@renown/sdk 6.2.3-dev.23 → 6.2.3-dev.25

package/dist/signer-GzTlZLjR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-GzTlZLjR.js","names":[],"sources":["../src/crypto/utils.ts","../src/crypto/renown-crypto.ts","../src/crypto/renown-crypto-builder.ts","../src/crypto/memory-key-storage.ts","../src/crypto/signer.ts"],"sourcesContent":["import { encodeDIDFromPub, getPublicKey } from \"@didtools/key-webcrypto\";\nimport type { DID, JwkKeyPair } from \"./types.js\";\n\nexport const ECDSA_ALGORITHM: EcKeyAlgorithm = {\n  name: \"ECDSA\",\n  namedCurve: \"P-256\",\n};\n\nexport const ECDSA_SIGN_ALGORITHM = {\n  name: \"ECDSA\",\n  namedCurve: \"P-256\",\n  hash: \"SHA-256\",\n};\n\nexport async function parseDid(keyPair: CryptoKeyPair): Promise<DID> {\n  return encodeDIDFromPub(await getPublicKey(keyPair)) as DID;\n}\n\nexport async function exportKeyPair(\n  keyPair: CryptoKeyPair,\n  subtleCrypto: SubtleCrypto,\n): Promise<JwkKeyPair> {\n  return {\n    publicKey: await subtleCrypto.exportKey(\"jwk\", keyPair.publicKey),\n    privateKey: await subtleCrypto.exportKey(\"jwk\", keyPair.privateKey),\n  };\n}\n\nexport async function importKeyPair(\n  jwkKeyPair: JwkKeyPair,\n  subtleCrypto: SubtleCrypto,\n  algorithm: EcKeyAlgorithm = ECDSA_ALGORITHM,\n): Promise<CryptoKeyPair> {\n  return {\n    publicKey: await subtleCrypto.importKey(\n      \"jwk\",\n      jwkKeyPair.publicKey,\n      algorithm,\n      true,\n      [\"verify\"],\n    ),\n    privateKey: await subtleCrypto.importKey(\n      \"jwk\",\n      jwkKeyPair.privateKey,\n      algorithm,\n      true,\n      [\"sign\"],\n    ),\n  };\n}\n\nexport async function generateKeyPair(\n  subtleCrypto: SubtleCrypto,\n  algorithm: EcKeyAlgorithm = ECDSA_ALGORITHM,\n): Promise<CryptoKeyPair> {\n  return subtleCrypto.generateKey(algorithm, true, [\"sign\", \"verify\"]);\n}\n","import { fromString, toString } from \"uint8arrays\";\nimport {\n  DEFAULT_RENOWN_CHAIN_ID,\n  DEFAULT_RENOWN_NETWORK_ID,\n} from \"../constants.js\";\nimport type { CreateBearerTokenOptions, Issuer } from \"../types.js\";\nimport { createAuthBearerToken } from \"../utils.js\";\nimport type { DID, IRenownCrypto, JsonWebKeyPairStorage } from \"./types.js\";\nimport { ECDSA_ALGORITHM, ECDSA_SIGN_ALGORITHM } from \"./utils.js\";\n\nexport class RenownCrypto implements IRenownCrypto {\n  #subtleCrypto: SubtleCrypto;\n  #keyPair: CryptoKeyPair;\n  #keyPairStorage: JsonWebKeyPairStorage;\n\n  readonly did: DID;\n  /** Chain id the bearer token is scoped to; keep it equal to the issuing Renown instance's. */\n  readonly chainId: number;\n\n  static algorithm = ECDSA_ALGORITHM;\n  static signAlgorithm = ECDSA_SIGN_ALGORITHM;\n\n  constructor(\n    keyPairStorage: JsonWebKeyPairStorage,\n    crypto: SubtleCrypto,\n    keyPair: CryptoKeyPair,\n    did: DID,\n    chainId = Number(DEFAULT_RENOWN_CHAIN_ID),\n  ) {\n    this.#keyPairStorage = keyPairStorage;\n    this.#subtleCrypto = crypto;\n    this.#keyPair = keyPair;\n    this.did = did;\n    this.chainId = chainId;\n  }\n\n  get publicKey() {\n    return this.