@bwalletx/connect 0.4.1 → 0.5.0

package/dist/index.d.cts

@@ -2,6 +2,8 @@ import { WalletInterface, WalletProtocol } from '@bsv/sdk';
 import { f as PairingOptions, W as WalletOption } from './wallets-VOKIKBbO.cjs';
 export { g as BRC29_PROTOCOL, i as Brc29Remittance, B as BuyTokenRequest, C as ConnectedWallet, D as DiscoverWalletsOptions, H as HandCashAdapterOptions, L as LegacyPayer, j as PairConnectionOptions, k as PairStorage, l as PairedWallet, b as PayOptions, m as PayOutput, P as PayRequest, a as PayResult, n as PaySource, c as PaymentError, o as PaymentErrorCode, S as SocketFactory, q as SocketLike, T as TokenQuote, r as WalletKind, s as amountInSats, d as brc100Option, t as buyToken, u as clearPairing, e as discoverWallets, h as handcashAdapter, v as isIdentityKeyHex, w as isPaymail, x as pairBwalletX, p as pairingOption, y as pay, z as resolvePaymailP2P, A as restorePairing, E as tip } from './wallets-VOKIKBbO.cjs';
 export { AuthorizeParams, GET_URL, SIGNIN_CSS, SIGNIN_TAG, SigninBrand, SigninLabel, SigninSize, SigninTheme, WEB_WALLET_URL, buildAuthorizeUrl, defineBwalletxSignin, markSvg, signinText } from './element.cjs';
+import { b as AccessResponse, H as HoldingProof, A as AccessError } from './access-Z6xQwKVF.cjs';
+export { c as ACCESS_ERROR_STATUS, d as ACCESS_PROTOCOL, e as ACCESS_VERSION, f as AccessChallenge, g as AccessErrorBody, h as AccessErrorCode, i as AccessKind, a as AccessRequirement, P as PROTOCOL_MEDIA, T as TokenRequirement, j as accessErrorMessage, k as canonicalJson, p as protocolMediaUrl } from './access-Z6xQwKVF.cjs';
 
 /** Ids bWalletX announces in BRC-100 wallet discovery. */
 declare const RDNS_EXTENSION = "com.bwalletx.extension";
@@ -107,4 +109,45 @@ declare function pickWallet(options: WalletOption[], o?: {
     title?: string;
 }): Promise<WalletOption | null>;
 
-export { BWALLETX_RDNS, type ButtonOptions, type Challenge, type FoundBy, type FoundWallet, LOGIN_PROTOCOL, LOGO_URL, type PairingModalOptions, PairingOptions, RDNS_EXTENSION, RDNS_MOBILE, type SignInMethod, type SignInOptions, type SignInResult, WalletOption, connectBwalletX, discoverBwalletX, findBwalletX, inOrder, pairingModal, pickWallet, qrSvg, renderButton, signInWithBwalletX };
+/**
+ * Browser side of the access protocol: ask the wallet to sign the site's challenge and prove the
+ * keys holding the required token, using standard BRC-100 calls only (so any BRC-100 wallet works).
+ */
+
+/** The challenge route's answer (createAccessChallenge). */
+interface AccessChallengeLike {
+    challenge: string;
+}
+interface RequestAccessOptions {
+    /** Ask your server for a challenge. Gets the wallet's identity key. */
+    challenge: (identityKey: string) => Promise<AccessChallengeLike>;
+    /** Post the signed response to your server. Throw AccessError (or return an error body) to refuse. */
+    verify?: (response: AccessResponse) => Promise<unknown>;
+    wallet?: WalletInterface;
+    pairing?: SignInOptions['pairing'];
+    discoverMs?: number;
+    /** Basket holding BSV-21 outputs. Default 'bsv21' (bWalletX, 1Sat wallets). */
+    tokenBasket?: string;
+}
+interface RequestAccessResult {
+    response: AccessResponse;
+    /** Whatever `verify` returned. */
+    verified?: unknown;
+    wallet: WalletInterface;
+}
+/** Map a wallet / fetch failure to a protocol error. */
+declare function toAccessError(e: unknown): AccessError;
+/** Read an AccessErrorBody from a server answer and throw it as AccessError. */
+declare function throwIfAccessError(body: unknown): void;
+/**
+ * Sign the challenge with every key that locks an output of `tokenId` in the wallet's token basket.
+ * Outputs whose derivation can't be reproduced are skipped (the server counts only what is proven).
+ */
+declare function proveHoldings(wallet: WalletInterface, challenge: string, tokenId: string, basket?: string): Promise<HoldingProof[]>;
+/**
+ * Run the whole flow: find the wallet, get a challenge, sign it, prove holdings, post to verify.
+ * Throws AccessError with a protocol code on every failure.
+ */
+declare function requestAccess(o: RequestAccessOptions): Promise<RequestAccessResult>;
+
+export { type AccessChallengeLike, AccessError, AccessResponse, BWALLETX_RDNS, type ButtonOptions, type Challenge, type FoundBy, type FoundWallet, HoldingProof, LOGIN_PROTOCOL, LOGO_URL, type PairingModalOptions, PairingOptions, RDNS_EXTENSION, RDNS_MOBILE, type RequestAccessOptions, type RequestAccessResult, type SignInMethod, type SignInOptions, type SignInResult, WalletOption, connectBwalletX, discoverBwalletX, findBwalletX, inOrder, pairingModal, pickWallet, proveHoldings, qrSvg, renderButton, requestAccess, signInWithBwalletX, throwIfAccessError, toAccessError };

