,GAAG;AAAA,YACX,WAAW,CAAC,gBAAgB,SAAS,EAAE,cAAe,EAAE,YAAY,CAAC;AAAA,UACvE,CAAC;AACD,gBAAM,IAAI,MAAM,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,OAAO,EAAE,OAAO,WAAW,EAAE,UAAU,CAAC;AAC5G,mBAAU,EAAE,UAAiC;AAC7C,oBAAW,EAAE,WAAkC;AAC/C,qBAAW;AAAA,QACb;AACA,cAAM,UAAU,GAAG;AACnB,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR,aAAa,GAAG;AAAA,UAChB;AAAA,UACA;AAAA,UACA,QAAQ,GAAG;AAAA,UACX,UAAU,GAAG;AAAA,UACb,cAAc,CAAC,CAAC,GAAG;AAAA,UACnB;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,eAAO;AAAA,MACT,SAAS,GAAG;AACV,YAAK,GAAa,YAAY,aAAa;AACzC,mBAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,cAAc,cAAc,OAAO,EAAE;AACxE,iBAAO;AAAA,QACT;AACA,cAAM,KAAK,CAAC;AAAA,MACd;AAAA,IACF;AAAA,IACA,CAAC,MAAM,WAAW;AAAA,EACpB;AAEA,QAAM,aAAa,YAAY,YAAY;AACzC,UAAM,IAAI,MAAM;AAChB,QAAI,EAAE,UAAW,OAAM,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC/D,QAAI,MAAM,aAAa,mBAAoB,OAAM,aAAa;AAC9D,UAAM,UAAU;AAChB,aAAS,KAAK;AAAA,EAChB,GAAG,CAAC,MAAM,QAAQ,CAAC;AAEnB,QAAM,OAAO,MAAM;AACjB,QAAI,CAAC,MAAM,QAAS,OAAM,IAAI,aAAa,iBAAiB,qCAAqC;AACjG,WAAO,MAAM;AAAA,EACf;AAEA,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,CAAC,QAAQ,IAAI,KAAK,GAAG,KAAK,MAAM,QAAQ,UAAU;AAAA,MACvD,KAAK,CAAC,QAAQ,IAAI,KAAK,GAAG,KAAK,MAAM,QAAQ,UAAU;AAAA,MACvD,UAAU,CAAC,QAAQ,SAAS,KAAK,GAAG,GAAG;AAAA,IACzC;AAAA,IACA,CAAC,OAAO,SAAS,SAAS,YAAY,WAAW;AAAA,EACnD;AAEA,SAAO,cAAc,IAAI,UAAU,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC1D;AAGO,SAAS,cAAoC;AAClD,QAAM,IAAI,WAAW,GAAG;AACxB,MAAI,CAAC,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAC9E,SAAO;AACT;AAOO,IAAM,mBAAmB;","names":[]}
+{"version":3,"sources":["../src/react.ts"],"sourcesContent":["/**\n * React wrapper for <bwalletx-signin>. React is an optional peer dependency; the button itself is\n * the web component, so markup and behaviour are identical everywhere.\n *\n *   import { BwalletxSignin } from '@bwalletx/connect/react';\n *   <BwalletxSignin challengeUrl=\"/auth/bwalletx/challenge\" verifyUrl=\"/auth/bwalletx/verify\"\n *     onSignedIn={(d) => router.refresh()} />\n */\nimport {\n  createContext,\n  createElement,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type CSSProperties,\n  type ReactElement,\n  type ReactNode,\n} from 'react';\nimport type { WalletInterface } from '@bsv/sdk';\nimport { clearPairing } from './pair.js';\nimport { signInWithBwalletX, type Challenge } from './signin.js';\nimport { pairingModal } from './modal.js';\nimport { pickWallet } from './modal.js';\nimport { discoverWallets, type ConnectedWallet, type WalletOption } from './wallets.js';\nimport { PaymentError, buyToken, pay, tip, type BuyTokenRequest, type PayOptions, type PayRequest, type PayResult } from './pay.js';\nimport { defineBwalletxSignin, type SigninBrand, type SigninLabel, type SigninSize, type SigninTheme } from './element.js';\n\nexport interface SignedInDetail {\n  identityKey: string;\n  method: string;\n  nonce: string;\n  signature: number[];\n  response: unknown;\n}\n\nexport interface BwalletxSigninProps {\n  size?: SigninSize;\n  theme?: SigninTheme;\n  label?: SigninLabel;\n  brand?: SigninBrand;\n  /** true/undefined = default, false = hidden, string = custom text. */\n  subtitle?: boolean | string;\n  fullWidth?: boolean;\n  loading?: boolean;\n  disabled?: boolean;\n  challengeUrl?: string;\n  verifyUrl?: string;\n  getUrl?: string;\n  webUrl?: string;\n  href?: string;\n  authorizeUrl?: string;\n  clientId?: string;\n  redirectUri?: string;\n  scope?: string;\n  discoverMs?: number;\n  'aria-label'?: string;\n  className?: string;\n  style?: CSSProperties;\n  id?: string;\n  /** Every click. Call e.preventDefault() to skip the built-in flow. */\n  onClick?: (e: CustomEvent<{ element: HTMLElement }>) => void;\n  onSignedIn?: (d: SignedInDetail) => void;\n  onNotFound?: () => void;\n  onError?: (error: unknown) => void;\n}\n\nexport function BwalletxSignin(props: BwalletxSigninProps): ReactElement {\n  const ref = useRef<HTMLElement>(null);\n  const cb = useRef(props);\n  cb.current = props;\n\n  useEffect(() => {\n    defineBwalletxSignin();\n    const el = ref.current;\n    if (!el) return;\n    const on: [string, EventListener][] = [\n      ['bwalletx-signin', (e) => cb.current.onClick?.(e as CustomEvent<{ element: HTMLElement }>)],\n      ['bwalletx-signed-in', (e) => cb.current.onSignedIn?.((e as CustomEvent<SignedInDetail>).detail)],\n      ['bwalletx-not-found', () => cb.current.onNotFound?.()],\n      ['bwalletx-error', (e) => cb.current.onError?.((e as CustomEvent<{ error: unknown }>).detail.error)],\n    ];\n    for (const [t, f] of on) el.addEventListener(t, f);\n    return () => { for (const [t, f] of on) el.removeEventListener(t, f); };\n  }, []);\n\n  const p = props;\n  const flag = (v: boolean | undefined) => (v ? '' : undefined);\n  return createElement('bwalletx-signin', {\n    ref,\n    id: p.id,\n    class: p.className,\n    style: p.style,\n    size: p.size,\n    theme: p.theme,\n    label: p.label,\n    brand: p.brand,\n    subtitle: p.subtitle === false ? 