@renown/sdk 6.2.2-dev.6 → 6.2.2-dev.60

package/dist/local-credential-verifier-BcCzjvmd.js

@@ -0,0 +1,846 @@
+import { a as DEFAULT_RENOWN_NETWORK_ID, o as DEFAULT_RENOWN_URL, r as CREDENTIAL_TYPES } from "./constants-BexAR53F.js";
+import { m as verifyAuthBearerToken, p as parsePkhDid, s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-DrjINLqt.js";
+import { recoverTypedDataAddress } from "viem";
+import { createAction } from "@powerhousedao/shared/document-model";
+//#region src/discovery.ts
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 3e3;
+async function resolveSwitchboardEndpoint(options) {
+	const { switchboardUrl, baseUrl, timeoutMs } = options;
+	if (switchboardUrl) return switchboardUrl;
+	if (!baseUrl) return;
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs ?? DEFAULT_DISCOVERY_TIMEOUT_MS);
+	try {
+		const url = new URL("/api/switchboard", baseUrl);
+		const response = await fetch(url, {
+			method: "GET",
+			signal: controller.signal
+		});
+		if (!response.ok) return;
+		return (await response.json()).endpoint || void 0;
+	} catch {
+		return;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+//#endregion
+//#region src/switchboard.ts
+function userDriveId(address) {
+	return `renown-${address.toLowerCase()}`;
+}
+const CREDENTIALS_QUERY = `
+  query RenownCredentials($input: RenownCredentialsInput!) {
+    renownCredentials(input: $input) {
+      documentId
+      credentialId
+      context
+      type
+      issuerId
+      issuerEthereumAddress
+      issuanceDate
+      expirationDate
+      credentialSubjectId
+      credentialSubjectApp
+      credentialStatusId
+      credentialStatusType
+      credentialSchemaId
+      credentialSchemaType
+      proofVerificationMethod
+      proofEthereumAddress
+      proofCreated
+      proofPurpose
+      proofType
+      proofValue
+      proofEip712Domain
+      proofEip712PrimaryType
+      revoked
+    }
+  }
+`;
+const USERS_QUERY = `
+  query RenownUsers($input: RenownUsersInput!) {
+    renownUsers(input: $input) {
+      documentId
+      username
+      ethAddress
+      userImage
+      createdAt
+      updatedAt
+    }
+  }
+`;
+const CREATE_EMPTY_DOCUMENT_MUTATION = `
+  mutation CreateEmptyDocument(
+    $documentType: String!
+    $parentIdentifier: String
+  ) {
+    createEmptyDocument(
+      documentType: $documentType
+      parentIdentifier: $parentIdentifier
+    ) {
+      id
+    }
+  }
+`;
+const MUTATE_DOCUMENT_MUTATION = `
+  mutation MutateDocument(
+    $documentIdentifier: String!
+    $actions: [ActionInput!]!
+  ) {
+    mutateDocument: execute(
+      documentIdentifier: $documentIdentifier
+      actions: $actions
+    ) {
+      id
+    }
+  }
+`;
+const RENOWN_CREDENTIAL_DOC_TYPE = "powerhouse/renown-credential";
+const RENOWN_USER_DOC_TYPE = "powerhouse/renown-user";
+function reshapeCredential(row) {
+	const domain = JSON.parse(row.proofEip712Domain);
+	return {
+		"@context": row.context,
+		type: row.type,
+		id: row.credentialId,
+		issuer: {
+			id: row.issuerId,
+			ethereumAddress: row.issuerEthereumAddress
+		},
+		credentialSubject: {
+			id: row.credentialSubjectId ?? "",
+			app: row.credentialSubjectApp
+		},
+		credentialSchema: {
+			id: row.credentialSchemaId,
+			type: row.credentialSchemaType
+		},
+		...row.credentialStatusId ? { credentialStatus: {
+			id: row.credentialStatusId,
+			type: row.credentialStatusType ?? ""
+		} } : {},
+		issuanceDate: row.issuanceDate,
+		expirationDate: row.expirationDate ?? "",
+		proof: {
+			type: row.proofType,
+			created: row.proofCreated,
+			verificationMethod: row.proofVerificationMethod,
+			proofPurpose: row.proofPurpose,
+			proofValue: row.proofValue,
+			ethereumAddress: row.proofEthereumAddress,
+			eip712: {
+				domain,
+				types: CREDENTIAL_TYPES,
+				primaryType: "VerifiableCredential"
+			}
+		}
+	};
+}
+function issuerChainId(issuerId) {
+	return issuerId.split(":")[3];
+}
+function issuerDidAddress(issuerId) {
