@bwalletx/connect 0.5.0 → 0.5.4

package/dist/react.cjs

@@ -83,10 +83,22 @@ function pairUrl(link) {
   const q = new URLSearchParams({ v: link.v, r: link.r, c: link.c, k: link.k, o: link.o, e: String(link.e) });
   return `https://${PAIR_HOST}/pair?${q}`;
 }
-var relaySocketUrl = (relay, channel, role, expiry) => {
+var newClaim = () => b64url(crypto.getRandomValues(new Uint8Array(16)));
+var WALLET_CLAIM_INFO = "bwallet-pair-wallet-claim-v1";
+var hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+async function walletClaimFor(channel, sitePub) {
+  const d = await crypto.subtle.digest("SHA-256", enc.encode(`${WALLET_CLAIM_INFO}|${channel}|${sitePub}`));
+  return b64url(new Uint8Array(d));
+}
+async function claimDigest(claim) {
+  return hex(new Uint8Array(await crypto.subtle.digest("SHA-256", enc.encode(claim))));
+}
+var relaySocketUrl = (relay, channel, role, expiry, claim, walletClaimHash) => {
   const local = /^(localhost|127\.0\.0\.1)(:\d+)?$/.test(relay);
   const q = new URLSearchParams({ role });
   if (expiry) q.set("e", String(expiry));
+  if (claim) q.set("claim", claim);
+  if (walletClaimHash && role === "site") q.set("wc", walletClaimHash);
   return `${local ? "ws" : "wss"}://${relay}/v1/c/${channel}?${q}`;
 };
 async function deriveSession(mine, theirs, channel) {
@@ -184,6 +196,7 @@ function parseStored(raw) {
     if (typeof p.s !== "string" || !/^[0-9a-f]{64}$/i.test(p.s)) return null;
     if (typeof p.k !== "string" || !/^0[23][0-9a-f]{64}$/i.test(p.k)) return null;
     if (!n(p.sent) || !n(p.lastSeen) || !n(p.pairedAt)) return null;
+    if (p.sc !== void 0 && (typeof p.sc !== "string" || !/^[A-Za-z0-9_-]{22,64}$/.test(p.sc))) return null;
     return p;
   } catch {
     return null;
@@ -241,7 +254,12 @@ var Link = class {
     await this.opening;
   }
   reopen() {
-    const ws = this.socket(relaySocketUrl(this.p.r, this.p.c, "site", Math.floor(Date.now() / 1e3) + QR_LIFETIME_S - 10));
+    if (!this.p.sc) {
+      this.p = { ...this.p, sc: newClaim() };
+      this.persist();
+    }
+    const e = Math.floor(Date.now() / 1e3) + QR_LIFETIME_S - 10;
+    const ws = this.socket(relaySocketUrl(this.p.r, this.p.c, "site", e, this.p.sc));
     return new Promise((resolve, reject) => {
       ws.onopen = () => {
         this.ws = ws;
@@ -335,11 +353,13 @@ function pairBwalletX(opts) {
   const siteKey = import_sdk2.PrivateKey.fromRandom();
   const channel = newChannel();
   const expiry = Math.floor(Date.now() / 1e3) + QR_LIFETIME_S;
-  return new Promise((resolve, reject) => {
+  const siteClaim = newClaim();
+  const sitePub = siteKey.toPublicKey().toString();
+  return walletClaimFor(channel, sitePub).then(claimDigest).then((wc) => new Promise((resolve, reject) => {
     if (opts.signal?.aborted) return reject(new Error("cancelled"));
     let ws;
     try {
-      ws = socket(relaySocketUrl(relay, channel, "site", expiry));
+      ws = socket(relaySocketUrl(relay, channel, "site", expiry, siteClaim, wc));
     } catch (e) {
       return reject(e);
     }
@@ -378,7 +398,7 @@ function pairBwalletX(opts) {
       if (msg.t === "ready") {
         settled = true;
         clearTimeout(timer);
-        const p = { v: 1, c: channel, r: relay, s: siteKey.toHex(), k: walletKey, ...sealer.counters, pairedAt: Date.now() };
+        const p = { v: 1, c: channel, r: relay, s: siteKey.toHex(), k: walletKey, ...sealer.counters, pairedAt: Date.now(), sc: siteClaim };
         await Promise.resolve(storage.setItem(key, JSON.stringify(p))).catch(() => {
         });
         const link = new Link(p, sealer, storage, key, socket, opts.callTimeoutMs ?? 12e4);
@@ -388,8 +408,8 @@ function pairBwalletX(opts) {
         fail(new Error("Pairing was declined in bWalletX"));
       }
     });
-    opts.onLink(pairUrl({ v: PAIR_VERSION, r: relay, c: channel, k: siteKey.toPublicKey().toString(), o: origin, e: expiry }));
-  });
+    opts.onLink(pairUrl({ v: PAIR_VERSION, r: relay, c: channel, k: sitePub, o: origin, e: expiry }));
+  }));
 }
 async function restorePairing(opts = {}) {
   const storage = opts.storage === void 0 ? defaultStorage() : opts.storage ?? memoryStorage();
@@ -407,17 +427,40 @@ async function clearPairing(opts = {}) {
   });
 }
 
+// src/theme.ts
+var WALLET_THEME_META = "bwalletx-theme";
+var ID = /^[a-z0-9-]{1,32}$/;
+function declareWalletTheme(theme) {
+  if (typeof document === "undefined") return;
+  const id = (theme ?? "").trim().toLowerCase();
+  let meta = document.head.querySelector(`meta[name="${WALLET_THEME_META}"]`);
+  if (!id || !ID.test(id)) {
+    meta?.remove();
+    return;
+  }
+  if (!meta) {
+    meta = document.createElement("meta");
+    meta.name = WALLET_THEME_META;
+    document.head.appendChild(meta);
+  }
+  if (meta.content !== id) meta.content = id;
+}
+
 // src/discover.ts
+var import_sdk3 = require("@bsv/sdk");
 var RDNS_EXTENSION = "com.bwalletx.extension";
 var RDNS_MOBILE = "space.bwallet.mobile";
 var BWALLETX_RDNS = [RDNS_EXTENSION, RDNS_MOBILE];
-function discoverBwalletX(ms = 1200) {
+var DEFAULT_DISCOVER_MS = 300;
+function discoverBwalletX(ms = DEFAULT_DISCOVER_MS) {
   if (typeof window === "undefined") return Promise.resolve(null);
   return new Promise((resolve) => {
     let done = false;
+    let timer;
     const finish = (r) => {
       if (done) return;
       done = true;
+      if (timer !== void 0) clearTimeout(timer);
       window.removeEventListener("brc100:announceWallet", onAnnounce);
       resolve(r);
     };
@@ -428,605 +471,340 @@ function discoverBwalletX(ms = 1200) {
         finish({ wallet: d.wallet, method: rdns === RDNS_EXTENSION ? "extension" : "in-app", rdns });
       }
     };
+    const cwiNow = () => {
+      const cwi = window.CWI;
+      if (cwi) finish({ wallet: cwi, method: "in-app", rdns: null });
+      return !!cwi;
+    };
     window.addEventListener("brc100:announceWallet", onAnnounce);
     window.dispatchEvent(new Event("brc100:requestWallet"));
-    setTimeout(() => {
-      const cwi = window.CWI;
-      finish(cwi ? { wallet: cwi, method: "in-app", rdns: null } : null);
+    if (done || cwiNow()) return;
+    if (isFramed()) {
+      void probeXdm(Math.max(ms, 1200)).then((w) => finish(w ? { wallet: w, method: "in-app", rdns: null } : null));
+      return;
+    }
+    timer = setTimeout(() => {
+      timer = void 0;
+      if (!cwiNow()) finish(null);
     }, ms);
   });
 }
+var isFramed = () => {
+  try {
+    return window.parent !== window;
+  } catch {
+    return true;
+  }
+};
+var BWALLETX_PARENT_ORIGINS = [
+  "https://web.bwalletx.com",
+  "https://desktop.bwalletx.com",
+  "https://bwalletx.com",
+  "https://www.bwallet.space",
+  "https://bwallet.space",
+  "capacitor://localhost",
+  // iOS app shell
+  "https://localhost",
+  // Android app shell
+  "tauri://localhost",
+  // bWalletX Desktop (macOS)
+  "https://tauri.localhost",
+  // bWalletX Desktop (Windows)
+  "chrome-extension://bombmmcjghjdlbmcclnhjodgcelnehgl"
+  // bWalletX for Chrome (fixed id)
+];
+var parentOrigin = () => {
+  try {
+    const anc = window.location.ancestorOrigins;
+    if (anc && anc.length > 0) return anc[0] ?? null;
+    if (!document.referrer) return null;
+    const u = new URL(document.referrer);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return null;
+  }
+};
+async function probeXdm(ms = 1200, allowed = BWALLETX_PARENT_ORIGINS) {
+  const origin = parentOrigin();
+  if (!origin || !allowed.includes(origin)) return null;
+  try {
+    const w = new import_sdk3.WalletClient(new import_sdk3.XDM(origin));
+    const ok = await Promise.race([
+      w.isAuthenticated({}).then(
+        () => true,
+        () => false
+      ),
+      new Promise((r) => setTimeout(() => r(false), ms))
+    ]);
+    return ok ? w : null;
+  } catch {
+    return null;
+  }
+}
+var warmedAt = 0;
+function prewarmBwalletX() {
+  if (typeof window === "undefined" || Date.now() - warmedAt < 2e4) return;
+  warmedAt = Date.now();
+  void discoverBwalletX(0).then((f) => {
+    if (f && f.method === "extension") void f.wallet.isAuthenticated({}).catch(() => {
+    });
+  });
+}
+function bindPrewarm(el2) {
+  const on = () => prewarmBwalletX();
+  const evs = ["pointerenter", "focus", "touchstart"];
+  for (const e of evs) el2.addEventListener(e, on, { passive: true });
+  return () => evs.forEach((e) => el2.removeEventListener(e, on));
+}
 
 // src/signin.ts
 var LOGIN_PROTOCOL = [2, "bwallet sign in"];
 async function connectBwalletX(opts = {}) {
-  if (opts.wallet) return { wallet: opts.wallet, method: "wallet" };
-  const found = await discoverBwalletX(opts.discoverMs);
-  if (found) return { wallet: found.wallet, method: found.method };
+  const status = (s) => {
+    try {
+      opts.onStatus?.(s);
+    } catch {
+    }
+  };
+  if (opts.wallet) {
+    status("opening");
+    return { wallet: opts.wallet, method: "wallet" };
+  }
+  status("finding");
+  const found = await discoverBwalletX(opts.discoverMs ?? DEFAULT_DISCOVER_MS);
+  if (found) {
+    status("opening");
+    return { wallet: found.wallet, method: found.method };
+  }
   if (opts.reusePairing !== false) {
     const restored = await restorePairing(opts.pairing ?? {});
-    if (restored) return { wallet: restored, method: "pairing" };
+    if (restored) {
+      status("opening");
+      return { wallet: restored, method: "pairing" };
+    }
   }
   if (!opts.pairing) {
