@renown/sdk 6.2.2-dev.2 → 6.2.2-dev.21

package/README.md

@@ -81,14 +81,116 @@ const { networkId, chainId, address } = parsePkhDid("did:pkh:eip155:1:0x...");
 const result = await verifyAuthBearerToken(jwt); // false | AuthVerifiedCredential
 ```
 
+## Wallet adapters (in-page sign-in)
+
+`@renown/sdk/wallet` provides pluggable wallet adapters so a host app (e.g.
+Connect) can sign a Renown credential **in-page**, without redirecting to the
+Renown portal. Each adapter is a separate subexport, loaded via dynamic
+`import()` so its wallet libraries are **optional peer dependencies** with zero
+startup cost until a login method is chosen.
+
+| Subexport                | Adapter  | Peer dependencies                                              |
+| ------------------------ | -------- | ------------------------------------------------------------- |
+| `@renown/sdk/wallet/rainbow` | RainbowKit + wagmi (external wallets) | `wagmi`, `@rainbow-me/rainbowkit`, `@tanstack/react-query`, `viem` |
+| `@renown/sdk/wallet/privy`   | Privy (embedded / social / email)     | `@privy-io/react-auth`, `viem`                                |
+| `@renown/sdk/wallet/mock`    | Headless test/dev signer (no UI)      | `viem`                                                        |
+
+Install only the peer deps for the adapters you enable.
+
+> **Host apps should not wire these adapters by hand.** Use the
+> `RenownWalletProvider` + `useRenownLoginMethods` + `useRenownAuth` primitives
+> from `@powerhousedao/reactor-browser/renown`, which handle the activator,
+> lazy-loading, controller merging and login UI wiring. See that package's
+> README ("Renown in-page sign-in"). `resolveAdapters` below is the low-level
+> primitive those build on.
+
+```typescript
+import { resolveAdapters } from "@renown/sdk/wallet";
+
+// Loads ONLY the configured adapters (dynamic import, on demand).
+const adapters = await resolveAdapters({
+  rainbow: { walletConnectProjectId: "..." },
+  privy: { appId: "...", methods: ["google", "email"] },
+});
+```
+
+Each adapter exposes a `Provider` (mount it around the app; it accepts a runtime
+`theme` of `"light" | "dark" | { mode, accentColor?, accentColorForeground? }`)
+and a controller with `connect(method?)`, `disconnect()`, and `getSession()`.
+`connect()` resolves a `WalletSession` (`{ address, chainId, signTypedData }`);
+pass it to `renown.signIn(session)` to write + log in the credential in-page.
+
+**Login methods.** Rainbow supports `wallet`; Privy supports `wallet`, `google`,
+`apple`, `email` (default `["google", "email"]`). Social/email flows run inside
+Privy's own modal (OAuth uses a popup, keeping the page alive) so sign-in
+completes in-page — no full-page redirect.
+
+**Configuration.** Only public identifiers belong in client config: Privy's
+`appId` (and optional `clientId`), and RainbowKit's `walletConnectProjectId`.
+Never put a Privy **App Secret** in browser config — it is server-only.
+
 ## Node.js
 
-For server-side usage, import from `@renown/sdk/node`:
+For server-side usage, import from `@renown/sdk/node`.
+
+**Building an instance (scripts / CLI).** The Node `RenownBuilder` uses file-based
+storage. Its `build()` **blocks** on revalidating a stored credential against the
+switchboard before resolving (so a short-lived process acts on fresh state); pass
+`revalidate: "never"` to skip the network check.
 
 ```typescript
 import { RenownBuilder } from "@renown/sdk/node";
+
+const renown = await new RenownBuilder("my-cli", {
+  switchboardUrl: "https://switchboard.example/graphql",
+}).build();
+// renown.user is present only if the stored credential is still valid
 ```
 
+`renown.revalidate()` re-checks the current credential on demand and logs out if
+it was revoked/expired; it is **fail-open** (a network error keeps the session).
+
+### Verifying a session cookie (SSR)
+
+To gate server-rendered pages, store the bearer token from
+`renown.getBearerToken()` — plus an optional display hint (name/avatar) — in a
+cookie (name exported as `RENOWN_SESSION_COOKIE`), then verify it on the server:
+
+```typescript
+import {
+  serializeRenownSessionCookie,
+  verifyRenownSession,
+  readSessionClaims,
+} from "@renown/sdk/node";
+
+// Build the cookie value (token + display hint) when setting the cookie:
+const cookieValue = serializeRenownSessionCookie({
+  token,
+  profile: { name: "alice.eth", avatar: null },
+});
+
+// Verify the cookie value — checks the JWT (signature + expiry) and merges the
+// display hint (unverified). verifyCredential:true also re-checks vs switchboard.
+const session = await verifyRenownSession(cookieValue, {
+  switchboardUrl: "https://switchboard.example/graphql",
+  // verifyCredential: true, // default false = token-only, no network
+});
+if (session) {
+  // session.user (incl. display hint), session.appDid, session.expiresAt
+}
+
+// Cheap, signature-free decode for optimistic checks (e.g. a proxy redirect).
+// NEVER trust this for access control.
+const claims = readSessionClaims(cookieValue);
+```
+
+`verifyCredential` defaults to **`false`** (token-only, no network): the JWT is
+signed and expiring, and the switchboard enforces the credential on every real
+operation, so token-only is enough for optimistic SSR UI. Set it to `true` on
+routes that render sensitive data to also catch revocation server-side. To
+verify a bare bearer token (e.g. an `Authorization` header), use
+`verifyAuthBearerToken` instead.
+
 ## License
 
 AGPL-3.0-only

package/dist/crypto.d.ts

@@ -1,3 +1,3 @@
-import { a as signatureHasResultingHash, c as ConnectCrypto, d as IConnectCrypto, f as IRenownCrypto, i as parseSignatureHashField, l as RenownCrypto, m as JwkKeyPair, n as createSignatureVerifier, o as MemoryKeyStorage, p as JsonWebKeyPairStorage, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner, u as DID } from "./signer-DYKGoYHB.js";
-import { t as BrowserKeyStorage } from "./browser-key-storage-DSkDBAhU.js";
+import { a as JwkKeyPair, i as JsonWebKeyPairStorage, n as IConnectCrypto, r as IRenownCrypto, t as DID } from "./types-DsF91dDF.js";
+import { a as parseSignatureHashField, c as RenownCryptoBuilder, i as extractResultingHashFromSignature, l as ConnectCrypto, n as RenownCryptoSigner, o as signatureHasResultingHash, r as createSignatureVerifier, s as MemoryKeyStorage, t as BrowserKeyStorage, u as RenownCrypto } from "./index-25fTa4yI.js";
 export { BrowserKeyStorage, ConnectCrypto, DID, IConnectCrypto, IRenownCrypto, JsonWebKeyPairStorage, JwkKeyPair, MemoryKeyStorage, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, createSignatureVerifier, extractResultingHashFromSignature, parseSignatureHashField, signatureHasResultingHash };

package/dist/crypto.js

@@ -1,3 +1,3 @@
-import { a as signatureHasResultingHash, c as ConnectCrypto, i as parseSignatureHashField, l as RenownCrypto, n as createSignatureVerifier, o as MemoryKeyStorage, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-XkA-D7Qt.js";
+import { a as signatureHasResultingHash, c as ConnectCrypto, i as parseSignatureHashField, l as RenownCrypto, n as createSignatureVerifier, o as MemoryKeyStorage, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-CgYhXTV7.js";
 import { t as BrowserKeyStorage } from "./browser-key-storage-v4O-fjz0.js";
 export { BrowserKeyStorage, ConnectCrypto, MemoryKeyStorage, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, createSignatureVerifier, extractResultingHashFromSignature, parseSignatureHashField, signatureHasResultingHash };

package/dist/index-25fTa4yI.d.ts

@@ -0,0 +1,127 @@
+import { a as JwkKeyPair, i as JsonWebKeyPairStorage, l as CreateBearerTokenOptions, r as IRenownCrypto, t as DID, w as Issuer } from "./types-DsF91dDF.js";
+import { Action, AppActionSigner, ISigner, Signature, SignatureVerificationHandler, UserActionSigner } from "@powerhousedao/shared/document-model";
+
+//#region src/crypto/renown-crypto.d.ts
+declare class RenownCrypto implements IRenownCrypto {
+  #private;
+  readonly did: DID;
+  static algorithm: EcKeyAlgorithm;
+  static signAlgorithm: {
+    name: string;
+    namedCurve: string;
+    hash: string;
+  };
+  constructor(keyPairStorage: JsonWebKeyPairStorage, crypto: SubtleCrypto, keyPair: CryptoKeyPair, did: DID);
+  get publicKey(): CryptoKey;
+  getBearerToken(address: string | undefined, options?: CreateBearerTokenOptions): Promise<string>;
+  removeDid(): Promise<void>;
+  sign(data: Uint8Array | string): Promise<Uint8Array>;
+  verify(data: Uint8Array, signature: Uint8Array): Promise<boolean>;
+  get issuer(): Issuer;
+}
+/**
+ * @deprecated Use RenownCrypto instead
+ */
+declare class ConnectCrypto extends RenownCrypto {}
+//#endregion
+//#region src/crypto/renown-crypto-builder.d.ts
+declare class RenownCryptoBuilder {
+  #private;
+  private keyPairStorage?;
+  private subtleCrypto?;
+  withKeyPairStorage(storage: JsonWebKeyPairStorage): this;
+  withSubtleCrypto(crypto: SubtleCrypto): this;
+  build(): Promise<RenownCrypto>;
+}
+//#endregion
+//#region src/crypto/memory-key-storage.d.ts
+declare class MemoryKeyStorage implements JsonWebKeyPairStorage {
+  private keyPair;
+  constructor(keyPair?: JwkKeyPair);
+  loadKeyPair(): Promise<JwkKeyPair | undefined>;
+  saveKeyPair(keyPair: JwkKeyPair): Promise<void>;
+  removeKeyPair(): Promise<void>;
+}
+//#endregion
+//#region src/crypto/signer.d.ts
+declare class RenownCryptoSigner implements ISigner {
+  private readonly crypto;
+  private readonly appName;
+  user?: UserActionSigner | undefined;
+  readonly app: AppActionSigner;
+  constructor(crypto: IRenownCrypto, appName: string, user?: UserActionSigner | undefined);
+  get publicKey(): CryptoKey;
+  sign(data: Uint8Array): Promise<Uint8Array>;
+  verify(data: Uint8Array, signature: Uint8Array): Promise<void>;
+  signAction(action: Action, abortSignal?: AbortSignal): Promise<Signature>;
+  /**
+   * Signs an action including a predicted resulting state hash.