'off' : typeof p.subtitle === 'string' ? p.subtitle : undefined,\n    'full-width': flag(p.fullWidth),\n    loading: flag(p.loading),\n    disabled: flag(p.disabled),\n    'challenge-url': p.challengeUrl,\n    'verify-url': p.verifyUrl,\n    'get-url': p.getUrl,\n    'web-url': p.webUrl,\n    href: p.href,\n    'authorize-url': p.authorizeUrl,\n    'client-id': p.clientId,\n    'redirect-uri': p.redirectUri,\n    scope: p.scope,\n    'discover-ms': p.discoverMs,\n    'aria-label': p['aria-label'],\n  });\n}\n\nexport default BwalletxSignin;\n\nexport type BwalletXStatus = 'idle' | 'restoring' | 'connecting' | 'connected' | 'error';\n\nexport interface BwalletXState {\n  status: BwalletXStatus;\n  identityKey: string | null;\n  handle: string | null;\n  paymail: string | null;\n  /** The BRC-100 wallet. null until connect() (a session restored from the cookie has no wallet yet). */\n  wallet: WalletInterface | null;\n  /** Which option connected (e.g. 'com.bwalletx.extension', 'bwalletx-pairing', 'handcash'). */\n  walletId: string | null;\n  /** True while the transitional HandCash adapter is in use. */\n  transitional: boolean;\n  /** The server session (verifyUrl/sessionUrl) is in place. */\n  signedIn: boolean;\n  error: Error | null;\n}\n\nexport interface BwalletXContextValue extends BwalletXState {\n  /** Find wallets, show the picker if there is a choice, connect, and sign in if verifyUrl is set. */\n  connect(opts?: { walletId?: string }): Promise<ConnectedWallet | null>;\n  disconnect(): Promise<void>;\n  /** The wallets found on the last connect() (or listWallets()). */\n  wallets: WalletOption[];\n  listWallets(): Promise<WalletOption[]>;\n  pay(req: PayRequest): Promise<PayResult>;\n  tip(req: PayRequest): Promise<PayResult>;\n  buyToken(req: BuyTokenRequest): Promise<PayResult>;\n}\n\nexport interface BwalletXProviderProps {\n  children?: ReactNode;\n  /** POST { identityKey } → challenge. With verifyUrl, connect() also signs in. */\n  challengeUrl?: string;\n  /** POST { identityKey, nonce, signature } → { identityKey, handle?, paymail? } and sets the cookie. */\n  verifyUrl?: string;\n  /** POST to clear the cookie on disconnect(). */\n  logoutUrl?: string;\n  /** GET → { identityKey, handle?, paymail? } to restore a session on load. */\n  sessionUrl?: string;\n  /** Offer phone pairing with the built-in QR modal. Default true. */\n  pairing?: boolean;\n  /** Show the built-in picker when more than one wallet is available. Default true. */\n  picker?: boolean;\n  /** Extra options, e.g. [handcashAdapter({ login })]. */\n  extraWallets?: WalletOption[];\n  /** Probe desktop wallets on localhost. Default false. */\n  probeLocal?: boolean;\n  discoverMs?: number;\n  payOptions?: PayOptions;\n  onError?: (e: Error) => void;\n}\n\nconst empty: BwalletXState = {\n  status: 'idle', identityKey: null, handle: null, paymail: null, wallet: null, walletId: null, transitional: false, signedIn: false, error: null,\n};\n\nconst Ctx = createContext<BwalletXContextValue | null>(null);\n\nasync function postJson(url: string, body: unknown): Promise<Record<string, unknown>> {\n  const r = await fetch(url, { method: 'POST', credentials: 'same-origin', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });\n  const j = (await r.json().catch(() => ({}))) as Record<string, unknown>;\n  if (!r.ok) throw Object.assign(new Error(String(j.error ?? `${url} answered ${r.status}`)), { status: r.status, code: j.code });\n  return j;\n}\n\n/** Holds the connected wallet and session for the tree. Renders nothing itself; SSR-safe. */\nexport function BwalletXProvider(p: BwalletXProviderProps): ReactElement {\n  const [state, setState] = useState<BwalletXState>(empty);\n  const [wallets, setWallets] = useState<WalletOption[]>([]);\n  const props = useRef(p);\n  props.current = p;\n  const payer = useRef<ConnectedWallet['payer']>(null);\n\n  const fail = useCallback((e: unknown) => {\n    const err = e instanceof Error ? e : new Error(String(e));\n    setState((s) => ({ ...s, status: 'error', error: err }));\n    props.current.onError?.(err);\n    return err;\n  }, []);\n\n  useEffect(() => {\n    const url = p.sessionUrl;\n    if (!url) return;\n    let live = true;\n    setState((s) => ({ ...s, status: 'restoring' }));\n    fetch(url, { credentials: 'same-origin' })\n      .then((r) => r.json())\n      .then((j: { identityKey?: string | null; handle?: string; paymail?: string }) => {\n        if (!live) return;\n        setState((s) =>\n          j.identityKey\n            ? { ...s, status: 'connected', identityKey: j.identityKey, handle: j.handle ?? null, paymail: j.paymail ?? null, signedIn: true }\n            : { ...s, status: s.status === 'restoring' ? 'idle' : s.status },\n        );\n      })\n      .catch(() => live && setState((s) => ({ ...s, status: s.status === 'restoring' ? 