package/dist/index.d.ts

@@ -2,6 +2,8 @@ import { WalletInterface, WalletProtocol } from '@bsv/sdk';
 import { f as PairingOptions, W as WalletOption } from './wallets-VOKIKBbO.js';
 export { g as BRC29_PROTOCOL, i as Brc29Remittance, B as BuyTokenRequest, C as ConnectedWallet, D as DiscoverWalletsOptions, H as HandCashAdapterOptions, L as LegacyPayer, j as PairConnectionOptions, k as PairStorage, l as PairedWallet, b as PayOptions, m as PayOutput, P as PayRequest, a as PayResult, n as PaySource, c as PaymentError, o as PaymentErrorCode, S as SocketFactory, q as SocketLike, T as TokenQuote, r as WalletKind, s as amountInSats, d as brc100Option, t as buyToken, u as clearPairing, e as discoverWallets, h as handcashAdapter, v as isIdentityKeyHex, w as isPaymail, x as pairBwalletX, p as pairingOption, y as pay, z as resolvePaymailP2P, A as restorePairing, E as tip } from './wallets-VOKIKBbO.js';
 export { AuthorizeParams, GET_URL, SIGNIN_CSS, SIGNIN_TAG, SigninBrand, SigninLabel, SigninSize, SigninTheme, WEB_WALLET_URL, buildAuthorizeUrl, defineBwalletxSignin, markSvg, signinText } from './element.js';
+import { b as AccessResponse, H as HoldingProof, A as AccessError } from './access-Z6xQwKVF.js';
+export { c as ACCESS_ERROR_STATUS, d as ACCESS_PROTOCOL, e as ACCESS_VERSION, f as AccessChallenge, g as AccessErrorBody, h as AccessErrorCode, i as AccessKind, a as AccessRequirement, P as PROTOCOL_MEDIA, T as TokenRequirement, j as accessErrorMessage, k as canonicalJson, p as protocolMediaUrl } from './access-Z6xQwKVF.js';
 
 /** Ids bWalletX announces in BRC-100 wallet discovery. */
 declare const RDNS_EXTENSION = "com.bwalletx.extension";
@@ -107,4 +109,45 @@ declare function pickWallet(options: WalletOption[], o?: {
     title?: string;
 }): Promise<WalletOption | null>;
 
-export { BWALLETX_RDNS, type ButtonOptions, type Challenge, type FoundBy, type FoundWallet, LOGIN_PROTOCOL, LOGO_URL, type PairingModalOptions, PairingOptions, RDNS_EXTENSION, RDNS_MOBILE, type SignInMethod, type SignInOptions, type SignInResult, WalletOption, connectBwalletX, discoverBwalletX, findBwalletX, inOrder, pairingModal, pickWallet, qrSvg, renderButton, signInWithBwalletX };
+/**
+ * Browser side of the access protocol: ask the wallet to sign the site's challenge and prove the
+ * keys holding the required token, using standard BRC-100 calls only (so any BRC-100 wallet works).
+ */
+
+/** The challenge route's answer (createAccessChallenge). */
+interface AccessChallengeLike {
+    challenge: string;
+}
+interface RequestAccessOptions {
+    /** Ask your server for a challenge. Gets the wallet's identity key. */
+    challenge: (identityKey: string) => Promise<AccessChallengeLike>;
+    /** Post the signed response to your server. Throw AccessError (or return an error body) to refuse. */
+    verify?: (response: AccessResponse) => Promise<unknown>;
+    wallet?: WalletInterface;
+    pairing?: SignInOptions['pairing'];
+    discoverMs?: number;
+    /** Basket holding BSV-21 outputs. Default 'bsv21' (bWalletX, 1Sat wallets). */
+    tokenBasket?: string;
+}
+interface RequestAccessResult {
+    response: AccessResponse;
+    /** Whatever `verify` returned. */
+    verified?: unknown;
+    wallet: WalletInterface;
+}
+/** Map a wallet / fetch failure to a protocol error. */
+declare function toAccessError(e: unknown): AccessError;
+/** Read an AccessErrorBody from a server answer and throw it as AccessError. */
+declare function throwIfAccessError(body: unknown): void;
+/**
+ * Sign the challenge with every key that locks an output of `tokenId` in the wallet's token basket.
+ * Outputs whose derivation can't be reproduced are skipped (the server counts only what is proven).
+ */
+declare function proveHoldings(wallet: WalletInterface, challenge: string, tokenId: string, basket?: string): Promise<HoldingProof[]>;
+/**
+ * Run the whole flow: find the wallet, get a challenge, sign it, prove holdings, post to verify.
+ * Throws AccessError with a protocol code on every failure.
+ */
+declare function requestAccess(o: RequestAccessOptions): Promise<RequestAccessResult>;
+
+export { type AccessChallengeLike, AccessError, AccessResponse, BWALLETX_RDNS, type ButtonOptions, type Challenge, type FoundBy, type FoundWallet, HoldingProof, LOGIN_PROTOCOL, LOGO_URL, type PairingModalOptions, PairingOptions, RDNS_EXTENSION, RDNS_MOBILE, type RequestAccessOptions, type RequestAccessResult, type SignInMethod, type SignInOptions, type SignInResult, WalletOption, connectBwalletX, discoverBwalletX, findBwalletX, inOrder, pairingModal, pickWallet, proveHoldings, qrSvg, renderButton, requestAccess, signInWithBwalletX, throwIfAccessError, toAccessError };