+   *
+   * The resulting hash is packed into the signature tuple's 4th element (index 3)
+   * using the format: `${prevStateHash}:${resultingStateHash}`
+   *
+   * This allows offline verification of documents without reducer logic:
+   * - Verifier can check that the signature is valid for the claimed resulting state
+   * - Verifier can compare claimed resulting state to actual operation.hash
+   *
+   * @param action - The action to sign
+   * @param resultingStateHash - The predicted hash of document state AFTER this action runs
+   * @param abortSignal - Optional abort signal
+   * @returns A Signature tuple with the resulting hash encoded in element [3]
+   */
+  signActionWithResultingState(action: Action, resultingStateHash: string, abortSignal?: AbortSignal): Promise<Signature>;
+  /**
+   * Internal signing implementation shared by signAction and signActionWithResultingState.
+   */
+  private _signAction;
+  private hashAction;
+  private buildSignatureMessage;
+  private arrayBufferToHex;
+  private arrayBufferToBase64;
+}
+/**
+ * Creates a signature verification handler that verifies signatures using the Web Crypto API.
+ * The verification uses ECDSA with P-256 curve and SHA-256 hash, matching the RenownCrypto signing algorithm.
+ */
+declare function createSignatureVerifier(requireSignature?: boolean): SignatureVerificationHandler;
+/**
+ * Parses the hash field (element [3]) from a signature tuple.
+ *
+ * Supports two formats:
+ * - Old format: just `prevStateHash` (no colon)
+ * - New format: `prevStateHash:resultingStateHash` (colon-separated)
+ *
+ * @param hashField - The 4th element of a Signature tuple
+ * @returns Object with prevStateHash and optional resultingStateHash
+ */
+declare function parseSignatureHashField(hashField: string): {
+  prevStateHash: string;
+  resultingStateHash: string | undefined;
+};
+/**
+ * Extracts the resulting state hash from a signature, if present.
+ *
+ * @param signature - A Signature tuple
+ * @returns The resulting state hash, or undefined if not present
+ */
+declare function extractResultingHashFromSignature(signature: Signature): string | undefined;
+/**
+ * Checks if a signature includes a resulting state hash.
+ *
+ * @param signature - A Signature tuple
+ * @returns true if the signature includes a resulting state hash
+ */
+declare function signatureHasResultingHash(signature: Signature): boolean;
+//#endregion
+//#region src/crypto/browser-key-storage.d.ts
+declare class BrowserKeyStorage implements JsonWebKeyPairStorage {
+  #private;
+  constructor(db: IDBDatabase);
+  static create(dbName?: string): Promise<BrowserKeyStorage>;
+  saveKeyPair(keyPair: JwkKeyPair): Promise<void>;
+  loadKeyPair(): Promise<JwkKeyPair | undefined>;
+  removeKeyPair(): Promise<void>;
+}
+//#endregion
+export { parseSignatureHashField as a, RenownCryptoBuilder as c, extractResultingHashFromSignature as i, ConnectCrypto as l, RenownCryptoSigner as n, signatureHasResultingHash as o, createSignatureVerifier as r, MemoryKeyStorage as s, BrowserKeyStorage as t, RenownCrypto as u };
+//# sourceMappingURL=index-25fTa4yI.d.ts.map

package/dist/index-25fTa4yI.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-25fTa4yI.d.ts","names":[],"sources":["../src/crypto/renown-crypto.ts","../src/crypto/renown-crypto-builder.ts","../src/crypto/memory-key-storage.ts","../src/crypto/signer.ts","../src/crypto/browser-key-storage.ts"],"mappings":";;;;cASa,YAAA,YAAwB,aAAA;EAAA;WAK1B,GAAA,EAAK,GAAA;EAAA,OAEP,SAAA,EAAS,cAAA;EAAA,OACT,aAAA;;;;;cAGL,cAAA,EAAgB,qBAAA,EAChB,MAAA,EAAQ,YAAA,EACR,OAAA,EAAS,aAAA,EACT,GAAA,EAAK,GAAA;EAAA,IAQH,SAAA,CAAA,GAAS,SAAA;EAIP,cAAA,CACJ,OAAA,sBACA,OAAA,GAAU,wBAAA,GACT,OAAA;EAUG,SAAA,CAAA,GAAa,OAAA;EAQb,IAAA,CAAK,IAAA,EAAM,UAAA,YAAsB,OAAA,CAAQ,UAAA;EAazC,MAAA,CAAO,IAAA,EAAM,UAAA,EAAY,SAAA,EAAW,UAAA,GAAa,OAAA;EAAA,IASnD,MAAA,CAAA,GAAU,MAAA;AAAA;;;;cAiBH,aAAA,SAAsB,YAAA;;;cCtFtB,mBAAA;EAAA;UACH,cAAA;EAAA,QACA,YAAA;EAER,kBAAA,CAAmB,OAAA,EAAS,qBAAA;EAK5B,gBAAA,CAAiB,MAAA,EAAQ,YAAA;EAKnB,KAAA,CAAA,GAAS,OAAA,CAAQ,YAAA;AAAA;;;cCrBZ,gBAAA,YAA4B,qBAAA;EAAA,QAC/B,OAAA;cAEI,OAAA,GAAU,UAAA;EAItB,WAAA,CAAA,GAAW,OAAA,CAAA,UAAA;EAIX,WAAA,CAAY,OAAA,EAAS,UAAA,GAAU,OAAA;EAK/B,aAAA,CAAA,GAAa,OAAA;AAAA;;;cCDF,kBAAA,YAA8B,OAAA;EAAA,iBAItB,MAAA;EAAA,iBACA,OAAA;EACV,IAAA,GAAO,gBAAA;EAAA,SALP,GAAA,EAAK,eAAA;cAGK,MAAA,EAAQ,aAAA,EACR,OAAA,UACV,IAAA,GAAO,gBAAA;EAAA,IAQZ,SAAA,CAAA,GAAS,SAAA;EAIP,IAAA,CAAK,IAAA,EAAM,UAAA,GAAa,OAAA,CAAQ,UAAA;EAIhC,MAAA,CAAO,IAAA,EAAM,UAAA,EAAY,SAAA,EAAW,UAAA,GAAa,OAAA;EAOjD,UAAA,CACJ,MAAA,EAAQ,MAAA,EACR,WAAA,GAAc,WAAA,GACb,OAAA,CAAQ,SAAA;EHXR;;;;;;;;;;;;;;;EG+BG,4BAAA,CACJ,MAAA,EAAQ,MAAA,EACR,kBAAA,UACA,WAAA,GAAc,WAAA,GACb,OAAA,CAAQ,SAAA;EHzDJ;;;EAAA,QGkEO,WAAA;EAAA,QAiCA,UAAA;EAAA,QAYN,qBAAA;EAAA,QASA,gBAAA;EAAA,QAQA,mBAAA;AAAA;;;;;iBAcM,uBAAA,CACd,gBAAA,aACC,4BAAA;;;;;;;;;;;iBAgNa,uBAAA,CAAwB,SAAA;EACtC,aAAA;EACA,kBAAA;AAAA;;;;;;;iBAuBc,iCAAA,CACd,SAAA,EAAW,SAAA;;;;;AH3Sb;;iBGwTgB,yBAAA,CAA0B,SAAA,EAAW,SAAA;;;cCjZxC,iBAAA,YAA6B,qBAAA;EAAA;cAG5B,EAAA,EAAI,WAAA;EAAA,OAIH,MAAA,CACX,MAAA,YACC,OAAA,CAAQ,iBAAA;EA4CL,WAAA,CAAY,OAAA,EAAS,UAAA,GAAU,OAAA;EAS/B,WAAA,CAAA,GAAe,OAAA,CAAQ,UAAA;EAavB,aAAA,CAAA,GAAiB,OAAA;AAAA"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { $ as User, A as ISigner, B as PKHDid, C as DIDResolutionResult, D as IPowerhouseIssuerType, E as IPowerhouseCredentialSubject, F as JWTVerified, G as RenownEvents, H as ProfileFetcher, I as JWTVerifyPolicies, J as RenownStorageMap, K as RenownProfile, L as JsonWebKey, M as InternalUser, N as Issuer, O as IProof, P as JWTPayload, Q as Unsubscribe, R as KeyCapabilitySection, S as DIDResolutionMetadata, T as IAuthCredentialSubject, U as Proof, V as PowerhouseVerifiableCredential, W as RenownEventEmitter, X as ServiceEndpoint, Y as Service, Z as Signer, _ as ConditionWeightedThreshold, a as signatureHasResultingHash, at as BaseStorage, b as DIDDocument, c as ConnectCrypto, ct as CREDENTIAL_SCHEMA_EIP712_TYPE, d as IConnectCrypto, dt as DEFAULT_RENOWN_CHAIN_ID, et as Verifiable, f as IRenownCrypto, ft as DEFAULT_RENOWN_NETWORK_ID, g as AuthVerifiedCredential, gt as VERIFIABLE_CREDENTIAL_EIP712_TYPE, h as AuthVerifiableCredential, ht as ISSUER_TYPE, i as parseSignatureHashField, it as W3CCredential, j as IVerifiableCredential, k as IRenown, l as RenownCrypto, lt as CREDENTIAL_SUBJECT_TYPE, m as JwkKeyPair, mt as DOMAIN_TYPE, n as createSignatureVerifier, nt as VerifiedCredential, o as MemoryKeyStorage, p as JsonWebKeyPairStorage, pt as DEFAULT_RENOWN_URL, q as RenownStorage, r as extractResultingHashFromSignature, rt as VerifiedJWT, s as RenownCryptoBuilder, st as IEventEmitter, t as RenownCryptoSigner, tt as VerificationMethod, u as DID, ut as CREDENTIAL_TYPES, v as CreateBearerTokenOptions, w as EcdsaSignature, x as DIDDocumentMetadata, y as CredentialStatus, z as LoginStatus } from "./signer-DYKGoYHB.js";
-import { t as BrowserKeyStorage } from "./browser-key-storage-DSkDBAhU.js";
-import { _ as verifyCredentialSignature, a as getResolver, c as fetchRenownProfile, d as BuildCredentialParams, f as CredentialDomain, g as recoverCredentialSigner, h as buildAndSignCredential, i as createAuthBearerToken, l as BaseRenownBuilder, m as SignCredentialTypedData, n as VerifyAuthBearerTokenOptions, o as parsePkhDid, p as CredentialMessage, r as assertIsAuthCredential, s as verifyAuthBearerToken, t as ILogger, u as RenownBuilderOptions, v as Renown, y as RenownMemoryStorage } from "./utils-D8C7f9Qs.js";