'idle' : s.status })));\n    return () => {\n      live = false;\n    };\n  }, [p.sessionUrl]);\n\n  const listWallets = useCallback(async () => {\n    const c = props.current;\n    const list = await discoverWallets({\n      ms: c.discoverMs,\n      probeLocal: c.probeLocal,\n      extra: c.extraWallets,\n      pairing: c.pairing === false ? undefined : () => pairingModal(),\n    });\n    setWallets(list);\n    return list;\n  }, []);\n\n  const connect = useCallback(\n    async (opts: { walletId?: string } = {}) => {\n      const c = props.current;\n      setState((s) => ({ ...s, status: 'connecting', error: null }));\n      try {\n        const list = await listWallets();\n        let choice: WalletOption | null | undefined = opts.walletId ? list.find((w) => w.id === opts.walletId) : undefined;\n        if (!choice) {\n          const direct = list.filter((w) => w.kind !== 'pairing');\n          choice = c.picker !== false && list.length > 1 ? await pickWallet(list) : (direct[0] ?? list[0] ?? null);\n        }\n        if (!choice) {\n          if (!list.length) throw Object.assign(new Error('No wallet found. Get bWalletX at bwalletx.com.'), { code: 'NOT_FOUND' });\n          setState((s) => ({ ...s, status: s.identityKey ? 'connected' : 'idle' }));\n          return null;\n        }\n        const cw = await choice.connect();\n        let { handle = null, paymail = null } = cw as { handle?: string | null; paymail?: string | null };\n        let signedIn = false;\n        if (cw.wallet && c.challengeUrl && c.verifyUrl) {\n          const r = await signInWithBwalletX({\n            wallet: cw.wallet,\n            challenge: (identityKey) => postJson(c.challengeUrl!, { identityKey }) as unknown as Promise<Challenge>,\n          });\n          const v = await postJson(c.verifyUrl, { identityKey: r.identityKey, nonce: r.nonce, signature: r.signature });\n          handle = (v.handle as string | undefined) ?? handle;\n          paymail = (v.paymail as string | undefined) ?? paymail;\n          signedIn = true;\n        }\n        payer.current = cw.payer;\n        setState({\n          status: 'connected',\n          identityKey: cw.identityKey,\n          handle,\n          paymail,\n          wallet: cw.wallet,\n          walletId: cw.optionId,\n          transitional: !!cw.transitional,\n          signedIn,\n          error: null,\n        });\n        return cw;\n      } catch (e) {\n        if ((e as Error)?.message === 'cancelled') {\n          setState((s) => ({ ...s, status: s.identityKey ? 'connected' : 'idle' }));\n          return null;\n        }\n        throw fail(e);\n      }\n    },\n    [fail, listWallets],\n  );\n\n  const disconnect = useCallback(async () => {\n    const c = props.current;\n    if (c.logoutUrl) await postJson(c.logoutUrl, {}).catch(() => {});\n    if (state.walletId === 'bwalletx-pairing') await clearPairing();\n    payer.current = null;\n    setState(empty);\n  }, [state.walletId]);\n\n  const need = () => {\n    if (!payer.current) throw new PaymentError('NOT_SUPPORTED', 'Connect a wallet first (connect()).');\n    return payer.current;\n  };\n\n  const value = useMemo<BwalletXContextValue>(\n    () => ({\n      ...state,\n      wallets,\n      connect,\n      disconnect,\n      listWallets,\n      pay: (req) => pay(need(), req, props.current.payOptions),\n      tip: (req) => tip(need(), req, props.current.payOptions),\n      buyToken: (req) => buyToken(need(), req),\n    }),\n    [state, wallets, connect, disconnect, listWallets],\n  );\n\n  return createElement(Ctx.Provider, { value }, p.children);\n}\n\n/** The wallet + session state. Must be inside <BwalletXProvider>. */\nexport function useBwalletX(): BwalletXContextValue {\n  const v = useContext(Ctx);\n  if (!v) throw new Error('useBwalletX() must be used inside <BwalletXProvider>');\n  return v;\n}\n\nexport { handcashAdapter, brc100Option, pairingOption, discoverWallets } from './wallets.js';\nexport type { WalletOption, ConnectedWallet, HandCashAdapterOptions } from './wallets.js';\nexport { PaymentError } from './pay.js';\nexport type { PayRequest, PayResult, BuyTokenRequest, PayOptions } from './pay.js';\n/** Alias with the casing used by <BwalletxSignin>. */\nexport const BwalletxProvider = BwalletXProvider;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAiDA,SAAS,eAAe,OAA0C;AACvE,QAAM,MAAM,OAAoB,IAAI;AACpC,QAAM,KAAK,OAAO,KAAK;AACvB,KAAG,UAAU;AAEb,YAAU,MAAM;AACd,yBAAqB;AACrB,UAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAI;AACT,UAAM,KAAgC;AAAA,MACpC,CAAC,mBAAmB,CAAC,MAAM,GAAG,QAAQ,UAAU,CAA0C,CAAC;AAAA,MAC3F,CAAC,sBAAsB,CAAC,MAAM,GAAG,QAAQ,aAAc,EAAkC,MAAM,CAAC;AAAA,MAChG,CAAC,sBAAsB,MAAM,GAAG,QAAQ,aAAa,CAAC;AAAA,MACtD,CAAC,kBAAkB,CAAC,MAAM,GAAG,QAAQ,UAAW,EAAsC,OAAO,KAAK,CAAC;AAAA,IACrG;AACA,eAAW,CAAC,GAAG,CAAC,KAAK,GAAI,IAAG,iBAAiB,GAAG,CAAC;AACjD,WAAO,MAAM;AAAE,iBAAW,CAAC,GAAG,CAAC,KAAK,GAAI,IAAG,oBAAoB,GAAG,CAAC;AAAA,IAAG;AAAA,EACxE,GAAG,CAAC,CAAC;AAEL,QAAM,IAAI;AACV,QAAM,OAAO,CAAC,MAA4B,IAAI,KAAK;AACnD,SAAO,cAAc,mBAAmB;AAAA,IACtC;AAAA,IACA,IAAI,EAAE;AAAA,IACN,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,MAAM,EAAE;AAAA,IACR,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,OAAO,EAAE;AAAA,IACT,UAAU,EAAE,aAAa,QAAQ,QAAQ,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,IACvF,cAAc,KAAK,EAAE,SAAS;AAAA,IAC9B,SAAS,KAAK,EAAE,OAAO;AAAA,IACvB,UAAU,KAAK,EAAE,QAAQ;AAAA,IACzB,iBAAiB,EAAE;AAAA,IACnB,cAAc,EAAE;AAAA,IAChB,WAAW,EAAE;AAAA,IACb,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,IACR,iBAAiB,EAAE;AAAA,IACnB,aAAa,EAAE;AAAA,IACf,gBAAgB,EAAE;AAAA,IAClB,OAAO,EAAE;AAAA,IACT,eAAe,EAAE;AAAA,IACjB,cAAc,EAAE,YAAY;AAAA,EAC9B,CAAC;AACH;AAEA,IAAO,gBAAQ;AAuDf,IAAM,QAAuB;AAAA,EAC3B,QAAQ;AAAA,EAAQ,aAAa;AAAA,EAAM,QAAQ;AAAA,EAAM,SAAS;AAAA,EAAM,QAAQ;AAAA,EAAM,UAAU;AAAA,EAAM,cAAc;AAAA,EAAO,UAAU;AAAA,EAAO,OAAO;AAC7I;AAEA,IAAM,MAAM,cAA2C,IAAI;AAE3D,eAAe,SAAS,KAAa,MAAiD;AACpF,QAAM,IAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,QAAQ,aAAa,eAAe,SAAS,EAAE,gBAAgB,mBAAmB,GAAG,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC;AACtJ,QAAM,IAAK,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC1C,MAAI,CAAC,EAAE,GAAI,OAAM,OAAO,OAAO,IAAI,MAAM,OAAO,EAAE,SAAS,GAAG,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK,CAAC;AAC9H,SAAO;AACT;AAGO,SAAS,iBAAiB,GAAwC;AACvE,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,KAAK;AACvD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAyB,CAAC,CAAC;AACzD,QAAM,QAAQ,OAAO,CAAC;AACtB,QAAM,UAAU;AAChB,QAAM,QAAQ,OAAiC,IAAI;AAEnD,QAAM,OAAO,YAAY,CAAC,MAAe;AACvC,UAAM,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;AACxD,aAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,SAAS,OAAO,IAAI,EAAE;AACvD,UAAM,QAAQ,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,YAAU,MAAM;AACd,UAAM,MAAM,EAAE;AACd,QAAI,CAAC,IAAK;AACV,QAAI,OAAO;AACX,aAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,YAAY,EAAE;AAC/C,UAAM,KAAK,EAAE,aAAa,cAAc,CAAC,EACtC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EACpB,KAAK,CAAC,MAA0E;AAC/E,UAAI,CAAC,KAAM;AACX;AAAA,QAAS,CAAC,MACR,EAAE,cACE,EAAE,GAAG,GAAG,QAAQ,aAAa,aAAa,EAAE,aAAa,QAAQ,EAAE,UAAU,MAAM,SAAS,EAAE,WAAW,MAAM,UAAU,KAAK,IAC9H,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,cAAc,SAAS,EAAE,OAAO;AAAA,MACnE;AAAA,IACF,CAAC,EACA,MAAM,MAAM,QAAQ,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,cAAc,SAAS,EAAE,OAAO,EAAE,CAAC;AACxG,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,EAAE,UAAU,CAAC;AAEjB,QAAM,cAAc,YAAY,YAAY;AAC1C,UAAM,IAAI,MAAM;AAChB,UAAM,OAAO,MAAM,gBAAgB;AAAA,MACjC,IAAI,EAAE;AAAA,MACN,YAAY,EAAE;AAAA,MACd,OAAO,EAAE;AAAA,MACT,SAAS,EAAE,YAAY,QAAQ,SAAY,MAAM,aAAa;AAAA,IAChE,CAAC;AACD,eAAW,IAAI;AACf,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU;AAAA,IACd,OAAO,OAA8B,CAAC,MAAM;AAC1C,YAAM,IAAI,MAAM;AAChB,eAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,cAAc,OAAO,KAAK,EAAE;AAC7D,UAAI;AACF,cAAM,OAAO,MAAM,YAAY;AAC/B,YAAI,SAA0C,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,IAAI;AACzG,YAAI,CAAC,QAAQ;AACX,gBAAM,SAAS,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,SAAS;AACtD,mBAAS,EAAE,WAAW,SAAS,KAAK,SAAS,IAAI,MAAM,WAAW,IAAI,IAAK,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK;AAAA,QACrG;AACA,YAAI,CAAC,QAAQ;AACX,cAAI,CAAC,KAAK,OAAQ,OAAM,OAAO,OAAO,IAAI,MAAM,gDAAgD,GAAG,EAAE,MAAM,YAAY,CAAC;AACxH,mBAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,cAAc,cAAc,OAAO,EAAE;AACxE,iBAAO;AAAA,QACT;AACA,cAAM,KAAK,MAAM,OAAO,QAAQ;AAChC,YAAI,EAAE,SAAS,MAAM,UAAU,KAAK,IAAI;AACxC,YAAI,WAAW;AACf,YAAI,GAAG,UAAU,EAAE,gBAAgB,EAAE,WAAW;AAC9C,gBAAM,IAAI,MAAM,mBAAmB;AAAA,YACjC,QAAQ,GAAG;AAAA,YACX,WAAW,CAAC,gBAAgB,SAAS,EAAE,cAAe,EAAE,YAAY,CAAC;AAAA,UACvE,CAAC;AACD,gBAAM,IAAI,MAAM,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,OAAO,EAAE,OAAO,WAAW,EAAE,UAAU,CAAC;AAC5G,mBAAU,EAAE,UAAiC;AAC7C,oBAAW,EAAE,WAAkC;AAC/C,qBAAW;AAAA,QACb;AACA,cAAM,UAAU,GAAG;AACnB,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR,aAAa,GAAG;AAAA,UAChB;AAAA,UACA;AAAA,UACA,QAAQ,GAAG;AAAA,UACX,UAAU,GAAG;AAAA,UACb,cAAc,CAAC,CAAC,GAAG;AAAA,UACnB;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,eAAO;AAAA,MACT,SAAS,GAAG;AACV,YAAK,GAAa,YAAY,aAAa;AACzC,mBAAS,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,cAAc,cAAc,OAAO,EAAE;AACxE,iBAAO;AAAA,QACT;AACA,cAAM,KAAK,CAAC;AAAA,MACd;AAAA,IACF;AAAA,IACA,CAAC,MAAM,WAAW;AAAA,EACpB;AAEA,QAAM,aAAa,YAAY,YAAY;AACzC,UAAM,IAAI,MAAM;AAChB,QAAI,EAAE,UAAW,OAAM,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC/D,QAAI,MAAM,aAAa,mBAAoB,OAAM,aAAa;AAC9D,UAAM,UAAU;AAChB,aAAS,KAAK;AAAA,EAChB,GAAG,CAAC,MAAM,QAAQ,CAAC;AAEnB,QAAM,OAAO,MAAM;AACjB,QAAI,CAAC,MAAM,QAAS,OAAM,IAAI,aAAa,iBAAiB,qCAAqC;AACjG,WAAO,MAAM;AAAA,EACf;AAEA,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,CAAC,QAAQ,IAAI,KAAK,GAAG,KAAK,MAAM,QAAQ,UAAU;AAAA,MACvD,KAAK,CAAC,QAAQ,IAAI,KAAK,GAAG,KAAK,MAAM,QAAQ,UAAU;AAAA,MACvD,UAAU,CAAC,QAAQ,SAAS,KAAK,GAAG,GAAG;AAAA,IACzC;AAAA,IACA,CAAC,OAAO,SAAS,SAAS,YAAY,WAAW;AAAA,EACnD;AAEA,SAAO,cAAc,IAAI,UAAU,EAAE,MAAM,GAAG,EAAE,QAAQ;AAC1D;AAGO,SAAS,cAAoC;AAClD,QAAM,IAAI,WAAW,GAAG;AACxB,MAAI,CAAC,EAAG,OAAM,IAAI,MAAM,sDAAsD;AAC9E,SAAO;AACT;AAOO,IAAM,mBAAmB;","names":[]}

package/dist/server.cjs

@@ -20,30 +20,52 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server.ts
 var server_exports = {};
 __export(server_exports, {
+  ACCESS_CHALLENGE_LIFETIME_S: () => ACCESS_CHALLENGE_LIFETIME_S,
+  ACCESS_ERROR_STATUS: () => ACCESS_ERROR_STATUS,
+  ACCESS_PROTOCOL: () => ACCESS_PROTOCOL,
+  ACCESS_VERSION: () => ACCESS_VERSION,
+  AccessError: () => AccessError,