+	return issuerId.split(":")[4];
+}
+function bindsTo(row, address, chainId, appDid) {
+	const expected = address.toLowerCase();
+	return !row.revoked && row.credentialSubjectId === appDid && issuerChainId(row.issuerId) === String(chainId) && issuerDidAddress(row.issuerId)?.toLowerCase() === expected && row.issuerEthereumAddress.toLowerCase() === expected;
+}
+var SwitchboardClient = class {
+	#endpoint;
+	#transport;
+	constructor(source) {
+		if (typeof source === "string") {
+			this.#endpoint = source;
+			this.#transport = (query, variables) => this.#post(source, query, variables);
+		} else this.#transport = source;
+	}
+	/** The HTTP endpoint, or undefined when reading through a local executor. */
+	get endpoint() {
+		return this.#endpoint;
+	}
+	async #post(endpoint, query, variables) {
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				query,
+				variables
+			})
+		});
+		if (!response.ok) throw new Error(`Switchboard request failed: ${response.status}`);
+		const body = await response.json();
+		if (body.errors?.length) throw new Error(body.errors.map((e) => e.message).join("; "));
+		return body.data;
+	}
+	async #request(query, variables) {
+		const data = await this.#transport(query, variables);
+		if (!data) throw new Error("Switchboard returned no data");
+		return data;
+	}
+	async getCredential(params) {
+		const { address, chainId, appDid } = params;
+		const { renownCredentials } = await this.#request(CREDENTIALS_QUERY, { input: {
+			driveId: userDriveId(address),
+			ethAddress: address.toLowerCase(),
+			did: appDid,
+			includeRevoked: false
+		} });
+		const now = Date.now();
+		const mostRecent = renownCredentials.filter((row) => bindsTo(row, address, chainId, appDid)).filter((row) => {
+			if (!row.expirationDate) return true;
+			const expiresAt = Date.parse(row.expirationDate);
+			return !Number.isNaN(expiresAt) && expiresAt > now;
+		}).sort((a, b) => Date.parse(b.issuanceDate) - Date.parse(a.issuanceDate)).at(0);
+		return mostRecent ? reshapeCredential(mostRecent) : void 0;
+	}
+	async getProfileByAddress(address) {
+		const { renownUsers } = await this.#request(USERS_QUERY, { input: {
+			driveId: userDriveId(address),
+			ethAddresses: [address.toLowerCase()]
+		} });
+		const user = renownUsers.at(0);
+		if (!user) return void 0;
+		return {
+			documentId: user.documentId,
+			username: user.username,
+			ethAddress: user.ethAddress,
+			userImage: user.userImage,
+			createdAt: user.createdAt,
+			updatedAt: user.updatedAt
+		};
+	}
+	async createEmptyDocument(documentType, parentIdentifier) {
+		const { createEmptyDocument } = await this.#request(CREATE_EMPTY_DOCUMENT_MUTATION, {
+			documentType,
+			parentIdentifier
+		});
+		return createEmptyDocument.id;
+	}
+	async mutateDocument(documentIdentifier, actions) {
+		const { mutateDocument } = await this.#request(MUTATE_DOCUMENT_MUTATION, {
+			documentIdentifier,
+			actions
+		});
+		return mutateDocument.id;
+	}
+	async issueCredential(credential, parentIdentifier) {
+		const documentId = await this.createEmptyDocument(RENOWN_CREDENTIAL_DOC_TYPE, parentIdentifier);
+		const input = {
+			id: credential.id,
+			context: credential["@context"],
+			type: credential.type,
+			issuer: {
+				id: credential.issuer.id,
+				ethereumAddress: credential.issuer.ethereumAddress
+			},
+			credentialSubject: {
+				id: credential.credentialSubject.id,
+				app: credential.credentialSubject.app
+			},
+			credentialSchema: {
+				id: credential.credentialSchema.id,
+				type: credential.credentialSchema.type
+			},
+			issuanceDate: credential.issuanceDate,
+			expirationDate: credential.expirationDate || void 0,
+			proof: {
+				type: credential.proof.type,
+				created: credential.proof.created,
+				verificationMethod: credential.proof.verificationMethod,
+				proofPurpose: credential.proof.proofPurpose,
+				proofValue: credential.proof.proofValue,
+				ethereumAddress: credential.proof.ethereumAddress,
+				eip712: {
+					domain: {