+import { $ as IEventEmitter, A as LoginStatus, B as Service, C as InternalUser, D as JWTVerifyPolicies, E as JWTVerified, F as RenownEventEmitter, G as User, H as SignInParams, I as RenownEvents, J as VerifiedCredential, K as Verifiable, L as RenownProfile, M as PowerhouseVerifiableCredential, N as ProfileFetcher, O as JsonWebKey, P as Proof, R as RenownStorage, S as IVerifiableCredential, T as JWTPayload, U as Signer, V as ServiceEndpoint, W as Unsubscribe, X as W3CCredential, Y as VerifiedJWT, Z as BaseStorage, _ as IPowerhouseCredentialSubject, _t as DEFAULT_RENOWN_URL, a as JwkKeyPair, at as VerifiedAuthCredential, b as IRenown, bt as RENOWN_SESSION_COOKIE, c as ConditionWeightedThreshold, ct as fetchDelegationCredential, d as DIDDocument, dt as verifyCredentialSignature, et as BuildCredentialParams, f as DIDDocumentMetadata, ft as CREDENTIAL_SCHEMA_EIP712_TYPE, g as IAuthCredentialSubject, gt as DEFAULT_RENOWN_NETWORK_ID, h as EcdsaSignature, ht as DEFAULT_RENOWN_CHAIN_ID, i as JsonWebKeyPairStorage, it as SignCredentialTypedData, j as PKHDid, k as KeyCapabilitySection, l as CreateBearerTokenOptions, lt as recoverCredentialSigner, m as DIDResolutionResult, mt as CREDENTIAL_TYPES, n as IConnectCrypto, nt as CredentialMessage, o as AuthVerifiableCredential, ot as VerifyAuthCredentialOptions, p as DIDResolutionMetadata, pt as CREDENTIAL_SUBJECT_TYPE, q as VerificationMethod, r as IRenownCrypto, rt as FetchDelegationCredentialOptions, s as AuthVerifiedCredential, st as buildAndSignCredential, t as DID, tt as CredentialDomain, u as CredentialStatus, ut as verifyAuthCredential, v as IPowerhouseIssuerType, vt as DOMAIN_TYPE, w as Issuer, x as ISigner, xt as VERIFIABLE_CREDENTIAL_EIP712_TYPE, y as IProof, yt as ISSUER_TYPE, z as RenownStorageMap } from "./types-DsF91dDF.js";
+import { a as parseSignatureHashField, c as RenownCryptoBuilder, i as extractResultingHashFromSignature, l as ConnectCrypto, n as RenownCryptoSigner, o as signatureHasResultingHash, r as createSignatureVerifier, s as MemoryKeyStorage, t as BrowserKeyStorage, u as RenownCrypto } from "./index-25fTa4yI.js";
+import { a as getResolver, c as fetchRenownProfile, d as ResolveSwitchboardEndpointOptions, f as resolveSwitchboardEndpoint, h as SwitchboardClient, i as createAuthBearerToken, l as BaseRenownBuilder, m as RenownMemoryStorage, n as VerifyAuthBearerTokenOptions, o as parsePkhDid, p as Renown, r as assertIsAuthCredential, s as verifyAuthBearerToken, t as ILogger, u as RenownBuilderOptions } from "./utils-OOrVXHof.js";
 
 //#region src/event/event.browser.d.ts
 declare class BrowserEventEmitter<Events extends Record<string, unknown>> implements IEventEmitter<Events> {
@@ -22,13 +22,18 @@ declare class BrowserStorage<T extends Record<string, unknown> = Record<string,
 //#region src/init.browser.d.ts
 declare class BrowserRenownStorage extends BrowserStorage<RenownStorageMap> {}
 declare class BrowserRenownEventEmitter extends BrowserEventEmitter<RenownEvents> {}
+declare function readPersistedUser(basename?: string): User | undefined;
 interface BrowserRenownBuilderOptions {
   /** Base path for storage keys (e.g., "/app" for multi-tenant apps) */
   basename?: string;
   /** Renown server URL. Defaults to https://www.renown.id */
   baseUrl?: string;
+  /** Switchboard GraphQL endpoint for the direct-to-reactor flow. */
+  switchboardUrl?: string;
   /** IndexedDB database name for key storage. Defaults to "renownKeyDB" */
   keyDbName?: string;
+  /** Re-check a stored credential on build (default "always"). */
+  revalidate?: "always" | "never";
 }
 /**
  * Browser-specific Renown builder with pre-configured defaults.
@@ -36,10 +41,6 @@ interface BrowserRenownBuilderOptions {
  */
 declare class RenownBuilder extends BaseRenownBuilder {
   #private;
-  /**
-   * @param appName - Application name used for signing context
-   * @param options - Browser-specific configuration options
-   */
   constructor(appName: string, options?: BrowserRenownBuilderOptions);
   /**
    * Set base path for storage keys (e.g., "/app" for multi-tenant apps).
@@ -65,5 +66,5 @@ declare class RenownBuilder extends BaseRenownBuilder {
  */
 declare function initRenown(appName: string, options?: BrowserRenownBuilderOptions): Promise<Renown>;
 //#endregion
-export { AuthVerifiableCredential, AuthVerifiedCredential, BaseRenownBuilder, BrowserKeyStorage, BrowserRenownBuilderOptions, BrowserRenownEventEmitter, BrowserRenownStorage, BuildCredentialParams, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConditionWeightedThreshold, ConnectCrypto, CreateBearerTokenOptions, CredentialDomain, CredentialMessage, CredentialStatus, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DID, DIDDocument, DIDDocumentMetadata, DIDResolutionMetadata, DIDResolutionResult, DOMAIN_TYPE, EcdsaSignature, IAuthCredentialSubject, IConnectCrypto, ILogger, IPowerhouseCredentialSubject, IPowerhouseIssuerType, IProof, IRenown, IRenownCrypto, ISSUER_TYPE, ISigner, IVerifiableCredential, InternalUser, Issuer, JWTPayload, JWTVerified, JWTVerifyPolicies, JsonWebKey, JsonWebKeyPairStorage, JwkKeyPair, KeyCapabilitySection, LoginStatus, MemoryKeyStorage, PKHDid, PowerhouseVerifiableCredential, ProfileFetcher, Proof, Renown, RenownBuilder, RenownBuilderOptions, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownEventEmitter, RenownEvents, RenownMemoryStorage, RenownProfile, RenownStorage, RenownStorageMap, Service, ServiceEndpoint, SignCredentialTypedData, Signer, Unsubscribe, User, VERIFIABLE_CREDENTIAL_EIP712_TYPE, Verifiable, VerificationMethod, VerifiedCredential, VerifiedJWT, VerifyAuthBearerTokenOptions, W3CCredential, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, recoverCredentialSigner, signatureHasResultingHash, verifyAuthBearerToken, verifyCredentialSignature };
+export { AuthVerifiableCredential, AuthVerifiedCredential, BaseRenownBuilder, BrowserKeyStorage, BrowserRenownBuilderOptions, BrowserRenownEventEmitter, BrowserRenownStorage, BuildCredentialParams, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConditionWeightedThreshold, ConnectCrypto, CreateBearerTokenOptions, CredentialDomain, CredentialMessage, CredentialStatus, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DID, DIDDocument, DIDDocumentMetadata, DIDResolutionMetadata, DIDResolutionResult, DOMAIN_TYPE, EcdsaSignature, FetchDelegationCredentialOptions, IAuthCredentialSubject, IConnectCrypto, ILogger, IPowerhouseCredentialSubject, IPowerhouseIssuerType, IProof, IRenown, IRenownCrypto, ISSUER_TYPE, ISigner, IVerifiableCredential, InternalUser, Issuer, JWTPayload, JWTVerified, JWTVerifyPolicies, JsonWebKey, JsonWebKeyPairStorage, JwkKeyPair, KeyCapabilitySection, LoginStatus, MemoryKeyStorage, PKHDid, PowerhouseVerifiableCredential, ProfileFetcher, Proof, RENOWN_SESSION_COOKIE, Renown, RenownBuilder, RenownBuilderOptions, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownEventEmitter, RenownEvents, RenownMemoryStorage, RenownProfile, RenownStorage, RenownStorageMap, ResolveSwitchboardEndpointOptions, Service, ServiceEndpoint, SignCredentialTypedData, SignInParams, Signer, SwitchboardClient, Unsubscribe, User, VERIFIABLE_CREDENTIAL_EIP712_TYPE, Verifiable, VerificationMethod, VerifiedAuthCredential, VerifiedCredential, VerifiedJWT, VerifyAuthBearerTokenOptions, VerifyAuthCredentialOptions, W3CCredential, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, readPersistedUser, recoverCredentialSigner, resolveSwitchboardEndpoint, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/event/event.browser.ts","../src/storage/storage.browser.ts","../src/init.browser.ts"],"mappings":";;;;;cAQa,mBAAA,gBACI,MAAA,8BACJ,aAAA,CAAc,MAAA;EAAA;EAGzB,EAAA,iBAAmB,MAAA,CAAA,CACjB,KAAA,EAAO,CAAA,EACP,QAAA,GAAW,