@renown/sdk 6.2.2-dev.5 → 6.2.2-dev.50

package/README.md

@@ -28,6 +28,16 @@ const renown = await new RenownBuilder("my-app")
 - `withCrypto(crypto)` — Pre-built crypto instance
 - `withKeyPairStorage(storage)` — Key pair storage (crypto is built from this)
 - `withProfileFetcher(fetcher)` — Custom profile enrichment strategy
+- `withChainId(chainId)` — Chain credentials are issued on (default `1`)
+
+**The chain id is part of the user's identity.** The issuer DID is
+`did:pkh:eip155:<chainId>:<address>`, so the same wallet on a different chain is a
+different user. `signIn` therefore rejects a wallet session whose chain differs
+from this one, and the bearer token is scoped to it too. When you pass a
+pre-built crypto via `withCrypto()`, give it the same chain
+(`RenownCryptoBuilder().withChainId(...)`) — the builder warns if the two
+disagree. Keep the wallet adapters' `chains` in step, so the wallet UI prompts a
+network switch instead of the user reaching a rejection at the end of the flow.
 
 ## Renown Instance
 
@@ -81,14 +91,165 @@ const { networkId, chainId, address } = parsePkhDid("did:pkh:eip155:1:0x...");
 const result = await verifyAuthBearerToken(jwt); // false | AuthVerifiedCredential
 ```
 
+## Wallet adapters (in-page sign-in)
+
+`@renown/sdk/wallet` provides pluggable wallet adapters so a host app (e.g.
+Connect) can sign a Renown credential **in-page**, without redirecting to the
+Renown portal. Each adapter lives behind its own subexport and hands the host a
+**descriptor** — eager metadata plus a lazy loader — so its wallet library is
+fetched only when a login method is actually chosen.
+
+**You pay for the adapters you import.** Importing `@renown/sdk/wallet/<id>`
+loads no wallet library, but it does make that adapter's peer dependencies a
+build-time requirement for your bundler. An app that never imports
+`@renown/sdk/wallet/rainbow` does not need RainbowKit installed at all — no
+bundler aliases, no stub modules.
+
+| Subexport | Adapter | Peer dependencies to install |
+| --- | --- | --- |
+| `@renown/sdk/wallet/rainbow` | RainbowKit + wagmi (external wallets) | `wagmi`, `@rainbow-me/rainbowkit`, `@tanstack/react-query` |
+| `@renown/sdk/wallet/privy` | Privy (embedded / social / email) | `@privy-io/react-auth` |
+| `@renown/sdk/wallet/mock` | Headless test/dev signer (no UI) | none (`viem` is a direct dependency) |
+
+Each subexport also has a `…/factory` sibling (e.g.
+`@renown/sdk/wallet/privy/factory`) holding the `create<Id>Adapter` function.
+That is the heavy half the descriptor's `load()` imports; you rarely need it
+directly.
+
+> **Host apps should not wire these adapters by hand.** Use the
+> `RenownWalletProvider` + `useRenownLoginMethods` + `useRenownAuth` primitives
+> from `@powerhousedao/reactor-browser/renown`, which handle the activator,
+> lazy-loading, controller merging and login UI wiring. See that package's
+> README ("Renown in-page sign-in"). `resolveAdapters` below is the low-level
+> primitive those build on.
+
+```typescript
+import { resolveAdapters } from "@renown/sdk/wallet";
+import { privyAdapter } from "@renown/sdk/wallet/privy";
+import { rainbowAdapter } from "@renown/sdk/wallet/rainbow";
+
+// Descriptors are cheap: metadata only, no wallet library loaded yet.
+const descriptors = [
+  rainbowAdapter({ walletConnectProjectId: "..." }),
+  privyAdapter({ appId: "...", methods: ["google", "email"] }),
+];
+
+// This is where each adapter's library is actually fetched.
+const adapters = await resolveAdapters(descriptors);
+```
+
+`resolveAdapters` keeps the adapters that loaded and logs the ones that didn't;
+it rejects only if none load. Each resolved adapter exposes its `meta`, a
+`Provider` (mount it around the app; it accepts a runtime `theme` of
+`"light" | "dark" | { mode, accentColor?, accentColorForeground? }`) and a
+controller with `connect(method?)`, `disconnect()`, and `getSession()`.
+`connect()` resolves a `WalletSession` (`{ address, chainId, signTypedData }`);
+pass it to `renown.signIn(session)` to write + log in the credential in-page.
+
+Both adapters honour `mode` and `accentColor`. `accentColorForeground` is
+RainbowKit-only — Privy derives its own contrast. Privy accepts hex only, so an
+accent it cannot convert to hex (a named or `hsl()` color) is dropped rather than
+forwarded; `rgb()`, which is what resolving a CSS token yields, converts fine.
+
+**Login methods.** Rainbow supports `wallet`; Privy supports `wallet`, `google`,
+`apple`, `email` (default `["google", "email"]`). Each adapter's config accepts
+only the methods it can drive, so a typo is a compile error. Social/email flows
+run inside Privy's own modal (OAuth uses a popup, keeping the page alive) so
+sign-in completes in-page — no full-page redirect.
+
+**Configuration.** Only public identifiers belong in client config: Privy's
+`appId` (and optional `clientId`), and RainbowKit's `walletConnectProjectId`.
+Never put a Privy **App Secret** in browser config — it is server-only.
+
+`walletConnectProjectId` is optional, but treat it as required in practice: without
+it the rainbow adapter offers only an installed browser wallet and the Safe App
+iframe. Every other RainbowKit wallet connects over WalletConnect — `rainbowWallet`
+always when its extension is absent, `metaMaskWallet` on desktop without the
+extension — so those are omitted rather than offered and failing on the relay.
+
+The rainbow adapter's `chains` (from `wagmi/chains`) defaults to Ethereum mainnet
+alone, matching the chain credentials are issued on. Widen it only alongside
+`withChainId`: a wallet on a chain outside the list has to switch networks to sign
+in, and one that signs on a chain Renown does not issue on is rejected. The
+adapter warns at config time if `chains` cannot produce the issuing chain.
+
 ## Node.js
 
-For server-side usage, import from `@renown/sdk/node`:
+For server-side usage, import from `@renown/sdk/node`.
+
+**Building an instance (scripts / CLI).** The Node `RenownBuilder` uses file-based
+storage. Its `build()` **blocks** on revalidating a stored credential against the
+switchboard before resolving (so a short-lived process acts on fresh state); pass
+`revalidate: "never"` to skip the network check.
 
 ```typescript
 import { RenownBuilder } from "@renown/sdk/node";
+
+const renown = await new RenownBuilder("my-cli", {
+  switchboardUrl: "https://switchboard.example/graphql",
+}).build();
+// renown.user is present only if the stored credential is still valid
+```
+
+`renown.revalidate()` re-checks the current credential on demand and logs out if
+it was revoked/expired; it is **fail-open** (a network error keeps the session).
+On success it then calls `renown.refreshProfile()`.
+
+`renown.refreshProfile()` re-reads profile attributes (`username`, `userImage`)
+at the source and updates the store only if they changed, resolving `true` when
+they did. It can never log anyone out, so the browser builder runs it on every
+start — including when `revalidate: "never"` disables the credential check.
+
+### Verifying a session cookie (SSR)
+
+To gate server-rendered pages, store the bearer token from
+`renown.getBearerToken()` — plus an optional `RenownSessionProfile` display hint
+— in a cookie (name exported as `RENOWN_SESSION_COOKIE`), then verify it on the
+server. The payload type `RenownSessionCookie` is exported from both entry
+points; use it to type your route handler instead of redeclaring the shape:
+
+```typescript
+import {
+  serializeRenownSessionCookie,
+  verifyRenownSession,
+  readSessionClaims,
+} from "@renown/sdk/node";
+
+// Build the cookie value (token + display hint) when setting the cookie. The
+// documentId/username/userImage fields let verifySession rebuild `user.profile`.
+const cookieValue = serializeRenownSessionCookie({
+  token,
+  profile: {
+    name: "alice.eth",
+    avatar: null,
+    documentId: "doc-123",
+    username: "alice.eth",
+    userImage: null,
+  },
+});
+
+// Verify the cookie value — checks the JWT (signature + expiry) and merges the
+// display hint (unverified). verifyCredential:true also re-checks vs switchboard.