+						version: credential.proof.eip712.domain.version,
+						chainId: credential.proof.eip712.domain.chainId
+					},
+					primaryType: credential.proof.eip712.primaryType
+				}
+			}
+		};
+		await this.mutateDocument(documentId, [createAction("INIT", input)]);
+		return documentId;
+	}
+	async findOrCreateUser(address, profile = {}) {
+		const updates = [];
+		if (profile.username !== void 0) updates.push(createAction("SET_USERNAME", { username: profile.username }));
+		if (profile.userImage !== void 0) updates.push(createAction("SET_USER_IMAGE", { userImage: profile.userImage }));
+		const existing = await this.getProfileByAddress(address);
+		if (existing) {
+			if (updates.length) await this.mutateDocument(existing.documentId, updates);
+			return existing.documentId;
+		}
+		const documentId = await this.createEmptyDocument(RENOWN_USER_DOC_TYPE);
+		await this.mutateDocument(documentId, [createAction("SET_ETH_ADDRESS", { ethAddress: address }), ...updates]);
+		return documentId;
+	}
+	async revokeCredential(documentId, reason) {
+		await this.mutateDocument(documentId, [createAction("REVOKE", {
+			revokedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			reason: reason ?? null
+		})]);
+	}
+	profileFetcher = (user) => this.getProfileByAddress(user.address).catch(() => void 0);
+};
+//#endregion
+//#region src/credential.ts
+/** Assemble a Renown delegation VC and sign it with the provided signer. */
+async function buildAndSignCredential(params) {
+	const { signTypedData, address, chainId, app, appId, expiresInDays = 7 } = params;
+	const issuerId = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;
+	const credentialId = `urn:uuid:${globalThis.crypto.randomUUID()}`;
+	const now = /* @__PURE__ */ new Date();
+	const expirationDate = new Date(now.getTime() + expiresInDays * 24 * 60 * 60 * 1e3);
+	const message = {
+		"@context": ["https://www.w3.org/2018/credentials/v1"],
+		type: ["VerifiableCredential", "RenownCredential"],
+		id: credentialId,
+		issuer: {
+			id: issuerId,
+			ethereumAddress: address
+		},
+		credentialSubject: {
+			id: appId,
+			app
+		},
+		credentialSchema: {
+			id: "https://renown.id/schemas/renown-credential/v1",
+			type: "JsonSchemaValidator2018"
+		},
+		issuanceDate: now.toISOString(),
+		expirationDate: expirationDate.toISOString()
+	};
+	const domain = {
+		version: "1",
+		chainId
+	};
+	const { EIP712Domain, ...signTypes } = CREDENTIAL_TYPES;
+	const signature = await signTypedData({
+		domain,
+		types: signTypes,
+		primaryType: "VerifiableCredential",
+		message
+	});
+	return {
+		...message,
+		proof: {
+			type: "EthereumEip712Signature2021",
+			created: message.issuanceDate,
+			verificationMethod: issuerId,
+			proofPurpose: "assertionMethod",
+			proofValue: signature,
+			ethereumAddress: address,
+			eip712: {
+				domain,
+				types: CREDENTIAL_TYPES,
+				primaryType: "VerifiableCredential"
+			}
+		}
+	};
+}
+/** Recover the address that signed a credential's EIP-712 proof. */
+async function recoverCredentialSigner(credential) {
+	const { proof, ...message } = credential;
+	const { EIP712Domain, ...types } = CREDENTIAL_TYPES;
+	return recoverTypedDataAddress({
+		domain: proof.eip712.domain,
+		types,
+		primaryType: "VerifiableCredential",
+		message,
+		signature: proof.proofValue
+	});
+}
+/** True when the proof was signed by the credential's declared issuer address. */
+async function verifyCredentialSignature(credential) {
+	try {
+		return (await recoverCredentialSigner(credential)).toLowerCase() === credential.issuer.ethereumAddress.toLowerCase();
+	} catch {
+		return false;
+	}
+}
+function withEip712Domain(credential, chainId) {
+	if (credential.proof.eip712?.domain) return credential;
+	return {
+		...credential,
+		proof: {
+			...credential.proof,
+			eip712: {
+				domain: {
+					version: "1",
+					chainId
+				},
+				types: CREDENTIAL_TYPES,
+				primaryType: "VerifiableCredential"
+			}
+		}
+	};
+}