IAAA,EAAM,MAAA,CAAO,CAAA;EAc1B,IAAA,iBAAqB,MAAA,CAAA,CAAQ,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,MAAA,CAAO,CAAA;AAAA;;;cC3BzC,cAAA,WACD,MAAA,oBAA0B,MAAA,2BAC5B,WAAA,CAAY,CAAA;EAAA;mBACH,SAAA;cAEL,SAAA,UAAmB,QAAA;EAQ/B,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,GAAM,CAAA,CAAE,GAAA;EAQtC,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,GAAA;EAM7C,MAAA,CAAO,GAAA,QAAW,CAAA;AAAA;;;cCtBP,oBAAA,SAA6B,cAAA,CAAe,gBAAA;AAAA,cAC5C,yBAAA,SAAkC,mBAAA,CAAoB,YAAA;AAAA,UAElD,2BAAA;EFGI;EEDnB,QAAA;EFGmB;EEDnB,OAAA;EFeqB;EEbrB,SAAA;AAAA;;;;;cAOW,aAAA,SAAsB,iBAAA;EAAA;EFbtB;;;;cEqBC,OAAA,UAAiB,OAAA,GAAS,2BAAA;EFlBnB;;;EEgCnB,YAAA,CAAa,QAAA;EF9Ba;;;;EEwC1B,aAAA,CAAc,SAAA;EF1BO;;;;EEmCf,KAAA,CAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;;;;;;AD9DzB;;iBC4EgB,UAAA,CACd,OAAA,UACA,OAAA,GAAS,2BAAA,GAAgC,OAAA,CAAA,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/event/event.browser.ts","../src/storage/storage.browser.ts","../src/init.browser.ts"],"mappings":";;;;;cAQa,mBAAA,gBACI,MAAA,8BACJ,aAAA,CAAc,MAAA;EAAA;EAGzB,EAAA,iBAAmB,MAAA,CAAA,CACjB,KAAA,EAAO,CAAA,EACP,QAAA,GAAW,IAAA,EAAM,MAAA,CAAO,CAAA;EAc1B,IAAA,iBAAqB,MAAA,CAAA,CAAQ,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,MAAA,CAAO,CAAA;AAAA;;;cC3BzC,cAAA,WACD,MAAA,oBAA0B,MAAA,2BAC5B,WAAA,CAAY,CAAA;EAAA;mBACH,SAAA;cAEL,SAAA,UAAmB,QAAA;EAQ/B,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,GAAM,CAAA,CAAE,GAAA;EAQtC,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,GAAA;EAM7C,MAAA,CAAO,GAAA,QAAW,CAAA;AAAA;;;cCtBP,oBAAA,SAA6B,cAAA,CAAe,gBAAA;AAAA,cAC5C,yBAAA,SAAkC,mBAAA,CAAoB,YAAA;AAAA,iBAInD,iBAAA,CAAkB,QAAA,YAAoB,IAAA;AAAA,UASrC,2BAAA;EFPN;EEST,QAAA;EFR0B;EEU1B,OAAA;EFIoC;EEFpC,cAAA;EFEoD;EEApD,SAAA;EFnBwB;EEqBxB,UAAA;AAAA;;;;;cAOW,aAAA,SAAsB,iBAAA;EAAA;cAKrB,OAAA,UAAiB,OAAA,GAAS,2BAAA;EF7B7B;;;EE+CT,YAAA,CAAa,QAAA;EF9CA;;;;EEwDb,aAAA,CAAc,SAAA;EF1CsB;;;;EEmD9B,KAAA,CAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;;;;;AD9EzB;;;iBCkGgB,UAAA,CACd,OAAA,UACA,OAAA,GAAS,2BAAA,GAAgC,OAAA,CAAA,MAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
-import { _ as VERIFIABLE_CREDENTIAL_EIP712_TYPE, a as BaseStorage, c as verifyCredentialSignature, d as CREDENTIAL_TYPES, f as DEFAULT_RENOWN_CHAIN_ID, g as ISSUER_TYPE, h as DOMAIN_TYPE, i as RenownMemoryStorage, l as CREDENTIAL_SCHEMA_EIP712_TYPE, m as DEFAULT_RENOWN_URL, n as fetchRenownProfile, o as buildAndSignCredential, p as DEFAULT_RENOWN_NETWORK_ID, r as Renown, s as recoverCredentialSigner, t as BaseRenownBuilder, u as CREDENTIAL_SUBJECT_TYPE } from "./renown-builder-DP0iFzK1.js";
-import { a as signatureHasResultingHash, c as ConnectCrypto, d as createAuthBearerToken, f as getResolver, i as parseSignatureHashField, l as RenownCrypto, m as verifyAuthBearerToken, n as createSignatureVerifier, o as MemoryKeyStorage, p as parsePkhDid, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner, u as assertIsAuthCredential } from "./signer-XkA-D7Qt.js";
+import { S as VERIFIABLE_CREDENTIAL_EIP712_TYPE, _ as DEFAULT_RENOWN_NETWORK_ID, a as BaseStorage, b as ISSUER_TYPE, c as recoverCredentialSigner, d as SwitchboardClient, f as resolveSwitchboardEndpoint, g as DEFAULT_RENOWN_CHAIN_ID, h as CREDENTIAL_TYPES, i as RenownMemoryStorage, l as verifyAuthCredential, m as CREDENTIAL_SUBJECT_TYPE, n as fetchRenownProfile, o as buildAndSignCredential, p as CREDENTIAL_SCHEMA_EIP712_TYPE, r as Renown, s as fetchDelegationCredential, t as BaseRenownBuilder, u as verifyCredentialSignature, v as DEFAULT_RENOWN_URL, x as RENOWN_SESSION_COOKIE, y as DOMAIN_TYPE } from "./renown-builder-BqWoYtBR.js";
+import { a as signatureHasResultingHash, c as ConnectCrypto, d as createAuthBearerToken, f as getResolver, i as parseSignatureHashField, l as RenownCrypto, m as verifyAuthBearerToken, n as createSignatureVerifier, o as MemoryKeyStorage, p as parsePkhDid, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner, u as assertIsAuthCredential } from "./signer-CgYhXTV7.js";
 import { t as BrowserKeyStorage } from "./browser-key-storage-v4O-fjz0.js";
 //#region src/event/event.browser.ts
 var TypedCustomEvent = class extends CustomEvent {
@@ -49,6 +49,14 @@ var BrowserStorage = class extends BaseStorage {
 //#region src/init.browser.ts
 var BrowserRenownStorage = class extends BrowserStorage {};
 var BrowserRenownEventEmitter = class extends BrowserEventEmitter {};
+function readPersistedUser(basename) {
+	if (typeof localStorage === "undefined") return void 0;
+	try {
+		return new BrowserStorage("renown", basename).get("user");
+	} catch {
+		return;
+	}
+}
 /**
 * Browser-specific Renown builder with pre-configured defaults.
 * Uses localStorage for user data and IndexedDB for key storage.
@@ -56,17 +64,16 @@ var BrowserRenownEventEmitter = class extends BrowserEventEmitter {};
 var RenownBuilder = class extends BaseRenownBuilder {
 	#basename;
 	#keyDbName;
-	/**
-	* @param appName - Application name used for signing context
-	* @param options - Browser-specific configuration options
-	*/
+	#revalidate;
 	constructor(appName, options = {}) {
 		super(appName);
 		this.#basename = options.basename;
 		this.#keyDbName = options.keyDbName;
+		this.#revalidate = options.revalidate ?? "always";
 		this.withStorage(new BrowserRenownStorage("renown", this.#basename));
 		this.withEventEmitter(new BrowserRenownEventEmitter());
 		if (options.baseUrl) this.withBaseUrl(options.baseUrl);
+		if (options.switchboardUrl) this.withSwitchboardUrl(options.switchboardUrl);
 	}
 	/**
 	* Set base path for storage keys (e.g., "/app" for multi-tenant apps).
@@ -91,7 +98,9 @@ var RenownBuilder = class extends BaseRenownBuilder {
 	async build() {
 		const keyStorage = await BrowserKeyStorage.create(this.#keyDbName);
 		this.withKeyPairStorage(keyStorage);
-		return super.build();
+		const renown = await super.build();
+		if (this.#revalidate === "always" && renown.user) renown.revalidate();
+		return renown;
 	}
 };
 /**
@@ -105,6 +114,6 @@ function initRenown(appName, options = {}) {
 	return new RenownBuilder(appName, options).build();
 }
 //#endregion
-export { BaseRenownBuilder, BrowserKeyStorage, BrowserRenownEventEmitter, BrowserRenownStorage, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConnectCrypto, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DOMAIN_TYPE, ISSUER_TYPE, MemoryKeyStorage, Renown, RenownBuilder, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownMemoryStorage, VERIFIABLE_CREDENTIAL_EIP712_TYPE, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, recoverCredentialSigner, signatureHasResultingHash, verifyAuthBearerToken, verifyCredentialSignature };