+const session = await verifyRenownSession(cookieValue, {
+  switchboardUrl: "https://switchboard.example/graphql",
+  // verifyCredential: true, // default false = token-only, no network
+});
+if (session) {
+  // session.user (incl. display hint), session.appDid, session.expiresAt
+}
+
+// Cheap, signature-free decode for optimistic checks (e.g. a proxy redirect).
+// NEVER trust this for access control.
+const claims = readSessionClaims(cookieValue);
 ```
 
+`verifyCredential` defaults to **`false`** (token-only, no network): the JWT is
+signed and expiring, and the switchboard enforces the credential on every real
+operation, so token-only is enough for optimistic SSR UI. Set it to `true` on
+routes that render sensitive data to also catch revocation server-side. To
+verify a bare bearer token (e.g. an `Authorization` header), use
+`verifyAuthBearerToken` instead.
+
 ## License
 
 AGPL-3.0-only

package/dist/{browser-key-storage-v4O-fjz0.js → browser-key-storage-e3RQsnLS.js}

@@ -65,4 +65,4 @@ var BrowserKeyStorage = class BrowserKeyStorage {
 //#endregion
 export { BrowserKeyStorage as t };
 
-//# sourceMappingURL=browser-key-storage-v4O-fjz0.js.map
+//# sourceMappingURL=browser-key-storage-e3RQsnLS.js.map

package/dist/{browser-key-storage-v4O-fjz0.js.map → browser-key-storage-e3RQsnLS.js.map}

@@ -1 +1 @@
-{"version":3,"file":"browser-key-storage-v4O-fjz0.js","names":["#db","#openDatabase","#useStore"],"sources":["../src/crypto/browser-key-storage.ts"],"sourcesContent":["import type { JsonWebKeyPairStorage, JwkKeyPair } from \"./types.js\";\n\nconst DEFAULT_DB_NAME = \"renownKeyDB\";\nconst STORE_NAME = \"keyPairs\";\nconst KEY = \"keyPair\";\n\nexport class BrowserKeyStorage implements JsonWebKeyPairStorage {\n  #db: IDBDatabase;\n\n  constructor(db: IDBDatabase) {\n    this.#db = db;\n  }\n\n  static async create(\n    dbName: string = DEFAULT_DB_NAME,\n  ): Promise<BrowserKeyStorage> {\n    const db = await BrowserKeyStorage.#openDatabase(dbName);\n    return new BrowserKeyStorage(db);\n  }\n\n  static #openDatabase(dbName: string): Promise<IDBDatabase> {\n    return new Promise((resolve, reject) => {\n      const req = indexedDB.open(dbName);\n\n      req.onupgradeneeded = (event) => {\n        const db = (event.target as IDBOpenDBRequest).result;\n        if (!db.objectStoreNames.contains(STORE_NAME)) {\n          db.createObjectStore(STORE_NAME);\n        }\n      };\n\n      req.onsuccess = () => {\n        const db = req.result;\n        if (!db.objectStoreNames.contains(STORE_NAME)) {\n          const currentVersion = db.version;\n          db.close();\n          const upgradeReq = indexedDB.open(dbName, currentVersion + 1);\n          upgradeReq.onupgradeneeded = (event) => {\n            const upgradeDb = (event.target as IDBOpenDBRequest).result;\n            if (!upgradeDb.objectStoreNames.contains(STORE_NAME)) {\n              upgradeDb.createObjectStore(STORE_NAME);\n            }\n          };\n          upgradeReq.onsuccess = () => resolve(upgradeReq.result);\n          upgradeReq.onerror = () => reject(upgradeReq.error as Error);\n        } else {\n          resolve(db);\n        }\n      };\n\n      req.onerror = () => reject(req.error as Error);\n    });\n  }\n\n  #useStore(mode: IDBTransactionMode = \"readwrite\") {\n    const transaction = this.#db.transaction(STORE_NAME, mode);\n    return transaction.objectStore(STORE_NAME);\n  }\n\n  async saveKeyPair(keyPair: JwkKeyPair) {\n    const store = this.#useStore();\n    const request = store.put(keyPair, KEY);\n    return new Promise<void>((resolve, reject) => {\n      request.onsuccess = () => resolve();\n      request.onerror = () => reject(new Error(\"Failed to save key pair\"));\n    });\n  }\n\n  async loadKeyPair(): Promise<JwkKeyPair | undefined> {\n    const store = this.#useStore(\"readonly\");\n    const request = store.get(KEY);\n\n    return new Promise<JwkKeyPair | undefined>((resolve, reject) => {\n      request.onsuccess = () => {\n        const keyPair = request.result as JwkKeyPair | undefined;\n        resolve(keyPair);\n      };\n      request.onerror = () => reject(new Error(\"Failed to load key pair\"));\n    });\n  }\n\n  async removeKeyPair(): Promise<void> {\n    const store = this.#useStore();\n    const request = store.delete(KEY);\n\n    return new Promise<void>((resolve, reject) => {\n      request.onsuccess = () => resolve();\n      request.onerror = () => reject(new Error(\"Failed to remove key pair\"));\n    });\n  }\n}\n"],"mappings":";AAEA,MAAM,kBAAkB;AACxB,MAAM,aAAa;AACnB,MAAM,MAAM;AAEZ,IAAa,oBAAb,MAAa,kBAAmD;CAC9D;CAEA,YAAY,IAAiB;AAC3B,QAAA,KAAW;;CAGb,aAAa,OACX,SAAiB,iBACW;AAE5B,SAAO,IAAI,kBADA,MAAM,mBAAA,aAAgC,OAAO,CACxB;;CAGlC,QAAA,aAAqB,QAAsC;AACzD,SAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAM,UAAU,KAAK,OAAO;AAElC,OAAI,mBAAmB,UAAU;IAC/B,MAAM,KAAM,MAAM,OAA4B;AAC9C,QAAI,CAAC,GAAG,iBAAiB,SAAS,WAAW,CAC3C,IAAG,kBAAkB,WAAW;;AAIpC,OAAI,kBAAkB;IACpB,MAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAG,iBAAiB,SAAS,WAAW,EAAE;KAC7C,MAAM,iBAAiB,GAAG;AAC1B,QAAG,OAAO;KACV,MAAM,aAAa,UAAU,KAAK,QAAQ,iBAAiB,EAAE;AAC7D,gBAAW,mBAAmB,UAAU;MACtC,MAAM,YAAa,MAAM,OAA4B;AACrD,UAAI,CAAC,UAAU,iBAAiB,SAAS,WAAW,CAClD,WAAU,kBAAkB,WAAW;;AAG3C,gBAAW,kBAAkB,QAAQ,WAAW,OAAO;AACvD,gBAAW,gBAAgB,OAAO,WAAW,MAAe;UAE5D,SAAQ,GAAG;;AAIf,OAAI,gBAAgB,OAAO,IAAI,MAAe;IAC9C;;CAGJ,UAAU,OAA2B,aAAa;AAEhD,SADoB,MAAA,GAAS,YAAY,YAAY,KAAK,CACvC,YAAY,WAAW;;CAG5C,MAAM,YAAY,SAAqB;EAErC,MAAM,UADQ,MAAA,UAAgB,CACR,IAAI,SAAS,IAAI;AACvC,SAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,WAAQ,kBAAkB,SAAS;AACnC,WAAQ,gBAAgB,uBAAO,IAAI,MAAM,0BAA0B,CAAC;IACpE;;CAGJ,MAAM,cAA+C;EAEnD,MAAM,UADQ,MAAA,SAAe,WAAW,CAClB,IAAI,IAAI;AAE9B,SAAO,IAAI,SAAiC,SAAS,WAAW;AAC9D,WAAQ,kBAAkB;IACxB,MAAM,UAAU,QAAQ;AACxB,YAAQ,QAAQ;;AAElB,WAAQ,gBAAgB,uBAAO,IAAI,MAAM,0BAA0B,CAAC;IACpE;;CAGJ,MAAM,gBAA+B;EAEnC,MAAM,UADQ,MAAA,UAAgB,CACR,OAAO,IAAI;AAEjC,SAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,WAAQ,kBAAkB,SAAS;AACnC,WAAQ,gBAAgB,uBAAO,IAAI,MAAM,4BAA4B,CAAC;IACtE"}