+async function fetchDelegationCredentialRest(params) {
+	const { address, chainId, appDid, baseUrl } = params;
+	const url = new URL(`/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`, baseUrl);
+	const response = await fetch(url, { method: "GET" });
+	if (!response.ok) return void 0;
+	const { credential } = await response.json();
+	if (!credential) return void 0;
+	const [, , , issuerChainId, issuerAddress] = credential.issuer.id.split(":");
+	if (credential.credentialSubject.id !== appDid || issuerChainId !== String(chainId) || issuerAddress.toLowerCase() !== address.toLowerCase() || credential.issuer.ethereumAddress.toLowerCase() !== address.toLowerCase()) return;
+	if (credential.expirationDate) {
+		const expiresAt = Date.parse(credential.expirationDate);
+		if (Number.isNaN(expiresAt) || expiresAt <= Date.now()) return;
+	}
+	return credential;
+}
+async function finalizeCredential(credential, chainId, verifySignature) {
+	if (!verifySignature) return credential;
+	const withDomain = withEip712Domain(credential, chainId);
+	if (withDomain.proof.eip712.domain.chainId !== chainId || !await verifyCredentialSignature(withDomain)) return;
+	return withDomain;
+}
+async function fetchDelegationCredential(options) {
+	const { address, chainId, appDid, switchboardUrl, switchboardRequest, discover = true, verifySignature = true } = options;
+	const explicitBaseUrl = options.baseUrl;
+	const baseUrl = explicitBaseUrl ?? "https://www.renown.id";
+	try {
+		const source = switchboardRequest ?? (switchboardUrl ? switchboardUrl : discover && explicitBaseUrl ? await resolveSwitchboardEndpoint({ baseUrl }) : void 0);
+		const credential = source ? await new SwitchboardClient(source).getCredential({
+			address,
+			chainId,
+			appDid
+		}) : await fetchDelegationCredentialRest({
+			address,
+			chainId,
+			appDid,
+			baseUrl
+		});
+		if (!credential) return void 0;
+		return await finalizeCredential(credential, chainId, verifySignature);
+	} catch {
+		return;
+	}
+}
+async function verifyAuthCredential(jwt, options = {}) {
+	const verified = await verifyAuthBearerToken(jwt, { audience: options.audience });
+	if (!verified) return void 0;
+	const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
+	const appDid = verified.issuer;
+	const credential = await fetchDelegationCredential({
+		address,
+		chainId,
+		appDid,
+		baseUrl: options.renownUrl,
+		switchboardUrl: options.switchboardUrl,
+		switchboardRequest: options.switchboardRequest,
+		verifySignature: options.verifySignature
+	});
+	if (!credential) return void 0;
+	return {
+		address,
+		chainId,
+		networkId,
+		did: credential.issuer.id,
+		appDid,
+		credential
+	};
+}
+//#endregion
+//#region src/storage/common.ts
+var BaseStorage = class {};
+var MemoryStorage = class extends BaseStorage {
+	data = /* @__PURE__ */ new Map();
+	get(key) {
+		return this.data.get(key);
+	}
+	set(key, value) {
+		if (value === void 0) this.data.delete(key);
+		else this.data.set(key, value);
+	}
+	delete(key) {
+		this.data.delete(key);
+	}
+};
+//#endregion
+//#region src/common.ts
+var RenownMemoryStorage = class extends MemoryStorage {};
+var Renown = class {
+	#baseUrl;
+	#store;
+	#eventEmitter;
+	#appName;
+	#crypto;
+	#signer;
+	#profileFetcher;
+	#switchboard;
+	#chainId;
+	#status = "initial";
+	constructor(store, eventEmitter, crypto, appName, baseUrl = DEFAULT_RENOWN_URL, profileFetcher, switchboard, chainId = 1) {
+		this.#store = store;
+		this.#eventEmitter = eventEmitter;
+		this.#baseUrl = baseUrl;
+		this.#crypto = crypto;
+		this.#appName = appName;
+		this.#profileFetcher = profileFetcher;
+		this.#switchboard = switchboard;
+		this.#chainId = chainId;
+		const restoredUser = this.user;
+		this.#signer = new RenownCryptoSigner(crypto, this.#appName, restoredUser);
+		if (restoredUser) this.#status = "authorized";
+		this.on("user", (user) => {
+			this.#signer.user = user;
+		});
+	}
+	get baseUrl() {
+		return this.#baseUrl;
+	}