     throw Object.assign(new Error("bWalletX was not found in this browser"), { code: "NOT_FOUND" });
   }
+  status("pairing");
   return { wallet: await pairBwalletX(opts.pairing), method: "pairing" };
 }
 async function signInWithBwalletX(opts) {
   const { wallet, method } = await connectBwalletX(opts);
   if (method !== "pairing") await wallet.waitForAuthentication({}).catch(() => {
   });
-  const { publicKey: identityKey } = await wallet.getPublicKey({ identityKey: true });
-  const c = await opts.challenge(identityKey);
-  const { signature } = await wallet.createSignature({
-    protocolID: c.protocolID ?? LOGIN_PROTOCOL,
-    keyID: c.keyID,
-    counterparty: "anyone",
-    data: Array.from(new TextEncoder().encode(c.message))
-  });
+  const { publicKey: identityKey } = await atStage("identity", () => wallet.getPublicKey({ identityKey: true }));
+  try {
+    opts.onStatus?.("signing");
+  } catch {
+  }
+  const c = await atStage("challenge", () => opts.challenge(identityKey));
+  const { signature } = await atStage(
+    "signature",
+    () => wallet.createSignature({
+      protocolID: c.protocolID ?? LOGIN_PROTOCOL,
+      keyID: c.keyID,
+      counterparty: "anyone",
+      data: Array.from(new TextEncoder().encode(c.message))
+    })
+  );
   return { identityKey, signature: Array.from(signature), nonce: c.nonce, method, wallet };
 }
+async function atStage(stage, run) {
+  try {
+    return await run();
+  } catch (e) {
+    const err = e instanceof Error ? e : new Error(String(e));
+    if (!err.stage) Object.assign(err, { stage });
+    throw err;
+  }
+}
 
 // src/modal.ts
 var import_qrcode_generator = __toESM(require("qrcode-generator"), 1);
-var CSS = `
-.bwx-ov{position:fixed;inset:0;z-index:2147483000;background:rgba(0,0,0,.6);display:flex;align-items:center;justify-content:center;padding:16px;font:15px/1.4 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
-.bwx-box{background:#0b0b0b;color:#f4f1e8;border:1px solid #3a3220;border-radius:16px;width:min(360px,100%);padding:20px;box-shadow:0 20px 60px rgba(0,0,0,.5)}
-.bwx-box h2{margin:0 0 6px;font-size:18px;color:#e8c766}
-.bwx-box p{margin:0 0 14px;color:#bdb6a3;font-size:14px}
-.bwx-qr{background:#fff;border-radius:12px;padding:12px;display:flex;justify-content:center}
-.bwx-qr svg{width:100%;height:auto;max-width:260px}
-.bwx-code{margin:14px 0 0;text-align:center;font-size:28px;letter-spacing:.3em;color:#e8c766;font-variant-numeric:tabular-nums}
-.bwx-row{display:flex;gap:8px;margin-top:14px}
-.bwx-btn{flex:1;border:1px solid #3a3220;background:#15130e;color:#f4f1e8;border-radius:10px;padding:10px 12px;font:inherit;cursor:pointer}
-.bwx-btn:hover{border-color:#e8c766}
-.bwx-list{display:flex;flex-direction:column;gap:8px}
-.bwx-opt{display:flex;align-items:center;gap:10px;text-align:left}
-.bwx-opt img{width:24px;height:24px;border-radius:6px}
-.bwx-tag{margin-left:auto;font-size:11px;color:#8d866f}
-`;
-function mount() {
-  const root = document.createElement("div");
-  root.className = "bwx-ov";
-  root.setAttribute("role", "dialog");
-  root.setAttribute("aria-modal", "true");
-  const style = document.createElement("style");
-  style.textContent = CSS;
-  const box = document.createElement("div");
-  box.className = "bwx-box";
-  root.append(style, box);
-  document.body.appendChild(root);
-  return { root, box, close: () => root.remove() };
-}
-function el(tag, cls, text) {
-  const e = document.createElement(tag);
-  if (cls) e.className = cls;
-  if (text != null) e.textContent = text;
-  return e;
+
+// src/access-client.ts
+var import_sdk4 = require("@bsv/sdk");
+
+// src/access.ts
+var ACCESS_PROTOCOL = [2, "bwalletx access"];
+var MAX_HOLDING_PROOFS = 50;
+var AccessError = class extends Error {
+  code;
+  have;
+  need;
+  constructor(code, message, extra = {}) {
+    super(message ?? code);
+    this.name = "AccessError";
+    this.code = code;
+    this.have = extra.have;
+    this.need = extra.need;
+  }
+  toJSON() {
+    const b = { error: this.code, message: this.message };
+    if (this.have !== void 0) b.have = this.have;
+    if (this.need !== void 0) b.need = this.need;
+    return b;
+  }
+};
+function canonicalJson(v) {
+  if (v === null) return "null";
+  if (typeof v === "string" || typeof v === "boolean") return JSON.stringify(v);
+  if (typeof v === "number") {
+    if (!Number.isFinite(v)) throw new Error("canonicalJson: non-finite number");
+    return JSON.stringify(v);
+  }
+  if (Array.isArray(v)) return `[${v.map((x) => canonicalJson(x)).join(",")}]`;
+  if (typeof v === "object") {
+    const o = v;
+    const keys = Object.keys(o).filter((k) => o[k] !== void 0).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
+  }
+  throw new Error(`canonicalJson: unsupported ${typeof v}`);
 }
-function qrSvg(text) {
-  const q = (0, import_qrcode_generator.default)(0, "M");
-  q.addData(text);
-  q.make();
-  return q.createSvgTag({ cellSize: 4, margin: 2, scalable: true });
+function challengeBytes(challenge) {
+  return Array.from(new TextEncoder().encode(challenge));
 }
-function pairingModal(o = {}) {
-  const ac = new AbortController();
-  let ui = null;
-  let codeEl = null;
-  const close = () => {
-    ui?.close();
-    ui = null;
-  };
-  ac.signal.addEventListener("abort", close);
-  return {
-    signal: ac.signal,
-    close,
-    onLink(link) {
-      if (typeof document === "undefined") return;
-      close();
-      ui = mount();
-      const h = el("h2", "", o.title ?? "Connect bWalletX");
-      const p = el("p", "", "Scan with bWalletX on your phone, or paste the link into web.bwalletx.com.");
-      const qr = el("div", "bwx-qr");
-      qr.innerHTML = qrSvg(link);
-      codeEl = el("div", "bwx-code", "");
-      codeEl.setAttribute("aria-live", "polite");
-      const row = el("div", "bwx-row");
-      const copy = el("button", "bwx-btn", "Copy link");
-      copy.onclick = () => void navigator.clipboard?.writeText(link).then(() => copy.textContent = "Copied");
-      const cancel = el("button", "bwx-btn", "Cancel");
-      cancel.onclick = () => {
-        o.onCancel?.();
-        ac.abort();
-      };
-      row.append(copy, cancel);
-      ui.box.append(h, p, qr, codeEl, row);
-    },
-    onCode(code) {
-      if (codeEl) {
-        codeEl.textContent = code;
-        const p = ui?.box.querySelector("p");
-        if (p) p.textContent = "Check bWalletX shows the same code, then tap Connect.";
+var TOKEN_ID = /^bsv21:[0-9a-f]{64}_\d{1,6}$/;
+var RAW = /^[1-9]\d{0,38}$/;
+function normaliseRequirement(r) {
+  if (!r || typeof r !== "object") throw new AccessError("bad_request", "require must be an object");
+  const req = r;
+  const out = {};
+  if (req.token !== void 0) {
+    const t = req.token;
+    if (!t || typeof t !== "object" || typeof t.id !== "string") throw new AccessError("bad_request", "require.token.id is required");
+    const id = t.id.trim().toLowerCase();
+    if (!TOKEN_ID.test(id)) throw new AccessError("bad_request", "require.token.id must be 'bsv21:<txid>_<vout>'");
+    const hasMin = t.min !== void 0;
+    const hasBps = t.minBps !== void 0;
+    if (hasMin === hasBps) throw new AccessError("bad_request", "require.token needs exactly one of min or minBps");
+    out.token = { id };
+    if (hasMin) {
+      if (typeof t.min !== "string" || !RAW.test(t.min)) throw new AccessError("bad_request", "require.token.min must be a positive integer string (raw units)");
+      out.token.min = t.min;
+    } else {
+      if (!Number.isInteger(t.minBps) || t.minBps < 1 || t.minBps > 1e4) {
+        throw new AccessError("bad_request", "require.token.minBps must be an integer 1..10000");
       }
+      out.token.minBps = t.minBps;
     }
-  };
-}
-function pickWallet(options, o = {}) {
-  if (typeof document === "undefined") return Promise.resolve(null);
-  return new Promise((resolve) => {
-    const ui = mount();
-    const done = (w) => {
-      ui.close();
-      resolve(w);
-    };
-    ui.box.append(el("h2", "", o.title ?? "Choose a wallet"));
-    if (!options.length) ui.box.append(el("p", "", "No wallet found. Get bWalletX at bwalletx.com."));
-    const list = el("div", "bwx-list");
-    for (const w of options) {
-      const b = el("button", "bwx-btn bwx-opt");
-      if (w.icon) {
-        const img = el("img");
-        img.src = w.icon;
-        img.alt = "";
-        b.append(img);
-      }
-      b.append(el("span", "", w.name));
-      if (w.kind === "handcash") b.append(el("span", "bwx-tag", "until BRC-100"));
-      b.onclick = () => done(w);
-      list.append(b);
+  }
+  if (req.identityLevel !== void 0) {
+    if (!Number.isInteger(req.identityLevel) || req.identityLevel < 1 || req.identityLevel > 10) {
+      throw new AccessError("bad_request", "require.identityLevel must be an integer 1..10");
     }
-    const cancel = el("button", "bwx-btn", "Cancel");
-    cancel.onclick = () => done(null);
-    ui.root.onclick = (e) => e.target === ui.root && done(null);
-    ui.box.append(list, el("div", "bwx-row"));
-    ui.box.lastChild.append(cancel);
-  });
+    out.identityLevel = req.identityLevel;
+  }
+  if (req.kyc !== void 0) {
+    if (typeof req.kyc !== "boolean") throw new AccessError("bad_request", "require.kyc must be a boolean");
+    if (req.kyc) out.kyc = true;
+  }
+  if (!out.token && !out.identityLevel && !out.kyc) throw new AccessError("bad_request", "require is empty");
+  return out;
+}
+function parseAccessChallenge(s) {