+{"version":3,"file":"browser-key-storage-e3RQsnLS.js","names":["#db","#openDatabase","#useStore"],"sources":["../src/crypto/browser-key-storage.ts"],"sourcesContent":["import type { JsonWebKeyPairStorage, JwkKeyPair } from \"./types.js\";\n\nconst DEFAULT_DB_NAME = \"renownKeyDB\";\nconst STORE_NAME = \"keyPairs\";\nconst KEY = \"keyPair\";\n\nexport class BrowserKeyStorage implements JsonWebKeyPairStorage {\n  #db: IDBDatabase;\n\n  constructor(db: IDBDatabase) {\n    this.#db = db;\n  }\n\n  static async create(\n    dbName: string = DEFAULT_DB_NAME,\n  ): Promise<BrowserKeyStorage> {\n    const db = await BrowserKeyStorage.#openDatabase(dbName);\n    return new BrowserKeyStorage(db);\n  }\n\n  static #openDatabase(dbName: string): Promise<IDBDatabase> {\n    return new Promise((resolve, reject) => {\n      const req = indexedDB.open(dbName);\n\n      req.onupgradeneeded = (event) => {\n        const db = (event.target as IDBOpenDBRequest).result;\n        if (!db.objectStoreNames.contains(STORE_NAME)) {\n          db.createObjectStore(STORE_NAME);\n        }\n      };\n\n      req.onsuccess = () => {\n        const db = req.result;\n        if (!db.objectStoreNames.contains(STORE_NAME)) {\n          const currentVersion = db.version;\n          db.close();\n          const upgradeReq = indexedDB.open(dbName, currentVersion + 1);\n          upgradeReq.onupgradeneeded = (event) => {\n            const upgradeDb = (event.target as IDBOpenDBRequest).result;\n            if (!upgradeDb.objectStoreNames.contains(STORE_NAME)) {\n              upgradeDb.createObjectStore(STORE_NAME);\n            }\n          };\n          upgradeReq.onsuccess = () => resolve(upgradeReq.result);\n          upgradeReq.onerror = () => reject(upgradeReq.error as Error);\n        } else {\n          resolve(db);\n        }\n      };\n\n      req.onerror = () => reject(req.error as Error);\n    });\n  }\n\n  #useStore(mode: IDBTransactionMode = \"readwrite\") {\n    const transaction = this.#db.transaction(STORE_NAME, mode);\n    return transaction.objectStore(STORE_NAME);\n  }\n\n  async saveKeyPair(keyPair: JwkKeyPair) {\n    const store = this.#useStore();\n    const request = store.put(keyPair, KEY);\n    return new Promise<void>((resolve, reject) => {\n      request.onsuccess = () => resolve();\n      request.onerror = () => reject(new Error(\"Failed to save key pair\"));\n    });\n  }\n\n  async loadKeyPair(): Promise<JwkKeyPair | undefined> {\n    const store = this.#useStore(\"readonly\");\n    const request = store.get(KEY);\n\n    return new Promise<JwkKeyPair | undefined>((resolve, reject) => {\n      request.onsuccess = () => {\n        const keyPair = request.result as JwkKeyPair | undefined;\n        resolve(keyPair);\n      };\n      request.onerror = () => reject(new Error(\"Failed to load key pair\"));\n    });\n  }\n\n  async removeKeyPair(): Promise<void> {\n    const store = this.#useStore();\n    const request = store.delete(KEY);\n\n    return new Promise<void>((resolve, reject) => {\n      request.onsuccess = () => resolve();\n      request.onerror = () => reject(new Error(\"Failed to remove key pair\"));\n    });\n  }\n}\n"],"mappings":";AAEA,MAAM,kBAAkB;AACxB,MAAM,aAAa;AACnB,MAAM,MAAM;AAEZ,IAAa,oBAAb,MAAa,kBAAmD;CAC9D;CAEA,YAAY,IAAiB;AAC3B,QAAA,KAAW;;CAGb,aAAa,OACX,SAAiB,iBACW;AAE5B,SAAO,IAAI,kBADA,MAAM,mBAAA,aAAgC,OAAO,CACxB;;CAGlC,QAAA,aAAqB,QAAsC;AACzD,SAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAM,UAAU,KAAK,OAAO;AAElC,OAAI,mBAAmB,UAAU;IAC/B,MAAM,KAAM,MAAM,OAA4B;AAC9C,QAAI,CAAC,GAAG,iBAAiB,SAAS,WAAW,CAC3C,IAAG,kBAAkB,WAAW;;AAIpC,OAAI,kBAAkB;IACpB,MAAM,KAAK,IAAI;AACf,QAAI,CAAC,GAAG,iBAAiB,SAAS,WAAW,EAAE;KAC7C,MAAM,iBAAiB,GAAG;AAC1B,QAAG,OAAO;KACV,MAAM,aAAa,UAAU,KAAK,QAAQ,iBAAiB,EAAE;AAC7D,gBAAW,mBAAmB,UAAU;MACtC,MAAM,YAAa,MAAM,OAA4B;AACrD,UAAI,CAAC,UAAU,iBAAiB,SAAS,WAAW,CAClD,WAAU,kBAAkB,WAAW;;AAG3C,gBAAW,kBAAkB,QAAQ,WAAW,OAAO;AACvD,gBAAW,gBAAgB,OAAO,WAAW,MAAe;UAE5D,SAAQ,GAAG;;AAIf,OAAI,gBAAgB,OAAO,IAAI,MAAe;IAC9C;;CAGJ,UAAU,OAA2B,aAAa;AAEhD,SADoB,MAAA,GAAS,YAAY,YAAY,KAAK,CACvC,YAAY,WAAW;;CAG5C,MAAM,YAAY,SAAqB;EAErC,MAAM,UADQ,MAAA,UAAgB,CACR,IAAI,SAAS,IAAI;AACvC,SAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,WAAQ,kBAAkB,SAAS;AACnC,WAAQ,gBAAgB,uBAAO,IAAI,MAAM,0BAA0B,CAAC;IACpE;;CAGJ,MAAM,cAA+C;EAEnD,MAAM,UADQ,MAAA,SAAe,WAAW,CAClB,IAAI,IAAI;AAE9B,SAAO,IAAI,SAAiC,SAAS,WAAW;AAC9D,WAAQ,kBAAkB;IACxB,MAAM,UAAU,QAAQ;AACxB,YAAQ,QAAQ;;AAElB,WAAQ,gBAAgB,uBAAO,IAAI,MAAM,0BAA0B,CAAC;IACpE;;CAGJ,MAAM,gBAA+B;EAEnC,MAAM,UADQ,MAAA,UAAgB,CACR,OAAO,IAAI;AAEjC,SAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,WAAQ,kBAAkB,SAAS;AACnC,WAAQ,gBAAgB,uBAAO,IAAI,MAAM,4BAA4B,CAAC;IACtE"}

package/dist/constants-B7wOp9oo.js

@@ -0,0 +1,79 @@
+//#region src/constants.ts
+const DEFAULT_RENOWN_URL = "https://www.renown.id";
+const DEFAULT_RENOWN_NETWORK_ID = "eip155";
+const DEFAULT_RENOWN_CHAIN_ID = "1";
+/** Default cookie name for a server-readable Renown session (bearer token). */
+const RENOWN_SESSION_COOKIE = "renown_session";
+const DOMAIN_TYPE = [{
+	name: "version",
+	type: "string"
+}, {
+	name: "chainId",
+	type: "uint256"
+}];
+const VERIFIABLE_CREDENTIAL_EIP712_TYPE = [
+	{
+		name: "@context",
+		type: "string[]"
+	},
+	{
+		name: "type",
+		type: "string[]"
+	},
+	{
+		name: "id",
+		type: "string"
+	},
+	{
+		name: "issuer",
+		type: "Issuer"
+	},
+	{
+		name: "credentialSubject",
+		type: "CredentialSubject"
+	},
+	{
+		name: "credentialSchema",
+		type: "CredentialSchema"
+	},
+	{
+		name: "issuanceDate",
+		type: "string"
+	},
+	{
+		name: "expirationDate",
+		type: "string"
+	}
+];
+const CREDENTIAL_SCHEMA_EIP712_TYPE = [{
+	name: "id",
+	type: "string"
+}, {
+	name: "type",
+	type: "string"
+}];
+const CREDENTIAL_SUBJECT_TYPE = [{
+	name: "app",
+	type: "string"
+}, {
+	name: "id",
+	type: "string"
+}];
+const ISSUER_TYPE = [{
+	name: "id",
+	type: "string"
+}, {
+	name: "ethereumAddress",
+	type: "string"
+}];
+const CREDENTIAL_TYPES = {
+	EIP712Domain: DOMAIN_TYPE,
+	VerifiableCredential: VERIFIABLE_CREDENTIAL_EIP712_TYPE,
+	CredentialSchema: CREDENTIAL_SCHEMA_EIP712_TYPE,
+	CredentialSubject: CREDENTIAL_SUBJECT_TYPE,
+	Issuer: ISSUER_TYPE
+};
+//#endregion
+export { DEFAULT_RENOWN_NETWORK_ID as a, ISSUER_TYPE as c, DEFAULT_RENOWN_CHAIN_ID as i, RENOWN_SESSION_COOKIE as l, CREDENTIAL_SUBJECT_TYPE as n, DEFAULT_RENOWN_URL as o, CREDENTIAL_TYPES as r, DOMAIN_TYPE as s, CREDENTIAL_SCHEMA_EIP712_TYPE as t, VERIFIABLE_CREDENTIAL_EIP712_TYPE as u };
+
+//# sourceMappingURL=constants-B7wOp9oo.js.map

