@qntx/siwx 0.0.0-stage → 0.7.1

package/dist/message-ZewmOzps.mjs

@@ -0,0 +1,510 @@
+//#region src/core/error.ts
+const SYNTAX_MESSAGES = {
+	InvalidUtf8: "invalid UTF-8",
+	CarriageReturn: "CR not allowed",
+	MissingPreamble: "missing preamble marker",
+	MissingAccountSuffix: "missing account suffix",
+	UnexpectedEof: "unexpected end of input",
+	ExpectedBlankLine: "expected blank line",
+	UnexpectedTrailing: "unexpected trailing content",
+	ResourceSyntax: "resource line must start with '- '",
+	InvalidEnvelope: "invalid off-chain message envelope"
+};
+function describe(info) {
+	if (info.code === "MessageTooLarge") return `message exceeds maximum size of ${info.max} bytes, got ${info.length}`;
+	if (info.code === "Syntax") return info.syntax === "MissingField" ? `invalid message syntax: missing ${info.field}` : `invalid message syntax: ${SYNTAX_MESSAGES[info.syntax]}`;
+	if (info.code === "InvalidField") return `invalid ${info.field}: ${info.reason}`;
+	if (info.code === "Mismatch") return `${info.field} mismatch: expected ${info.expected}, got ${JSON.stringify(info.actual)}`;
+	if (info.code === "Expired") return "message expired";
+	if (info.code === "NotYetValid") return "message not yet valid";
+	if (info.code === "IssuedAtTooOld") return "issued-at exceeds max age";
+	if (info.code === "InvalidSignature") return `invalid signature: ${info.reason}`;
+	if (info.code === "VerificationFailed") return "verification failed";
+	if (info.code === "Unsupported") return `unsupported: ${info.reason}`;
+	return `backend error: ${info.reason}`;
+}
+/** The single error type thrown by every library failure. */
+var SiwxError = class extends Error {
+	/** Structured payload; `code` matches the Rust `Error::code()`. */
+	info;
+	constructor(info) {
+		super(describe(info));
+		this.name = "SiwxError";
+		this.info = info;
+	}
+	/** Stable variant name for cross-language contract tests. */
+	get code() {
+		return this.info.code;
+	}
+};
+/** `SiwxError` constructor shorthand for layout failures. */
+function syntaxError(syntax, field) {
+	if (syntax === "MissingField") {
+		if (field === void 0) throw new RangeError("MissingField requires a field");
+		return new SiwxError({
+			code: "Syntax",
+			syntax,
+			field
+		});
+	}
+	return new SiwxError({
+		code: "Syntax",
+		syntax
+	});
+}
+/** `SiwxError` constructor shorthand for a malformed field value. */
+function fieldError(field, reason) {
+	return new SiwxError({
+		code: "InvalidField",
+		field,
+		reason
+	});
+}
+/** `SiwxError` constructor shorthand for a binding mismatch. */
+function mismatchError(field, expected, actual) {
+	return new SiwxError({
+		code: "Mismatch",
+		field,
+		expected,
+		actual
+	});
+}
+//#endregion
+//#region src/core/account.ts
+//! CAIP-10 `account_id`: `namespace ":" reference ":" address`.
+/** Every character matches — avoids spread-on-string for Hermes-safe lint. */
+function everyChar(s, test) {
+	const pred = typeof test === "function" ? test : (c) => test.test(c);
+	for (const c of s) if (!pred(c)) return false;
+	return true;
+}
+/**
+* Validate and build an `account_id`.
+*
+* `namespace` is CAIP-2 `[-a-z0-9]{3,8}`; `reference` is `[-_a-zA-Z0-9]{1,32}`; `address` is
+* `[-.%a-zA-Z0-9]{1,128}`.
+*
+* @throws {SiwxError} `InvalidField` `chainId` for bad namespace/reference, `address` for a bad
+*   address.