+	/** Chain id this app issues credentials on; a session from another chain is rejected by {@link signIn}. */
+	get chainId() {
+		return this.#chainId;
+	}
+	get user() {
+		return this.#store.get("user");
+	}
+	get status() {
+		return this.#status;
+	}
+	get signer() {
+		return this.#signer;
+	}
+	get crypto() {
+		return this.#crypto;
+	}
+	get did() {
+		return this.#crypto.did;
+	}
+	get profileFetcher() {
+		return this.#profileFetcher;
+	}
+	#updateStatus(status) {
+		this.#status = status;
+		this.#eventEmitter.emit("status", status);
+	}
+	#updateUser(user) {
+		if (user) this.#store.set("user", user);
+		else this.#store.delete("user");
+		this.#eventEmitter.emit("user", user);
+	}
+	async login(userDid) {
+		this.#updateStatus("checking");
+		try {
+			const result = parsePkhDid(userDid);
+			const credential = await this.#getCredential(result.address, result.chainId, this.#crypto.did);
+			if (!credential) {
+				this.#updateUser(void 0);
+				throw new Error("Credential not found");
+			}
+			return await this.#completeLogin(userDid, result, credential);
+		} catch (error) {
+			this.#updateUser(void 0);
+			this.#updateStatus("not-authorized");
+			throw error;
+		}
+	}
+	async signIn(params) {
+		if (!this.#switchboard) throw new Error("signIn requires a switchboard endpoint. Set switchboardUrl or a discoverable baseUrl.");
+		const { address, chainId, signTypedData, username, userImage, expiresInDays } = params;
+		if (chainId !== this.#chainId) throw new Error(`Renown signIn: wallet is on chain ${chainId}, but this app issues credentials on chain ${this.#chainId}. Switch networks and retry — signing here would create a separate identity for the same address.`);
+		this.#updateStatus("checking");
+		try {
+			const credential = await buildAndSignCredential({
+				signTypedData,
+				address,
+				chainId,
+				app: this.#appName,
+				appId: this.did,
+				expiresInDays
+			});
+			await this.#switchboard.issueCredential(credential);
+			await this.#switchboard.findOrCreateUser(address, {
+				username,
+				userImage
+			});
+			const userDid = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;
+			return await this.#completeLogin(userDid, parsePkhDid(userDid), credential);
+		} catch (error) {
+			this.#updateUser(void 0);
+			this.#updateStatus("not-authorized");
+			throw error;
+		}
+	}
+	async #completeLogin(userDid, result, credential) {
+		if (!(credential.issuer.id === userDid && credential.credentialSubject.id === this.did)) throw new Error("Invalid credential");
+		const verifiableCredential = credential.proof.eip712?.domain ? credential : {
+			...credential,
+			proof: {
+				...credential.proof,
+				eip712: {
+					domain: {
+						version: "1",
+						chainId: result.chainId
+					},
+					types: CREDENTIAL_TYPES,
+					primaryType: "VerifiableCredential"
+				}
+			}
+		};
+		if (credential.issuer.ethereumAddress.toLowerCase() !== result.address.toLowerCase() || verifiableCredential.proof.eip712.domain.chainId !== result.chainId || !await verifyCredentialSignature(verifiableCredential)) throw new Error("Invalid credential signature");
+		const user = {
+			...result,
+			address: credential.issuer.ethereumAddress,
+			did: userDid,
+			credential: verifiableCredential
+		};
+		this.#updateUser(user);
+		this.#updateStatus("authorized");
+		if (this.#profileFetcher) this.#profileFetcher(user, this.#baseUrl).then((profile) => {
+			if (profile && this.user?.address === user.address && this.user.chainId === user.chainId) this.#updateUser({
+				...this.user,
+				profile,
+				ens: {
+					name: profile.username ?? void 0,
+					avatarUrl: profile.userImage ?? void 0
+				}
+			});
+		}).catch(console.error);
+		return user;
+	}
+	logout() {
+		this.#updateUser(void 0);
+		this.#updateStatus("initial");
+		return Promise.resolve();
+	}
+	async revalidate() {
+		const user = this.user;
+		if (!user) return false;
+		try {
+			if (!await this.#getCredential(user.address, user.chainId, this.#crypto.did)) {
+				await this.logout();