package/dist/constants-B7wOp9oo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants-B7wOp9oo.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["export const DEFAULT_RENOWN_URL = \"https://www.renown.id\";\nexport const DEFAULT_RENOWN_NETWORK_ID = \"eip155\";\nexport const DEFAULT_RENOWN_CHAIN_ID = \"1\";\n\n/** Default cookie name for a server-readable Renown session (bearer token). */\nexport const RENOWN_SESSION_COOKIE = \"renown_session\";\n\nexport const DOMAIN_TYPE = [\n  { name: \"version\", type: \"string\" },\n  { name: \"chainId\", type: \"uint256\" },\n] as const;\n\nexport const VERIFIABLE_CREDENTIAL_EIP712_TYPE = [\n  { name: \"@context\", type: \"string[]\" },\n  { name: \"type\", type: \"string[]\" },\n  { name: \"id\", type: \"string\" },\n  { name: \"issuer\", type: \"Issuer\" },\n  { name: \"credentialSubject\", type: \"CredentialSubject\" },\n  { name: \"credentialSchema\", type: \"CredentialSchema\" },\n  { name: \"issuanceDate\", type: \"string\" },\n  { name: \"expirationDate\", type: \"string\" },\n] as const;\n\nexport const CREDENTIAL_SCHEMA_EIP712_TYPE = [\n  { name: \"id\", type: \"string\" },\n  { name: \"type\", type: \"string\" },\n] as const;\n\nexport const CREDENTIAL_SUBJECT_TYPE = [\n  { name: \"app\", type: \"string\" },\n  { name: \"id\", type: \"string\" },\n] as const;\n\nexport const ISSUER_TYPE = [\n  { name: \"id\", type: \"string\" },\n  { name: \"ethereumAddress\", type: \"string\" },\n] as const;\n\nexport const CREDENTIAL_TYPES = {\n  EIP712Domain: DOMAIN_TYPE,\n  VerifiableCredential: VERIFIABLE_CREDENTIAL_EIP712_TYPE,\n  CredentialSchema: CREDENTIAL_SCHEMA_EIP712_TYPE,\n  CredentialSubject: CREDENTIAL_SUBJECT_TYPE,\n  Issuer: ISSUER_TYPE,\n} as const;\n"],"mappings":";AAAA,MAAa,qBAAqB;AAClC,MAAa,4BAA4B;AACzC,MAAa,0BAA0B;;AAGvC,MAAa,wBAAwB;AAErC,MAAa,cAAc,CACzB;CAAE,MAAM;CAAW,MAAM;CAAU,EACnC;CAAE,MAAM;CAAW,MAAM;CAAW,CACrC;AAED,MAAa,oCAAoC;CAC/C;EAAE,MAAM;EAAY,MAAM;EAAY;CACtC;EAAE,MAAM;EAAQ,MAAM;EAAY;CAClC;EAAE,MAAM;EAAM,MAAM;EAAU;CAC9B;EAAE,MAAM;EAAU,MAAM;EAAU;CAClC;EAAE,MAAM;EAAqB,MAAM;EAAqB;CACxD;EAAE,MAAM;EAAoB,MAAM;EAAoB;CACtD;EAAE,MAAM;EAAgB,MAAM;EAAU;CACxC;EAAE,MAAM;EAAkB,MAAM;EAAU;CAC3C;AAED,MAAa,gCAAgC,CAC3C;CAAE,MAAM;CAAM,MAAM;CAAU,EAC9B;CAAE,MAAM;CAAQ,MAAM;CAAU,CACjC;AAED,MAAa,0BAA0B,CACrC;CAAE,MAAM;CAAO,MAAM;CAAU,EAC/B;CAAE,MAAM;CAAM,MAAM;CAAU,CAC/B;AAED,MAAa,cAAc,CACzB;CAAE,MAAM;CAAM,MAAM;CAAU,EAC9B;CAAE,MAAM;CAAmB,MAAM;CAAU,CAC5C;AAED,MAAa,mBAAmB;CAC9B,cAAc;CACd,sBAAsB;CACtB,kBAAkB;CAClB,mBAAmB;CACnB,QAAQ;CACT"}

package/dist/crypto.d.ts

@@ -1,3 +1,3 @@
-import { a as signatureHasResultingHash, c as ConnectCrypto, d as IConnectCrypto, f as IRenownCrypto, i as parseSignatureHashField, l as RenownCrypto, m as JwkKeyPair, n as createSignatureVerifier, o as MemoryKeyStorage, p as JsonWebKeyPairStorage, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner, u as DID } from "./signer-DYKGoYHB.js";
-import { t as BrowserKeyStorage } from "./browser-key-storage-DSkDBAhU.js";
+import { a as JwkKeyPair, i as JsonWebKeyPairStorage, n as IConnectCrypto, r as IRenownCrypto, t as DID } from "./types-ocCFjR5j.js";
+import { a as parseSignatureHashField, c as RenownCryptoBuilder, i as extractResultingHashFromSignature, l as ConnectCrypto, n as RenownCryptoSigner, o as signatureHasResultingHash, r as createSignatureVerifier, s as MemoryKeyStorage, t as BrowserKeyStorage, u as RenownCrypto } from "./index-BF2qTv7d.js";
 export { BrowserKeyStorage, ConnectCrypto, DID, IConnectCrypto, IRenownCrypto, JsonWebKeyPairStorage, JwkKeyPair, MemoryKeyStorage, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, createSignatureVerifier, extractResultingHashFromSignature, parseSignatureHashField, signatureHasResultingHash };

package/dist/crypto.js

@@ -1,3 +1,3 @@
-import { a as signatureHasResultingHash, c as ConnectCrypto, i as parseSignatureHashField, l as RenownCrypto, n as createSignatureVerifier, o as MemoryKeyStorage, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-CgYhXTV7.js";
-import { t as BrowserKeyStorage } from "./browser-key-storage-v4O-fjz0.js";
+import { a as signatureHasResultingHash, c as ConnectCrypto, i as parseSignatureHashField, l as RenownCrypto, n as createSignatureVerifier, o as MemoryKeyStorage, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-BpvojvCh.js";
+import { t as BrowserKeyStorage } from "./browser-key-storage-e3RQsnLS.js";
 export { BrowserKeyStorage, ConnectCrypto, MemoryKeyStorage, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, createSignatureVerifier, extractResultingHashFromSignature, parseSignatureHashField, signatureHasResultingHash };

package/dist/index-BF2qTv7d.d.ts

@@ -0,0 +1,131 @@
+import { a as JwkKeyPair, i as JsonWebKeyPairStorage, l as CreateBearerTokenOptions, r as IRenownCrypto, t as DID, w as Issuer } from "./types-ocCFjR5j.js";
+import { Action, AppActionSigner, ISigner, Signature, SignatureVerificationHandler, UserActionSigner } from "@powerhousedao/shared/document-model";
+
+//#region src/crypto/renown-crypto.d.ts
+declare class RenownCrypto implements IRenownCrypto {
+  #private;
+  readonly did: DID;
+  /** Chain id the bearer token is scoped to; keep it equal to the issuing Renown instance's. */
+  readonly chainId: number;
+  static algorithm: EcKeyAlgorithm;
+  static signAlgorithm: {
+    name: string;
+    namedCurve: string;
+    hash: string;
+  };
+  constructor(keyPairStorage: JsonWebKeyPairStorage, crypto: SubtleCrypto, keyPair: CryptoKeyPair, did: DID, chainId?: number);
+  get publicKey(): CryptoKey;
+  getBearerToken(address: string | undefined, options?: CreateBearerTokenOptions): Promise<string>;
+  removeDid(): Promise<void>;
+  sign(data: Uint8Array | string): Promise<Uint8Array>;
+  verify(data: Uint8Array, signature: Uint8Array): Promise<boolean>;
+  get issuer(): Issuer;
+}
+/**
+ * @deprecated Use RenownCrypto instead
+ */
+declare class ConnectCrypto extends RenownCrypto {}
+//#endregion
+//#region src/crypto/renown-crypto-builder.d.ts
+declare class RenownCryptoBuilder {
+  #private;
+  private keyPairStorage?;
+  private subtleCrypto?;
+  private chainId?;
+  withKeyPairStorage(storage: JsonWebKeyPairStorage): this;
+  withSubtleCrypto(crypto: SubtleCrypto): this;
+  withChainId(chainId: number): this;
+  build(): Promise<RenownCrypto>;
+}
+//#endregion
+//#region src/crypto/memory-key-storage.d.ts
+declare class MemoryKeyStorage implements JsonWebKeyPairStorage {
+  private keyPair;
+  constructor(keyPair?: JwkKeyPair);
+  loadKeyPair(): Promise<JwkKeyPair | undefined>;
+  saveKeyPair(keyPair: JwkKeyPair): Promise<void>;
+  removeKeyPair(): Promise<void>;
+}
+//#endregion
+//#region src/crypto/signer.d.ts
+declare class RenownCryptoSigner implements ISigner {
+  private readonly crypto;
+  private readonly appName;
+  user?: UserActionSigner | undefined;
+  readonly app: AppActionSigner;
+  constructor(crypto: IRenownCrypto, appName: string, user?: UserActionSigner | undefined);
+  get publicKey(): CryptoKey;
+  sign(data: Uint8Array): Promise<Uint8Array>;
+  verify(data: Uint8Array, signature: Uint8Array): Promise<void>;
+  signAction(action: Action, abortSignal?: AbortSignal): Promise<Signature>;
+  /**
+   * Signs an action including a predicted resulting state hash.