+*/
+function createAccountId(namespace, reference, address) {
+	if (namespace.length < 3 || namespace.length > 8 || !everyChar(namespace, /[a-z0-9-]/)) throw fieldError("chainId", "bad CAIP-2 namespace");
+	if (reference.length === 0 || reference.length > 32 || !everyChar(reference, /[A-Za-z0-9_-]/)) throw fieldError("chainId", "bad CAIP-2 reference");
+	if (address.length === 0 || address.length > 128 || !everyChar(address, (c) => /[A-Za-z0-9]/.test(c) || c === "-" || c === "." || c === "%")) throw fieldError("address", "bad CAIP-10 address");
+	return Object.freeze({
+		namespace,
+		reference,
+		address,
+		id: `${namespace}:${reference}:${address}`
+	});
+}
+/**
+* Parse `namespace:reference:address`.
+*
+* @throws {SiwxError} `InvalidField` `chainId` when the shape is wrong.
+*/
+function parseAccountId(id) {
+	const first = id.indexOf(":");
+	const second = first === -1 ? -1 : id.indexOf(":", first + 1);
+	if (first === -1 || second < 0) throw fieldError("chainId", "expected namespace:reference:address");
+	return createAccountId(id.slice(0, first), id.slice(first + 1, second), id.slice(second + 1));
+}
+//#endregion
+//#region src/core/layout.ts
+//! Shared pieces of the CAIP-122 text layouts (eip4361 and SIWS): the
+//! preamble infix/suffix and the optional trailing tags in fixed ABNF order.
+const MID = " wants you to sign in with your ";
+const SUFFIX = " account:";
+/**
+* Parse the optional trailing tags in fixed ABNF order: `Expiration Time`, `Not Before`, `Request
+* ID`, `Resources` (with `- ` items). Each may appear at most once and only in this order.
+*/
+function optionalTags(lines, start) {
+	let i = start;
+	let resources;
+	const take = (tag) => {
+		const line = lines[i];
+		if (line !== void 0 && line.startsWith(tag)) {
+			i++;
+			return line.slice(tag.length);
+		}
+	};
+	const expirationTime = take("Expiration Time: ");
+	const notBefore = take("Not Before: ");
+	const requestId = take("Request ID: ");
+	if (lines[i] === "Resources:") {
+		i++;
+		const list = [];
+		while (i < lines.length) {
+			const r = lines[i] ?? "";
+			if (r.startsWith("- ")) {
+				list.push(r.slice(2));
+				i++;
+			} else if (r.startsWith("-")) throw syntaxError("ResourceSyntax");
+			else throw syntaxError("UnexpectedTrailing");
+		}
+		resources = list;
+	}
+	if (i !== lines.length) throw syntaxError("UnexpectedTrailing");
+	return {
+		expirationTime,
+		notBefore,
+		requestId,
+		resources
+	};
+}
+//#endregion
+//#region src/core/limits.ts
+/** Minimum EIP-4361 nonce length. */
+const MIN_NONCE_LEN = 8;
+/** Maximum accepted signing-text size in bytes. */
+const MAX_MESSAGE_BYTES = 16384;
+/** Maximum number of entries in the `Resources` list. */
+const MAX_RESOURCES = 32;
+/** Maximum accepted `statement` size in bytes. */
+const MAX_STATEMENT_BYTES = 4096;
+/** Maximum accepted `request_id` size in bytes. */
+const MAX_REQUEST_ID_BYTES = 128;
+/** Maximum accepted URI size in bytes (`uri` and each resource). */
+const MAX_URI_BYTES = 2048;
+//#endregion
+//#region src/core/rfc3986.ts
+//! RFC 3986 URI validation, matching Rust `iri-string` exactly:
+//! `URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ]`,
+//! `authority = [ userinfo "@" ] host [ ":" port ]`, strict dec-octet
+//! (no leading zeros), IPv6 / IPvFuture / pct-encoding.