+				return false;
+			}
+			await this.refreshProfile();
+			return true;
+		} catch {
+			return true;
+		}
+	}
+	async refreshProfile() {
+		const user = this.user;
+		if (!user || !this.#profileFetcher) return false;
+		try {
+			const profile = await this.#profileFetcher(user, this.#baseUrl);
+			if (!profile) return false;
+			const current = this.user;
+			if (!current || current.address !== user.address || current.chainId !== user.chainId) return false;
+			if (current.profile !== void 0 && current.profile.documentId === profile.documentId && current.profile.username === profile.username && current.profile.userImage === profile.userImage) return false;
+			this.#updateUser({
+				...current,
+				profile,
+				ens: {
+					name: profile.username ?? void 0,
+					avatarUrl: profile.userImage ?? void 0
+				}
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	on(event, listener) {
+		return this.#eventEmitter.on(event, listener);
+	}
+	async #getCredential(address, chainId, appDid) {
+		if (this.#switchboard) return this.#switchboard.getCredential({
+			address,
+			chainId,
+			appDid
+		});
+		if (!this.#baseUrl) throw new Error("RENOWN_URL is not set");
+		const url = new URL(`/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`, this.#baseUrl);
+		const response = await fetch(url, { method: "GET" });
+		if (response.ok) return (await response.json()).credential;
+		else throw new Error(`Failed to get credential: ${response.status}`);
+	}
+	async verifyBearerToken(token) {
+		return verifyAuthBearerToken(token);
+	}
+	async getBearerToken(options) {
+		if (!this.user) throw new Error("User not found");
+		return this.#crypto.getBearerToken(this.user.address, options);
+	}
+};
+//#endregion
+//#region src/event/memory.ts
+var MemoryEventEmitter = class {
+	#listeners = /* @__PURE__ */ new Map();
+	on(event, listener) {
+		if (!this.#listeners.has(event)) this.#listeners.set(event, /* @__PURE__ */ new Set());
+		this.#listeners.get(event).add(listener);
+		return () => {
+			this.#listeners.get(event)?.delete(listener);
+		};
+	}
+	emit(event, data) {
+		this.#listeners.get(event)?.forEach((listener) => listener(data));
+	}
+};
+//#endregion
+//#region src/profile.ts
+const fetchRenownProfile = async (user, baseUrl) => {
+	try {
+		const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/profile`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ ethAddress: user.address })
+		});
+		if (!response.ok) return;
+		return (await response.json()).profile ?? void 0;
+	} catch {
+		return;
+	}
+};
+//#endregion
+//#region src/renown-builder.ts
+/**
+* Base builder for creating Renown instances.
+* Use platform-specific builders (RenownBuilder from init.browser.js or init.node.js)
+* for pre-configured defaults.
+*/
+var BaseRenownBuilder = class BaseRenownBuilder {
+	#appName;
+	#storage;
+	#eventEmitter;
+	#crypto;
+	#keyPairStorage;
+	#baseUrl;
+	#switchboardUrl;
+	#profileFetcher;
+	#chainId;
+	/**
+	* @param appName - Application name used for signing context
+	*/
+	constructor(appName) {
+		this.#appName = appName;
+	}
+	/**
+	* Set custom storage for user data persistence.
+	* Defaults to in-memory storage if not set.
+	*/
+	withStorage(storage) {
+		this.#storage = storage;
+		return this;
+	}
+	/**
+	* Set custom event emitter for user state changes.
+	* Defaults to in-memory event emitter if not set.
+	*/
+	withEventEmitter(eventEmitter) {
+		this.#eventEmitter = eventEmitter;
+		return this;
+	}
+	/**
+	* Set a pre-built crypto instance.
+	* Either crypto or keyPairStorage must be provided.
+	*/
+	withCrypto(crypto) {
+		this.#crypto = crypto;
+		return this;
+	}
+	/**
+	* Set key pair storage for cryptographic keys.
+	* A crypto instance will be built from this storage.
+	* Either crypto or keyPairStorage must be provided.
+	*/
+	withKeyPairStorage(keyPairStorage) {
+		this.#keyPairStorage = keyPairStorage;
+		return this;
+	}
+	/**
+	* Set the Renown server URL for credential verification.