   CHALLENGE_LIFETIME_MS: () => CHALLENGE_LIFETIME_MS,
   IdentityLinkConflictError: () => IdentityLinkConflictError,
   LOGIN_PROTOCOL: () => LOGIN_PROTOCOL,
+  MAX_HOLDING_PROOFS: () => MAX_HOLDING_PROOFS,
   MIN_SECRET_LENGTH: () => MIN_SECRET_LENGTH,
+  PROTOCOL_MEDIA: () => PROTOCOL_MEDIA,
   PaymentVerificationError: () => PaymentVerificationError,
+  accessErrorMessage: () => accessErrorMessage,
+  atLeastRaw: () => atLeastRaw,
+  bitSignResolver: () => bitSignResolver,
+  canonicalJson: () => canonicalJson,
+  challengeBytes: () => challengeBytes,
+  checkTokenHolding: () => checkTokenHolding,
+  createAccessChallenge: () => createAccessChallenge,
   createChallenge: () => createChallenge,
   isIdentityKey: () => isIdentityKey,
+  kindFor: () => kindFor,
   linkIdentity: () => linkIdentity,
   loginMessage: () => loginMessage,
   memoryStore: () => memoryStore,
+  normaliseRequirement: () => normaliseRequirement,
+  oneSatResolver: () => oneSatResolver,
   originAllowed: () => originAllowed,
+  parseAccessChallenge: () => parseAccessChallenge,
   pgNonceTableSql: () => pgNonceTableSql,
   pgStore: () => pgStore,
+  protocolMediaUrl: () => protocolMediaUrl,
   readCookie: () => readCookie,
   redisStore: () => redisStore,
   serializeCookie: () => serializeCookie,
   signInOrLink: () => signInOrLink,
   signSession: () => signSession,
+  tokenNeedRaw: () => tokenNeedRaw,
+  verifyAccess: () => verifyAccess,
+  verifyHoldingProof: () => verifyHoldingProof,
   verifyPayment: () => verifyPayment,
   verifySession: () => verifySession,
   verifySignIn: () => verifySignIn
 });
 module.exports = __toCommonJS(server_exports);
-var import_sdk2 = require("@bsv/sdk");
+var import_sdk3 = require("@bsv/sdk");
 
 // src/nonce-stores.ts
 var ttlSeconds = (c) => Math.max(1, Math.ceil((c.expiresAt - Date.now()) / 1e3));
@@ -349,6 +371,359 @@ async function signInOrLink(identityKey, o) {
   return { status: "created", userId, identityKey: key };
 }
 
+// src/access.ts
+var ACCESS_VERSION = 1;
+var ACCESS_PROTOCOL = [2, "bwalletx access"];
+var ACCESS_CHALLENGE_LIFETIME_S = 120;
+var MAX_HOLDING_PROOFS = 50;
+var ACCESS_ERROR_STATUS = {
+  not_installed: 424,
+  user_rejected: 403,
+  wrong_account: 409,
+  insufficient_tokens: 403,
+  identity_level_too_low: 403,
+  kyc_required: 403,
+  indexer_unavailable: 503,
+  expired: 401,
+  replay: 401,
+  invalid_signature: 401,
+  bad_request: 400
+};
+var AccessError = class extends Error {
+  code;
+  have;
+  need;
+  constructor(code, message, extra = {}) {
+    super(message ?? code);
+    this.name = "AccessError";
+    this.code = code;
+    this.have = extra.have;
+    this.need = extra.need;
+  }
+  toJSON() {
+    const b = { error: this.code, message: this.message };
+    if (this.have !== void 0) b.have = this.have;
+    if (this.need !== void 0) b.need = this.need;
+    return b;
+  }
+};
+var PROTOCOL_MEDIA = {
+  "401": { name: "Identity", color: "#22c55e", video: "assets/protocol/401.mp4", poster: "assets/protocol/401.jpg" },
+  "402": { name: "Payment", color: "#3b82f6", video: "assets/protocol/402.mp4", poster: "assets/protocol/402.jpg" },
+  "403": { name: "Access", color: "#ef4444", video: "assets/protocol/403.mp4", poster: "assets/protocol/403.jpg" }
+};
+function protocolMediaUrl(kind, which, version = "latest") {
+  return `https://unpkg.com/@bwalletx/connect@${version}/${PROTOCOL_MEDIA[kind][which]}`;
+}
+function canonicalJson(v) {
+  if (v === null) return "null";
+  if (typeof v === "string" || typeof v === "boolean") return JSON.stringify(v);
+  if (typeof v === "number") {
+    if (!Number.isFinite(v)) throw new Error("canonicalJson: non-finite number");
+    return JSON.stringify(v);
+  }
+  if (Array.isArray(v)) return `[${v.map((x) => canonicalJson(x)).join(",")}]`;
+  if (typeof v === "object") {
+    const o = v;
+    const keys2 = Object.keys(o).filter((k) => o[k] !== void 0).sort();
+    return `{${keys2.map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported ${typeof v}`);
+}
+function challengeBytes(challenge) {
+  return Array.from(new TextEncoder().encode(challenge));
+}
+var TOKEN_ID = /^bsv21:[0-9a-f]{64}_\d{1,6}$/;
+var RAW = /^[1-9]\d{0,38}$/;
+function normaliseRequirement(r) {
+  if (!r || typeof r !== "object") throw new AccessError("bad_request", "require must be an object");
+  const req = r;
+  const out = {};
+  if (req.token !== void 0) {
+    const t = req.token;
+    if (!t || typeof t !== "object" || typeof t.id !== "string") throw new AccessError("bad_request", "require.token.id is required");
+    const id = t.id.trim().toLowerCase();
+    if (!TOKEN_ID.test(id)) throw new AccessError("bad_request", "require.token.id must be 'bsv21:<txid>_<vout>'");
+    const hasMin = t.min !== void 0;
+    const hasBps = t.minBps !== void 0;
+    if (hasMin === hasBps) throw new AccessError("bad_request", "require.token needs exactly one of min or minBps");
+    out.token = { id };
+    if (hasMin) {
+      if (typeof t.min !== "string" || !RAW.test(t.min)) throw new AccessError("bad_request", "require.token.min must be a positive integer string (raw units)");