+export { BaseRenownBuilder, BrowserKeyStorage, BrowserRenownEventEmitter, BrowserRenownStorage, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConnectCrypto, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DOMAIN_TYPE, ISSUER_TYPE, MemoryKeyStorage, RENOWN_SESSION_COOKIE, Renown, RenownBuilder, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownMemoryStorage, SwitchboardClient, VERIFIABLE_CREDENTIAL_EIP712_TYPE, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, readPersistedUser, recoverCredentialSigner, resolveSwitchboardEndpoint, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["#eventTarget","#buildKey","#basename","#keyDbName"],"sources":["../src/event/event.browser.ts","../src/storage/storage.browser.ts","../src/init.browser.ts"],"sourcesContent":["import type { IEventEmitter } from \"./types.js\";\n\nexport class TypedCustomEvent<T> extends CustomEvent<T> {\n  constructor(type: string, detail?: T) {\n    super(type, { detail });\n  }\n}\n\nexport class BrowserEventEmitter<\n  Events extends Record<string, unknown>,\n> implements IEventEmitter<Events> {\n  #eventTarget = new EventTarget();\n\n  on<K extends keyof Events>(\n    event: K,\n    listener: (data: Events[K]) => void,\n  ): () => void {\n    const wrappedListener = (e: Event) => {\n      if (e instanceof TypedCustomEvent) {\n        listener(e.detail as Events[K]);\n      }\n    };\n\n    this.#eventTarget.addEventListener(event.toString(), wrappedListener);\n    return () => {\n      this.#eventTarget.removeEventListener(event.toString(), wrappedListener);\n    };\n  }\n\n  emit<K extends keyof Events>(event: K, data: Events[K]): void {\n    const customEvent = new TypedCustomEvent(event.toString(), data);\n    this.#eventTarget.dispatchEvent(customEvent);\n  }\n}\n","import { BaseStorage } from \"./common.js\";\n\nexport class BrowserStorage<\n  T extends Record<string, unknown> = Record<string, unknown>,\n> extends BaseStorage<T> {\n  private readonly namespace: string;\n\n  constructor(namespace: string, basename: string | undefined) {\n    super();\n    this.namespace = `${basename}:${namespace}`;\n  }\n\n  #buildKey(key: keyof T): string {\n    return `${this.namespace}:${key.toString()}`;\n  }\n  get<Key extends keyof T>(key: Key): T[Key] | undefined {\n    const value = localStorage.getItem(this.#buildKey(key));\n    if (value) {\n      return JSON.parse(value) as T[Key];\n    }\n    return undefined;\n  }\n\n  set<Key extends keyof T>(key: Key, value?: T[Key]): void {\n    return value\n      ? localStorage.setItem(this.#buildKey(key), JSON.stringify(value))\n      : localStorage.removeItem(this.#buildKey(key));\n  }\n\n  delete(key: keyof T): void {\n    return localStorage.removeItem(this.#buildKey(key));\n  }\n}\n","import type { Renown } from \"./common.js\";\nimport { BrowserKeyStorage } from \"./crypto/browser-key-storage.js\";\nimport { BrowserEventEmitter } from \"./event/event.browser.js\";\nimport { BaseRenownBuilder } from \"./renown-builder.js\";\nimport { BrowserStorage } from \"./storage/storage.browser.js\";\nimport type { RenownEvents, RenownStorageMap } from \"./types.js\";\n\nexport class BrowserRenownStorage extends BrowserStorage<RenownStorageMap> {}\nexport class BrowserRenownEventEmitter extends BrowserEventEmitter<RenownEvents> {}\n\nexport interface BrowserRenownBuilderOptions {\n  /** Base path for storage keys (e.g., \"/app\" for multi-tenant apps) */\n  basename?: string;\n  /** Renown server URL. Defaults to https://www.renown.id */\n  baseUrl?: string;\n  /** IndexedDB database name for key storage. Defaults to \"renownKeyDB\" */\n  keyDbName?: string;\n}\n\n/**\n * Browser-specific Renown builder with pre-configured defaults.\n * Uses localStorage for user data and IndexedDB for key storage.\n */\nexport class RenownBuilder extends BaseRenownBuilder {\n  #basename?: string;\n  #keyDbName?: string;\n\n  /**\n   * @param appName - Application name used for signing context\n   * @param options - Browser-specific configuration options\n   */\n  constructor(appName: string, options: BrowserRenownBuilderOptions = {}) {\n    super(appName);\n    this.#basename = options.basename;\n    this.#keyDbName = options.keyDbName;\n    this.withStorage(new BrowserRenownStorage(\"renown\", this.#basename));\n    this.withEventEmitter(new BrowserRenownEventEmitter());\n    if (options.baseUrl) {\n      this.withBaseUrl(options.baseUrl);\n    }\n  }\n\n  /**\n   * Set base path for storage keys (e.g., \"/app\" for multi-tenant apps).\n   */\n  withBasename(basename: string): this {\n    this.#basename = basename;\n    this.withStorage(new BrowserRenownStorage(\"renown\", this.#basename));\n    return this;\n  }\n\n  /**\n   * Set IndexedDB database name for key storage.\n   * Defaults to \"renownKeyDB\".\n   */\n  withKeyDbName(keyDbName: string): this {\n    this.#keyDbName = keyDbName;\n    return this;\n  }\n\n  /**\n   * Build and initialize the Renown instance.\n   * Initializes IndexedDB for key storage before building.\n   */\n  async build(): Promise<Renown> {\n    const keyStorage = await BrowserKeyStorage.create(this.#keyDbName);\n    this.withKeyPairStorage(keyStorage);\n    return super.build();\n  }\n}\n\n/**\n * @deprecated Use RenownBuilder directly instead.\n * Initialize a browser-specific Renown instance.\n * @param appName - Application name used for signing context\n * @param options - Browser-specific configuration options\n * @returns Initialized Renown instance\n */\nexport function initRenown(\n  appName: string,\n  options: BrowserRenownBuilderOptions = {},\n) {\n  return new RenownBuilder(appName, options).build();\n}\n"],"mappings":";;;;AAEA,IAAa,mBAAb,cAAyC,YAAe;CACtD,YAAY,MAAc,QAAY;AACpC,QAAM,MAAM,EAAE,QAAQ,CAAC;;;AAI3B,IAAa,sBAAb,MAEmC;CACjC,eAAe,IAAI,aAAa;CAEhC,GACE,OACA,UACY;EACZ,MAAM,mBAAmB,MAAa;AACpC,OAAI,aAAa,iBACf,UAAS,EAAE,OAAoB;;AAInC,QAAA,YAAkB,iBAAiB,MAAM,UAAU,EAAE,gBAAgB;AACrE,eAAa;AACX,SAAA,YAAkB,oBAAoB,MAAM,UAAU,EAAE,gBAAgB;;;CAI5E,KAA6B,OAAU,MAAuB;EAC5D,MAAM,cAAc,IAAI,iBAAiB,MAAM,UAAU,EAAE,KAAK;AAChE,QAAA,YAAkB,cAAc,YAAY;;;;;AC7BhD,IAAa,iBAAb,cAEU,YAAe;CACvB;CAEA,YAAY,WAAmB,UAA8B;AAC3D,SAAO;AACP,OAAK,YAAY,GAAG,SAAS,GAAG;;CAGlC,UAAU,KAAsB;AAC9B,SAAO,GAAG,KAAK,UAAU,GAAG,IAAI,UAAU;;CAE5C,IAAyB,KAA8B;EACrD,MAAM,QAAQ,aAAa,QAAQ,MAAA,SAAe,IAAI,CAAC;AACvD,MAAI,MACF,QAAO,KAAK,MAAM,MAAM;;CAK5B,IAAyB,KAAU,OAAsB;AACvD,SAAO,QACH,aAAa,QAAQ,MAAA,SAAe,IAAI,EAAE,KAAK,UAAU,MAAM,CAAC,GAChE,aAAa,WAAW,MAAA,SAAe,IAAI,CAAC;;CAGlD,OAAO,KAAoB;AACzB,SAAO,aAAa,WAAW,MAAA,SAAe,IAAI,CAAC;;;;;ACvBvD,IAAa,uBAAb,cAA0C,eAAiC;AAC3E,IAAa,4BAAb,cAA+C,oBAAkC;;;;;AAejF,IAAa,gBAAb,cAAmC,kBAAkB;CACnD;CACA;;;;;CAMA,YAAY,SAAiB,UAAuC,EAAE,EAAE;AACtE,QAAM,QAAQ;AACd,QAAA,WAAiB,QAAQ;AACzB,QAAA,YAAkB,QAAQ;AAC1B,OAAK,YAAY,IAAI,qBAAqB,UAAU,MAAA,SAAe,CAAC;AACpE,OAAK,iBAAiB,IAAI,2BAA2B,CAAC;AACtD,MAAI,QAAQ,QACV,MAAK,YAAY,QAAQ,QAAQ;;;;;CAOrC,aAAa,UAAwB;AACnC,QAAA,WAAiB;AACjB,OAAK,YAAY,IAAI,qBAAqB,UAAU,MAAA,SAAe,CAAC;AACpE,SAAO;;;;;;CAOT,cAAc,WAAyB;AACrC,QAAA,YAAkB;AAClB,SAAO;;;;;;CAOT,MAAM,QAAyB;EAC7B,MAAM,aAAa,MAAM,kBAAkB,OAAO,MAAA,UAAgB;AAClE,OAAK,mBAAmB,WAAW;AACnC,SAAO,MAAM,OAAO;;;;;;;;;;AAWxB,SAAgB,WACd,SACA,UAAuC,EAAE,EACzC;AACA,QAAO,IAAI,cAAc,SAAS,QAAQ,CAAC,OAAO"}
+{"version":3,"file":"index.js","names":["#eventTarget","#buildKey","#basename","#keyDbName","#revalidate"],"sources":["../src/event/event.browser.ts","../src/storage/storage.browser.ts","../src/init.browser.ts"],"sourcesContent":["import type { IEventEmitter } from \"./types.js\";\n\nexport class TypedCustomEvent<T> extends CustomEvent<T> {\n  constructor(type: string, detail?: T) {\n    super(type, { detail });\n  }\n}\n\nexport class BrowserEventEmitter<\n  Events extends Record<string, unknown>,\n> implements IEventEmitter<Events> {\n  #eventTarget = new EventTarget();\n\n  on<K extends keyof Events>(\n    event: K,\n    listener: (data: Events[K]) => void,\n  ): () => void {\n    const wrappedListener = (e: Event) => {\n      if (e instanceof TypedCustomEvent) {\n        listener(e.detail as Events[K]);\n      }\n    };\n\n    this.#eventTarget.addEventListener(event.toString(), wrappedListener);\n    return () => {\n      this.#eventTarget.removeEventListener(event.toString(), wrappedListener);\n    };\n  }\n\n  emit<K extends keyof Events>(event: K, data: Events[K]): void {\n    const customEvent = new TypedCustomEvent(event.toString(), data);\n    this.