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   qrSvg,
   resolvePaymailP2P,
   tip
-} from "./chunk-FUQ46RJV.js";
+} from "./chunk-GF6GUDZL.js";
 import {
   BWALLETX_RDNS,
   GET_URL,
@@ -34,10 +34,24 @@ import {
   inOrder,
   markSvg,
   pairBwalletX,
+  proveHoldings,
+  requestAccess,
   restorePairing,
   signInWithBwalletX,
-  signinText
-} from "./chunk-NNMUSWPG.js";
+  signinText,
+  throwIfAccessError,
+  toAccessError
+} from "./chunk-CVLXFNAG.js";
+import {
+  ACCESS_ERROR_STATUS,
+  ACCESS_PROTOCOL,
+  ACCESS_VERSION,
+  AccessError,
+  PROTOCOL_MEDIA,
+  accessErrorMessage,
+  canonicalJson,
+  protocolMediaUrl
+} from "./chunk-MWD4BCO5.js";
 
 // src/button.ts
 var CSS = `
@@ -83,21 +97,28 @@ function renderButton(el, opts = {}) {
   return b;
 }
 export {
+  ACCESS_ERROR_STATUS,
+  ACCESS_PROTOCOL,
+  ACCESS_VERSION,
+  AccessError,
   BRC29_PROTOCOL,
   BWALLETX_RDNS,
   GET_URL,
   LOGIN_PROTOCOL,
   LOGO_URL,
+  PROTOCOL_MEDIA,
   PaymentError,
   RDNS_EXTENSION,
   RDNS_MOBILE,
   SIGNIN_CSS,
   SIGNIN_TAG,
   WEB_WALLET_URL,
+  accessErrorMessage,
   amountInSats,
   brc100Option,
   buildAuthorizeUrl,
   buyToken,
+  canonicalJson,
   clearPairing,
   connectBwalletX,
   defineBwalletxSignin,
@@ -114,12 +135,17 @@ export {
   pairingOption,
   pay,
   pickWallet,
+  protocolMediaUrl,
+  proveHoldings,
   qrSvg,
   renderButton,
+  requestAccess,
   resolvePaymailP2P,
   restorePairing,
   signInWithBwalletX,
   signinText,
-  tip
+  throwIfAccessError,
+  tip,
+  toAccessError
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/button.ts"],"sourcesContent":["const CSS = `\n.bwx-signin{display:inline-flex;align-items:center;gap:12px;min-height:48px;padding:10px 22px 10px 10px;border:0;border-radius:12px;cursor:pointer;background:linear-gradient(180deg,#fcd34d,#f59e0b);color:#000;text-align:left;font:700 16px/1.2 system-ui,-apple-system,\"Segoe UI\",sans-serif;box-shadow:0 8px 24px rgba(245,158,11,.2)}\n.bwx-signin:hover{background:linear-gradient(180deg,#fde68a,#fbbf24)}\n.bwx-signin:focus-visible{outline:2px solid #ffd24d;outline-offset:3px}\n.bwx-signin:disabled{opacity:.6;cursor:wait}\n.bwx-signin .bwx-mark{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border-radius:50%;background:#000;flex:none}\n.bwx-signin small{display:block;font-size:11px;font-weight:500;color:rgba(0,0,0,.6)}`;\n\nexport const LOGO_URL = 'https://bwalletx.com/logo.svg';\n\nexport interface ButtonOptions {\n  /** Second line under the label. Default \"also works with bWallet\". false hides it. */\n  subtitle?: string | false;\n  onClick?: (button: HTMLButtonElement) => void;\n}\n\n/** Put the gold \"Sign in with bWalletX\" button into `el` (replacing its contents). */\nexport function renderButton(el: HTMLElement | string, opts: ButtonOptions = {}): HTMLButtonElement {\n  const host = typeof el === 'string' ? document.querySelector<HTMLElement>(el) : el;\n  if (!host) throw new Error(`renderButton: no element ${String(el)}`);\n  if (!document.getElementById('bwx-signin-css')) {\n    const style = document.createElement('style');\n    style.id = 'bwx-signin-css';\n    style.textContent = CSS;\n    document.head.appendChild(style);\n  }\n  const b = document.createElement('button');\n  b.type = 'button';\n  b.className = 'bwx-signin';\n  const mark = document.createElement('span');\n  mark.className = 'bwx-mark';\n  const img = document.createElement('img');\n  img.src = LOGO_URL;\n  img.alt = '';\n  img.width = 15;\n  img.height = 20;\n  mark.appendChild(img);\n  const label = document.createElement('span');\n  label.className = 'bwx-label';\n  label.textContent = 'Sign in with bWalletX';\n  const sub = opts.subtitle === undefined ? 'also works with bWallet' : opts.subtitle;\n  if (sub) {\n    const small = document.createElement('small');\n    small.textContent = sub;\n    label.appendChild(small);\n  }\n  b.append(mark, label);\n  if (opts.onClick) b.addEventListener('click', () => opts.onClick!