+      out.token.min = t.min;
+    } else {
+      if (!Number.isInteger(t.minBps) || t.minBps < 1 || t.minBps > 1e4) {
+        throw new AccessError("bad_request", "require.token.minBps must be an integer 1..10000");
+      }
+      out.token.minBps = t.minBps;
+    }
+  }
+  if (req.identityLevel !== void 0) {
+    if (!Number.isInteger(req.identityLevel) || req.identityLevel < 1 || req.identityLevel > 10) {
+      throw new AccessError("bad_request", "require.identityLevel must be an integer 1..10");
+    }
+    out.identityLevel = req.identityLevel;
+  }
+  if (req.kyc !== void 0) {
+    if (typeof req.kyc !== "boolean") throw new AccessError("bad_request", "require.kyc must be a boolean");
+    if (req.kyc) out.kyc = true;
+  }
+  if (!out.token && !out.identityLevel && !out.kyc) throw new AccessError("bad_request", "require is empty");
+  return out;
+}
+function kindFor(r) {
+  return r.token ? "403" : "401";
+}
+function parseAccessChallenge(s) {
+  if (typeof s !== "string" || s.length > 4096) throw new AccessError("bad_request", "challenge must be a string");
+  let c;
+  try {
+    c = JSON.parse(s);
+  } catch {
+    throw new AccessError("bad_request", "challenge is not JSON");
+  }
+  if (!c || typeof c !== "object" || c.v !== 1) throw new AccessError("bad_request", "unsupported challenge version");
+  if (c.kind !== "401" && c.kind !== "402" && c.kind !== "403") throw new AccessError("bad_request", "bad kind");
+  if (typeof c.origin !== "string" || typeof c.nonce !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(c.nonce)) {
+    throw new AccessError("bad_request", "bad origin or nonce");
+  }
+  if (!Number.isInteger(c.iat) || !Number.isInteger(c.exp) || c.exp <= c.iat) throw new AccessError("bad_request", "bad iat/exp");
+  if (c.sub !== void 0 && (typeof c.sub !== "string" || !/^0[23][0-9a-f]{64}$/.test(c.sub))) throw new AccessError("bad_request", "bad sub");
+  c.require = normaliseRequirement(c.require);
+  if (canonicalJson(c) !== s) throw new AccessError("bad_request", "challenge is not canonical");
+  return c;
+}
+function tokenNeedRaw(t, supplyRaw) {
+  if (t.min) return t.min;
+  if (supplyRaw === void 0 || !/^\d+$/.test(supplyRaw)) throw new AccessError("indexer_unavailable", "token supply unknown");
+  const n = BigInt(supplyRaw) * BigInt(t.minBps);
+  const need = (n + 9999n) / 10000n;
+  return (need < 1n ? 1n : need).toString();
+}
+function atLeastRaw(have, need) {
+  try {
+    return BigInt(have) >= BigInt(need);
+  } catch {
+    return false;
+  }
+}
+function accessErrorMessage(code, e = {}) {
+  switch (code) {
+    case "not_installed":
+      return "No bWalletX (or other BRC-100 wallet) was found.";
+    case "user_rejected":
+      return "The request was declined in the wallet.";
+    case "wrong_account":
+      return "The wallet is signed in to a different account than this site expects.";
+    case "insufficient_tokens":
+      return `Not enough tokens: holding ${e.have ?? 0}, need ${e.need ?? "?"}.`;
+    case "identity_level_too_low":
+      return `Identity level ${e.have ?? 0} is below the required level ${e.need ?? "?"}.`;
+    case "kyc_required":
+      return "A verified identity (KYC) is required.";
+    case "indexer_unavailable":
+      return "Holdings could not be checked right now. Try again shortly.";
+    case "expired":
+      return "The request expired. Try again.";
+    case "replay":
+      return "That request was already used. Try again.";
+    case "invalid_signature":
+      return "The wallet signature did not verify.";
+    case "bad_request":
+      return "The request was malformed.";
+  }
+}
+
+// src/access-server.ts
+var import_sdk2 = require("@bsv/sdk");
+var bare = (tokenId) => tokenId.replace(/^bsv21:/, "");
+function oneSatResolver(o = {}) {
+  const base = (o.base ?? "https://api.1sat.app/1sat").replace(/\/$/, "");
+  const f = o.fetch ?? globalThis.fetch;
+  const t = o.timeoutMs ?? 12e3;
+  const call = async (path, init) => {
+    const res = await f(`${base}${path}`, { ...init, signal: AbortSignal.timeout(t), cache: "no-store" });
+    if (!res.ok) throw new Error(`1sat ${res.status} for ${path}`);
+    return res.json();
+  };
+  return {
+    async tokenBalance(tokenId, addresses) {
+      const sorted = [...new Set(addresses)].sort();
+      let total = 0n;
+      for (let i = 0; i < sorted.length; i += 100) {
+        const j = await call(`/bsv21/${bare(tokenId)}/p2pkh/balance`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(sorted.slice(i, i + 100))
+        });
+        const b = j?.balance ?? 0;
+        const s = typeof b === "number" ? String(Math.trunc(b)) : String(b).split(".")[0] || "0";
+        if (!/^\d+$/.test(s)) throw new Error("1sat returned a bad balance");
+        total += BigInt(s);
+      }
+      return total.toString();
+    },
+    async tokenSupply(tokenId) {
+      const j = await call(`/bsv21/${bare(tokenId)}`);
+      const tok = (j?.token ?? j) || {};
+      const v = tok.amt ?? tok.max ?? tok.supply;