+  if (typeof s !== "string" || s.length > 4096) throw new AccessError("bad_request", "challenge must be a string");
+  let c;
+  try {
+    c = JSON.parse(s);
+  } catch {
+    throw new AccessError("bad_request", "challenge is not JSON");
+  }
+  if (!c || typeof c !== "object" || c.v !== 1) throw new AccessError("bad_request", "unsupported challenge version");
+  if (c.kind !== "401" && c.kind !== "402" && c.kind !== "403") throw new AccessError("bad_request", "bad kind");
+  if (typeof c.origin !== "string" || typeof c.nonce !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(c.nonce)) {
+    throw new AccessError("bad_request", "bad origin or nonce");
+  }
+  if (!Number.isInteger(c.iat) || !Number.isInteger(c.exp) || c.exp <= c.iat) throw new AccessError("bad_request", "bad iat/exp");
+  if (c.sub !== void 0 && (typeof c.sub !== "string" || !/^0[23][0-9a-f]{64}$/.test(c.sub))) throw new AccessError("bad_request", "bad sub");
+  c.require = normaliseRequirement(c.require);
+  if (canonicalJson(c) !== s) throw new AccessError("bad_request", "challenge is not canonical");
+  return c;
 }
 
-// src/wallets.ts
-var import_sdk3 = require("@bsv/sdk");
-async function brc100Connected(wallet, o) {
-  await wallet.waitForAuthentication({}).catch(() => {
-  });
-  const { publicKey } = await wallet.getPublicKey({ identityKey: true });
-  return { wallet, payer: wallet, identityKey: publicKey, optionId: o.id, kind: o.kind };
+// src/access-client.ts
+var ONESAT = [0, "onesat"];
+var LEGACY_ONESAT = [0, "p 1sat"];
+function toAccessError(e) {
+  if (e instanceof AccessError) return e;
+  const err = e;
+  const msg = String(err?.message ?? e ?? "");
+  if (err?.code === "NOT_FOUND") return new AccessError("not_installed", msg);
+  if (/reject|denied|declin|cancel|user/i.test(msg) || err?.code === "ERR_USER_REJECTED" || err?.status === 4001) {
+    return new AccessError("user_rejected", msg);
+  }
+  return new AccessError("bad_request", msg || "access failed");
 }
-function brc100Option(wallet, info) {
-  const opt = {
-    id: info.id,
-    name: info.name,
-    icon: info.icon,
-    rdns: info.rdns,
-    kind: "brc100",
-    isBwalletX: info.isBwalletX ?? false,
-    connect: () => brc100Connected(wallet, opt)
-  };
-  return opt;
+function throwIfAccessError(body) {
+  const b = body;
+  if (b && typeof b.error === "string") throw new AccessError(b.error, b.message, { have: b.have, need: b.need });
 }
-function pairingOption(pairing) {
-  const opt = {
-    id: "bwalletx-pairing",
-    name: "bWalletX on your phone",
-    kind: "pairing",
-    isBwalletX: true,
-    async connect() {
-      const p = typeof pairing === "function" ? pairing() : pairing;
-      const w = await restorePairing(p) ?? await pairBwalletX(p);
-      return brc100Connected(w, opt);
-    }
-  };
-  return opt;
+function hash160FromP2pkh(script) {
+  const m = /^76a914([0-9a-f]{40})88ac$/i.exec(script.slice(-50));
+  return m ? m[1].toLowerCase() : null;
 }
-function handcashAdapter(o) {
-  const opt = {
-    id: "handcash",
-    name: "HandCash",
-    icon: o.icon,
-    kind: "handcash",
-    isBwalletX: false,
-    async connect() {
-      const p = await o.login();
-      return {
-        wallet: null,
-        payer: o.pay ? { pay: o.pay } : null,
-        identityKey: p.identityKey ?? null,
-        handle: p.handle,
-        paymail: p.paymail ?? `${p.handle.replace(/^\$/, "")}@handcash.io`,
-        optionId: opt.id,
-        kind: "handcash",
-        transitional: true
-      };
+async function proveHoldings(wallet, challenge, tokenId, basket = "bsv21") {
+  const bare = tokenId.replace(/^bsv21:/, "");
+  const list = await wallet.listOutputs({ basket, include: "locking scripts", includeCustomInstructions: true, limit: 1e4 });
+  const byKey = /* @__PURE__ */ new Map();
+  const data = challengeBytes(challenge);
+  for (const out of list.outputs) {
+    if (byKey.size >= MAX_HOLDING_PROOFS) break;
+    let ci = {};
+    try {
+      ci = JSON.parse(out.customInstructions ?? "{}");
+    } catch {
+      continue;
     }
-  };
-  return opt;
-}
-var NAMES = { [RDNS_EXTENSION]: "bWalletX", "space.bwallet.mobile": "bWalletX" };
-async function probe(substrate, ms) {
-  try {
-    const w = new import_sdk3.WalletClient(substrate);
-    const ok = await Promise.race([w.isAuthenticated({}).then(() => true), new Promise((r) => setTimeout(() => r(false), ms))]);
-    return ok ? w : null;
-  } catch {
-    return null;
-  }
-}
-async function discoverWallets(o = {}) {
-  const out = [];
-  const ms = o.ms ?? 1200;
-  if (typeof window !== "undefined") {
-    const seen = /* @__PURE__ */ new Map();
-    const onAnnounce = (e) => {
-      const d = e.detail;
-      if (!d?.wallet) return;
-      const rdns = d.info?.rdns ?? d.info?.uuid ?? `wallet-${seen.size}`;
-      if (seen.has(rdns)) return;
-      const isB = BWALLETX_RDNS.includes(rdns);
-      seen.set(rdns, brc100Option(d.wallet, { id: rdns, rdns, name: NAMES[rdns] ?? d.info?.name ?? rdns, icon: d.info?.icon, isBwalletX: isB }));
-    };
-    window.addEventListener("brc100:announceWallet", onAnnounce);
-    window.dispatchEvent(new Event("brc100:requestWallet"));
-    const local = o.probeLocal ? Promise.all([probe("json-api", ms), probe("Cicada", ms)]) : Promise.resolve([null, null]);
-    await new Promise((r) => setTimeout(r, ms));
-    window.removeEventListener("brc100:announceWallet", onAnnounce);
-    out.push(...seen.values());
-    const cwi = window.CWI;
-    if (cwi && ![...seen.values()].some((x) => x.rdns === "space.bwallet.mobile")) {
-      out.push(brc100Option(cwi, { id: "window.CWI", name: "This app\u2019s wallet", isBwalletX: false }));
+    if (ci.id !== bare || !ci.keyID) continue;
+    const want = out.lockingScript ? hash160FromP2pkh(out.lockingScript) : null;
+    const counterparty = ci.counterparty ?? "self";
+    for (const protocolID of ci.protocolID ? [ci.protocolID] : [ONESAT, LEGACY_ONESAT]) {
+      const { publicKey } = await wallet.getPublicKey({ protocolID, keyID: ci.keyID, counterparty });
+      const h = import_sdk4.Utils.toHex(import_sdk4.Hash.hash160(import_sdk4.PublicKey.fromString(publicKey).encode(true)));
+      if (want && h !== want) continue;
+      const existing = byKey.get(publicKey);
+      if (existing) {
+        existing.outpoints.push(out.outpoint.replace(".", "_"));
+        break;
+      }
+      const { signature } = await wallet.createSignature({ protocolID, keyID: ci.keyID, counterparty, data });
+      byKey.set(publicKey, { pubkey: publicKey, signature: Array.from(signature), outpoints: [out.outpoint.replace(".", "_")] });
+      break;
     }
-    const [json, cicada] = await local;
-    if (json) out.push(brc100Option(json, { id: "localhost:3321", name: "Desktop wallet (localhost:3321)" }));
-    if (cicada) out.push(brc100Option(cicada, { id: "localhost:3301", name: "Desktop wallet (localhost:3301)" }));
-  }
-  if (o.pairing) out.push(pairingOption(o.pairing));
-  out.push(...o.extra ?? []);
-  const rank = (w) => w.isBwalletX ? 0 : w.kind === "handcash" ? 2 : 1;
-  return out.map((w, i) => ({ w, i })).sort((a, b) => rank(a.w) - rank(b.w) || a.i - b.i).map((x) => x.w);
-}
-
-// src/pay.ts
-var import_sdk4 = require("@bsv/sdk");
-var BRC29_PROTOCOL = [2, "3241645161d8"];
-var PaymentError = class extends Error {
-  constructor(code, message, maybeSent = false, cause) {
-    super(message);
-    this.code = code;
-    this.maybeSent = maybeSent;
-    this.cause = cause;
-    this.name = "PaymentError";
-  }
-  code;
-  maybeSent;
-  cause;
-};
-var isLegacy = (s) => typeof s.pay === "function" && typeof s.createAction !== "function";
-var isIdentityKeyHex = (s) => /^0[23][0-9a-fA-F]{64}$/.test(s);
-var isPaymail = (s) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
-function randomB64(n) {
-  const b = new Uint8Array(n);
-  globalThis.crypto.getRandomValues(b);
-  return import_sdk4.Utils.toBase64(Array.from(b));
-}
-function opReturn(text) {
-  const d = import_sdk4.Utils.toArray(text, "utf8");
-  const len = d.length;
-  const push = len < 76 ? [len] : len <= 255 ? [76, len] : [77, len & 255, len >> 8];
-  return import_sdk4.Utils.toHex([0, 106, ...push, ...d]);
-}
-var clip = (s, n) => s.length > n ? s.slice(0, n - 1) + "\u2026" : s;
-var describe = (s) => clip(s.length < 5 ? `${s} payment`.trim() : s, 50);
-async function usdRate(o) {
-  if (typeof o.usdPerBsv === "number") return o.usdPerBsv;
-  try {
-    if (typeof o.usdPerBsv === "function") return await o.usdPerBsv();
-    const r = await (o.fetch ?? fetch)("https://api.whatsonchain.com/v1/bsv/main/exchangerate");
-    const j = await r.json();
-    if (!r.ok || !(Number(j.rate) > 0)) throw new Error(`status ${r.status}`);
-    return Number(j.rate);
-  } catch (e) {
-    throw new PaymentError("RATE_FAILED", `Could not get the BSV/USD rate: ${e.message}`, false, e);
-  }
-}
-async function amountInSats(req, o = {}) {
-  if (req.sats != null) {
-    if (!Number.isSafeInteger(req.sats) || req.sats <= 0) throw new PaymentError("BAD_REQUEST", "sats must be a positive integer");
-    return req.sats;
-  }
-  if (req.usd != null) {
-    if (!(req.usd > 0)) throw new PaymentError("BAD_REQUEST", "usd must be positive");
-    return Math.max(1, Math.ceil(req.usd / await usdRate(o) * 1e8));
   }
-  throw new PaymentError("BAD_REQUEST", "Give sats or usd");
+  return [...byKey.values()];
 }