(b));\n  host.replaceChildren(b);\n  return b;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQL,IAAM,WAAW;AASjB,SAAS,aAAa,IAA0B,OAAsB,CAAC,GAAsB;AAClG,QAAM,OAAO,OAAO,OAAO,WAAW,SAAS,cAA2B,EAAE,IAAI;AAChF,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4BAA4B,OAAO,EAAE,CAAC,EAAE;AACnE,MAAI,CAAC,SAAS,eAAe,gBAAgB,GAAG;AAC9C,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,KAAK;AACX,UAAM,cAAc;AACpB,aAAS,KAAK,YAAY,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,SAAS,cAAc,QAAQ;AACzC,IAAE,OAAO;AACT,IAAE,YAAY;AACd,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,YAAY;AACjB,QAAM,MAAM,SAAS,cAAc,KAAK;AACxC,MAAI,MAAM;AACV,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,MAAI,SAAS;AACb,OAAK,YAAY,GAAG;AACpB,QAAM,QAAQ,SAAS,cAAc,MAAM;AAC3C,QAAM,YAAY;AAClB,QAAM,cAAc;AACpB,QAAM,MAAM,KAAK,aAAa,SAAY,4BAA4B,KAAK;AAC3E,MAAI,KAAK;AACP,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,cAAc;AACpB,UAAM,YAAY,KAAK;AAAA,EACzB;AACA,IAAE,OAAO,MAAM,KAAK;AACpB,MAAI,KAAK,QAAS,GAAE,iBAAiB,SAAS,MAAM,KAAK,QAAS,CAAC,CAAC;AACpE,OAAK,gBAAgB,CAAC;AACtB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/button.ts"],"sourcesContent":["const CSS = `\n.bwx-signin{display:inline-flex;align-items:center;gap:12px;min-height:48px;padding:10px 22px 10px 10px;border:0;border-radius:12px;cursor:pointer;background:linear-gradient(180deg,#fcd34d,#f59e0b);color:#000;text-align:left;font:700 16px/1.2 system-ui,-apple-system,\"Segoe UI\",sans-serif;box-shadow:0 8px 24px rgba(245,158,11,.2)}\n.bwx-signin:hover{background:linear-gradient(180deg,#fde68a,#fbbf24)}\n.bwx-signin:focus-visible{outline:2px solid #ffd24d;outline-offset:3px}\n.bwx-signin:disabled{opacity:.6;cursor:wait}\n.bwx-signin .bwx-mark{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border-radius:50%;background:#000;flex:none}\n.bwx-signin small{display:block;font-size:11px;font-weight:500;color:rgba(0,0,0,.6)}`;\n\nexport const LOGO_URL = 'https://bwalletx.com/logo.svg';\n\nexport interface ButtonOptions {\n  /** Second line under the label. Default \"also works with bWallet\". false hides it. */\n  subtitle?: string | false;\n  onClick?: (button: HTMLButtonElement) => void;\n}\n\n/** Put the gold \"Sign in with bWalletX\" button into `el` (replacing its contents). */\nexport function renderButton(el: HTMLElement | string, opts: ButtonOptions = {}): HTMLButtonElement {\n  const host = typeof el === 'string' ? document.querySelector<HTMLElement>(el) : el;\n  if (!host) throw new Error(`renderButton: no element ${String(el)}`);\n  if (!document.getElementById('bwx-signin-css')) {\n    const style = document.createElement('style');\n    style.id = 'bwx-signin-css';\n    style.textContent = CSS;\n    document.head.appendChild(style);\n  }\n  const b = document.createElement('button');\n  b.type = 'button';\n  b.className = 'bwx-signin';\n  const mark = document.createElement('span');\n  mark.className = 'bwx-mark';\n  const img = document.createElement('img');\n  img.src = LOGO_URL;\n  img.alt = '';\n  img.width = 15;\n  img.height = 20;\n  mark.appendChild(img);\n  const label = document.createElement('span');\n  label.className = 'bwx-label';\n  label.textContent = 'Sign in with bWalletX';\n  const sub = opts.subtitle === undefined ? 'also works with bWallet' : opts.subtitle;\n  if (sub) {\n    const small = document.createElement('small');\n    small.textContent = sub;\n    label.appendChild(small);\n  }\n  b.append(mark, label);\n  if (opts.onClick) b.addEventListener('click', () => opts.onClick!(b));\n  host.replaceChildren(b);\n  return b;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQL,IAAM,WAAW;AASjB,SAAS,aAAa,IAA0B,OAAsB,CAAC,GAAsB;AAClG,QAAM,OAAO,OAAO,OAAO,WAAW,SAAS,cAA2B,EAAE,IAAI;AAChF,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4BAA4B,OAAO,EAAE,CAAC,EAAE;AACnE,MAAI,CAAC,SAAS,eAAe,gBAAgB,GAAG;AAC9C,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,KAAK;AACX,UAAM,cAAc;AACpB,aAAS,KAAK,YAAY,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,SAAS,cAAc,QAAQ;AACzC,IAAE,OAAO;AACT,IAAE,YAAY;AACd,QAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,OAAK,YAAY;AACjB,QAAM,MAAM,SAAS,cAAc,KAAK;AACxC,MAAI,MAAM;AACV,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,MAAI,SAAS;AACb,OAAK,YAAY,GAAG;AACpB,QAAM,QAAQ,SAAS,cAAc,MAAM;AAC3C,QAAM,YAAY;AAClB,QAAM,cAAc;AACpB,QAAM,MAAM,KAAK,aAAa,SAAY,4BAA4B,KAAK;AAC3E,MAAI,KAAK;AACP,UAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,UAAM,cAAc;AACpB,UAAM,YAAY,KAAK;AAAA,EACzB;AACA,IAAE,OAAO,MAAM,KAAK;AACpB,MAAI,KAAK,QAAS,GAAE,iBAAiB,SAAS,MAAM,KAAK,QAAS,CAAC,CAAC;AACpE,OAAK,gBAAgB,CAAC;AACtB,SAAO;AACT;","names":[]}

package/dist/next.cjs

@@ -31,6 +31,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var next_exports = {};
 __export(next_exports, {
   IdentityLinkConflictError: () => IdentityLinkConflictError,
+  createBwalletXAccess: () => createBwalletXAccess,
   createBwalletXAuth: () => createBwalletXAuth,
   linkIdentity: () => linkIdentity,
   memoryStore: () => memoryStore,
@@ -78,7 +79,7 @@ async function signInOrLink(identityKey, o) {
 }
 