+      const s = v === void 0 || v === null ? "" : String(v).split(".")[0];
+      if (!/^\d+$/.test(s) || s === "0") throw new Error("1sat did not report a supply");
+      return s;
+    }
+  };
+}
+function bitSignResolver(o = {}) {
+  const base = (o.base ?? "https://bit-sign.online").replace(/\/$/, "");
+  const f = o.fetch ?? globalThis.fetch;
+  const tokens = o.tokens ?? oneSatResolver({ fetch: f });
+  return {
+    tokenBalance: (id, a) => tokens.tokenBalance(id, a),
+    tokenSupply: tokens.tokenSupply ? (id) => tokens.tokenSupply(id) : void 0,
+    async identity(identityKey, response) {
+      const res = await f(`${base}/api/access/verify`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ response, only: "identity" }),
+        signal: AbortSignal.timeout(o.timeoutMs ?? 12e3),
+        cache: "no-store"
+      });
+      const j = await res.json().catch(() => null);
+      if (!j?.identity || j.identityKey !== identityKey) throw new Error(`bit-sign ${res.status}`);
+      return { level: Number(j.identity.level) || 0, kyc: j.identity.kyc === true };
+    }
+  };
+}
+function normalOrigin(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  return u.origin;
+}
+function randomNonce() {
+  const b = new Uint8Array(18);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createAccessChallenge(o) {
+  const origin = normalOrigin(o.origin);
+  const require2 = normaliseRequirement(o.require);
+  let sub;
+  if (o.identityKey !== void 0 && o.identityKey !== null && o.identityKey !== "") {
+    if (!isIdentityKey(o.identityKey)) throw new AccessError("bad_request", "identityKey must be a compressed public key");
+    sub = o.identityKey.toLowerCase();
+  }
+  const iat = Math.floor((o.now ?? Date.now()) / 1e3);
+  const exp = iat + (o.lifetimeS ?? ACCESS_CHALLENGE_LIFETIME_S);
+  const nonce = randomNonce();
+  const c = { v: 1, kind: o.kind ?? kindFor(require2), origin, nonce, iat, exp, sub, require: require2 };
+  const challenge = canonicalJson(c);
+  await o.store.put(nonce, { identityKey: sub ?? "", origin, message: challenge, expiresAt: exp * 1e3 });
+  return { challenge, nonce, kind: c.kind, protocolID: ACCESS_PROTOCOL, keyID: nonce, exp };
+}
+var isByteArray = (s) => Array.isArray(s) && s.length >= 8 && s.length <= 80 && s.every((b) => Number.isInteger(b) && b >= 0 && b <= 255);
+function verifyHoldingProof(challenge, p) {
+  const proof = p;
+  if (!proof || typeof proof.pubkey !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(proof.pubkey) || !isByteArray(proof.signature)) return null;
+  try {
+    const pub = import_sdk2.PublicKey.fromString(proof.pubkey);
+    const sig = import_sdk2.Signature.fromDER(proof.signature);
+    return pub.verify(challengeBytes(challenge), sig) ? pub.toAddress() : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyAccess(o) {
+  const r = o.response;
+  if (!r || typeof r !== "object" || r.v !== 1) throw new AccessError("bad_request", "response must be { v: 1, challenge, identityKey, signature }");
+  const c = parseAccessChallenge(r.challenge);
+  const nowS = Math.floor((o.now ?? Date.now()) / 1e3);
+  const pending = await o.store.take(c.nonce);
+  if (!pending) throw new AccessError(nowS >= c.exp ? "expired" : "replay");
+  if (nowS >= c.exp || (o.now ?? Date.now()) > pending.expiresAt) throw new AccessError("expired");
+  if (pending.message !== r.challenge) throw new AccessError("replay", "challenge does not match the one issued");
+  let origin;
+  try {
+    origin = normalOrigin(o.origin);
+  } catch {
+    throw new AccessError("bad_request", "server origin is misconfigured");
+  }
+  if (c.origin !== origin || pending.origin !== origin) throw new AccessError("bad_request", "origin mismatch");
+  if (o.require && canonicalJson(normaliseRequirement(o.require)) !== canonicalJson(c.require)) {
+    throw new AccessError("bad_request", "challenge requirement does not match this gate");
+  }
+  if (!isIdentityKey(r.identityKey)) throw new AccessError("bad_request", "identityKey must be a compressed public key");
+  const identityKey = r.identityKey.toLowerCase();
+  if (c.sub && c.sub !== identityKey) throw new AccessError("wrong_account");
+  if (!isByteArray(r.signature)) throw new AccessError("invalid_signature");
+  let valid = false;
+  try {
+    ({ valid } = await new import_sdk2.ProtoWallet("anyone").verifySignature({
+      protocolID: ACCESS_PROTOCOL,
+      keyID: c.nonce,
+      counterparty: identityKey,
+      data: challengeBytes(r.challenge),
+      signature: r.signature
+    }));
+  } catch {
+    valid = false;
+  }
+  if (!valid) throw new AccessError("invalid_signature");
+  const grant = { ok: true, identityKey, kind: c.kind, require: c.require, addresses: [], have: {} };
+  if (c.require.identityLevel || c.require.kyc) {
+    if (!o.resolver.identity) throw new AccessError("indexer_unavailable", "no identity resolver configured");
+    let id;
+    try {
+      id = await o.resolver.identity(identityKey, r);
+    } catch (e) {
+      throw new AccessError("indexer_unavailable", `identity lookup failed: ${e.message}`);
+    }