+   *
+   * The resulting hash is packed into the signature tuple's 4th element (index 3)
+   * using the format: `${prevStateHash}:${resultingStateHash}`
+   *
+   * This allows offline verification of documents without reducer logic:
+   * - Verifier can check that the signature is valid for the claimed resulting state
+   * - Verifier can compare claimed resulting state to actual operation.hash
+   *
+   * @param action - The action to sign
+   * @param resultingStateHash - The predicted hash of document state AFTER this action runs
+   * @param abortSignal - Optional abort signal
+   * @returns A Signature tuple with the resulting hash encoded in element [3]
+   */
+  signActionWithResultingState(action: Action, resultingStateHash: string, abortSignal?: AbortSignal): Promise<Signature>;
+  /**
+   * Internal signing implementation shared by signAction and signActionWithResultingState.
+   */
+  private _signAction;
+  private hashAction;
+  private buildSignatureMessage;
+  private arrayBufferToHex;
+  private arrayBufferToBase64;
+}
+/**
+ * Creates a signature verification handler that verifies signatures using the Web Crypto API.
+ * The verification uses ECDSA with P-256 curve and SHA-256 hash, matching the RenownCrypto signing algorithm.
+ */
+declare function createSignatureVerifier(requireSignature?: boolean): SignatureVerificationHandler;
+/**
+ * Parses the hash field (element [3]) from a signature tuple.
+ *
+ * Supports two formats:
+ * - Old format: just `prevStateHash` (no colon)
+ * - New format: `prevStateHash:resultingStateHash` (colon-separated)
+ *
+ * @param hashField - The 4th element of a Signature tuple
+ * @returns Object with prevStateHash and optional resultingStateHash
+ */
+declare function parseSignatureHashField(hashField: string): {
+  prevStateHash: string;
+  resultingStateHash: string | undefined;
+};
+/**
+ * Extracts the resulting state hash from a signature, if present.
+ *
+ * @param signature - A Signature tuple
+ * @returns The resulting state hash, or undefined if not present
+ */
+declare function extractResultingHashFromSignature(signature: Signature): string | undefined;
+/**
+ * Checks if a signature includes a resulting state hash.
+ *
+ * @param signature - A Signature tuple
+ * @returns true if the signature includes a resulting state hash
+ */
+declare function signatureHasResultingHash(signature: Signature): boolean;
+//#endregion
+//#region src/crypto/browser-key-storage.d.ts
+declare class BrowserKeyStorage implements JsonWebKeyPairStorage {
+  #private;
+  constructor(db: IDBDatabase);
+  static create(dbName?: string): Promise<BrowserKeyStorage>;
+  saveKeyPair(keyPair: JwkKeyPair): Promise<void>;
+  loadKeyPair(): Promise<JwkKeyPair | undefined>;
+  removeKeyPair(): Promise<void>;
+}
+//#endregion
+export { parseSignatureHashField as a, RenownCryptoBuilder as c, extractResultingHashFromSignature as i, ConnectCrypto as l, RenownCryptoSigner as n, signatureHasResultingHash as o, createSignatureVerifier as r, MemoryKeyStorage as s, BrowserKeyStorage as t, RenownCrypto as u };
+//# sourceMappingURL=index-BF2qTv7d.d.ts.map

package/dist/index-BF2qTv7d.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-BF2qTv7d.d.ts","names":[],"sources":["../src/crypto/renown-crypto.ts","../src/crypto/renown-crypto-builder.ts","../src/crypto/memory-key-storage.ts","../src/crypto/signer.ts","../src/crypto/browser-key-storage.ts"],"mappings":";;;;cAUa,YAAA,YAAwB,aAAA;EAAA;WAK1B,GAAA,EAAK,GAAA;EALU;EAAA,SAOf,OAAA;EAAA,OAEF,SAAA,EAAS,cAAA;EAAA,OACT,aAAA;;;;;cAGL,cAAA,EAAgB,qBAAA,EAChB,MAAA,EAAQ,YAAA,EACR,OAAA,EAAS,aAAA,EACT,GAAA,EAAK,GAAA,EACL,OAAA;EAAA,IASE,SAAA,CAAA,GAAS,SAAA;EAIP,cAAA,CACJ,OAAA,sBACA,OAAA,GAAU,wBAAA,GACT,OAAA;EAUG,SAAA,CAAA,GAAa,OAAA;EAQb,IAAA,CAAK,IAAA,EAAM,UAAA,YAAsB,OAAA,CAAQ,UAAA;EAazC,MAAA,CAAO,IAAA,EAAM,UAAA,EAAY,SAAA,EAAW,UAAA,GAAa,OAAA;EAAA,IASnD,MAAA,CAAA,GAAU,MAAA;AAAA;;;;cAiBH,aAAA,SAAsB,YAAA;;;cC3FtB,mBAAA;EAAA;UACH,cAAA;EAAA,QACA,YAAA;EAAA,QACA,OAAA;EAER,kBAAA,CAAmB,OAAA,EAAS,qBAAA;EAK5B,gBAAA,CAAiB,MAAA,EAAQ,YAAA;EAOzB,WAAA,CAAY,OAAA;EAKN,KAAA,CAAA,GAAS,OAAA,CAAQ,YAAA;AAAA;;;cC7BZ,gBAAA,YAA4B,qBAAA;EAAA,QAC/B,OAAA;cAEI,OAAA,GAAU,UAAA;EAItB,WAAA,CAAA,GAAW,OAAA,CAAA,UAAA;EAIX,WAAA,CAAY,OAAA,EAAS,UAAA,GAAU,OAAA;EAK/B,aAAA,CAAA,GAAa,OAAA;AAAA;;;cCDF,kBAAA,YAA8B,OAAA;EAAA,iBAItB,MAAA;EAAA,iBACA,OAAA;EACV,IAAA,GAAO,gBAAA;EAAA,SALP,GAAA,EAAK,eAAA;cAGK,MAAA,EAAQ,aAAA,EACR,OAAA,UACV,IAAA,GAAO,gBAAA;EAAA,IAQZ,SAAA,CAAA,GAAS,SAAA;EAIP,IAAA,CAAK,IAAA,EAAM,UAAA,GAAa,OAAA,CAAQ,UAAA;EAIhC,MAAA,CAAO,IAAA,EAAM,UAAA,EAAY,SAAA,EAAW,UAAA,GAAa,OAAA;EAOjD,UAAA,CACJ,MAAA,EAAQ,MAAA,EACR,WAAA,GAAc,WAAA,GACb,OAAA,CAAQ,SAAA;EHNR;;;;;;;;;;;;;;;EG0BG,4BAAA,CACJ,MAAA,EAAQ,MAAA,EACR,kBAAA,UACA,WAAA,GAAc,WAAA,GACb,OAAA,CAAQ,SAAA;EHxDF;;;EAAA,QGiEK,WAAA;EAAA,QAiCA,UAAA;EAAA,QAYN,qBAAA;EAAA,QASA,gBAAA;EAAA,QAQA,mBAAA;AAAA;;;;;iBAcM,uBAAA,CACd,gBAAA,aACC,4BAAA;;;;;;;;;;;iBAgNa,uBAAA,CAAwB,SAAA;EACtC,aAAA;EACA,kBAAA;AAAA;;;;;;;iBAuBc,iCAAA,CACd,SAAA,EAAW,SAAA;;;;;;;iBAaG,yBAAA,CAA0B,SAAA,EAAW,SAAA;;;cCjZxC,iBAAA,YAA6B,qBAAA;EAAA;cAG5B,EAAA,EAAI,WAAA;EAAA,OAIH,MAAA,CACX,MAAA,YACC,OAAA,CAAQ,iBAAA;EA4CL,WAAA,CAAY,OAAA,EAAS,UAAA,GAAU,OAAA;EAS/B,WAAA,CAAA,GAAe,OAAA,CAAQ,UAAA;EAavB,aAAA,CAAA,GAAiB,OAAA;AAAA"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { $ as User, A as ISigner, B as PKHDid, C as DIDResolutionResult, D as IPowerhouseIssuerType, E as IPowerhouseCredentialSubject, F as JWTVerified, G as RenownEvents, H as ProfileFetcher, I as JWTVerifyPolicies, J as RenownStorageMap, K as RenownProfile, L as JsonWebKey, M as InternalUser, N as Issuer, O as IProof, P as JWTPayload, Q as Unsubscribe, R as KeyCapabilitySection, S as DIDResolutionMetadata, T as IAuthCredentialSubject, U as Proof, V as PowerhouseVerifiableCredential, W