 // src/server.ts
-var import_sdk = require("@bsv/sdk");
+var import_sdk2 = require("@bsv/sdk");
 
 // src/nonce-stores.ts
 var ttlSeconds = (c) => Math.max(1, Math.ceil((c.expiresAt - Date.now()) / 1e3));
@@ -213,6 +214,292 @@ function readCookie(header, name) {
   return null;
 }
 
+// src/access.ts
+var ACCESS_PROTOCOL = [2, "bwalletx access"];
+var ACCESS_CHALLENGE_LIFETIME_S = 120;
+var MAX_HOLDING_PROOFS = 50;
+var ACCESS_ERROR_STATUS = {
+  not_installed: 424,
+  user_rejected: 403,
+  wrong_account: 409,
+  insufficient_tokens: 403,
+  identity_level_too_low: 403,
+  kyc_required: 403,
+  indexer_unavailable: 503,
+  expired: 401,
+  replay: 401,
+  invalid_signature: 401,
+  bad_request: 400
+};
+var AccessError = class extends Error {
+  code;
+  have;
+  need;
+  constructor(code, message, extra = {}) {
+    super(message ?? code);
+    this.name = "AccessError";
+    this.code = code;
+    this.have = extra.have;
+    this.need = extra.need;
+  }
+  toJSON() {
+    const b = { error: this.code, message: this.message };
+    if (this.have !== void 0) b.have = this.have;
+    if (this.need !== void 0) b.need = this.need;
+    return b;
+  }
+};
+function canonicalJson(v) {
+  if (v === null) return "null";
+  if (typeof v === "string" || typeof v === "boolean") return JSON.stringify(v);
+  if (typeof v === "number") {
+    if (!Number.isFinite(v)) throw new Error("canonicalJson: non-finite number");
+    return JSON.stringify(v);
+  }
+  if (Array.isArray(v)) return `[${v.map((x) => canonicalJson(x)).join(",")}]`;
+  if (typeof v === "object") {
+    const o = v;
+    const keys2 = Object.keys(o).filter((k) => o[k] !== void 0).sort();
+    return `{${keys2.map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported ${typeof v}`);
+}
+function challengeBytes(challenge) {
+  return Array.from(new TextEncoder().encode(challenge));
+}
+var TOKEN_ID = /^bsv21:[0-9a-f]{64}_\d{1,6}$/;
+var RAW = /^[1-9]\d{0,38}$/;
+function normaliseRequirement(r) {
+  if (!r || typeof r !== "object") throw new AccessError("bad_request", "require must be an object");
+  const req = r;
+  const out = {};
+  if (req.token !== void 0) {
+    const t = req.token;
+    if (!t || typeof t !== "object" || typeof t.id !== "string") throw new AccessError("bad_request", "require.token.id is required");
+    const id = t.id.trim().toLowerCase();
+    if (!TOKEN_ID.test(id)) throw new AccessError("bad_request", "require.token.id must be 'bsv21:<txid>_<vout>'");
+    const hasMin = t.min !== void 0;
+    const hasBps = t.minBps !== void 0;
+    if (hasMin === hasBps) throw new AccessError("bad_request", "require.token needs exactly one of min or minBps");
+    out.token = { id };
+    if (hasMin) {
+      if (typeof t.min !== "string" || !RAW.test(t.min)) throw new AccessError("bad_request", "require.token.min must be a positive integer string (raw units)");
+      out.token.min = t.min;
+    } else {
+      if (!Number.isInteger(t.minBps) || t.minBps < 1 || t.minBps > 1e4) {
+        throw new AccessError("bad_request", "require.token.minBps must be an integer 1..10000");
+      }
+      out.token.minBps = t.minBps;
+    }
+  }
+  if (req.identityLevel !== void 0) {
+    if (!Number.isInteger(req.identityLevel) || req.identityLevel < 1 || req.identityLevel > 10) {
+      throw new AccessError("bad_request", "require.identityLevel must be an integer 1..10");
+    }
+    out.identityLevel = req.identityLevel;
+  }
+  if (req.kyc !== void 0) {
+    if (typeof req.kyc !== "boolean") throw new AccessError("bad_request", "require.kyc must be a boolean");
+    if (req.kyc) out.kyc = true;
+  }
+  if (!out.token && !out.identityLevel && !out.kyc) throw new AccessError("bad_request", "require is empty");
+  return out;
+}
+function kindFor(r) {
+  return r.token ? "403" : "401";
+}
+function parseAccessChallenge(s) {
+  if (typeof s !== "string" || s.length > 4096) throw new AccessError("bad_request", "challenge must be a string");
+  let c;
+  try {
+    c = JSON.parse(s);
+  } catch {
+    throw new AccessError("bad_request", "challenge is not JSON");
+  }
+  if (!c || typeof c !== "object" || c.v !== 1) throw new AccessError("bad_request", "unsupported challenge version");
+  if (c.kind !== "401" && c.kind !== "402" && c.kind !== "403") throw new AccessError("bad_request", "bad kind");
+  if (typeof c.origin !== "string" || typeof c.nonce !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(c.nonce)) {
+    throw new AccessError("bad_request", "bad origin or nonce");
+  }
+  if (!Number.isInteger(c.iat) || !Number.isInteger(c.exp) || c.exp <= c.iat) throw new AccessError("bad_request", "bad iat/exp");
+  if (c.sub !== void 0 && (typeof c.sub !== "string" || !/^0[23][0-9a-f]{64}$/.test(c.sub))) throw new AccessError("bad_request", "bad sub");
+  c.require = normaliseRequirement(c.require);