-async function resolvePaymailP2P(paymail, sats, f = fetch) {
-  const [alias, domain] = paymail.split("@");
-  const fail = (m, e) => new PaymentError("RESOLVE_FAILED", `Could not resolve ${paymail}: ${m}`, false, e);
-  let caps;
-  try {
-    const r = await f(`https://${domain}/.well-known/bsvalias`);
-    caps = (await r.json()).capabilities;
-  } catch (e) {
-    throw fail("no bsvalias document (or CORS blocked it; resolve on your server and pass resolvePaymail)", e);
-  }
-  const fill = (u) => u.replace("{alias}", encodeURIComponent(alias)).replace("{domain.tld}", domain);
-  const dest = caps?.["2a40af698840"];
-  if (!dest) throw fail("it does not offer P2P payment destinations");
-  let body;
+async function requestAccess(o) {
+  let wallet;
   try {
-    const r = await f(fill(dest), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ satoshis: sats }) });
-    if (!r.ok) throw new Error(`status ${r.status}`);
-    body = await r.json();
+    ({ wallet } = await connectBwalletX({ wallet: o.wallet, pairing: o.pairing, discoverMs: o.discoverMs }));
   } catch (e) {
-    throw fail(e.message, e);
+    throw e?.code === "NOT_FOUND" ? new AccessError("not_installed") : toAccessError(e);
   }
-  if (!body.outputs?.length) throw fail("no outputs returned");
-  const receive = caps["5f1323cddf31"];
-  return {
-    outputs: body.outputs.map((o) => ({ script: o.script, satoshis: o.satoshis })),
-    reference: body.reference,
-    submit: receive ? async (hex) => {
-      await f(fill(receive), {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ hex, reference: body.reference, metadata: {} })
-      });
-    } : void 0
-  };
-}
-async function runAction(wallet, description, outputs, labels) {
   try {
-    return await wallet.createAction({
-      description: describe(description),
-      outputs: outputs.map((o) => ({ lockingScript: o.script, satoshis: o.satoshis, outputDescription: describe(o.description ?? "payment") })),
-      labels: labels?.length ? labels : void 0,
-      options: { randomizeOutputs: false }
+    const { publicKey: identityKey } = await wallet.getPublicKey({ identityKey: true });
+    const { challenge } = await o.challenge(identityKey);
+    const c = parseAccessChallenge(challenge);
+    if (c.sub && c.sub !== identityKey.toLowerCase()) throw new AccessError("wrong_account");
+    if (Date.now() / 1e3 >= c.exp) throw new AccessError("expired");
+    const { signature } = await wallet.createSignature({
+      protocolID: ACCESS_PROTOCOL,
+      keyID: c.nonce,
+      counterparty: "anyone",
+      data: challengeBytes(challenge)
     });
+    const response = { v: 1, challenge, identityKey, signature: Array.from(signature) };
+    if (c.require.token) response.holdings = await proveHoldings(wallet, challenge, c.require.token.id, o.tokenBasket);
+    let verified;
+    if (o.verify) {
+      verified = await o.verify(response);
+      throwIfAccessError(verified);
+    }
+    return { response, verified, wallet };
   } catch (e) {
-    const msg = e?.message ?? String(e);
-    const rejected = /denied|reject|cancel|abort|user/i.test(msg) || e?.code === 4001;
-    throw new PaymentError(rejected ? "WALLET_REJECTED" : "WALLET_ERROR", rejected ? "The payment was declined in the wallet." : `The wallet could not make the payment: ${msg}`, !rejected, e);
-  }
-}
-async function pay(source, req, o = {}) {
-  const to = (req.to ?? "").trim();
-  if (!to) throw new PaymentError("BAD_REQUEST", "Give a recipient (to)");
-  if (req.memo && req.memo.length > 1e3) throw new PaymentError("BAD_REQUEST", "memo is too long");
-  const sats = await amountInSats(req, o);
-  if (isLegacy(source)) return source.pay({ ...req, to, sats });
-  let outputs;
-  let remittance;
-  let submit;
-  if (isIdentityKeyHex(to)) {
-    const derivationPrefix = randomB64(8);
-    const derivationSuffix = randomB64(8);
-    let pk;
-    let me;
-    try {
-      ({ publicKey: pk } = await source.getPublicKey({ protocolID: BRC29_PROTOCOL, keyID: `${derivationPrefix} ${derivationSuffix}`, counterparty: to.toLowerCase() }));
-      ({ publicKey: me } = await source.getPublicKey({ identityKey: true }));
-    } catch (e) {
-      throw new PaymentError("WALLET_ERROR", `The wallet could not derive the payment key: ${e.message}`, false, e);
-    }
-    outputs = [{ script: new import_sdk4.P2PKH().lock(import_sdk4.PublicKey.fromString(pk).toHash()).toHex(), satoshis: sats, description: "payment" }];
-    remittance = { senderIdentityKey: me, derivationPrefix, derivationSuffix, outputIndex: 0 };
-  } else if (isPaymail(to)) {
-    const r2 = await (o.resolvePaymail ?? ((p, s) => resolvePaymailP2P(p, s, o.fetch ?? fetch)))(to, sats);
-    outputs = r2.outputs;
-    submit = r2.submit;
-  } else {
-    try {
-      outputs = [{ script: new import_sdk4.P2PKH().lock(to).toHex(), satoshis: sats, description: "payment" }];
-    } catch {
-      throw new PaymentError("BAD_REQUEST", `Not a paymail, address or identity key: ${to}`);
-    }
-  }
-  if (req.memo && req.memoOnChain) outputs = [...outputs, { script: opReturn(req.memo), satoshis: 0, description: "memo" }];
-  const r = await runAction(source, req.memo || `Pay ${clip(to, 30)}`, outputs, req.labels);
-  if (!r.txid) throw new PaymentError("WALLET_ERROR", "The wallet did not return a txid", true);
-  const tx = r.tx ? Array.from(r.tx) : void 0;
-  if (submit && tx) {
-    await submit(import_sdk4.Transaction.fromAtomicBEEF(tx).toHex()).catch(() => {
-    });
-  }
-  return { txid: r.txid, tx, sats, outputs, remittance };
-}
-function tip(source, req, o = {}) {
-  return pay(source, { memo: "Tip", ...req, labels: [...req.labels ?? [], "tip"] }, o);
-}
-async function buyToken(source, req) {
-  if (isLegacy(source)) throw new PaymentError("NOT_SUPPORTED", "This wallet cannot buy tokens. Use a BRC-100 wallet such as bWalletX.");
-  const q = await req.quote({ token: req.token, amount: req.amount });
-  if (!q?.outputs?.length) throw new PaymentError("BAD_REQUEST", "The quote returned no outputs");
-  const sats = q.outputs.reduce((n, x) => n + x.satoshis, 0);
-  const r = await runAction(source, q.description ?? `Buy ${clip(req.token, 30)}`, q.outputs, [...req.labels ?? [], "token-buy"]);
-  if (!r.txid) throw new PaymentError("WALLET_ERROR", "The wallet did not return a txid", true);
-  const res = { txid: r.txid, tx: r.tx ? Array.from(r.tx) : void 0, sats, outputs: q.outputs };
-  await q.onPaid?.(res);
-  return res;
-}
-
-// src/access-client.ts
-var import_sdk5 = require("@bsv/sdk");
-
-// src/access.ts
-var ACCESS_PROTOCOL = [2, "bwalletx access"];
-var MAX_HOLDING_PROOFS = 50;
-var AccessError = class extends Error {
-  code;
-  have;
-  need;
-  constructor(code, message, extra = {}) {
-    super(message ?? code);
-    this.name = "AccessError";
-    this.code = code;
-    this.have = extra.have;
-    this.need = extra.need;
-  }
-  toJSON() {
-    const b = { error: this.code, message: this.message };
-    if (this.have !== void 0) b.have = this.have;
-    if (this.need !== void 0) b.need = this.need;
-    return b;
-  }
-};
-function canonicalJson(v) {
-  if (v === null) return "null";
-  if (typeof v === "string" || typeof v === "boolean") return JSON.stringify(v);
-  if (typeof v === "number") {
-    if (!Number.isFinite(v)) throw new Error("canonicalJson: non-finite number");
-    return JSON.stringify(v);
-  }
-  if (Array.isArray(v)) return `[${v.map((x) => canonicalJson(x)).join(",")}]`;
-  if (typeof v === "object") {
-    const o = v;
-    const keys = Object.keys(o).filter((k) => o[k] !== void 0).sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`).join(",")}}`;
-  }
-  throw new Error(`canonicalJson: unsupported ${typeof v}`);
-}
-function challengeBytes(challenge) {
-  return Array.from(new TextEncoder().encode(challenge));
-}
-var TOKEN_ID = /^bsv21:[0-9a-f]{64}_\d{1,6}$/;
-var RAW = /^[1-9]\d{0,38}$/;
-function normaliseRequirement(r) {
-  if (!r || typeof r !== "object") throw new AccessError("bad_request", "require must be an object");
-  const req = r;
-  const out = {};
-  if (req.token !== void 0) {
-    const t = req.token;
-    if (!t || typeof t !== "object" || typeof t.id !== "string") throw new AccessError("bad_request", "require.token.id is required");
-    const id = t.id.trim().toLowerCase();
-    if (!TOKEN_ID.test(id)) throw new AccessError("bad_request", "require.token.id must be 'bsv21:<txid>_<vout>'");
-    const hasMin = t.min !== void 0;
-    const hasBps = t.minBps !== void 0;
-    if (hasMin === hasBps) throw new AccessError("bad_request", "require.token needs exactly one of min or minBps");
-    out.token = { id };
-    if (hasMin) {
-      if (typeof t.min !== "string" || !RAW.test(t.min)) throw new AccessError("bad_request", "require.token.min must be a positive integer string (raw units)");
-      out.token.min = t.min;
-    } else {
-      if (!Number.isInteger(t.minBps) || t.minBps < 1 || t.minBps > 1e4) {
-        throw new AccessError("bad_request", "require.token.minBps must be an integer 1..10000");
-      }
-      out.token.minBps = t.minBps;
-    }
-  }
-  if (req.identityLevel !== void 0) {
-    if (!Number.isInteger(req.identityLevel) || req.identityLevel < 1 || req.identityLevel > 10) {
-      throw new AccessError("bad_request", "require.identityLevel must be an integer 1..10");
-    }
-    out.identityLevel = req.identityLevel;
-  }
-  if (req.kyc !== void 0) {