+    grant.have.identityLevel = id.level;
+    grant.have.kyc = id.kyc;
+    if (c.require.kyc && !id.kyc) throw new AccessError("kyc_required");
+    if (c.require.identityLevel && id.level < c.require.identityLevel) {
+      throw new AccessError("identity_level_too_low", void 0, { have: id.level, need: c.require.identityLevel });
+    }
+  }
+  if (c.require.token) {
+    const proofs = Array.isArray(r.holdings) ? r.holdings.slice(0, MAX_HOLDING_PROOFS) : [];
+    const addresses = /* @__PURE__ */ new Set();
+    for (const p of proofs) {
+      const a = verifyHoldingProof(r.challenge, p);
+      if (a) addresses.add(a);
+    }
+    grant.addresses = [...addresses].sort();
+    const check = await checkTokenHolding(c.require, grant.addresses, o.resolver);
+    grant.have.tokenRaw = check.have;
+    grant.have.needRaw = check.need;
+  }
+  return grant;
+}
+async function checkTokenHolding(require2, addresses, resolver) {
+  const t = require2.token;
+  if (!t) return { have: "0", need: "0" };
+  let supply;
+  if (t.minBps) {
+    if (!resolver.tokenSupply) throw new AccessError("indexer_unavailable", "no supply resolver configured");
+    try {
+      supply = await resolver.tokenSupply(t.id);
+    } catch (e) {
+      throw new AccessError("indexer_unavailable", `supply lookup failed: ${e.message}`);
+    }
+  }
+  const need = tokenNeedRaw(t, supply);
+  if (!addresses.length) throw new AccessError("insufficient_tokens", void 0, { have: "0", need });
+  let have;
+  try {
+    have = await resolver.tokenBalance(t.id, addresses);
+  } catch (e) {
+    throw new AccessError("indexer_unavailable", `balance lookup failed: ${e.message}`);
+  }
+  if (!atLeastRaw(have, need)) throw new AccessError("insufficient_tokens", void 0, { have, need });
+  return { have, need };
+}
+
 // src/server.ts
 var LOGIN_PROTOCOL = [2, "bwallet sign in"];
 var CHALLENGE_LIFETIME_MS = 2 * 60 * 1e3;
@@ -380,13 +755,13 @@ var storeOrDefault = (s) => s ?? (defaultStore ??= memoryStore());
 function isIdentityKey(x) {
   if (typeof x !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;
   try {
-    import_sdk2.PublicKey.fromString(x);
+    import_sdk3.PublicKey.fromString(x);
     return true;
   } catch {
     return false;
   }
 }
-function normalOrigin(origin) {
+function normalOrigin2(origin) {
   const u = new URL(origin);
   if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) {
     throw new Error(`origin must be scheme://host[:port], got ${origin}`);
@@ -404,7 +779,7 @@ function loginMessage(origin, nonce, expiresAt) {
     `Expires: ${new Date(expiresAt).toISOString()}`
   ].join("\n");
 }
-function randomNonce() {
+function randomNonce2() {
   const b = new Uint8Array(16);
   globalThis.crypto.getRandomValues(b);
   let s = "";
@@ -413,8 +788,8 @@ function randomNonce() {
 }
 async function createChallenge(opts) {
   if (!isIdentityKey(opts.identityKey)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
-  const origin = normalOrigin(opts.origin);
-  const nonce = randomNonce();
+  const origin = normalOrigin2(opts.origin);
+  const nonce = randomNonce2();
   const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
   const message = loginMessage(origin, nonce, expiresAt);
   await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });
@@ -426,7 +801,7 @@ async function verifySignIn(opts) {
   if (!c || Date.now() > c.expiresAt) return null;
   let origin;
   try {
-    origin = normalOrigin(opts.origin);
+    origin = normalOrigin2(opts.origin);
   } catch {
     return null;
   }
@@ -439,7 +814,7 @@ async function verifySignIn(opts) {
     return null;
   }
   try {
-    const { valid } = await new import_sdk2.ProtoWallet("anyone").verifySignature({
+    const { valid } = await new import_sdk3.ProtoWallet("anyone").verifySignature({
       protocolID: LOGIN_PROTOCOL,
       keyID: opts.nonce,
       counterparty: identityKey,
@@ -453,31 +828,53 @@ async function verifySignIn(opts) {
 }
 function originAllowed(requestOrigin, origin) {
   try {
-    return !!requestOrigin && requestOrigin === normalOrigin(origin);
+    return !!requestOrigin && requestOrigin === normalOrigin2(origin);
   } catch {
     return false;
   }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCESS_CHALLENGE_LIFETIME_S,
+  ACCESS_ERROR_STATUS,
+  ACCESS_PROTOCOL,
+  ACCESS_VERSION,
+  AccessError,
   CHALLENGE_LIFETIME_MS,
   IdentityLinkConflictError,
   LOGIN_PROTOCOL,
+  MAX_HOLDING_PROOFS,
   MIN_SECRET_LENGTH,
+  PROTOCOL_MEDIA,
   PaymentVerificationError,
+  accessErrorMessage,
+  atLeastRaw,
+  bitSignResolver,
+  canonicalJson,
+  challengeBytes,
+  checkTokenHolding,
+  createAccessChallenge,
   createChallenge,
   isIdentityKey,
+  kindFor,
   linkIdentity,
   loginMessage,
   memoryStore,
+  normaliseRequirement,
+  oneSatResolver,
   originAllowed,
+  parseAccessChallenge,
   pgNonceTableSql,
   pgStore,
+  protocolMediaUrl,
   readCookie,
   redisStore,
   serializeCookie,
   signInOrLink,
   signSession,
+  tokenNeedRaw,
+  verifyAccess,
+  verifyHoldingProof,
   verifyPayment,
   verifySession,
   verifySignIn