+  if (canonicalJson(c) !== s) throw new AccessError("bad_request", "challenge is not canonical");
+  return c;
+}
+function tokenNeedRaw(t, supplyRaw) {
+  if (t.min) return t.min;
+  if (supplyRaw === void 0 || !/^\d+$/.test(supplyRaw)) throw new AccessError("indexer_unavailable", "token supply unknown");
+  const n = BigInt(supplyRaw) * BigInt(t.minBps);
+  const need = (n + 9999n) / 10000n;
+  return (need < 1n ? 1n : need).toString();
+}
+function atLeastRaw(have, need) {
+  try {
+    return BigInt(have) >= BigInt(need);
+  } catch {
+    return false;
+  }
+}
+function accessErrorMessage(code, e = {}) {
+  switch (code) {
+    case "not_installed":
+      return "No bWalletX (or other BRC-100 wallet) was found.";
+    case "user_rejected":
+      return "The request was declined in the wallet.";
+    case "wrong_account":
+      return "The wallet is signed in to a different account than this site expects.";
+    case "insufficient_tokens":
+      return `Not enough tokens: holding ${e.have ?? 0}, need ${e.need ?? "?"}.`;
+    case "identity_level_too_low":
+      return `Identity level ${e.have ?? 0} is below the required level ${e.need ?? "?"}.`;
+    case "kyc_required":
+      return "A verified identity (KYC) is required.";
+    case "indexer_unavailable":
+      return "Holdings could not be checked right now. Try again shortly.";
+    case "expired":
+      return "The request expired. Try again.";
+    case "replay":
+      return "That request was already used. Try again.";
+    case "invalid_signature":
+      return "The wallet signature did not verify.";
+    case "bad_request":
+      return "The request was malformed.";
+  }
+}
+
+// src/access-server.ts
+var import_sdk = require("@bsv/sdk");
+function normalOrigin(origin) {
+  const u = new URL(origin);
+  if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) throw new Error(`origin must be scheme://host[:port], got ${origin}`);
+  return u.origin;
+}
+function randomNonce() {
+  const b = new Uint8Array(18);
+  globalThis.crypto.getRandomValues(b);
+  let s = "";
+  for (const x of b) s += String.fromCharCode(x);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createAccessChallenge(o) {
+  const origin = normalOrigin(o.origin);
+  const require2 = normaliseRequirement(o.require);
+  let sub;
+  if (o.identityKey !== void 0 && o.identityKey !== null && o.identityKey !== "") {
+    if (!isIdentityKey(o.identityKey)) throw new AccessError("bad_request", "identityKey must be a compressed public key");
+    sub = o.identityKey.toLowerCase();
+  }
+  const iat = Math.floor((o.now ?? Date.now()) / 1e3);
+  const exp = iat + (o.lifetimeS ?? ACCESS_CHALLENGE_LIFETIME_S);
+  const nonce = randomNonce();
+  const c = { v: 1, kind: o.kind ?? kindFor(require2), origin, nonce, iat, exp, sub, require: require2 };
+  const challenge = canonicalJson(c);
+  await o.store.put(nonce, { identityKey: sub ?? "", origin, message: challenge, expiresAt: exp * 1e3 });
+  return { challenge, nonce, kind: c.kind, protocolID: ACCESS_PROTOCOL, keyID: nonce, exp };
+}
+var isByteArray = (s) => Array.isArray(s) && s.length >= 8 && s.length <= 80 && s.every((b) => Number.isInteger(b) && b >= 0 && b <= 255);
+function verifyHoldingProof(challenge, p) {
+  const proof = p;
+  if (!proof || typeof proof.pubkey !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(proof.pubkey) || !isByteArray(proof.signature)) return null;
+  try {
+    const pub = import_sdk.PublicKey.fromString(proof.pubkey);
+    const sig = import_sdk.Signature.fromDER(proof.signature);
+    return pub.verify(challengeBytes(challenge), sig) ? pub.toAddress() : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyAccess(o) {
+  const r = o.response;
+  if (!r || typeof r !== "object" || r.v !== 1) throw new AccessError("bad_request", "response must be { v: 1, challenge, identityKey, signature }");
+  const c = parseAccessChallenge(r.challenge);
+  const nowS = Math.floor((o.now ?? Date.now()) / 1e3);
+  const pending = await o.store.take(c.nonce);
+  if (!pending) throw new AccessError(nowS >= c.exp ? "expired" : "replay");
+  if (nowS >= c.exp || (o.now ?? Date.now()) > pending.expiresAt) throw new AccessError("expired");
+  if (pending.message !== r.challenge) throw new AccessError("replay", "challenge does not match the one issued");
+  let origin;
+  try {
+    origin = normalOrigin(o.origin);
+  } catch {
+    throw new AccessError("bad_request", "server origin is misconfigured");
+  }
+  if (c.origin !== origin || pending.origin !== origin) throw new AccessError("bad_request", "origin mismatch");
+  if (o.require && canonicalJson(normaliseRequirement(o.require)) !== canonicalJson(c.require)) {
+    throw new AccessError("bad_request", "challenge requirement does not match this gate");
+  }
+  if (!isIdentityKey(r.identityKey)) throw new AccessError("bad_request", "identityKey must be a compressed public key");