as RenownEventEmitter, X as ServiceEndpoint, Y as Service, Z as Signer, _ as ConditionWeightedThreshold, a as signatureHasResultingHash, at as BaseStorage, b as DIDDocument, c as ConnectCrypto, ct as CREDENTIAL_SCHEMA_EIP712_TYPE, d as IConnectCrypto, dt as DEFAULT_RENOWN_CHAIN_ID, et as Verifiable, f as IRenownCrypto, ft as DEFAULT_RENOWN_NETWORK_ID, g as AuthVerifiedCredential, gt as VERIFIABLE_CREDENTIAL_EIP712_TYPE, h as AuthVerifiableCredential, ht as ISSUER_TYPE, i as parseSignatureHashField, it as W3CCredential, j as IVerifiableCredential, k as IRenown, l as RenownCrypto, lt as CREDENTIAL_SUBJECT_TYPE, m as JwkKeyPair, mt as DOMAIN_TYPE, n as createSignatureVerifier, nt as VerifiedCredential, o as MemoryKeyStorage, p as JsonWebKeyPairStorage, pt as DEFAULT_RENOWN_URL, q as RenownStorage, r as extractResultingHashFromSignature, rt as VerifiedJWT, s as RenownCryptoBuilder, st as IEventEmitter, t as RenownCryptoSigner, tt as VerificationMethod, u as DID, ut as CREDENTIAL_TYPES, v as CreateBearerTokenOptions, w as EcdsaSignature, x as DIDDocumentMetadata, y as CredentialStatus, z as LoginStatus } from "./signer-DYKGoYHB.js";
-import { t as BrowserKeyStorage } from "./browser-key-storage-DSkDBAhU.js";
-import { C as Renown, S as verifyCredentialSignature, _ as VerifyAuthCredentialOptions, a as getResolver, b as recoverCredentialSigner, c as fetchRenownProfile, d as BuildCredentialParams, f as CredentialDomain, g as VerifiedAuthCredential, h as SignCredentialTypedData, i as createAuthBearerToken, l as BaseRenownBuilder, m as FetchDelegationCredentialOptions, n as VerifyAuthBearerTokenOptions, o as parsePkhDid, p as CredentialMessage, r as assertIsAuthCredential, s as verifyAuthBearerToken, t as ILogger, u as RenownBuilderOptions, v as buildAndSignCredential, w as RenownMemoryStorage, x as verifyAuthCredential, y as fetchDelegationCredential } from "./utils-C9ZgMs_C.js";
+import { $ as IEventEmitter, A as LoginStatus, B as Service, C as InternalUser, D as JWTVerifyPolicies, E as JWTVerified, F as RenownEventEmitter, G as User, H as SignInParams, I as RenownEvents, J as VerifiedCredential, K as Verifiable, L as RenownProfile, M as PowerhouseVerifiableCredential, N as ProfileFetcher, O as JsonWebKey, P as Proof, R as RenownStorage, S as IVerifiableCredential, T as JWTPayload, U as Signer, V as ServiceEndpoint, W as Unsubscribe, X as W3CCredential, Y as VerifiedJWT, Z as BaseStorage, _ as IPowerhouseCredentialSubject, _t as DEFAULT_RENOWN_URL, a as JwkKeyPair, at as VerifiedAuthCredential, b as IRenown, bt as RENOWN_SESSION_COOKIE, c as ConditionWeightedThreshold, ct as fetchDelegationCredential, d as DIDDocument, dt as verifyCredentialSignature, et as BuildCredentialParams, f as DIDDocumentMetadata, ft as CREDENTIAL_SCHEMA_EIP712_TYPE, g as IAuthCredentialSubject, gt as DEFAULT_RENOWN_NETWORK_ID, h as EcdsaSignature, ht as DEFAULT_RENOWN_CHAIN_ID, i as JsonWebKeyPairStorage, it as SignCredentialTypedData, j as PKHDid, k as KeyCapabilitySection, l as CreateBearerTokenOptions, lt as recoverCredentialSigner, m as DIDResolutionResult, mt as CREDENTIAL_TYPES, n as IConnectCrypto, nt as CredentialMessage, o as AuthVerifiableCredential, ot as VerifyAuthCredentialOptions, p as DIDResolutionMetadata, pt as CREDENTIAL_SUBJECT_TYPE, q as VerificationMethod, r as IRenownCrypto, rt as FetchDelegationCredentialOptions, s as AuthVerifiedCredential, st as buildAndSignCredential, t as DID, tt as CredentialDomain, u as CredentialStatus, ut as verifyAuthCredential, v as IPowerhouseIssuerType, vt as DOMAIN_TYPE, w as Issuer, x as ISigner, xt as VERIFIABLE_CREDENTIAL_EIP712_TYPE, y as IProof, yt as ISSUER_TYPE, z as RenownStorageMap } from "./types-ocCFjR5j.js";
+import { a as parseSignatureHashField, c as RenownCryptoBuilder, i as extractResultingHashFromSignature, l as ConnectCrypto, n as RenownCryptoSigner, o as signatureHasResultingHash, r as createSignatureVerifier, s as MemoryKeyStorage, t as BrowserKeyStorage, u as RenownCrypto } from "./index-BF2qTv7d.js";
+import { C as SwitchboardClient, S as RenownMemoryStorage, _ as BaseRenownBuilder, a as getResolver, b as resolveSwitchboardEndpoint, d as RenownSessionProfile, g as fetchRenownProfile, i as createAuthBearerToken, n as VerifyAuthBearerTokenOptions, o as parsePkhDid, r as assertIsAuthCredential, s as verifyAuthBearerToken, t as ILogger, u as RenownSessionCookie, v as RenownBuilderOptions, x as Renown, y as ResolveSwitchboardEndpointOptions } from "./utils-DS2Ha4Bg.js";
 
 //#region src/event/event.browser.d.ts
 declare class BrowserEventEmitter<Events extends Record<string, unknown>> implements IEventEmitter<Events> {
@@ -22,13 +22,20 @@ declare class BrowserStorage<T extends Record<string, unknown> = Record<string,
 //#region src/init.browser.d.ts
 declare class BrowserRenownStorage extends BrowserStorage<RenownStorageMap> {}
 declare class BrowserRenownEventEmitter extends BrowserEventEmitter<RenownEvents> {}
+declare function readPersistedUser(basename?: string): User | undefined;
 interface BrowserRenownBuilderOptions {
   /** Base path for storage keys (e.g., "/app" for multi-tenant apps) */
   basename?: string;
   /** Renown server URL. Defaults to https://www.renown.id */
   baseUrl?: string;
+  /** Switchboard GraphQL endpoint for the direct-to-reactor flow. */
+  switchboardUrl?: string;
   /** IndexedDB database name for key storage. Defaults to "renownKeyDB" */
   keyDbName?: string;
+  /** Re-check a stored credential on build (default "always"). */
+  revalidate?: "always" | "never";
+  /** Chain id credentials are issued on (default 1). It is part of the issuer DID, so `signIn` rejects a session from another chain. */
+  chainId?: number;
 }
 /**
  * Browser-specific Renown builder with pre-configured defaults.