-    if (typeof req.kyc !== "boolean") throw new AccessError("bad_request", "require.kyc must be a boolean");
-    if (req.kyc) out.kyc = true;
-  }
-  if (!out.token && !out.identityLevel && !out.kyc) throw new AccessError("bad_request", "require is empty");
-  return out;
-}
-function parseAccessChallenge(s) {
-  if (typeof s !== "string" || s.length > 4096) throw new AccessError("bad_request", "challenge must be a string");
-  let c;
-  try {
-    c = JSON.parse(s);
-  } catch {
-    throw new AccessError("bad_request", "challenge is not JSON");
-  }
-  if (!c || typeof c !== "object" || c.v !== 1) throw new AccessError("bad_request", "unsupported challenge version");
-  if (c.kind !== "401" && c.kind !== "402" && c.kind !== "403") throw new AccessError("bad_request", "bad kind");
-  if (typeof c.origin !== "string" || typeof c.nonce !== "string" || !/^[A-Za-z0-9_-]{16,64}$/.test(c.nonce)) {
-    throw new AccessError("bad_request", "bad origin or nonce");
-  }
-  if (!Number.isInteger(c.iat) || !Number.isInteger(c.exp) || c.exp <= c.iat) throw new AccessError("bad_request", "bad iat/exp");
-  if (c.sub !== void 0 && (typeof c.sub !== "string" || !/^0[23][0-9a-f]{64}$/.test(c.sub))) throw new AccessError("bad_request", "bad sub");
-  c.require = normaliseRequirement(c.require);
-  if (canonicalJson(c) !== s) throw new AccessError("bad_request", "challenge is not canonical");
-  return c;
-}
-
-// src/access-client.ts
-var ONESAT = [0, "onesat"];
-var LEGACY_ONESAT = [0, "p 1sat"];
-function toAccessError(e) {
-  if (e instanceof AccessError) return e;
-  const err = e;
-  const msg = String(err?.message ?? e ?? "");
-  if (err?.code === "NOT_FOUND") return new AccessError("not_installed", msg);
-  if (/reject|denied|declin|cancel|user/i.test(msg) || err?.code === "ERR_USER_REJECTED" || err?.status === 4001) {
-    return new AccessError("user_rejected", msg);
-  }
-  return new AccessError("bad_request", msg || "access failed");
-}
-function throwIfAccessError(body) {
-  const b = body;
-  if (b && typeof b.error === "string") throw new AccessError(b.error, b.message, { have: b.have, need: b.need });
-}
-function hash160FromP2pkh(script) {
-  const m = /^76a914([0-9a-f]{40})88ac$/i.exec(script.slice(-50));
-  return m ? m[1].toLowerCase() : null;
-}
-async function proveHoldings(wallet, challenge, tokenId, basket = "bsv21") {
-  const bare = tokenId.replace(/^bsv21:/, "");
-  const list = await wallet.listOutputs({ basket, include: "locking scripts", includeCustomInstructions: true, limit: 1e4 });
-  const byKey = /* @__PURE__ */ new Map();
-  const data = challengeBytes(challenge);
-  for (const out of list.outputs) {
-    if (byKey.size >= MAX_HOLDING_PROOFS) break;
-    let ci = {};
-    try {
-      ci = JSON.parse(out.customInstructions ?? "{}");
-    } catch {
-      continue;
-    }
-    if (ci.id !== bare || !ci.keyID) continue;
-    const want = out.lockingScript ? hash160FromP2pkh(out.lockingScript) : null;
-    const counterparty = ci.counterparty ?? "self";
-    for (const protocolID of ci.protocolID ? [ci.protocolID] : [ONESAT, LEGACY_ONESAT]) {
-      const { publicKey } = await wallet.getPublicKey({ protocolID, keyID: ci.keyID, counterparty });
-      const h = import_sdk5.Utils.toHex(import_sdk5.Hash.hash160(import_sdk5.PublicKey.fromString(publicKey).encode(true)));
-      if (want && h !== want) continue;
-      const existing = byKey.get(publicKey);
-      if (existing) {
-        existing.outpoints.push(out.outpoint.replace(".", "_"));
-        break;
-      }
-      const { signature } = await wallet.createSignature({ protocolID, keyID: ci.keyID, counterparty, data });
-      byKey.set(publicKey, { pubkey: publicKey, signature: Array.from(signature), outpoints: [out.outpoint.replace(".", "_")] });
-      break;
-    }
-  }
-  return [...byKey.values()];
-}
-async function requestAccess(o) {
-  let wallet;
-  try {
-    ({ wallet } = await connectBwalletX({ wallet: o.wallet, pairing: o.pairing, discoverMs: o.discoverMs }));
-  } catch (e) {
-    throw e?.code === "NOT_FOUND" ? new AccessError("not_installed") : toAccessError(e);
-  }
-  try {
-    const { publicKey: identityKey } = await wallet.getPublicKey({ identityKey: true });
-    const { challenge } = await o.challenge(identityKey);
-    const c = parseAccessChallenge(challenge);
-    if (c.sub && c.sub !== identityKey.toLowerCase()) throw new AccessError("wrong_account");
-    if (Date.now() / 1e3 >= c.exp) throw new AccessError("expired");
-    const { signature } = await wallet.createSignature({
-      protocolID: ACCESS_PROTOCOL,
-      keyID: c.nonce,
-      counterparty: "anyone",
-      data: challengeBytes(challenge)
-    });
-    const response = { v: 1, challenge, identityKey, signature: Array.from(signature) };
-    if (c.require.token) response.holdings = await proveHoldings(wallet, challenge, c.require.token.id, o.tokenBasket);
-    let verified;
-    if (o.verify) {
-      verified = await o.verify(response);
-      throwIfAccessError(verified);
-    }
-    return { response, verified, wallet };
-  } catch (e) {
-    throw toAccessError(e);
+    throw toAccessError(e);
   }
 }
 
@@ -1114,144 +892,554 @@ async function buildAuthorizeUrl(p) {
   set("code_challenge", b64url2(digest));
   set("code_challenge_method", "S256");
   try {
-    sessionStorage.setItem("bwalletx:oauth", JSON.stringify({ verifier, state, nonce }));
-  } catch {
+    sessionStorage.setItem("bwalletx:oauth", JSON.stringify({ verifier, state, nonce }));
+  } catch {
+  }
+  return u.toString();
+}
+async function postJson(url, body) {
+  const res = await fetch(url, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.error ?? `HTTP ${res.status}`);
+  return data;
+}
+async function postAccess(url, body) {
+  const res = await fetch(url, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+  return res.json().catch(() => ({ error: "bad_request", message: `HTTP ${res.status}` }));
+}
+var OBSERVED = ["size", "theme", "label", "brand", "subtitle", "loading", "disabled", "full-width", "aria-label", "get-url", "web-url"];
+function createClass() {
+  return class BwalletxSigninElement extends HTMLElement {
+    static get observedAttributes() {
+      return OBSERVED;
+    }
+    #root;
+    #notFound = false;
+    #busy = false;
+    constructor() {
+      super();
+      this.#root = this.attachShadow({ mode: "open" });
+    }
+    connectedCallback() {
+      this.#render();
+    }
+    attributeChangedCallback() {
+      if (this.isConnected) this.#render();
+    }
+    /** The inner <button>, for focus() and tests. */
+    get button() {
+      return this.#root.querySelector("button");
+    }
+    get notFound() {
+      return this.#notFound;
+    }
+    focus(opts) {
+      this.button?.focus(opts);
+    }
+    #attr(name) {
+      return this.getAttribute(name);
+    }
+    #render() {
+      const size = this.#attr("size") ?? "lg";
+      const brand = this.#attr("brand") === "bWallet" ? "bWallet" : "bWalletX";
+      const text = signinText(this.#attr("label") ?? "signin", brand);
+      const subAttr = this.#attr("subtitle");
+      const subDefault = brand === "bWalletX" && (size === "lg" || size === "md") ? "also works with bWallet" : null;
+      const subtitle = subAttr === null || subAttr === "" || subAttr === "on" ? subAttr === "on" ? "also works with bWallet" : subDefault : subAttr === "off" ? null : subAttr;
+      const loading = this.hasAttribute("loading") || this.#busy;
+      const disabled = this.hasAttribute("disabled");
+      const markPx = size === "icon" ? 24 : size === "sm" ? 15 : size === "md" ? 17 : 20;
+      const aria = this.#attr("aria-label") ?? (subtitle && size !== "icon" ? `${text}, ${subtitle}` : text);
+      const getUrl = this.#attr("get-url") ?? GET_URL;
+      const webUrl = this.#attr("web-url") ?? WEB_WALLET_URL;
+      const esc = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
+      const label = size === "icon" ? "" : `<span class="txt" part="text"><b part="label">${esc(text)}</b>${subtitle ? `<small part="subtitle">${esc(subtitle)}</small>` : ""}</span>`;
+      const mark = loading ? '<span class="spin" aria-hidden="true"></span>' : markSvg(markPx);
+      const nf = this.#notFound ? `<p class="nf" part="not-found" role="status">bWalletX wasn't found in this browser. <a href="${esc(getUrl)}" target="_blank" rel="noopener">Get ${brand}</a> or <a href="${esc(webUrl)}" target="_blank" rel="noopener">use the web wallet</a>.</p>` : "";
+      this.#root.innerHTML = `<style>${SIGNIN_CSS}</style><button type="button" part="button" aria-label="${esc(aria)}" title="${esc(subtitle ? `${text} (${subtitle})` : text)}"${disabled ? " disabled" : ""}${loading ? ' aria-busy="true"' : ""}><span class="mark" part="mark">${mark}</span>${label}</button>${loading ? '<span class="sr" role="status">Connecting to bWalletX\u2026</span>' : ""}${nf}`;
+      this.button.addEventListener("click", () => void this.#click());
+      bindPrewarm(this.button);
+    }
+    #emit(type, detail, cancelable = false) {
+      return this.dispatchEvent(new CustomEvent(type, { detail, bubbles: true, composed: true, cancelable }));
+    }
+    #setBusy(on) {
+      this.#busy = on;
+      this.#render();
+    }
+    async #click() {
+      if (this.hasAttribute("disabled") || this.hasAttribute("loading") || this.#busy) return;
+      if (!this.#emit("bwalletx-signin", { element: this }, true)) return;