+  const identityKey = r.identityKey.toLowerCase();
+  if (c.sub && c.sub !== identityKey) throw new AccessError("wrong_account");
+  if (!isByteArray(r.signature)) throw new AccessError("invalid_signature");
+  let valid = false;
+  try {
+    ({ valid } = await new import_sdk.ProtoWallet("anyone").verifySignature({
+      protocolID: ACCESS_PROTOCOL,
+      keyID: c.nonce,
+      counterparty: identityKey,
+      data: challengeBytes(r.challenge),
+      signature: r.signature
+    }));
+  } catch {
+    valid = false;
+  }
+  if (!valid) throw new AccessError("invalid_signature");
+  const grant = { ok: true, identityKey, kind: c.kind, require: c.require, addresses: [], have: {} };
+  if (c.require.identityLevel || c.require.kyc) {
+    if (!o.resolver.identity) throw new AccessError("indexer_unavailable", "no identity resolver configured");
+    let id;
+    try {
+      id = await o.resolver.identity(identityKey, r);
+    } catch (e) {
+      throw new AccessError("indexer_unavailable", `identity lookup failed: ${e.message}`);
+    }
+    grant.have.identityLevel = id.level;
+    grant.have.kyc = id.kyc;
+    if (c.require.kyc && !id.kyc) throw new AccessError("kyc_required");
+    if (c.require.identityLevel && id.level < c.require.identityLevel) {
+      throw new AccessError("identity_level_too_low", void 0, { have: id.level, need: c.require.identityLevel });
+    }
+  }
+  if (c.require.token) {
+    const proofs = Array.isArray(r.holdings) ? r.holdings.slice(0, MAX_HOLDING_PROOFS) : [];
+    const addresses = /* @__PURE__ */ new Set();
+    for (const p of proofs) {
+      const a = verifyHoldingProof(r.challenge, p);
+      if (a) addresses.add(a);
+    }
+    grant.addresses = [...addresses].sort();
+    const check = await checkTokenHolding(c.require, grant.addresses, o.resolver);
+    grant.have.tokenRaw = check.have;
+    grant.have.needRaw = check.need;
+  }
+  return grant;
+}
+async function checkTokenHolding(require2, addresses, resolver) {
+  const t = require2.token;
+  if (!t) return { have: "0", need: "0" };
+  let supply;
+  if (t.minBps) {
+    if (!resolver.tokenSupply) throw new AccessError("indexer_unavailable", "no supply resolver configured");
+    try {
+      supply = await resolver.tokenSupply(t.id);
+    } catch (e) {
+      throw new AccessError("indexer_unavailable", `supply lookup failed: ${e.message}`);
+    }
+  }
+  const need = tokenNeedRaw(t, supply);
+  if (!addresses.length) throw new AccessError("insufficient_tokens", void 0, { have: "0", need });
+  let have;
+  try {
+    have = await resolver.tokenBalance(t.id, addresses);
+  } catch (e) {
+    throw new AccessError("indexer_unavailable", `balance lookup failed: ${e.message}`);
+  }
+  if (!atLeastRaw(have, need)) throw new AccessError("insufficient_tokens", void 0, { have, need });
+  return { have, need };
+}
+
 // src/server.ts
 var LOGIN_PROTOCOL = [2, "bwallet sign in"];
 var CHALLENGE_LIFETIME_MS = 2 * 60 * 1e3;
@@ -244,13 +531,13 @@ var storeOrDefault = (s) => s ?? (defaultStore ??= memoryStore());
 function isIdentityKey(x) {
   if (typeof x !== "string" || !/^0[23][0-9a-fA-F]{64}$/.test(x)) return false;
   try {
-    import_sdk.PublicKey.fromString(x);
+    import_sdk2.PublicKey.fromString(x);
     return true;
   } catch {
     return false;
   }
 }
-function normalOrigin(origin) {
+function normalOrigin2(origin) {
   const u = new URL(origin);
   if (u.origin === "null" || u.origin !== origin.replace(/\/$/, "")) {
     throw new Error(`origin must be scheme://host[:port], got ${origin}`);
@@ -268,7 +555,7 @@ function loginMessage(origin, nonce, expiresAt) {
     `Expires: ${new Date(expiresAt).toISOString()}`
   ].join("\n");
 }
-function randomNonce() {
+function randomNonce2() {
   const b = new Uint8Array(16);
   globalThis.crypto.getRandomValues(b);
   let s = "";
@@ -277,8 +564,8 @@ function randomNonce() {
 }
 async function createChallenge(opts) {
   if (!isIdentityKey(opts.identityKey)) throw new Error("identityKey must be a compressed public key (66 hex chars)");
-  const origin = normalOrigin(opts.origin);
-  const nonce = randomNonce();
+  const origin = normalOrigin2(opts.origin);
+  const nonce = randomNonce2();
   const expiresAt = Date.now() + CHALLENGE_LIFETIME_MS;
   const message = loginMessage(origin, nonce, expiresAt);
   await storeOrDefault(opts.store).put(nonce, { identityKey: opts.identityKey.toLowerCase(), origin, message, expiresAt });
@@ -290,7 +577,7 @@ async function verifySignIn(opts) {
   if (!c || Date.now() > c.expiresAt) return null;
   let origin;
   try {
-    origin = normalOrigin(opts.origin);
+    origin = normalOrigin2(opts.origin);
   } catch {
     return null;
   }
@@ -303,7 +590,7 @@ async function verifySignIn(opts) {
     return null;
   }
   try {