+const UNRESERVED = /[A-Za-z0-9._~-]/;
+const SUB_DELIM = /[!$&'()*+,;=]/;
+const HEX = /[0-9A-Fa-f]/;
+function isScheme(s) {
+	if (s.length === 0 || !/[A-Za-z]/.test(s.charAt(0))) return false;
+	for (const c of s) if (!/[A-Za-z0-9+.-]/.test(c)) return false;
+	return true;
+}
+/** `(unreserved / pct-encoded / sub-delims / ":" / "@")*`, ASCII only. */
+function everyPct(s, allowed) {
+	for (let i = 0; i < s.length; i++) {
+		const c = s.charAt(i);
+		if (c === "%") {
+			if (i + 2 >= s.length || !HEX.test(s.charAt(i + 1)) || !HEX.test(s.charAt(i + 2))) return false;
+			i += 2;
+			continue;
+		}
+		if (!allowed(c)) return false;
+	}
+	return true;
+}
+function isUserinfo(s) {
+	return everyPct(s, (c) => UNRESERVED.test(c) || SUB_DELIM.test(c) || c === ":");
+}
+function isRegName(s) {
+	return everyPct(s, (c) => UNRESERVED.test(c) || SUB_DELIM.test(c));
+}
+function isPcharString(s) {
+	return everyPct(s, (c) => UNRESERVED.test(c) || SUB_DELIM.test(c) || c === ":" || c === "@");
+}
+/** Dec-octet: 0-255, no leading zeros (RFC 3986 strict). */
+function isDecOctet(s) {
+	if (s.length === 0 || s.length > 3) return false;
+	if (s.length > 1 && s.startsWith("0")) return false;
+	for (const c of s) if (!/[0-9]/.test(c)) return false;
+	return Number(s) <= 255;
+}
+function isIPv4(s) {
+	const parts = s.split(".");
+	return parts.length === 4 && parts.every(isDecOctet);
+}
+function isH16(s) {
+	return s.length > 0 && s.length <= 4 && s.split("").every((c) => HEX.test(c));
+}
+/**
+* Count h16-equivalent groups in one half of an IPv6 literal (an IPv4 tail counts as two groups and
+* must be last).
+*/
+function ipv6GroupCount(part) {
+	if (part === "") return 0;
+	let n = 0;
+	const groups = part.split(":");
+	for (const g of groups) {
+		if (g === "") return -1;
+		if (g.includes(".")) {
+			if (g !== groups.at(-1) || !isIPv4(g)) return -1;
+			n += 2;
+		} else if (isH16(g)) n += 1;
+		else return -1;
+	}
+	return n;
+}
+/** IPv6address per RFC 3986, with optional IPv4 tail and `::` compression. */
+function isIPv6(s) {
+	const halves = s.split("::");
+	if (halves.length > 2) return false;
+	if (halves.length === 1) return ipv6GroupCount(halves[0] ?? "") === 8;
+	const hn = ipv6GroupCount(halves[0] ?? "");
+	const tn = ipv6GroupCount(halves[1] ?? "");
+	if (hn === -1 || tn === -1) return false;
+	return hn + tn < 8;
+}
+function isIPvFuture(s) {
+	const m = /^[vV]([0-9A-Fa-f]+)\.(.*)$/.exec(s);
+	if (m === null) return false;
+	const tail = m[2] ?? "";
+	if (tail.length === 0) return false;
+	for (const c of tail) if (!(UNRESERVED.test(c) || SUB_DELIM.test(c) || c === ":")) return false;
+	return true;
+}
+/** `host = IP-literal / IPv4address / reg-name` (first-match-wins). */
+function isHost(s) {
+	if (s.startsWith("[")) return s.endsWith("]") && (isIPv6(s.slice(1, -1)) || isIPvFuture(s.slice(1, -1)));
+	if (isIPv4(s)) return true;
+	return isRegName(s);
+}
+/** `authority = [ userinfo "@" ] host [ ":" port ]`. */
+function isAuthority(s) {
+	let rest = s;
+	const at = rest.lastIndexOf("@");
+	if (at !== -1) {
+		if (rest.indexOf("@") !== at) return false;
+		if (!isUserinfo(rest.slice(0, at))) return false;