+      const href = this.#attr("href");
+      const authorizeUrl = this.#attr("authorize-url");
+      if (authorizeUrl) {
+        location.assign(await buildAuthorizeUrl({ authorizeUrl, clientId: this.#attr("client-id"), redirectUri: this.#attr("redirect-uri"), scope: this.#attr("scope") }));
+        return;
+      }
+      if (href) {
+        location.assign(href);
+        return;
+      }
+      const challengeUrl = this.#attr("challenge-url");
+      if (!challengeUrl) return;
+      this.#notFound = false;
+      this.#setBusy(true);
+      try {
+        const ms = Number(this.#attr("discover-ms")) || DEFAULT_DISCOVER_MS;
+        const found = await discoverBwalletX(ms);
+        if (!found) {
+          this.#notFound = true;
+          this.#emit("bwalletx-not-found");
+          if (this.#attr("require-token")) this.#emit("bwalletx-access-denied", { code: "not_installed", message: "No wallet found" });
+          return;
+        }
+        const requireToken = this.#attr("require-token");
+        if (requireToken) {
+          const verifyUrl2 = this.#attr("verify-url");
+          const min = this.#attr("min");
+          const minBps = this.#attr("min-bps");
+          const hint = { token: { id: requireToken, ...minBps ? { minBps: Number(minBps) } : { min: min ?? "1" } } };
+          try {
+            const a = await requestAccess({
+              wallet: found.wallet,
+              challenge: (identityKey) => postJson(challengeUrl, { identityKey, require: hint }),
+              verify: verifyUrl2 ? (response2) => postAccess(verifyUrl2, response2) : void 0
+            });
+            this.#emit("bwalletx-access-granted", { identityKey: a.response.identityKey, response: a.verified });
+          } catch (e) {
+            const err = e instanceof AccessError ? e : new AccessError("bad_request", String(e));
+            this.#emit("bwalletx-access-denied", { code: err.code, message: err.message, have: err.have, need: err.need });
+          }
+          return;
+        }
+        const r = await signInWithBwalletX({ wallet: found.wallet, challenge: (identityKey) => postJson(challengeUrl, { identityKey }) });
+        const verifyUrl = this.#attr("verify-url");
+        const response = verifyUrl ? await postJson(verifyUrl, { identityKey: r.identityKey, nonce: r.nonce, signature: r.signature }) : null;
+        this.#emit("bwalletx-signed-in", { identityKey: r.identityKey, method: found.method, nonce: r.nonce, signature: r.signature, response });
+      } catch (error) {
+        this.#emit("bwalletx-error", { error });
+      } finally {
+        this.#setBusy(false);
+      }
+    }
+  };
+}
+function defineBwalletxSignin(tag = SIGNIN_TAG) {
+  if (typeof window === "undefined" || typeof customElements === "undefined") return void 0;
+  const existing = customElements.get(tag);
+  if (existing) return existing;
+  const C = createClass();
+  customElements.define(tag, C);
+  return C;
+}
+
+// src/modal.ts
+var CSS = `
+.bwx-ov{position:fixed;inset:0;z-index:2147483000;background:rgba(0,0,0,.6);display:flex;align-items:center;justify-content:center;padding:16px;font:15px/1.4 system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
+.bwx-box{background:#0b0b0b;color:#f4f1e8;border:1px solid #3a3220;border-radius:16px;width:min(360px,100%);padding:20px;box-shadow:0 20px 60px rgba(0,0,0,.5)}
+.bwx-box h2{margin:0 0 6px;font-size:18px;color:#e8c766}
+.bwx-box p{margin:0 0 14px;color:#bdb6a3;font-size:14px}
+.bwx-qr{background:#fff;border-radius:12px;padding:12px;display:flex;justify-content:center}
+.bwx-qr svg{width:100%;height:auto;max-width:260px}
+.bwx-code{margin:14px 0 0;text-align:center;font-size:28px;letter-spacing:.3em;color:#e8c766;font-variant-numeric:tabular-nums}
+.bwx-row{display:flex;gap:8px;margin-top:14px}
+.bwx-btn{flex:1;border:1px solid #3a3220;background:#15130e;color:#f4f1e8;border-radius:10px;padding:10px 12px;font:inherit;cursor:pointer}
+.bwx-btn:hover{border-color:#e8c766}
+a.bwx-btn{display:block;text-align:center;text-decoration:none;box-sizing:border-box}
+.bwx-primary{background:linear-gradient(180deg,#fcd34d,#f59e0b);color:#000;border:0;font-weight:700;min-height:48px;padding:13px 12px}
+.bwx-stack{display:flex;flex-direction:column;gap:8px}
+.bwx-list{display:flex;flex-direction:column;gap:8px}
+.bwx-opt{display:flex;align-items:center;gap:10px;text-align:left}
+.bwx-opt img{width:24px;height:24px;border-radius:6px}
+.bwx-tag{margin-left:auto;font-size:11px;color:#8d866f}
+`;
+function mount() {
+  const root = document.createElement("div");
+  root.className = "bwx-ov";
+  root.setAttribute("role", "dialog");
+  root.setAttribute("aria-modal", "true");
+  const style = document.createElement("style");
+  style.textContent = CSS;
+  const box = document.createElement("div");
+  box.className = "bwx-box";
+  root.append(style, box);
+  document.body.appendChild(root);
+  return { root, box, close: () => root.remove() };
+}
+function el(tag, cls, text) {
+  const e = document.createElement(tag);
+  if (cls) e.className = cls;
+  if (text != null) e.textContent = text;
+  return e;
+}
+function qrSvg(text) {
+  const q = (0, import_qrcode_generator.default)(0, "M");
+  q.addData(text);
+  q.make();
+  return q.createSvgTag({ cellSize: 4, margin: 2, scalable: true });
+}
+function isTouchDevice(env = globalThis) {
+  const nav = env.navigator;
+  if (!nav) return false;
+  const ua = nav.userAgent ?? "";
+  if (/Android|iPhone|iPad|iPod|Mobile|Silk|Kindle/i.test(ua)) return true;
+  if (/Macintosh/.test(ua) && (nav.maxTouchPoints ?? 0) > 1) return true;
+  try {
+    return !!env.matchMedia?.("(pointer: coarse)").matches && !env.matchMedia?.("(hover: hover)").matches;
+  } catch {
+    return false;
+  }
+}
+function pairingModal(o = {}) {
+  const ac = new AbortController();
+  let ui = null;
+  let codeEl = null;
+  const close = () => {
+    ui?.close();
+    ui = null;
+  };
+  ac.signal.addEventListener("abort", close);
+  return {
+    signal: ac.signal,
+    close,
+    onLink(link) {
+      if (typeof document === "undefined") return;
+      close();
+      ui = mount();
+      const app = o.mode === "app" || (o.mode ?? "auto") === "auto" && isTouchDevice();
+      const h = el("h2", "", o.title ?? "Connect bWalletX");
+      const cancel = el("button", "bwx-btn", "Cancel");
+      cancel.onclick = () => {
+        o.onCancel?.();
+        ac.abort();
+      };
+      codeEl = el("div", "bwx-code", "");
+      codeEl.setAttribute("aria-live", "polite");
+      if (app) {
+        const p2 = el("p", "", "Open bWalletX, approve, then come back to this page.");
+        const stack = el("div", "bwx-stack");
+        const open = el("a", "bwx-btn bwx-primary", "Open bWalletX");
+        open.href = link;
+        open.rel = "noopener";
+        const web = el("button", "bwx-btn", "Use web.bwalletx.com instead");
+        web.onclick = () => {
+          void navigator.clipboard?.writeText(link).catch(() => void 0);
+          window.open(WEB_WALLET_URL, "_blank", "noopener");
+          p2.textContent = "Link copied. In web.bwalletx.com tap Connect and paste it, then come back here.";
+        };
+        stack.append(open, web, cancel);
+        ui.box.append(h, p2, codeEl, stack);
+        return;
+      }
+      const p = el("p", "", "Scan with bWalletX on your phone, or paste the link into web.bwalletx.com.");
+      const qr = el("div", "bwx-qr");
+      qr.innerHTML = qrSvg(link);
+      const row = el("div", "bwx-row");
+      const copy = el("button", "bwx-btn", "Copy link");
+      copy.onclick = () => void navigator.clipboard?.writeText(link).then(() => copy.textContent = "Copied");
+      row.append(copy, cancel);
+      ui.box.append(h, p, qr, codeEl, row);
+    },
+    onCode(code) {
+      if (codeEl) {
+        codeEl.textContent = code;
+        const p = ui?.box.querySelector("p");
+        if (p) p.textContent = "Check bWalletX shows the same code, then tap Connect.";
+      }
+    }
+  };
+}
+function pickWallet(options, o = {}) {
+  if (typeof document === "undefined") return Promise.resolve(null);
+  return new Promise((resolve) => {
+    const ui = mount();
+    const done = (w) => {
+      ui.close();
+      resolve(w);
+    };
+    ui.box.append(el("h2", "", o.title ?? "Choose a wallet"));
+    if (!options.length) ui.box.append(el("p", "", "No wallet found. Get bWalletX at bwalletx.com."));
+    const list = el("div", "bwx-list");
+    for (const w of options) {
+      const b = el("button", "bwx-btn bwx-opt");
+      if (w.icon) {
+        const img = el("img");
+        img.src = w.icon;
+        img.alt = "";
+        b.append(img);
+      }
+      b.append(el("span", "", w.name));
+      if (w.kind === "handcash") b.append(el("span", "bwx-tag", "until BRC-100"));
+      b.onclick = () => done(w);
+      list.append(b);
+    }
+    const cancel = el("button", "bwx-btn", "Cancel");
+    cancel.onclick = () => done(null);
+    ui.root.onclick = (e) => e.target === ui.root && done(null);
+    ui.box.append(list, el("div", "bwx-row"));
+    ui.box.lastChild.append(cancel);
+  });
+}
+
+// src/wallets.ts
+var import_sdk5 = require("@bsv/sdk");
+async function brc100Connected(wallet, o) {
+  await wallet.waitForAuthentication({}).catch(() => {
+  });
+  const { publicKey } = await wallet.getPublicKey({ identityKey: true });
+  return { wallet, payer: wallet, identityKey: publicKey, optionId: o.id, kind: o.kind };