+	* Defaults to https://www.renown.id
+	*/
+	withBaseUrl(baseUrl) {
+		this.#baseUrl = baseUrl;
+		return this;
+	}
+	withSwitchboardUrl(switchboardUrl) {
+		this.#switchboardUrl = switchboardUrl;
+		return this;
+	}
+	withChainId(chainId) {
+		this.#chainId = chainId;
+		return this;
+	}
+	/**
+	* Set a profile fetcher strategy for enriching user data after login.
+	* The fetcher receives the authenticated user and the base URL,
+	* and returns a RenownProfile. Called in the background after each login.
+	* Defaults to fetchRenownProfile which calls the Renown API.
+	*/
+	withProfileFetcher(profileFetcher) {
+		this.#profileFetcher = profileFetcher;
+		return this;
+	}
+	/**
+	* Build and initialize the Renown instance.
+	* If a user is stored, attempts to re-authenticate them.
+	* @throws Error if neither crypto nor keyPairStorage is provided
+	*/
+	async build() {
+		if (!this.#crypto && !this.#keyPairStorage) throw new Error("Either crypto or keyPairStorage is required. Use withCrypto() or withKeyPairStorage() to set one.");
+		const chainId = this.#chainId ?? 1;
+		const crypto = this.#crypto ?? await new RenownCryptoBuilder().withKeyPairStorage(this.#keyPairStorage).withChainId(chainId).build();
+		if (crypto.chainId !== void 0 && crypto.chainId !== chainId) console.warn(`Renown: the supplied crypto signs bearer tokens for chain ${crypto.chainId}, but credentials are issued on chain ${chainId}.`);
+		const storage = this.#storage ?? new RenownMemoryStorage();
+		const eventEmitter = this.#eventEmitter ?? new MemoryEventEmitter();
+		const baseUrl = this.#baseUrl ?? "https://www.renown.id";
+		const switchboardEndpoint = await resolveSwitchboardEndpoint({
+			switchboardUrl: this.#switchboardUrl,
+			baseUrl
+		});
+		const switchboard = switchboardEndpoint ? new SwitchboardClient(switchboardEndpoint) : void 0;
+		const profileFetcher = this.#profileFetcher ?? (switchboard ? switchboard.profileFetcher : fetchRenownProfile);
+		return new Renown(storage, eventEmitter, crypto, this.#appName, baseUrl, profileFetcher, switchboard, chainId);
+	}
+	/**
+	* Create a BaseRenownBuilder from options object for a more concise API
+	*/
+	static from(options) {
+		const builder = new BaseRenownBuilder(options.appName);
+		if (options.storage) builder.withStorage(options.storage);
+		if (options.eventEmitter) builder.withEventEmitter(options.eventEmitter);
+		if (options.crypto) builder.withCrypto(options.crypto);
+		if (options.keyPairStorage) builder.withKeyPairStorage(options.keyPairStorage);
+		if (options.baseUrl) builder.withBaseUrl(options.baseUrl);
+		if (options.switchboardUrl) builder.withSwitchboardUrl(options.switchboardUrl);
+		if (options.profileFetcher) builder.withProfileFetcher(options.profileFetcher);
+		if (options.chainId !== void 0) builder.withChainId(options.chainId);
+		return builder;
+	}
+};
+//#endregion
+//#region src/local-credential-verifier.ts
+/** A credential check that reads a Switchboard's own renown read model through
+* `execute`, rather than any Renown or Switchboard over HTTP. */
+function createLocalCredentialVerifier(execute, options = {}) {
+	const request = async (query, variables) => {
+		try {
+			return await execute(query, variables);
+		} catch (error) {
+			options.onError?.(error);
+			throw error;
+		}
+	};
+	return async ({ address, chainId, appId }) => {
+		return await fetchDelegationCredential({
+			address,
+			chainId,
+			appDid: appId,
+			switchboardRequest: request
+		}) !== void 0;
+	};
+}
+//#endregion
+export { RenownMemoryStorage as a, fetchDelegationCredential as c, verifyCredentialSignature as d, SwitchboardClient as f, Renown as i, recoverCredentialSigner as l, BaseRenownBuilder as n, BaseStorage as o, resolveSwitchboardEndpoint as p, fetchRenownProfile as r, buildAndSignCredential as s, createLocalCredentialVerifier as t, verifyAuthCredential as u };
+
+//# sourceMappingURL=local-credential-verifier-BcCzjvmd.js.map