+		rest = rest.slice(at + 1);
+	}
+	let host = rest;
+	let port = "";
+	if (rest.startsWith("[")) {
+		const end = rest.indexOf("]");
+		if (end === -1) return false;
+		host = rest.slice(0, end + 1);
+		const after = rest.slice(end + 1);
+		if (after !== "") {
+			if (!after.startsWith(":")) return false;
+			port = after.slice(1);
+		}
+	} else {
+		const colon = rest.lastIndexOf(":");
+		if (colon !== -1) {
+			host = rest.slice(0, colon);
+			port = rest.slice(colon + 1);
+			if (host.includes(":")) return false;
+		}
+	}
+	if (port !== "" && !port.split("").every((c) => /[0-9]/.test(c))) return false;
+	return isHost(host);
+}
+/** `path` characters: each segment is `*pchar`. */
+function isPath(s) {
+	for (const seg of s.split("/")) if (!isPcharString(seg)) return false;
+	return true;
+}
+/** `query` / `fragment`: `*( pchar / "/" / "?" )`. */
+function isQueryOrFragment(s) {
+	return everyPct(s, (c) => UNRESERVED.test(c) || SUB_DELIM.test(c) || c === ":" || c === "@" || c === "/" || c === "?");
+}
+/** RFC 3986 `URI` (absolute, with scheme). */
+function isUri(s) {
+	const hash = s.indexOf("#");
+	if (hash !== -1 && s.includes("#", hash + 1)) return false;
+	let rest = s;
+	let fragment;
+	if (hash !== -1) {
+		fragment = rest.slice(hash + 1);
+		rest = rest.slice(0, hash);
+	}
+	const q = rest.indexOf("?");
+	let query;
+	if (q !== -1) {
+		query = rest.slice(q + 1);
+		rest = rest.slice(0, q);
+	}
+	const colon = rest.indexOf(":");
+	if (colon === -1) return false;
+	if (!isScheme(rest.slice(0, colon))) return false;
+	let hier = rest.slice(colon + 1);
+	if (hier.startsWith("//")) {
+		hier = hier.slice(2);
+		const slash = hier.indexOf("/");
+		const authority = slash === -1 ? hier : hier.slice(0, slash);
+		const path = slash === -1 ? "" : hier.slice(slash);
+		if (!isAuthority(authority)) return false;
+		if (!isPath(path)) return false;
+	} else if (!isPath(hier)) return false;
+	if (query !== void 0 && !isQueryOrFragment(query)) return false;
+	if (fragment !== void 0 && !isQueryOrFragment(fragment)) return false;
+	return true;
+}
+//#endregion
+//#region src/core/timestamp.ts
+//! Lexical RFC 3339 `date-time` + instant, mirroring Rust `Timestamp`.
+const SHAPE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+/** Days since 1970-01-01 for a proleptic-Gregorian y/m/d (Hinnant's algorithm). */
+function daysFromCivil(y, m, d) {
+	const yy = m <= 2 ? y - 1 : y;
+	const era = Math.floor((yy >= 0 ? yy : yy - 399) / 400);
+	const yoe = yy - era * 400;
+	const doy = Math.floor((153 * (m > 2 ? m - 3 : m + 9) + 2) / 5) + d - 1;
+	const doe = yoe * 365 + Math.floor(yoe / 4) - Math.floor(yoe / 100) + doy;
+	return era * 146097 + doe - 719468;
+}
+function daysInMonth(year, month) {
+	return [
+		31,
+		year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28,
+		31,
+		30,
+		31,
+		30,
+		31,
+		31,
+		30,
+		31,
+		30,
+		31
+	][month - 1] ?? 0;
+}
+/**
+* Parse an RFC 3339 `date-time`; `undefined` when invalid.
+*
+* Requires `T`/`t` and `Z`/`z`/`±HH:MM`; optional fraction; real calendar validity (Feb 30
+* rejected); leap second `:60` rejected like Rust `time`.