#eventTarget.dispatchEvent(customEvent);\n  }\n}\n","import { BaseStorage } from \"./common.js\";\n\nexport class BrowserStorage<\n  T extends Record<string, unknown> = Record<string, unknown>,\n> extends BaseStorage<T> {\n  private readonly namespace: string;\n\n  constructor(namespace: string, basename: string | undefined) {\n    super();\n    this.namespace = `${basename}:${namespace}`;\n  }\n\n  #buildKey(key: keyof T): string {\n    return `${this.namespace}:${key.toString()}`;\n  }\n  get<Key extends keyof T>(key: Key): T[Key] | undefined {\n    const value = localStorage.getItem(this.#buildKey(key));\n    if (value) {\n      return JSON.parse(value) as T[Key];\n    }\n    return undefined;\n  }\n\n  set<Key extends keyof T>(key: Key, value?: T[Key]): void {\n    return value\n      ? localStorage.setItem(this.#buildKey(key), JSON.stringify(value))\n      : localStorage.removeItem(this.#buildKey(key));\n  }\n\n  delete(key: keyof T): void {\n    return localStorage.removeItem(this.#buildKey(key));\n  }\n}\n","import type { Renown } from \"./common.js\";\nimport { BrowserKeyStorage } from \"./crypto/browser-key-storage.js\";\nimport { BrowserEventEmitter } from \"./event/event.browser.js\";\nimport { BaseRenownBuilder } from \"./renown-builder.js\";\nimport { BrowserStorage } from \"./storage/storage.browser.js\";\nimport type { RenownEvents, RenownStorageMap, User } from \"./types.js\";\n\nexport class BrowserRenownStorage extends BrowserStorage<RenownStorageMap> {}\nexport class BrowserRenownEventEmitter extends BrowserEventEmitter<RenownEvents> {}\n\n// Synchronously read the persisted user from localStorage (browser only) for an\n// instant optimistic first paint, before the async SDK build resolves.\nexport function readPersistedUser(basename?: string): User | undefined {\n  if (typeof localStorage === \"undefined\") return undefined;\n  try {\n    return new BrowserStorage<RenownStorageMap>(\"renown\", basename).get(\"user\");\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface BrowserRenownBuilderOptions {\n  /** Base path for storage keys (e.g., \"/app\" for multi-tenant apps) */\n  basename?: string;\n  /** Renown server URL. Defaults to https://www.renown.id */\n  baseUrl?: string;\n  /** Switchboard GraphQL endpoint for the direct-to-reactor flow. */\n  switchboardUrl?: string;\n  /** IndexedDB database name for key storage. Defaults to \"renownKeyDB\" */\n  keyDbName?: string;\n  /** Re-check a stored credential on build (default \"always\"). */\n  revalidate?: \"always\" | \"never\";\n}\n\n/**\n * Browser-specific Renown builder with pre-configured defaults.\n * Uses localStorage for user data and IndexedDB for key storage.\n */\nexport class RenownBuilder extends BaseRenownBuilder {\n  #basename?: string;\n  #keyDbName?: string;\n  #revalidate: \"always\" | \"never\";\n\n  constructor(appName: string, options: BrowserRenownBuilderOptions = {}) {\n    super(appName);\n    this.#basename = options.basename;\n    this.#keyDbName = options.keyDbName;\n    this.#revalidate = options.revalidate ?? \"always\";\n    this.withStorage(new BrowserRenownStorage(\"renown\", this.#basename));\n    this.withEventEmitter(new BrowserRenownEventEmitter());\n    if (options.baseUrl) {\n      this.withBaseUrl(options.baseUrl);\n    }\n    if (options.switchboardUrl) {\n      this.withSwitchboardUrl(options.switchboardUrl);\n    }\n  }\n\n  /**\n   * Set base path for storage keys (e.g., \"/app\" for multi-tenant apps).\n   */\n  withBasename(basename: string): this {\n    this.#basename = basename;\n    this.withStorage(new BrowserRenownStorage(\"renown\", this.#basename));\n    return this;\n  }\n\n  /**\n   * Set IndexedDB database name for key storage.\n   * Defaults to \"renownKeyDB\".\n   */\n  withKeyDbName(keyDbName: string): this {\n    this.#keyDbName = keyDbName;\n    return this;\n  }\n\n  /**\n   * Build and initialize the Renown instance.\n   * Initializes IndexedDB for key storage before building.\n   */\n  async build(): Promise<Renown> {\n    const keyStorage = await BrowserKeyStorage.create(this.#keyDbName);\n    this.withKeyPairStorage(keyStorage);\n    const renown = await super.build();\n    // Browser has a reactive UI, so revalidate in the background (fail-open) and\n    // let the store update if the credential was revoked; never block the paint.\n    if (this.#revalidate === \"always\" && renown.user) {\n      void renown.revalidate();\n    }\n    return renown;\n  }\n}\n\n/**\n * @deprecated Use RenownBuilder directly instead.\n * Initialize a browser-specific Renown instance.\n * @param appName - Application name used for signing context\n * @param options - Browser-specific configuration options\n * @returns Initialized Renown instance\n */\nexport function initRenown(\n  appName: string,\n  options: BrowserRenownBuilderOptions = {},\n) {\n  return new RenownBuilder(appName, options).build();\n}\n"],"mappings":";;;;AAEA,IAAa,mBAAb,cAAyC,YAAe;CACtD,YAAY,MAAc,QAAY;AACpC,QAAM,MAAM,EAAE,QAAQ,CAAC;;;AAI3B,IAAa,sBAAb,MAEmC;CACjC,eAAe,IAAI,aAAa;CAEhC,GACE,OACA,UACY;EACZ,MAAM,mBAAmB,MAAa;AACpC,OAAI,aAAa,iBACf,UAAS,EAAE,OAAoB;;AAInC,QAAA,YAAkB,iBAAiB,MAAM,UAAU,EAAE,gBAAgB;AACrE,eAAa;AACX,SAAA,YAAkB,oBAAoB,MAAM,UAAU,EAAE,gBAAgB;;;CAI5E,KAA6B,OAAU,MAAuB;EAC5D,MAAM,cAAc,IAAI,iBAAiB,MAAM,UAAU,EAAE,KAAK;AAChE,QAAA,YAAkB,cAAc,YAAY;;;;;AC7BhD,IAAa,iBAAb,cAEU,YAAe;CACvB;CAEA,YAAY,WAAmB,UAA8B;AAC3D,SAAO;AACP,OAAK,YAAY,GAAG,SAAS,GAAG;;CAGlC,UAAU,KAAsB;AAC9B,SAAO,GAAG,KAAK,UAAU,GAAG,IAAI,UAAU;;CAE5C,IAAyB,KAA8B;EACrD,MAAM,QAAQ,aAAa,QAAQ,MAAA,SAAe,IAAI,CAAC;AACvD,MAAI,MACF,QAAO,KAAK,MAAM,MAAM;;CAK5B,IAAyB,KAAU,OAAsB;AACvD,SAAO,QACH,aAAa,QAAQ,MAAA,SAAe,IAAI,EAAE,KAAK,UAAU,MAAM,CAAC,GAChE,aAAa,WAAW,MAAA,SAAe,IAAI,CAAC;;CAGlD,OAAO,KAAoB;AACzB,SAAO,aAAa,WAAW,MAAA,SAAe,IAAI,CAAC;;;;;ACvBvD,IAAa,uBAAb,cAA0C,eAAiC;AAC3E,IAAa,4BAAb,cAA+C,oBAAkC;AAIjF,SAAgB,kBAAkB,UAAqC;AACrE,KAAI,OAAO,iBAAiB,YAAa,QAAO,KAAA;AAChD,KAAI;AACF,SAAO,IAAI,eAAiC,UAAU,SAAS,CAAC,IAAI,OAAO;SACrE;AACN;;;;;;;AAqBJ,IAAa,gBAAb,cAAmC,kBAAkB;CACnD;CACA;CACA;CAEA,YAAY,SAAiB,UAAuC,EAAE,EAAE;AACtE,QAAM,QAAQ;AACd,QAAA,WAAiB,QAAQ;AACzB,QAAA,YAAkB,QAAQ;AAC1B,QAAA,aAAmB,QAAQ,cAAc;AACzC,OAAK,YAAY,IAAI,qBAAqB,UAAU,MAAA,SAAe,CAAC;AACpE,OAAK,iBAAiB,IAAI,2BAA2B,CAAC;AACtD,MAAI,QAAQ,QACV,MAAK,YAAY,QAAQ,QAAQ;AAEnC,MAAI,QAAQ,eACV,MAAK,mBAAmB,QAAQ,eAAe;;;;;CAOnD,aAAa,UAAwB;AACnC,QAAA,WAAiB;AACjB,OAAK,YAAY,IAAI,qBAAqB,UAAU,MAAA,SAAe,CAAC;AACpE,SAAO;;;;;;CAOT,cAAc,WAAyB;AACrC,QAAA,YAAkB;AAClB,SAAO;;;;;;CAOT,MAAM,QAAyB;EAC7B,MAAM,aAAa,MAAM,kBAAkB,OAAO,MAAA,UAAgB;AAClE,OAAK,mBAAmB,WAAW;EACnC,MAAM,SAAS,MAAM,MAAM,OAAO;AAGlC,MAAI,MAAA,eAAqB,YAAY,OAAO,KACrC,QAAO,YAAY;AAE1B,SAAO;;;;;;;;;;AAWX,SAAgB,WACd,SACA,UAAuC,EAAE,EACzC;AACA,QAAO,IAAI,cAAc,SAAS,QAAQ,CAAC,OAAO"}

package/dist/node.d.ts

@@ -1,5 +1,6 @@
-import { $ as User, A as ISigner, B as PKHDid, C as DIDResolutionResult, D as IPowerhouseIssuerType, E as IPowerhouseCredentialSubject, F as JWTVerified, G as RenownEvents, H as ProfileFetcher, I as JWTVerifyPolicies, J as RenownStorageMap, K as RenownProfile, L as JsonWebKey, M as InternalUser, N as Issuer, O as IProof, P as JWTPayload, Q as Unsubscribe, R as KeyCapabilitySection, S as DIDResolutionMetadata, T as IAuthCredentialSubject, U as Proof, V as PowerhouseVerifiableCredential, W as RenownEventEmitter, X as ServiceEndpoint, Y as Service, Z as Signer, _ as ConditionWeightedThreshold, a as signatureHasResultingHash, at as BaseStorage, b as DIDDocument, c as ConnectCrypto, ct as CREDENTIAL_SCHEMA_EIP712_TYPE, d as IConnectCrypto, dt as DEFAULT_RENOWN_CHAIN_ID, et as Verifiable, f as IRenownCrypto, ft as DEFAULT_RENOWN_NETWORK_ID, g as AuthVerifiedCredential, gt as VERIFIABLE_CREDENTIAL_EIP712_TYPE, h as AuthVerifiableCredential, ht as ISSUER_TYPE, i as parseSignatureHashField, it as W3CCredential, j as IVerifiableCredential, k as IRenown, l as RenownCrypto, lt as CREDENTIAL_SUBJECT_TYPE, m as JwkKeyPair, mt as DOMAIN_TYPE, n as createSignatureVerifier, nt as VerifiedCredential, o as MemoryKeyStorage, p as JsonWebKeyPairStorage, pt as DEFAULT_RENOWN_URL, q as RenownStorage, r as extractResultingHashFromSignature, rt as VerifiedJWT, s as RenownCryptoBuilder, st as IEventEmitter, t as RenownCryptoSigner, tt as VerificationMethod, u as DID, ut as CREDENTIAL_TYPES, v as CreateBearerTokenOptions, w as EcdsaSignature, x as DIDDocumentMetadata, y as CredentialStatus, z as LoginStatus } from "./signer-DYKGoYHB.js";