+}
+function brc100Option(wallet, info) {
+  const opt = {
+    id: info.id,
+    name: info.name,
+    icon: info.icon,
+    rdns: info.rdns,
+    kind: "brc100",
+    isBwalletX: info.isBwalletX ?? false,
+    connect: () => brc100Connected(wallet, opt)
+  };
+  return opt;
+}
+function pairingOption(pairing) {
+  const opt = {
+    id: "bwalletx-pairing",
+    name: "bWalletX on your phone",
+    kind: "pairing",
+    isBwalletX: true,
+    async connect() {
+      const p = typeof pairing === "function" ? pairing() : pairing;
+      const w = await restorePairing(p) ?? await pairBwalletX(p);
+      return brc100Connected(w, opt);
+    }
+  };
+  return opt;
+}
+function handcashAdapter(o) {
+  const opt = {
+    id: "handcash",
+    name: "HandCash",
+    icon: o.icon,
+    kind: "handcash",
+    isBwalletX: false,
+    async connect() {
+      const p = await o.login();
+      return {
+        wallet: null,
+        payer: o.pay ? { pay: o.pay } : null,
+        identityKey: p.identityKey ?? null,
+        handle: p.handle,
+        paymail: p.paymail ?? `${p.handle.replace(/^\$/, "")}@handcash.io`,
+        optionId: opt.id,
+        kind: "handcash",
+        transitional: true
+      };
+    }
+  };
+  return opt;
+}
+var NAMES = { [RDNS_EXTENSION]: "bWalletX", "space.bwallet.mobile": "bWalletX" };
+async function probe(substrate, ms) {
+  try {
+    const w = new import_sdk5.WalletClient(substrate);
+    const ok = await Promise.race([w.isAuthenticated({}).then(() => true), new Promise((r) => setTimeout(() => r(false), ms))]);
+    return ok ? w : null;
+  } catch {
+    return null;
+  }
+}
+async function discoverWallets(o = {}) {
+  const out = [];
+  const ms = o.ms ?? 300;
+  if (typeof window !== "undefined") {
+    const seen = /* @__PURE__ */ new Map();
+    const onAnnounce = (e) => {
+      const d = e.detail;
+      if (!d?.wallet) return;
+      const rdns = d.info?.rdns ?? d.info?.uuid ?? `wallet-${seen.size}`;
+      if (seen.has(rdns)) return;
+      const isB = BWALLETX_RDNS.includes(rdns);
+      seen.set(rdns, brc100Option(d.wallet, { id: rdns, rdns, name: NAMES[rdns] ?? d.info?.name ?? rdns, icon: d.info?.icon, isBwalletX: isB }));
+    };
+    window.addEventListener("brc100:announceWallet", onAnnounce);
+    window.dispatchEvent(new Event("brc100:requestWallet"));
+    const local = o.probeLocal ? Promise.all([probe("json-api", ms), probe("Cicada", ms)]) : Promise.resolve([null, null]);
+    await new Promise((r) => setTimeout(r, seen.size > 0 || window.CWI ? Math.min(ms, 50) : ms));
+    window.removeEventListener("brc100:announceWallet", onAnnounce);
+    out.push(...seen.values());
+    const cwi = window.CWI;
+    if (cwi && ![...seen.values()].some((x) => x.rdns === "space.bwallet.mobile")) {
+      out.push(brc100Option(cwi, { id: "window.CWI", name: "This app\u2019s wallet", isBwalletX: false }));
+    }
+    const [json, cicada] = await local;
+    if (json) out.push(brc100Option(json, { id: "localhost:3321", name: "Desktop wallet (localhost:3321)" }));
+    if (cicada) out.push(brc100Option(cicada, { id: "localhost:3301", name: "Desktop wallet (localhost:3301)" }));
+  }
+  if (o.pairing) out.push(pairingOption(o.pairing));
+  out.push(...o.extra ?? []);
+  const rank = (w) => w.isBwalletX ? 0 : w.kind === "handcash" ? 2 : 1;
+  return out.map((w, i) => ({ w, i })).sort((a, b) => rank(a.w) - rank(b.w) || a.i - b.i).map((x) => x.w);
+}
+
+// src/pay.ts
+var import_sdk6 = require("@bsv/sdk");
+var BRC29_PROTOCOL = [2, "3241645161d8"];
+var PaymentError = class extends Error {
+  constructor(code, message, maybeSent = false, cause) {
+    super(message);
+    this.code = code;
+    this.maybeSent = maybeSent;
+    this.cause = cause;
+    this.name = "PaymentError";
+  }
+  code;
+  maybeSent;
+  cause;
+};
+var isLegacy = (s) => typeof s.pay === "function" && typeof s.createAction !== "function";
+var isIdentityKeyHex = (s) => /^0[23][0-9a-fA-F]{64}$/.test(s);
+var isPaymail = (s) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s);
+function randomB64(n) {
+  const b = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(b);
+  return import_sdk6.Utils.toBase64(Array.from(b));
+}
+function opReturn(text) {
+  const d = import_sdk6.Utils.toArray(text, "utf8");
+  const len = d.length;
+  const push = len < 76 ? [len] : len <= 255 ? [76, len] : [77, len & 255, len >> 8];
+  return import_sdk6.Utils.toHex([0, 106, ...push, ...d]);
+}
+var clip = (s, n) => s.length > n ? s.slice(0, n - 1) + "\u2026" : s;
+var describe = (s) => clip(s.length < 5 ? `${s} payment`.trim() : s, 50);
+async function usdRate(o) {
+  if (typeof o.usdPerBsv === "number") return o.usdPerBsv;
+  try {
+    if (typeof o.usdPerBsv === "function") return await o.usdPerBsv();
+    const r = await (o.fetch ?? fetch)("https://api.whatsonchain.com/v1/bsv/main/exchangerate");
+    const j = await r.json();
+    if (!r.ok || !(Number(j.rate) > 0)) throw new Error(`status ${r.status}`);
+    return Number(j.rate);
+  } catch (e) {
+    throw new PaymentError("RATE_FAILED", `Could not get the BSV/USD rate: ${e.message}`, false, e);
   }
-  return u.toString();
 }
-async function postJson(url, body) {
-  const res = await fetch(url, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) throw new Error(data.error ?? `HTTP ${res.status}`);
-  return data;
+async function amountInSats(req, o = {}) {
+  if (req.sats != null) {
+    if (!Number.isSafeInteger(req.sats) || req.sats <= 0) throw new PaymentError("BAD_REQUEST", "sats must be a positive integer");
+    return req.sats;
+  }
+  if (req.usd != null) {
+    if (!(req.usd > 0)) throw new PaymentError("BAD_REQUEST", "usd must be positive");
+    return Math.max(1, Math.ceil(req.usd / await usdRate(o) * 1e8));
+  }
+  throw new PaymentError("BAD_REQUEST", "Give sats or usd");
 }
-async function postAccess(url, body) {
-  const res = await fetch(url, { method: "POST", credentials: "include", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
-  return res.json().catch(() => ({ error: "bad_request", message: `HTTP ${res.status}` }));
+async function resolvePaymailP2P(paymail, sats, f = fetch) {
+  const [alias, domain] = paymail.split("@");
+  const fail = (m, e) => new PaymentError("RESOLVE_FAILED", `Could not resolve ${paymail}: ${m}`, false, e);
+  let caps;
+  try {
+    const r = await f(`https://${domain}/.well-known/bsvalias`);
+    caps = (await r.json()).capabilities;
+  } catch (e) {
+    throw fail("no bsvalias document (or CORS blocked it; resolve on your server and pass resolvePaymail)", e);
+  }
+  const fill = (u) => u.replace("{alias}", encodeURIComponent(alias)).replace("{domain.tld}", domain);
+  const dest = caps?.["2a40af698840"];
+  if (!dest) throw fail("it does not offer P2P payment destinations");
+  let body;
+  try {
+    const r = await f(fill(dest), { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ satoshis: sats }) });
+    if (!r.ok) throw new Error(`status ${r.status}`);
+    body = await r.json();
+  } catch (e) {
+    throw fail(e.message, e);
+  }
+  if (!body.outputs?.length) throw fail("no outputs returned");
+  const receive = caps["5f1323cddf31"];
+  return {
+    outputs: body.outputs.map((o) => ({ script: o.script, satoshis: o.satoshis })),
+    reference: body.reference,
+    submit: receive ? async (hex2) => {
+      await f(fill(receive), {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hex: hex2, reference: body.reference, metadata: {} })
+      });
+    } : void 0
+  };
 }
-var OBSERVED = ["size", "theme", "label", "brand", "subtitle", "loading", "disabled", "full-width", "aria-label", "get-url", "web-url"];
-function createClass() {
-  return class BwalletxSigninElement extends HTMLElement {
-    static get observedAttributes() {
-      return OBSERVED;
-    }
-    #root;
-    #notFound = false;
-    #busy = false;
-    constructor() {
-      super();
-      this.#root = this.attachShadow({ mode: "open" });
-    }
-    connectedCallback() {
-      this.#render();
-    }
-    attributeChangedCallback() {
-      if (this.isConnected) this.#render();
-    }
-    /** The inner <button>, for focus() and tests. */
-    get button() {
-      return this.#root.querySelector("button");
-    }
-    get notFound() {
-      return this.#notFound;
-    }
-    focus(opts) {
-      this.button?.focus(opts);
-    }
-    #attr(name) {
-      return this.getAttribute(name);
-    }
-    #render() {
-      const size = this.#attr("size") ?? "lg";
-      const brand = this.#attr("brand") === "bWallet" ? "bWallet" : "bWalletX";
-      const text = signinText(this.#attr("label") ?? "signin", brand);
-      const subAttr = this.#attr("subtitle");
-      const subDefault = brand === "bWalletX" && (size === "lg" || size === "md") ? "also works with bWallet" : null;
-      const subtitle = subAttr === null || subAttr === "" || subAttr === "on" ? subAttr === "on" ? "also works with bWallet" : subDefault : subAttr === "off" ? null : subAttr;
-      const loading = this.hasAttribute("loading") || this.#busy;
-      const disabled = this.hasAttribute("disabled");
-      const markPx = size === "icon" ? 24 : size === "sm" ? 15 : size === "md" ? 17 : 20;
-      const aria = this.#attr("aria-label") ?? (subtitle && size !== "icon" ? `${text}, ${subtitle}` : text);
-      const getUrl = this.#attr("get-url") ?? GET_URL;
-      const webUrl = this.#attr("web-url") ?? WEB_WALLET_URL;