+*/
+function parseTimestamp(s) {
+	const m = SHAPE.exec(s);
+	if (m === null) return;
+	const [, ys, mos, ds, hs, mis, ss, frac, tz] = m;
+	const year = Number(ys);
+	const month = Number(mos);
+	const day = Number(ds);
+	const hour = Number(hs);
+	const minute = Number(mis);
+	const second = Number(ss);
+	if (month < 1 || month > 12) return;
+	if (day < 1 || day > daysInMonth(year, month)) return;
+	if (hour > 23 || minute > 59 || second > 59) return;
+	let ms = daysFromCivil(year, month, day) * 864e5 + hour * 36e5 + minute * 6e4 + second * 1e3;
+	if (frac !== void 0 && frac.length > 1) ms += Number(frac.slice(1, 4).padEnd(3, "0"));
+	if (tz !== void 0 && tz !== "Z" && tz !== "z") {
+		const oh = Number(tz.slice(1, 3));
+		const om = Number(tz.slice(4, 6));
+		if (oh > 23 || om > 59) return;
+		const off = (oh * 60 + om) * 6e4;
+		ms += tz.startsWith("+") ? -off : off;
+	}
+	if (!Number.isFinite(ms)) return;
+	return {
+		lexeme: s,
+		epochMs: Math.trunc(ms)
+	};
+}
+/**
+* `Date.prototype.toISOString()` semantics: UTC, millisecond precision, `YYYY-MM-DDTHH:MM:SS.sssZ`;
+* `undefined` for invalid dates and years outside `0000..=9999`.
+*/
+function timestampFromDate(date) {
+	const ms = date.getTime();
+	if (!Number.isFinite(ms)) return;
+	const year = date.getUTCFullYear();
+	if (year < 0 || year > 9999) return;
+	try {
+		return date.toISOString();
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/core/utf8.ts
+//! Strict UTF-8 helpers.
+//!
+//! `TextEncoder`/`TextDecoder` exist on every supported platform (Node,
+//! browsers, Hermes). Decoding must reject exactly what Rust
+//! `str::from_utf8` rejects — overlongs, surrogates, > U+10FFFF,
+//! truncated sequences — so `fatal: true` is used (which follows the
+//! WHATWG fatal algorithm and rejects all of those).
+const encoder = new TextEncoder();
+const fatalDecoder = new TextDecoder("utf-8", { fatal: true });
+/** Encode `text` as UTF-8 bytes. */
+function utf8Encode(text) {
+	return encoder.encode(text);
+}
+/** Decode `bytes` as strict UTF-8; `undefined` on any invalid sequence. */
+function utf8Decode(bytes) {
+	try {
+		return fatalDecoder.decode(bytes);
+	} catch {
+		return;
+	}
+}
+/** UTF-8 byte length of `text` (JS string length counts UTF-16 code units). */
+function utf8ByteLength(text) {
+	return encoder.encode(text).length;
+}
+//#endregion
+//#region src/core/message.ts
+//! CAIP-122 abstract data model: lexical `MessageFields` and the
+//! validated `Message` produced by `createMessage` (single validation
+//! path, same check order as Rust `Message::new`).
+const STATEMENT_CHARS = /* @__PURE__ */ new Set("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~:/?#[]@!$&'()*+,;= ");
+function isCaip10Address(s) {
+	if (s.length === 0 || s.length > 128) return false;
+	for (const c of s) if (!/[A-Za-z0-9]/.test(c) && c !== "-" && c !== "." && c !== "%") return false;
+	return true;
+}
+/**
+* Validate `fields` and return a frozen [`Message`].
+*
+* Check order (as Rust `Message::new`): scheme, domain, address, statement, uri, version, chainId,
+* nonce, issuedAt, expirationTime, notBefore, requestId, resources.
+*
+* @throws {SiwxError} `InvalidField` naming the first invalid field.