-    const { valid } = await new import_sdk.ProtoWallet("anyone").verifySignature({
+    const { valid } = await new import_sdk2.ProtoWallet("anyone").verifySignature({
       protocolID: LOGIN_PROTOCOL,
       keyID: opts.nonce,
       counterparty: identityKey,
@@ -317,7 +604,7 @@ async function verifySignIn(opts) {
 }
 function originAllowed(requestOrigin, origin) {
   try {
-    return !!requestOrigin && requestOrigin === normalOrigin(origin);
+    return !!requestOrigin && requestOrigin === normalOrigin2(origin);
   } catch {
     return false;
   }
@@ -401,9 +688,90 @@ function createBwalletXAuth(o) {
   };
   return auth;
 }
+var errJson = (e) => json(e.toJSON(), ACCESS_ERROR_STATUS[e.code]);
+function createBwalletXAccess(o) {
+  if (!o.store) throw new Error("createBwalletXAccess needs a nonce store");
+  const require2 = normaliseRequirement(o.require);
+  const reqHash = canonicalJson(require2);
+  const cookieName = o.cookieName ?? "bwx_access";
+  const maxAge = o.maxAge ?? 24 * 3600;
+  const recheckMs = (o.recheckEvery ?? 300) * 1e3;
+  const secure = o.secureCookie ?? o.origin.startsWith("https:");
+  const secret = () => {
+    const s = o.secret ?? (typeof process !== "undefined" ? process.env?.[o.secretEnv ?? "BWALLETX_SESSION_SECRET"] : void 0);
+    assertSecret(s);
+    return s;
+  };
+  const cookie = (v, age) => serializeCookie(v, { name: cookieName, maxAge: age, secure, sameSite: o.sameSite, domain: o.cookieDomain });
+  const badOrigin = (req) => !originAllowed(req.headers.get("origin"), o.origin);
+  const checked = /* @__PURE__ */ new Map();
+  const readToken = async (source) => {
+    if (typeof source === "string") return readCookie(source, cookieName);
+    if (source instanceof Headers) return readCookie(source.get("cookie"), cookieName);
+    if (source && typeof source.headers?.get === "function") return readCookie(source.headers.get("cookie"), cookieName);
+    const { cookies } = await import("next/headers");
+    const jar = await cookies();
+    return jar.get(cookieName)?.value ?? null;
+  };
+  const gate = {
+    require: require2,
+    async challenge(req) {
+      secret();
+      if (badOrigin(req)) return json({ error: "bad_request", message: "origin not allowed" }, 403);
+      const b = await body(req);
+      try {
+        return json(await createAccessChallenge({ origin: o.origin, require: require2, store: o.store, identityKey: b?.identityKey }));
+      } catch (e) {
+        return errJson(e instanceof AccessError ? e : new AccessError("bad_request", e.message));
+      }
+    },
+    async verify(req) {
+      const key = secret();
+      if (badOrigin(req)) return json({ error: "bad_request", message: "origin not allowed" }, 403);
+      const b = await body(req);
+      try {
+        const g = await verifyAccess({ origin: o.origin, response: b, store: o.store, resolver: o.resolver, require: require2 });
+        const token = await signSession({ sub: g.identityKey, acc: reqHash, ad: g.addresses }, { secret: key, maxAge });
+        checked.set(`${g.identityKey}|${g.addresses.join(",")}`, Date.now());
+        return json({ ok: true, identityKey: g.identityKey, have: g.have }, 200, { "set-cookie": cookie(token, maxAge) });
+      } catch (e) {
+        if (e instanceof AccessError) return errJson(e);
+        throw e;
+      }
+    },
+    async logout(req) {
+      if (badOrigin(req)) return json({ error: "bad_request", message: "origin not allowed" }, 403);
+      return json({ ok: true }, 200, { "set-cookie": cookie("", 0) });
+    },
+    async status(req) {
+      const a = await gate.getAccess(req);
+      return json(a, 200);
+    },
+    async getAccess(source) {
+      const s = await verifySession(await readToken(source), { secret: secret() });
+      if (!s || s.acc !== reqHash) return { ok: false, error: "no_session", message: "Not signed in to this gate." };
+      const addresses = Array.isArray(s.ad) ? s.ad.filter((x) => typeof x === "string") : [];
+      const k = `${s.sub}|${addresses.join(",")}`;
+      const last = checked.get(k) ?? 0;
+      if (require2.token && Date.now() - last >= recheckMs) {
+        try {
+          await checkTokenHolding(require2, addresses, o.resolver);
+          checked.set(k, Date.now());
+        } catch (e) {
+          checked.delete(k);
+          const ae = e instanceof AccessError ? e : new AccessError("indexer_unavailable", e.message);
+          return { ok: false, error: ae.code, message: ae.message === ae.code ? accessErrorMessage(ae.code, ae) : ae.message, have: ae.have, need: ae.need };
+        }
+      }
+      return { ok: true, identityKey: s.sub, addresses, checkedAt: checked.get(k) ?? last };
+    }
+  };
+  return gate;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   IdentityLinkConflictError,
+  createBwalletXAccess,
   createBwalletXAuth,
   linkIdentity,
   memoryStore,