@@ -36,10 +43,6 @@ interface BrowserRenownBuilderOptions {
  */
 declare class RenownBuilder extends BaseRenownBuilder {
   #private;
-  /**
-   * @param appName - Application name used for signing context
-   * @param options - Browser-specific configuration options
-   */
   constructor(appName: string, options?: BrowserRenownBuilderOptions);
   /**
    * Set base path for storage keys (e.g., "/app" for multi-tenant apps).
@@ -65,5 +68,5 @@ declare class RenownBuilder extends BaseRenownBuilder {
  */
 declare function initRenown(appName: string, options?: BrowserRenownBuilderOptions): Promise<Renown>;
 //#endregion
-export { AuthVerifiableCredential, AuthVerifiedCredential, BaseRenownBuilder, BrowserKeyStorage, BrowserRenownBuilderOptions, BrowserRenownEventEmitter, BrowserRenownStorage, BuildCredentialParams, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConditionWeightedThreshold, ConnectCrypto, CreateBearerTokenOptions, CredentialDomain, CredentialMessage, CredentialStatus, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DID, DIDDocument, DIDDocumentMetadata, DIDResolutionMetadata, DIDResolutionResult, DOMAIN_TYPE, EcdsaSignature, FetchDelegationCredentialOptions, IAuthCredentialSubject, IConnectCrypto, ILogger, IPowerhouseCredentialSubject, IPowerhouseIssuerType, IProof, IRenown, IRenownCrypto, ISSUER_TYPE, ISigner, IVerifiableCredential, InternalUser, Issuer, JWTPayload, JWTVerified, JWTVerifyPolicies, JsonWebKey, JsonWebKeyPairStorage, JwkKeyPair, KeyCapabilitySection, LoginStatus, MemoryKeyStorage, PKHDid, PowerhouseVerifiableCredential, ProfileFetcher, Proof, Renown, RenownBuilder, RenownBuilderOptions, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownEventEmitter, RenownEvents, RenownMemoryStorage, RenownProfile, RenownStorage, RenownStorageMap, Service, ServiceEndpoint, SignCredentialTypedData, Signer, Unsubscribe, User, VERIFIABLE_CREDENTIAL_EIP712_TYPE, Verifiable, VerificationMethod, VerifiedAuthCredential, VerifiedCredential, VerifiedJWT, VerifyAuthBearerTokenOptions, VerifyAuthCredentialOptions, W3CCredential, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, recoverCredentialSigner, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature };
+export { AuthVerifiableCredential, AuthVerifiedCredential, BaseRenownBuilder, BrowserKeyStorage, BrowserRenownBuilderOptions, BrowserRenownEventEmitter, BrowserRenownStorage, BuildCredentialParams, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConditionWeightedThreshold, ConnectCrypto, CreateBearerTokenOptions, CredentialDomain, CredentialMessage, CredentialStatus, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DID, DIDDocument, DIDDocumentMetadata, DIDResolutionMetadata, DIDResolutionResult, DOMAIN_TYPE, EcdsaSignature, FetchDelegationCredentialOptions, IAuthCredentialSubject, IConnectCrypto, ILogger, IPowerhouseCredentialSubject, IPowerhouseIssuerType, IProof, IRenown, IRenownCrypto, ISSUER_TYPE, ISigner, IVerifiableCredential, InternalUser, Issuer, JWTPayload, JWTVerified, JWTVerifyPolicies, JsonWebKey, JsonWebKeyPairStorage, JwkKeyPair, KeyCapabilitySection, LoginStatus, MemoryKeyStorage, PKHDid, PowerhouseVerifiableCredential, ProfileFetcher, Proof, RENOWN_SESSION_COOKIE, Renown, RenownBuilder, RenownBuilderOptions, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownEventEmitter, RenownEvents, RenownMemoryStorage, RenownProfile, type RenownSessionCookie, type RenownSessionProfile, RenownStorage, RenownStorageMap, ResolveSwitchboardEndpointOptions, Service, ServiceEndpoint, SignCredentialTypedData, SignInParams, Signer, SwitchboardClient, Unsubscribe, User, VERIFIABLE_CREDENTIAL_EIP712_TYPE, Verifiable, VerificationMethod, VerifiedAuthCredential, VerifiedCredential, VerifiedJWT, VerifyAuthBearerTokenOptions, VerifyAuthCredentialOptions, W3CCredential, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, readPersistedUser, recoverCredentialSigner, resolveSwitchboardEndpoint, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/event/event.browser.ts","../src/storage/storage.browser.ts","../src/init.browser.ts"],"mappings":";;;;;cAQa,mBAAA,gBACI,MAAA,8BACJ,aAAA,CAAc,MAAA;EAAA;EAGzB,EAAA,iBAAmB,MAAA,CAAA,CACjB,KAAA,EAAO,CAAA,EACP,QAAA,GAAW,IAAA,EAAM,MAAA,CAAO,CAAA;EAc1B,IAAA,iBAAqB,MAAA,CAAA,CAAQ,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,MAAA,CAAO,CAAA;AAAA;;;cC3BzC,cAAA,WACD,MAAA,oBAA0B,MAAA,2BAC5B,WAAA,CAAY,CAAA;EAAA;mBACH,SAAA;cAEL,SAAA,UAAmB,QAAA;EAQ/B,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,GAAM,CAAA,CAAE,GAAA;EAQtC,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,GAAA;EAM7C,MAAA,CAAO,GAAA,QAAW,CAAA;AAAA;;;cCtBP,oBAAA,SAA6B,cAAA,CAAe,gBAAA;AAAA,cAC5C,yBAAA,SAAkC,mBAAA,CAAoB,YAAA;AAAA,UAElD,2BAAA;EFGI;EEDnB,QAAA;EFGmB;EEDnB,OAAA;EFeqB;EEbrB,SAAA;AAAA;;;;;cAOW,aAAA,SAAsB,iBAAA;EAAA;EFbtB;;;;cEqBC,OAAA,UAAiB,OAAA,GAAS,2BAAA;EFlBnB;;;EEgCnB,YAAA,CAAa,QAAA;EF9Ba;;;;EEwC1B,aAAA,CAAc,SAAA;EF1BO;;;;EEmCf,KAAA,CAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;;;;;;AD9DzB;;iBC4EgB,UAAA,CACd,OAAA,UACA,OAAA,GAAS,2BAAA,GAAgC,OAAA,CAAA,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/event/event.browser.ts","../src/storage/storage.browser.ts","../src/init.browser.ts"],"mappings":";;;;;cAQa,mBAAA,gBACI,MAAA,8BACJ,aAAA,CAAc,MAAA;EAAA;EAGzB,EAAA,iBAAmB,MAAA,CAAA,CACjB,KAAA,EAAO,CAAA,EACP,QAAA,GAAW,IAAA,EAAM,MAAA,CAAO,CAAA;EAc1B,IAAA,iBAAqB,MAAA,CAAA,CAAQ,KAAA,EAAO,CAAA,EAAG,IAAA,EAAM,MAAA,CAAO,CAAA;AAAA;;;cC3BzC,cAAA,WACD,MAAA,oBAA0B,MAAA,2BAC5B,WAAA,CAAY,CAAA;EAAA;mBACH,SAAA;cAEL,SAAA,UAAmB,QAAA;EAQ/B,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,GAAM,CAAA,CAAE,GAAA;EAQtC,GAAA,mBAAsB,CAAA,CAAA,CAAG,GAAA,EAAK,GAAA,EAAK,KAAA,GAAQ,CAAA,CAAE,GAAA;EAM7C,MAAA,CAAO,GAAA,QAAW,CAAA;AAAA;;;cCtBP,oBAAA,SAA6B,cAAA,CAAe,gBAAA;AAAA,cAC5C,yBAAA,SAAkC,mBAAA,CAAoB,YAAA;AAAA,iBAInD,iBAAA,CAAkB,QAAA,YAAoB,IAAA;AAAA,UASrC,2BAAA;EFPN;EEST,QAAA;EFR0B;EEU1B,OAAA;EFIoC;EEFpC,cAAA;EFEoD;EEApD,SAAA;EFnBwB;EEqBxB,UAAA;EFtBA;EEwBA,OAAA;AAAA;;;;;cAOW,aAAA,SAAsB,iBAAA;EAAA;cAKrB,OAAA,UAAiB,OAAA,GAAS,2BAAA;EF9BnB;;;EEmDnB,YAAA,CAAa,QAAA;EFrCb;;;;EE+CA,aAAA,CAAc,SAAA;EF/C+B;;;;EEwDvC,KAAA,CAAA,GAAS,OAAA,CAAQ,MAAA;AAAA;;;ADnFzB;;;;;iBC2GgB,UAAA,CACd,OAAA,UACA,OAAA,GAAS,2BAAA,GAAgC,OAAA,CAAA,MAAA"}