+*/
+function createMessage(fields) {
+	if (fields.scheme !== void 0 && !isScheme(fields.scheme)) throw fieldError("scheme", "not an RFC 3986 scheme");
+	if (fields.domain.length === 0) throw fieldError("domain", "empty");
+	if (fields.domain.includes("@")) throw fieldError("domain", "userinfo not allowed");
+	if (fields.domain.startsWith(":")) throw fieldError("domain", "empty host");
+	if (!isAuthority(fields.domain)) throw fieldError("domain", "not an RFC 3986 authority");
+	if (!isCaip10Address(fields.address)) throw fieldError("address", fields.address.length === 0 || fields.address.length > 128 ? "expected 1..=128 characters" : "bad CAIP-10 charset");
+	if (fields.statement !== void 0) {
+		if (utf8ByteLength(fields.statement) > 4096) throw fieldError("statement", "exceeds maximum size");
+		for (const c of fields.statement) if (!STATEMENT_CHARS.has(c)) throw fieldError("statement", "must be RFC 3986 reserved / unreserved / SP");
+	}
+	checkUri(fields.uri, "uri");
+	if (fields.version !== "1") throw fieldError("version", "must be \"1\"");
+	if (fields.chainId.length === 0) throw fieldError("chainId", "empty");
+	if (fields.chainId.length > 64) throw fieldError("chainId", "exceeds 64 characters");
+	for (const c of fields.chainId) if (!/[A-Za-z0-9]/.test(c) && c !== "-" && c !== "_" && c !== ":") throw fieldError("chainId", "bad charset");
+	if (fields.nonce.length < 8) throw fieldError("nonce", "too short");
+	for (const c of fields.nonce) if (!/[A-Za-z0-9]/.test(c)) throw fieldError("nonce", "not ASCII alphanumeric");
+	if (parseTimestamp(fields.issuedAt) === void 0) throw fieldError("issuedAt", "not an RFC 3339 date-time");
+	if (fields.expirationTime !== void 0 && parseTimestamp(fields.expirationTime) === void 0) throw fieldError("expirationTime", "not an RFC 3339 date-time");
+	if (fields.notBefore !== void 0 && parseTimestamp(fields.notBefore) === void 0) throw fieldError("notBefore", "not an RFC 3339 date-time");
+	if (fields.requestId !== void 0) {
+		if (utf8ByteLength(fields.requestId) > 128) throw fieldError("requestId", "exceeds maximum size");
+		if (!isPcharString(fields.requestId)) throw fieldError("requestId", "must be RFC 3986 *pchar");
+	}
+	if (fields.resources !== void 0) {
+		if (fields.resources.length > 32) throw fieldError("resources", "too many");
+		for (const uri of fields.resources) checkUri(uri, "resources");
+	}
+	const out = {
+		domain: fields.domain,
+		address: fields.address,
+		uri: fields.uri,
+		version: fields.version,
+		chainId: fields.chainId,
+		nonce: fields.nonce,
+		issuedAt: fields.issuedAt,
+		...fields.scheme === void 0 ? {} : { scheme: fields.scheme },
+		...fields.statement === void 0 ? {} : { statement: fields.statement },
+		...fields.expirationTime === void 0 ? {} : { expirationTime: fields.expirationTime },
+		...fields.notBefore === void 0 ? {} : { notBefore: fields.notBefore },
+		...fields.requestId === void 0 ? {} : { requestId: fields.requestId },
+		...fields.resources === void 0 ? {} : { resources: fields.resources }
+	};
+	return Object.freeze(out);
+}
+function checkUri(uri, field) {
+	if (uri.length === 0) throw fieldError(field, "empty");
+	if (utf8ByteLength(uri) > 2048) throw fieldError(field, "exceeds maximum size");
+	if (!isUri(uri)) throw fieldError(field, "not an RFC 3986 URI");
+}
+//#endregion
+export { parseAccountId as _, parseTimestamp as a, mismatchError as b, MAX_REQUEST_ID_BYTES as c, MAX_URI_BYTES as d, MIN_NONCE_LEN as f, createAccountId as g, optionalTags as h, utf8Encode as i, MAX_RESOURCES as l, SUFFIX as m, utf8ByteLength as n, timestampFromDate as o, MID as p, utf8Decode as r, MAX_MESSAGE_BYTES as s, createMessage as t, MAX_STATEMENT_BYTES as u, SiwxError as v, syntaxError as x, fieldError as y };

package/dist/namespace-Cl7PJYC-.mjs

@@ -0,0 +1,68 @@
+import { a as parseTimestamp, b as mismatchError, i as utf8Encode, v as SiwxError } from "./message-ZewmOzps.mjs";
+//#region src/core/expect.ts
+//! Server-side binding + time policy, mirroring Rust `Expect`.
+const DEFAULT_SKEW_SECONDS = 60;
+/**
+* Check `message` against the bindings and time policy.
+*
+* @throws {RangeError} For invalid `time`, or non-finite/negative `skewSeconds`/`maxAgeSeconds`.