-import { _ as verifyCredentialSignature, a as getResolver, c as fetchRenownProfile, d as BuildCredentialParams, f as CredentialDomain, g as recoverCredentialSigner, h as buildAndSignCredential, i as createAuthBearerToken, l as BaseRenownBuilder, m as SignCredentialTypedData, n as VerifyAuthBearerTokenOptions, o as parsePkhDid, p as CredentialMessage, r as assertIsAuthCredential, s as verifyAuthBearerToken, t as ILogger, u as RenownBuilderOptions, v as Renown, y as RenownMemoryStorage } from "./utils-D8C7f9Qs.js";
+import { $ as IEventEmitter, A as LoginStatus, B as Service, C as InternalUser, D as JWTVerifyPolicies, E as JWTVerified, F as RenownEventEmitter, G as User, H as SignInParams, I as RenownEvents, J as VerifiedCredential, K as Verifiable, L as RenownProfile, M as PowerhouseVerifiableCredential, N as ProfileFetcher, O as JsonWebKey, P as Proof, R as RenownStorage, S as IVerifiableCredential, T as JWTPayload, U as Signer, V as ServiceEndpoint, W as Unsubscribe, X as W3CCredential, Y as VerifiedJWT, Z as BaseStorage, _ as IPowerhouseCredentialSubject, _t as DEFAULT_RENOWN_URL, a as JwkKeyPair, at as VerifiedAuthCredential, b as IRenown, bt as RENOWN_SESSION_COOKIE, c as ConditionWeightedThreshold, ct as fetchDelegationCredential, d as DIDDocument, dt as verifyCredentialSignature, et as BuildCredentialParams, f as DIDDocumentMetadata, ft as CREDENTIAL_SCHEMA_EIP712_TYPE, g as IAuthCredentialSubject, gt as DEFAULT_RENOWN_NETWORK_ID, h as EcdsaSignature, ht as DEFAULT_RENOWN_CHAIN_ID, i as JsonWebKeyPairStorage, it as SignCredentialTypedData, j as PKHDid, k as KeyCapabilitySection, l as CreateBearerTokenOptions, lt as recoverCredentialSigner, m as DIDResolutionResult, mt as CREDENTIAL_TYPES, n as IConnectCrypto, nt as CredentialMessage, o as AuthVerifiableCredential, ot as VerifyAuthCredentialOptions, p as DIDResolutionMetadata, pt as CREDENTIAL_SUBJECT_TYPE, q as VerificationMethod, r as IRenownCrypto, rt as FetchDelegationCredentialOptions, s as AuthVerifiedCredential, st as buildAndSignCredential, t as DID, tt as CredentialDomain, u as CredentialStatus, ut as verifyAuthCredential, v as IPowerhouseIssuerType, vt as DOMAIN_TYPE, w as Issuer, x as ISigner, xt as VERIFIABLE_CREDENTIAL_EIP712_TYPE, y as IProof, yt as ISSUER_TYPE, z as RenownStorageMap } from "./types-DsF91dDF.js";
+import { a as parseSignatureHashField, c as RenownCryptoBuilder, i as extractResultingHashFromSignature, l as ConnectCrypto, n as RenownCryptoSigner, o as signatureHasResultingHash, r as createSignatureVerifier, s as MemoryKeyStorage, u as RenownCrypto } from "./index-25fTa4yI.js";
+import { a as getResolver, c as fetchRenownProfile, d as ResolveSwitchboardEndpointOptions, f as resolveSwitchboardEndpoint, h as SwitchboardClient, i as createAuthBearerToken, l as BaseRenownBuilder, m as RenownMemoryStorage, n as VerifyAuthBearerTokenOptions, o as parsePkhDid, p as Renown, r as assertIsAuthCredential, s as verifyAuthBearerToken, t as ILogger, u as RenownBuilderOptions } from "./utils-OOrVXHof.js";
 
 //#region src/crypto/node-key-storage.d.ts
 declare const RENOWN_PRIVATE_KEY_ENV = "PH_RENOWN_PRIVATE_KEY";
@@ -53,17 +54,16 @@ interface NodeRenownBuilderOptions {
   keyPath?: string;
   /** Renown server URL. Defaults to https://www.renown.id */
   baseUrl?: string;
+  /** Switchboard GraphQL endpoint for the direct-to-reactor flow. */
+  switchboardUrl?: string;
+  /** Re-check a stored credential on build (default "always"). */
+  revalidate?: "always" | "never";
 }
-/**
- * Node.js-specific Renown builder with pre-configured defaults.
- * Uses file-based storage for both user data and key storage.
- */
+/** Node.js Renown builder: file-based user + key storage. */
 declare class RenownBuilder extends BaseRenownBuilder {
-  /**
-   * @param appName - Application name used for signing context
-   * @param options - Node.js-specific configuration options
-   */
+  #private;
   constructor(appName: string, options?: NodeRenownBuilderOptions);
+  build(): Promise<Renown>;
 }
 //#endregion
 //#region src/login.node.d.ts
@@ -133,5 +133,48 @@ declare function parseExpiry(expiry: string): number;
  */
 declare function formatExpiry(expiresIn: number): string;
 //#endregion
-export { AccessTokenResult, AuthStatusResult, AuthVerifiableCredential, AuthVerifiedCredential, BaseRenownBuilder, BrowserLoginOptions, BrowserLoginResult, BuildCredentialParams, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConditionWeightedThreshold, ConnectCrypto, CreateBearerTokenOptions, CredentialDomain, CredentialMessage, CredentialStatus, DEFAULT_KEYPAIR_PATH, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_STORAGE_PATH, DEFAULT_RENOWN_URL, DID, DIDDocument, DIDDocumentMetadata, DIDResolutionMetadata, DIDResolutionResult, DOMAIN_TYPE, EcdsaSignature, IAuthCredentialSubject, IConnectCrypto, ILogger, IPowerhouseCredentialSubject, IPowerhouseIssuerType, IProof, IRenown, IRenownCrypto, ISSUER_TYPE, ISigner, IVerifiableCredential, InternalUser, Issuer, JWTPayload, JWTVerified, JWTVerifyPolicies, JsonWebKey, JsonWebKeyPairStorage, JwkKeyPair, KeyCapabilitySection, LoginStatus, MemoryKeyStorage, NodeEventEmitter, NodeKeyStorage, NodeRenownBuilderOptions, NodeRenownEventEmitter, NodeRenownStorage, NodeStorage, PKHDid, PowerhouseVerifiableCredential, ProfileFetcher, Proof, RENOWN_PRIVATE_KEY_ENV, Renown, RenownBuilder, RenownBuilderOptions, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownEventEmitter, RenownEvents, RenownMemoryStorage, RenownProfile, RenownStorage, RenownStorageMap, Service, ServiceEndpoint, SignCredentialTypedData, Signer, Unsubscribe, User, VERIFIABLE_CREDENTIAL_EIP712_TYPE, Verifiable, VerificationMethod, VerifiedCredential, VerifiedJWT, VerifyAuthBearerTokenOptions, W3CCredential, assertIsAuthCredential, browserLogin, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchRenownProfile, formatExpiry, generateAccessToken, getAuthStatus, getResolver, openBrowser, parseExpiry, parsePkhDid, parseSignatureHashField, recoverCredentialSigner, signatureHasResultingHash, verifyAuthBearerToken, verifyCredentialSignature };
+//#region src/session.d.ts
+/** Server-side view of an authenticated Renown session. */
+interface RenownSession {
+  /** Authenticated user identity derived from the session token. */
+  user: User;
+  /** App/client DID the token was issued by. */
+  appDid: string;
+  /** Token expiry (epoch seconds), when present. */
+  expiresAt?: number;
+}
+/** Display hint carried alongside the token (unverified; not for auth). */
+interface RenownSessionProfile {
+  name?: string | null;
+  avatar?: string | null;
+}
+/** The `renown_session` cookie payload: the bearer token + a display hint. */
+interface RenownSessionCookie {
+  token: string;
+  profile?: RenownSessionProfile | null;
+}
+interface VerifyRenownSessionOptions {
+  /** Expected `aud` claim on the token. */
+  audience?: string;
+  /** Switchboard GraphQL endpoint used when re-verifying the credential. */
+  switchboardUrl?: string;