-      const esc = (s) => s.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
-      const label = size === "icon" ? "" : `<span class="txt" part="text"><b part="label">${esc(text)}</b>${subtitle ? `<small part="subtitle">${esc(subtitle)}</small>` : ""}</span>`;
-      const mark = loading ? '<span class="spin" aria-hidden="true"></span>' : markSvg(markPx);
-      const nf = this.#notFound ? `<p class="nf" part="not-found" role="status">bWalletX wasn't found in this browser. <a href="${esc(getUrl)}" target="_blank" rel="noopener">Get ${brand}</a> or <a href="${esc(webUrl)}" target="_blank" rel="noopener">use the web wallet</a>.</p>` : "";
-      this.#root.innerHTML = `<style>${SIGNIN_CSS}</style><button type="button" part="button" aria-label="${esc(aria)}" title="${esc(subtitle ? `${text} (${subtitle})` : text)}"${disabled ? " disabled" : ""}${loading ? ' aria-busy="true"' : ""}><span class="mark" part="mark">${mark}</span>${label}</button>${loading ? '<span class="sr" role="status">Connecting to bWalletX\u2026</span>' : ""}${nf}`;
-      this.button.addEventListener("click", () => void this.#click());
-    }
-    #emit(type, detail, cancelable = false) {
-      return this.dispatchEvent(new CustomEvent(type, { detail, bubbles: true, composed: true, cancelable }));
-    }
-    #setBusy(on) {
-      this.#busy = on;
-      this.#render();
+async function runAction(wallet, description, outputs, labels) {
+  try {
+    return await wallet.createAction({
+      description: describe(description),
+      outputs: outputs.map((o) => ({ lockingScript: o.script, satoshis: o.satoshis, outputDescription: describe(o.description ?? "payment") })),
+      labels: labels?.length ? labels : void 0,
+      options: { randomizeOutputs: false }
+    });
+  } catch (e) {
+    const msg = e?.message ?? String(e);
+    const rejected = /denied|reject|cancel|abort|user/i.test(msg) || e?.code === 4001;
+    throw new PaymentError(rejected ? "WALLET_REJECTED" : "WALLET_ERROR", rejected ? "The payment was declined in the wallet." : `The wallet could not make the payment: ${msg}`, !rejected, e);
+  }
+}
+async function pay(source, req, o = {}) {
+  const to = (req.to ?? "").trim();
+  if (!to) throw new PaymentError("BAD_REQUEST", "Give a recipient (to)");
+  if (req.memo && req.memo.length > 1e3) throw new PaymentError("BAD_REQUEST", "memo is too long");
+  const sats = await amountInSats(req, o);
+  if (isLegacy(source)) return source.pay({ ...req, to, sats });
+  let outputs;
+  let remittance;
+  let submit;
+  if (isIdentityKeyHex(to)) {
+    const derivationPrefix = randomB64(8);
+    const derivationSuffix = randomB64(8);
+    let pk;
+    let me;
+    try {
+      ({ publicKey: pk } = await source.getPublicKey({ protocolID: BRC29_PROTOCOL, keyID: `${derivationPrefix} ${derivationSuffix}`, counterparty: to.toLowerCase() }));
+      ({ publicKey: me } = await source.getPublicKey({ identityKey: true }));
+    } catch (e) {
+      throw new PaymentError("WALLET_ERROR", `The wallet could not derive the payment key: ${e.message}`, false, e);
     }
-    async #click() {
-      if (this.hasAttribute("disabled") || this.hasAttribute("loading") || this.#busy) return;
-      if (!this.#emit("bwalletx-signin", { element: this }, true)) return;
-      const href = this.#attr("href");
-      const authorizeUrl = this.#attr("authorize-url");
-      if (authorizeUrl) {
-        location.assign(await buildAuthorizeUrl({ authorizeUrl, clientId: this.#attr("client-id"), redirectUri: this.#attr("redirect-uri"), scope: this.#attr("scope") }));
-        return;
-      }
-      if (href) {
-        location.assign(href);
-        return;
-      }
-      const challengeUrl = this.#attr("challenge-url");
-      if (!challengeUrl) return;
-      this.#notFound = false;
-      this.#setBusy(true);
-      try {
-        const ms = Number(this.#attr("discover-ms")) || 1200;
-        const found = await discoverBwalletX(ms);
-        if (!found) {
-          this.#notFound = true;
-          this.#emit("bwalletx-not-found");
-          if (this.#attr("require-token")) this.#emit("bwalletx-access-denied", { code: "not_installed", message: "No wallet found" });
-          return;
-        }
-        const requireToken = this.#attr("require-token");
-        if (requireToken) {
-          const verifyUrl2 = this.#attr("verify-url");
-          const min = this.#attr("min");
-          const minBps = this.#attr("min-bps");
-          const hint = { token: { id: requireToken, ...minBps ? { minBps: Number(minBps) } : { min: min ?? "1" } } };
-          try {
-            const a = await requestAccess({
-              wallet: found.wallet,
-              challenge: (identityKey) => postJson(challengeUrl, { identityKey, require: hint }),
-              verify: verifyUrl2 ? (response2) => postAccess(verifyUrl2, response2) : void 0
-            });
-            this.#emit("bwalletx-access-granted", { identityKey: a.response.identityKey, response: a.verified });
-          } catch (e) {
-            const err = e instanceof AccessError ? e : new AccessError("bad_request", String(e));
-            this.#emit("bwalletx-access-denied", { code: err.code, message: err.message, have: err.have, need: err.need });
-          }
-          return;
-        }
-        const r = await signInWithBwalletX({ wallet: found.wallet, challenge: (identityKey) => postJson(challengeUrl, { identityKey }) });
-        const verifyUrl = this.#attr("verify-url");
-        const response = verifyUrl ? await postJson(verifyUrl, { identityKey: r.identityKey, nonce: r.nonce, signature: r.signature }) : null;
-        this.#emit("bwalletx-signed-in", { identityKey: r.identityKey, method: found.method, nonce: r.nonce, signature: r.signature, response });
-      } catch (error) {
-        this.#emit("bwalletx-error", { error });
-      } finally {
-        this.#setBusy(false);
-      }
+    outputs = [{ script: new import_sdk6.P2PKH().lock(import_sdk6.PublicKey.fromString(pk).toHash()).toHex(), satoshis: sats, description: "payment" }];
+    remittance = { senderIdentityKey: me, derivationPrefix, derivationSuffix, outputIndex: 0 };
+  } else if (isPaymail(to)) {
+    const r2 = await (o.resolvePaymail ?? ((p, s) => resolvePaymailP2P(p, s, o.fetch ?? fetch)))(to, sats);
+    outputs = r2.outputs;
+    submit = r2.submit;
+  } else {
+    try {
+      outputs = [{ script: new import_sdk6.P2PKH().lock(to).toHex(), satoshis: sats, description: "payment" }];
+    } catch {
+      throw new PaymentError("BAD_REQUEST", `Not a paymail, address or identity key: ${to}`);
     }
-  };
+  }
+  if (req.memo && req.memoOnChain) outputs = [...outputs, { script: opReturn(req.memo), satoshis: 0, description: "memo" }];
+  const r = await runAction(source, req.memo || `Pay ${clip(to, 30)}`, outputs, req.labels);
+  if (!r.txid) throw new PaymentError("WALLET_ERROR", "The wallet did not return a txid", true);
+  const tx = r.tx ? Array.from(r.tx) : void 0;
+  if (submit && tx) {
+    await submit(import_sdk6.Transaction.fromAtomicBEEF(tx).toHex()).catch(() => {
+    });
+  }
+  return { txid: r.txid, tx, sats, outputs, remittance };
 }
-function defineBwalletxSignin(tag = SIGNIN_TAG) {
-  if (typeof window === "undefined" || typeof customElements === "undefined") return void 0;
-  const existing = customElements.get(tag);
-  if (existing) return existing;
-  const C = createClass();
-  customElements.define(tag, C);
-  return C;
+function tip(source, req, o = {}) {
+  return pay(source, { memo: "Tip", ...req, labels: [...req.labels ?? [], "tip"] }, o);
+}
+async function buyToken(source, req) {
+  if (isLegacy(source)) throw new PaymentError("NOT_SUPPORTED", "This wallet cannot buy tokens. Use a BRC-100 wallet such as bWalletX.");
+  const q = await req.quote({ token: req.token, amount: req.amount });
+  if (!q?.outputs?.length) throw new PaymentError("BAD_REQUEST", "The quote returned no outputs");
+  const sats = q.outputs.reduce((n, x) => n + x.satoshis, 0);
+  const r = await runAction(source, q.description ?? `Buy ${clip(req.token, 30)}`, q.outputs, [...req.labels ?? [], "token-buy"]);
+  if (!r.txid) throw new PaymentError("WALLET_ERROR", "The wallet did not return a txid", true);
+  const res = { txid: r.txid, tx: r.tx ? Array.from(r.tx) : void 0, sats, outputs: q.outputs };
+  await q.onPaid?.(res);
+  return res;
 }
 
 // src/react.ts
@@ -1333,6 +1521,12 @@ function BwalletXProvider(p) {
     props.current.onError?.(err);
     return err;
   }, []);
+  const themeOn = !!p.theme && (state.status === "connecting" || state.status === "connected");
+  (0, import_react.useEffect)(() => {
+    if (!themeOn) return;
+    declareWalletTheme(p.theme);
+    return () => declareWalletTheme(null);
+  }, [themeOn, p.theme]);
   (0, import_react.useEffect)(() => {
     const url = p.sessionUrl;
     if (!url) return;
@@ -1383,7 +1577,7 @@ function BwalletXProvider(p) {
             wallet: cw.wallet,
             challenge: (identityKey) => postJson2(c.challengeUrl, { identityKey })
           });
-          const v = await postJson2(c.verifyUrl, { identityKey: r.identityKey, nonce: r.nonce, signature: r.signature });
+          const v = await atStage("verify", () => postJson2(c.verifyUrl, { identityKey: r.identityKey, nonce: r.nonce, signature: r.signature }));
           handle = v.handle ?? handle;
           paymail = v.paymail ?? paymail;
           signedIn = true;