+*   Order: domain, nonce, scheme, uri, chainId, requestId (`Mismatch`), then `Expired`,
+*   `NotYetValid`, `IssuedAtTooOld`. All comparisons at millisecond precision; a future `issued-at`
+*   is not an error.
+* @throws {SiwxError} The first failing check.
+*/
+const assertNonNegativeFinite = (name, v) => {
+	if (v !== void 0 && (!Number.isFinite(v) || v < 0)) throw new RangeError(`${name} must be a non-negative finite number`);
+};
+/** EpochMs of a timestamp already validated at `Message::new` time. */
+const lexemeMs = (ts) => {
+	const parsed = parseTimestamp(ts);
+	if (parsed === void 0) throw new RangeError("invalid stored timestamp");
+	return parsed.epochMs;
+};
+function checkExpect(message, expect) {
+	if (expect.time !== void 0 && !Number.isFinite(expect.time.getTime())) throw new RangeError("expect.time must be a valid Date");
+	assertNonNegativeFinite("skewSeconds", expect.skewSeconds);
+	assertNonNegativeFinite("maxAgeSeconds", expect.maxAgeSeconds);
+	if (message.domain !== expect.domain) throw mismatchError("domain", expect.domain, message.domain);
+	if (message.nonce !== expect.nonce) throw mismatchError("nonce", expect.nonce, message.nonce);
+	if (expect.scheme !== void 0 && message.scheme !== expect.scheme) throw mismatchError("scheme", expect.scheme, message.scheme);
+	if (expect.uri !== void 0 && message.uri !== expect.uri) throw mismatchError("uri", expect.uri, message.uri);
+	if (expect.chainId !== void 0 && message.chainId !== expect.chainId) throw mismatchError("chainId", expect.chainId, message.chainId);
+	if (expect.requestId !== void 0 && message.requestId !== expect.requestId) throw mismatchError("requestId", expect.requestId, message.requestId);
+	const now = Math.floor((expect.time ?? /* @__PURE__ */ new Date()).getTime());
+	const skew = Math.floor((expect.skewSeconds ?? DEFAULT_SKEW_SECONDS) * 1e3);
+	if (message.expirationTime !== void 0 && now > lexemeMs(message.expirationTime) + skew) throw new SiwxError({ code: "Expired" });
+	if (message.notBefore !== void 0 && now + skew < lexemeMs(message.notBefore)) throw new SiwxError({ code: "NotYetValid" });
+	if (expect.maxAgeSeconds !== void 0) {
+		const maxAge = Math.floor(expect.maxAgeSeconds * 1e3);
+		if (now > lexemeMs(message.issuedAt) + maxAge + skew) throw new SiwxError({ code: "IssuedAtTooOld" });
+	}
+}
+//#endregion
+//#region src/core/namespace.ts
+//! Chain namespace abstraction: parsing, formatting, and signature
+//! verification for one CAIP-2 namespace.
+/**
+* Run a synchronous verification body as a promise; throws reject. Shared idiom for namespace
+* `verify` implementations.
+*/
+async function settle(run) {
+	return new Promise((resolve) => {
+		resolve(run());
+	});
+}
+/** Full backend login flow: parse → checkExpect → account → verify. */
+async function authenticate(namespace, input) {
+	const signed = typeof input.message === "string" ? utf8Encode(input.message) : input.message;
+	const message = namespace.parse(signed);
+	checkExpect(message, input.expect);
+	const account = namespace.account(message);
+	await namespace.verify(message, signed, input.signature);
+	return {
+		message,
+		account
+	};
+}
+//#endregion
+export { settle as n, checkExpect as r, authenticate as t };

package/dist/namespace-DlgXqLsI.d.mts

@@ -0,0 +1,105 @@
+//#region src/core/account.d.ts
+/** A validated CAIP-10 `account_id`. */
+type AccountId = {
+  readonly namespace: string;
+  readonly reference: string;
+  readonly address: string;
+  /** Canonical string form `namespace:reference:address`. */
+  readonly id: string;
+};
+/**
+ * Validate and build an `account_id`.