package/dist/index.js

@@ -1,6 +1,7 @@
-import { _ as DOMAIN_TYPE, a as BaseStorage, c as recoverCredentialSigner, d as CREDENTIAL_SCHEMA_EIP712_TYPE, f as CREDENTIAL_SUBJECT_TYPE, g as DEFAULT_RENOWN_URL, h as DEFAULT_RENOWN_NETWORK_ID, i as RenownMemoryStorage, l as verifyAuthCredential, m as DEFAULT_RENOWN_CHAIN_ID, n as fetchRenownProfile, o as buildAndSignCredential, p as CREDENTIAL_TYPES, r as Renown, s as fetchDelegationCredential, t as BaseRenownBuilder, u as verifyCredentialSignature, v as ISSUER_TYPE, y as VERIFIABLE_CREDENTIAL_EIP712_TYPE } from "./renown-builder-Sn_Y2Cb2.js";
-import { a as signatureHasResultingHash, c as ConnectCrypto, d as createAuthBearerToken, f as getResolver, i as parseSignatureHashField, l as RenownCrypto, m as verifyAuthBearerToken, n as createSignatureVerifier, o as MemoryKeyStorage, p as parsePkhDid, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner, u as assertIsAuthCredential } from "./signer-CgYhXTV7.js";
-import { t as BrowserKeyStorage } from "./browser-key-storage-v4O-fjz0.js";
+import { a as DEFAULT_RENOWN_NETWORK_ID, c as ISSUER_TYPE, i as DEFAULT_RENOWN_CHAIN_ID, l as RENOWN_SESSION_COOKIE, n as CREDENTIAL_SUBJECT_TYPE, o as DEFAULT_RENOWN_URL, r as CREDENTIAL_TYPES, s as DOMAIN_TYPE, t as CREDENTIAL_SCHEMA_EIP712_TYPE, u as VERIFIABLE_CREDENTIAL_EIP712_TYPE } from "./constants-B7wOp9oo.js";
+import { a as BaseStorage, c as recoverCredentialSigner, d as SwitchboardClient, f as resolveSwitchboardEndpoint, i as RenownMemoryStorage, l as verifyAuthCredential, n as fetchRenownProfile, o as buildAndSignCredential, r as Renown, s as fetchDelegationCredential, t as BaseRenownBuilder, u as verifyCredentialSignature } from "./renown-builder-KOzzCXrQ.js";
+import { a as signatureHasResultingHash, c as ConnectCrypto, d as createAuthBearerToken, f as getResolver, i as parseSignatureHashField, l as RenownCrypto, m as verifyAuthBearerToken, n as createSignatureVerifier, o as MemoryKeyStorage, p as parsePkhDid, r as extractResultingHashFromSignature, s as RenownCryptoBuilder, t as RenownCryptoSigner, u as assertIsAuthCredential } from "./signer-BpvojvCh.js";
+import { t as BrowserKeyStorage } from "./browser-key-storage-e3RQsnLS.js";
 //#region src/event/event.browser.ts
 var TypedCustomEvent = class extends CustomEvent {
 	constructor(type, detail) {
@@ -49,6 +50,14 @@ var BrowserStorage = class extends BaseStorage {
 //#region src/init.browser.ts
 var BrowserRenownStorage = class extends BrowserStorage {};
 var BrowserRenownEventEmitter = class extends BrowserEventEmitter {};
+function readPersistedUser(basename) {
+	if (typeof localStorage === "undefined") return void 0;
+	try {
+		return new BrowserStorage("renown", basename).get("user");
+	} catch {
+		return;
+	}
+}
 /**
 * Browser-specific Renown builder with pre-configured defaults.
 * Uses localStorage for user data and IndexedDB for key storage.
@@ -56,17 +65,17 @@ var BrowserRenownEventEmitter = class extends BrowserEventEmitter {};
 var RenownBuilder = class extends BaseRenownBuilder {
 	#basename;
 	#keyDbName;
-	/**
-	* @param appName - Application name used for signing context
-	* @param options - Browser-specific configuration options
-	*/
+	#revalidate;
 	constructor(appName, options = {}) {
 		super(appName);
 		this.#basename = options.basename;
 		this.#keyDbName = options.keyDbName;
+		this.#revalidate = options.revalidate ?? "always";
 		this.withStorage(new BrowserRenownStorage("renown", this.#basename));
 		this.withEventEmitter(new BrowserRenownEventEmitter());
 		if (options.baseUrl) this.withBaseUrl(options.baseUrl);
+		if (options.switchboardUrl) this.withSwitchboardUrl(options.switchboardUrl);
+		if (options.chainId !== void 0) this.withChainId(options.chainId);
 	}
 	/**
 	* Set base path for storage keys (e.g., "/app" for multi-tenant apps).
@@ -91,7 +100,10 @@ var RenownBuilder = class extends BaseRenownBuilder {
 	async build() {
 		const keyStorage = await BrowserKeyStorage.create(this.#keyDbName);
 		this.withKeyPairStorage(keyStorage);
-		return super.build();
+		const renown = await super.build();
+		if (renown.user) if (this.#revalidate === "always") renown.revalidate();
+		else renown.refreshProfile();
+		return renown;
 	}
 };
 /**
@@ -105,6 +117,6 @@ function initRenown(appName, options = {}) {
 	return new RenownBuilder(appName, options).build();
 }
 //#endregion
-export { BaseRenownBuilder, BrowserKeyStorage, BrowserRenownEventEmitter, BrowserRenownStorage, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConnectCrypto, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DOMAIN_TYPE, ISSUER_TYPE, MemoryKeyStorage, Renown, RenownBuilder, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownMemoryStorage, VERIFIABLE_CREDENTIAL_EIP712_TYPE, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, recoverCredentialSigner, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature };
+export { BaseRenownBuilder, BrowserKeyStorage, BrowserRenownEventEmitter, BrowserRenownStorage, CREDENTIAL_SCHEMA_EIP712_TYPE, CREDENTIAL_SUBJECT_TYPE, CREDENTIAL_TYPES, ConnectCrypto, DEFAULT_RENOWN_CHAIN_ID, DEFAULT_RENOWN_NETWORK_ID, DEFAULT_RENOWN_URL, DOMAIN_TYPE, ISSUER_TYPE, MemoryKeyStorage, RENOWN_SESSION_COOKIE, Renown, RenownBuilder, RenownCrypto, RenownCryptoBuilder, RenownCryptoSigner, RenownMemoryStorage, SwitchboardClient, VERIFIABLE_CREDENTIAL_EIP712_TYPE, assertIsAuthCredential, buildAndSignCredential, createAuthBearerToken, createSignatureVerifier, extractResultingHashFromSignature, fetchDelegationCredential, fetchRenownProfile, getResolver, initRenown, parsePkhDid, parseSignatureHashField, readPersistedUser, recoverCredentialSigner, resolveSwitchboardEndpoint, signatureHasResultingHash, verifyAuthBearerToken, verifyAuthCredential, verifyCredentialSignature };
 
 //# sourceMappingURL=index.js.map