+  /** Renown service base URL used when re-verifying the credential. */
+  renownUrl?: string;
+  /** Also re-verify the credential against Switchboard (default false = token-only, no network). */
+  verifyCredential?: boolean;
+}
+/** Claims read from a session token without verifying its signature. */
+interface RenownSessionClaims {
+  address?: string;
+  chainId?: number;
+  networkId?: string;
+  /** Expiry in epoch seconds. */
+  expiresAt?: number;
+}
+/** Serialize a session cookie value (token + optional display hint). */
+declare function serializeRenownSessionCookie(value: RenownSessionCookie): string;
+declare function readSessionClaims(value: string): RenownSessionClaims | undefined;
+declare function verifyRenownSession(value: string, options?: VerifyRenownSessionOptions): Promise<RenownSession | undefined>;
+//#endregion
+export { AccessTokenResult, AuthStatusResult, AuthVerifiableCredential, AuthVerifiedCredential, BaseRenownBuilder, BrowserLoginOptions, BrowserLoginResult, BuildCredentialParams, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConditionWeightedThreshold, ConnectCrypto, CreateBearerTokenOptions, CredentialDomain, CredentialMessage, CredentialStatus, DEFAULT_KEYPAIR_PATH, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_STORAGE_PATH, DEFAULT_RENOWN_URL, DID, DIDDocument, DIDDocumentMetadata, DIDResolutionMetadata, DIDResolutionResult, DOMAIN_TYPE, EcdsaSignature, FetchDelegationCredentialOptions, IAuthCredentialSubject, IConnectCrypto, ILogger, IPowerhouseCredentialSubject, IPowerhouseIssuerType, IProof, IRenown, IRenownCrypto, ISSUER_TYPE, ISigner, IVerifiableCredential, InternalUser, Issuer, JWTPayload, JWTVerified, JWTVerifyPolicies, JsonWebKey, JsonWebKeyPairStorage, JwkKeyPair, KeyCapabilitySection, LoginStatus, MemoryKeyStorage, NodeEventEmitter, NodeKeyStorage, NodeRenownBuilderOptions, NodeRenownEventEmitter, NodeRenownStorage, NodeStorage, PKHDid, PowerhouseVerifiableCredential, ProfileFetcher, Proof, RENOWN_PRIVATE_KEY_ENV, RENOWN_SESSION_COOKIE, Renown, RenownBuilder, RenownBuilderOptions, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownEventEmitter, RenownEvents, RenownMemoryStorage, RenownProfile, RenownSession, RenownSessionClaims, RenownSessionCookie, RenownSessionProfile, RenownStorage, RenownStorageMap, ResolveSwitchboardEndpointOptions, Service, ServiceEndpoint, SignCredentialTypedData, SignInParams, Signer, SwitchboardClient, Unsubscribe, User, VERIFIABLE_CREDENTIAL_EIP712_TYPE, Verifiable, VerificationMethod, VerifiedAuthCredential, VerifiedCredential, VerifiedJWT, VerifyAuthBearerTokenOptions, VerifyAuthCredentialOptions, VerifyRenownSessionOptions, W3CCredential, assertIsAuthCredential, browserLogin, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, formatExpiry, generateAccessToken, getAuthStatus, getResolver, openBrowser, parseExpiry, parsePkhDid, parseSignatureHashField, readSessionClaims, recoverCredentialSigner, resolveSwitchboardEndpoint, serializeRenownSessionCookie, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature, verifyRenownSession };
 //# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","names":[],"sources":["../src/crypto/node-key-storage.ts","../src/event/event.node.ts","../src/storage/storage.node.ts","../src/init.node.ts","../src/login.node.ts"],"mappings":";;;;cAWa,sBAAA;AAAA,cACA,oBAAA;AADb;;;;;AACA;AADA,cASa,cAAA,YAA0B,qBAAA;EAAA;kBAKrB,oBAAA;EAAA,gBACA,sBAAA;cAGd,QAAA,WACA,OAAA;IAAW,UAAA;IAAqB,MAAA,GAAS,OAAA;EAAA;EAa3C,WAAA,CAAA,GAAe,OAAA,CAAQ,UAAA;EAyBjB,WAAA,CAAY,OAAA,EAAS,UAAA,GAAa,OAAA;EAWxC,aAAA,CAAA,GAAiB,OAAA;AAAA;;;cC5EN,gBAAA,gBACI,MAAA,8BACJ,aAAA,CAAc,MAAA;EAAA;;EAOzB,EAAA,iBAAmB,MAAA,CAAA,CACjB,KAAA,EAAO,CAAA,EACP,QAAA,GAAW,IAAA,EAAM,MAAA,CAAO,CAAA;EAQ1B,IAAA,iBAAqB,MAAA,CAAA,CAAQ,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,MAAA,CAAO,CAAA;AAAA;;;cClBzC,WAAA,WACD,MAAA,oBAA0B,MAAA,2BAC5B,WAAA,CAAY,CAAA;EAAA,iBACH,QAAA;cAEL,QAAA;EAAA,QAYJ,QAAA;EAAA,QAKA,SAAA;EAIR,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,GAAM,CAAA,CAAE,GAAA;EAKtC,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,GAAA;EAU7C,MAAA,CAAO,GAAA,QAAW,CAAA;AAAA;;;cCvCP,sBAAA,SAA+B,gBAAA,CAAiB,YAAA;AAAA,cAChD,iBAAA,SAA0B,WAAA,CAAY,gBAAA;AAAA,cAEtC,2BAAA;AAAA,UAEI,wBAAA;EHCgB;EGC/B,WAAA;EHD+B;EGG/B,OAAA;EHKW;EGHX,OAAA;AAAA;;;;;cAOW,aAAA,SAAsB,iBAAA;EHuDhB;;;;cGlDL,OAAA,UAAiB,OAAA,GAAS,wBAAA;AAAA;;;UCvBvB,mBAAA;;EAEf,SAAA;EJGW;EIDX,SAAA;;EAEA,UAAA,IAAc,GAAA,UAAa,SAAA;EJDM;EIGjC,UAAA;EJF+B;EII/B,mBAAA,IAAuB,GAAA;EJJQ;EIM/B,MAAA,GAAS,WAAA;AAAA;AAAA,UAGM,kBAAA;EACf,IAAA,EAAM,IAAA;EACN,MAAA;AAAA;AAAA,UAGe,gBAAA;EACf,aAAA;EACA,OAAA;EACA,OAAA;EACA,OAAA;EACA,MAAA;EACA,eAAA,GAAkB,IAAA;EAClB,OAAA;AAAA;;;;iBA+CoB,WAAA,CAAY,GAAA,WAAc,OAAA;;;;;;;;iBAyD1B,YAAA,CACpB,MAAA,EAAQ,OAAA,EACR,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,kBAAA;;;;iBA2CK,aAAA,CAAc,MAAA,EAAQ,OAAA,GAAU,gBAAA;AAAA,UAe/B,iBAAA;EACf,KAAA;EACA,GAAA;EACA,OAAA;EACA,SAAA;AAAA;AHvMF;;;;;AAAA,iBG+MsB,mBAAA,CACpB,MAAA,EAAQ,OAAA,EACR,OAAA,GAAU,wBAAA,GACT,OAAA,CAAQ,iBAAA;;;;;;iBAuBK,WAAA,CAAY,MAAA;;;;iBAgCZ,YAAA,CAAa,SAAA"}
+{"version":3,"file":"node.d.ts","names":[],"sources":["../src/crypto/node-key-storage.ts","../src/event/event.node.ts","../src/storage/storage.node.ts","../src/init.node.ts","../src/login.node.ts","../src/session.ts"],"mappings":";;;;;cAWa,sBAAA;AAAA,cACA,oBAAA;;AADb;;;;;cASa,cAAA,YAA0B,qBAAA;EAAA;kBAKrB,oBAAA;EAAA,gBACA,sBAAA;cAGd,QAAA,WACA,OAAA;IAAW,UAAA;IAAqB,MAAA,GAAS,OAAA;EAAA;EAa3C,WAAA,CAAA,GAAe,OAAA,CAAQ,UAAA;EAyBjB,WAAA,CAAY,OAAA,EAAS,UAAA,GAAa,OAAA;EAWxC,aAAA,CAAA,GAAiB,OAAA;AAAA;;;cC5EN,gBAAA,gBACI,MAAA,8BACJ,aAAA,CAAc,MAAA;EAAA;;EAOzB,EAAA,iBAAmB,MAAA,CAAA,CACjB,KAAA,EAAO,CAAA,EACP,QAAA,GAAW,IAAA,EAAM,MAAA,CAAO,CAAA;EAQ1B,IAAA,iBAAqB,MAAA,CAAA,CAAQ,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,MAAA,CAAO,CAAA;AAAA;;;cClBzC,WAAA,WACD,MAAA,oBAA0B,MAAA,2BAC5B,WAAA,CAAY,CAAA;EAAA,iBACH,QAAA;cAEL,QAAA;EAAA,QAYJ,QAAA;EAAA,QAKA,SAAA;EAIR,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,GAAM,CAAA,CAAE,GAAA;EAKtC,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,GAAA;EAU7C,MAAA,CAAO,GAAA,QAAW,CAAA;AAAA;;;cCtCP,sBAAA,SAA+B,gBAAA,CAAiB,YAAA;AAAA,cAChD,iBAAA,SAA0B,WAAA,CAAY,gBAAA;AAAA,cAEtC,2BAAA;AAAA,UAEI,wBAAA;EHAgB;EGE/B,WAAA;EHF+B;EGI/B,OAAA;EHIW;EGFX,OAAA;;EAEA,cAAA;EHuBuB;EGrBvB,UAAA;AAAA;;cAIW,aAAA,SAAsB,iBAAA;EAAA;cAGrB,OAAA,UAAiB,OAAA,GAAS,wBAAA;EAyBhC,KAAA,CAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;;;UChDR,mBAAA;;EAEf,SAAA;;EAEA,SAAA;EJCiC;EICjC,UAAA,IAAc,GAAA,UAAa,SAAA;EJDM;EIGjC,UAAA;EJFW;EIIX,mBAAA,IAAuB,GAAA;;EAEvB,MAAA,GAAS,WAAA;AAAA;AAAA,UAGM,kBAAA;EACf,IAAA,EAAM,IAAA;EACN,MAAA;AAAA;AAAA,UAGe,gBAAA;EACf,aAAA;EACA,OAAA;EACA,OAAA;EACA,OAAA;EACA,MAAA;EACA,eAAA,GAAkB,IAAA;EAClB,OAAA;AAAA;;;;iBA+CoB,WAAA,CAAY,GAAA,WAAc,OAAA;;;;;;;;iBAyD1B,YAAA,CACpB,MAAA,EAAQ,OAAA,EACR,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,kBAAA;;;;iBA2CK,aAAA,CAAc,MAAA,EAAQ,OAAA,GAAU,gBAAA;AAAA,UAe/B,iBAAA;EACf,KAAA;EACA,GAAA;EACA,OAAA;EACA,SAAA;AAAA;;AHvMF;;;;iBG+MsB,mBAAA,CACpB,MAAA,EAAQ,OAAA,EACR,OAAA,GAAU,wBAAA,GACT,OAAA,CAAQ,iBAAA;;;;;;iBAuBK,WAAA,CAAY,MAAA;;;;iBAgCZ,YAAA,CAAa,SAAA;;;;UCvQZ,aAAA;;EAEf,IAAA,EAAM,IAAA;ELIK;EKFX,MAAA;;EAEA,SAAA;AAAA;ALCF;AAAA,UKGiB,oBAAA;EACf,IAAA;EACA,MAAA;AAAA;ALGF;AAAA,UKCiB,mBAAA;EACf,KAAA;EACA,OAAA,GAAU,oBAAA;AAAA;AAAA,UAGK,0BAAA;EL0CY;EKxC3B,QAAA;ELmDiB;EKjDjB,cAAA;ELV0D;EKY1D,SAAA;ELZqC;EKcrC,gBAAA;AAAA;;UAIe,mBAAA;EACf,OAAA;EACA,OAAA;EACA,SAAA;ELX2C;EKa3C,SAAA;AAAA;;iBAIc,4BAAA,CACd,KAAA,EAAO,mBAAA;AAAA,iBAwBO,iBAAA,CACd,KAAA,WACC,mBAAA;AAAA,iBA+BmB,mBAAA,CACpB,KAAA,UACA,OAAA,GAAS,0BAAA,GACR,OAAA,CAAQ,aAAA"}