+ *
+ * `namespace` is CAIP-2 `[-a-z0-9]{3,8}`; `reference` is `[-_a-zA-Z0-9]{1,32}`; `address` is
+ * `[-.%a-zA-Z0-9]{1,128}`.
+ *
+ * @throws {SiwxError} `InvalidField` `chainId` for bad namespace/reference, `address` for a bad
+ *   address.
+ */
+declare function createAccountId(namespace: string, reference: string, address: string): AccountId;
+/**
+ * Parse `namespace:reference:address`.
+ *
+ * @throws {SiwxError} `InvalidField` `chainId` when the shape is wrong.
+ */
+declare function parseAccountId(id: string): AccountId;
+//#endregion
+//#region src/core/message.d.ts
+/** Plain lexical form of a CAIP-122 message (all strings, absent = `undefined`). */
+type MessageFields = {
+  readonly scheme?: string | undefined;
+  readonly domain: string;
+  readonly address: string;
+  readonly statement?: string | undefined;
+  readonly uri: string;
+  readonly version: string;
+  readonly chainId: string;
+  readonly nonce: string;
+  readonly issuedAt: string;
+  readonly expirationTime?: string | undefined;
+  readonly notBefore?: string | undefined;
+  readonly requestId?: string | undefined;
+  readonly resources?: ReadonlyArray<string> | undefined;
+};
+declare const brand: unique symbol;
+/** Validated CAIP-122 message; construct only via `createMessage`. */
+type Message = {
+  readonly [brand]: "Message";
+} & MessageFields;
+/**
+ * Validate `fields` and return a frozen [`Message`].
+ *
+ * Check order (as Rust `Message::new`): scheme, domain, address, statement, uri, version, chainId,
+ * nonce, issuedAt, expirationTime, notBefore, requestId, resources.
+ *
+ * @throws {SiwxError} `InvalidField` naming the first invalid field.
+ */
+declare function createMessage(fields: MessageFields): Message;
+//#endregion
+//#region src/core/expect.d.ts
+/** Expected bindings and clock policy for `checkExpect`. */
+type Expect = {
+  readonly domain: string;
+  readonly nonce: string;
+  readonly scheme?: string | undefined;
+  readonly uri?: string | undefined;
+  readonly chainId?: string | undefined;
+  readonly requestId?: string | undefined;
+  /** Reference instant (defaults to `new Date()`). */
+  readonly time?: Date | undefined;
+  /** Clock-skew tolerance in seconds (default 60). */
+  readonly skewSeconds?: number | undefined;
+  /** Maximum age of `issued-at` in seconds. */
+  readonly maxAgeSeconds?: number | undefined;
+};
+declare function checkExpect(message: Message, expect: Expect): void;
+//#endregion
+//#region src/core/namespace.d.ts
+/** A chain namespace profile. */
+type Namespace = {
+  /** CAIP-2 namespace, e.g. `"eip155"` / `"solana"`. */
+  readonly namespace: string;
+  /** Preamble label, e.g. `"Ethereum"` / `"Solana"`. */
+  readonly label: string;
+  /** Map `message` to an `AccountId` under this namespace's rules. */
+  account: (message: Message) => AccountId;
+  /** Render `message` to this namespace's signing text. */
+  format: (message: Message) => string;
+  /** Parse `signed` bytes, requiring label === `this.label`. */
+  parse: (signed: Uint8Array) => Message;
+  /** Verify `signature` over the exact `signed` bytes. */
+  verify: (message: Message, signed: Uint8Array, signature: Uint8Array) => Promise<void>;
+};
+/** Successful `authenticate`: parsed message plus CAIP-10 identity. */
+type Authenticated = {
+  readonly message: Message;
+  readonly account: AccountId;
+};
+/** Full backend login flow: parse → checkExpect → account → verify. */
+declare function authenticate(namespace: Namespace, input: {
+  readonly message: string | Uint8Array;
+  readonly signature: Uint8Array;
+  readonly expect: Expect;
+}): Promise<Authenticated>;
+//#endregion
+export { checkExpect as a, createMessage as c, parseAccountId as d, Expect as i, AccountId as l, Namespace as n, Message as o, authenticate as r, MessageFields as s, Authenticated as t, createAccountId as u };