#keyPair.publicKey;\n  }\n\n  async getBearerToken(\n    address: string | undefined,\n    options?: CreateBearerTokenOptions,\n  ): Promise<string> {\n    return await createAuthBearerToken(\n      this.chainId,\n      DEFAULT_RENOWN_NETWORK_ID,\n      address || this.did,\n      this.issuer,\n      options,\n    );\n  }\n\n  async removeDid(): Promise<void> {\n    await this.#keyPairStorage.removeKeyPair();\n  }\n\n  #stringToBytes(s: string): Uint8Array {\n    return fromString(s, \"utf-8\");\n  }\n\n  async sign(data: Uint8Array | string): Promise<Uint8Array> {\n    const dataBytes: Uint8Array =\n      typeof data === \"string\" ? this.#stringToBytes(data) : data;\n\n    const arrayBuffer = await this.#subtleCrypto.sign(\n      RenownCrypto.signAlgorithm,\n      this.#keyPair.privateKey,\n      dataBytes.buffer as ArrayBuffer,\n    );\n\n    return new Uint8Array(arrayBuffer);\n  }\n\n  async verify(data: Uint8Array, signature: Uint8Array): Promise<boolean> {\n    return this.#subtleCrypto.verify(\n      { name: \"ECDSA\", hash: \"SHA-256\" },\n      this.#keyPair.publicKey,\n      signature.buffer as ArrayBuffer,\n      data.buffer as ArrayBuffer,\n    );\n  }\n\n  get issuer(): Issuer {\n    return {\n      did: this.did,\n      signer: async (data: string | Uint8Array) => {\n        const signature = await this.sign(\n          typeof data === \"string\" ? new TextEncoder().encode(data) : data,\n        );\n        return toString(signature, \"base64url\");\n      },\n      alg: \"ES256\",\n    };\n  }\n}\n\n/**\n * @deprecated Use RenownCrypto instead\n */\nexport class ConnectCrypto extends RenownCrypto {}\n","import { RenownCrypto } from \"./renown-crypto.js\";\nimport type { JsonWebKeyPairStorage } from \"./types.js\";\nimport {\n  exportKeyPair,\n  generateKeyPair,\n  importKeyPair,\n  parseDid,\n} from \"./utils.js\";\n\nexport class RenownCryptoBuilder {\n  private keyPairStorage?: JsonWebKeyPairStorage;\n  private subtleCrypto?: SubtleCrypto;\n  private chainId?: number;\n\n  withKeyPairStorage(storage: JsonWebKeyPairStorage): this {\n    this.keyPairStorage = storage;\n    return this;\n  }\n\n  withSubtleCrypto(crypto: SubtleCrypto): this {\n    this.subtleCrypto = crypto;\n    return this;\n  }\n\n  // Scopes the bearer token to a chain (default 1). Match the Renown instance\n  // issuing credentials, or the token and the credential disagree.\n  withChainId(chainId: number): this {\n    this.chainId = chainId;\n    return this;\n  }\n\n  async build(): Promise<RenownCrypto> {\n    if (!this.keyPairStorage) {\n      throw new Error(\n        \"KeyPairStorage is required. Use withKeyPairStorage() to set it.\",\n      );\n    }\n\n    const subtleCrypto = this.subtleCrypto ?? globalThis.crypto.subtle;\n    const keyPair = await this.#initializeKeyPair(\n      subtleCrypto,\n      this.keyPairStorage,\n    );\n    const did = await parseDid(keyPair);\n\n    return new RenownCrypto(\n      this.keyPairStorage,\n      subtleCrypto,\n      keyPair,\n      did,\n      this.chainId,\n    );\n  }\n\n  async #initializeKeyPair(\n    subtleCrypto: SubtleCrypto,\n    keyPairStorage: JsonWebKeyPairStorage,\n  ): Promise<CryptoKeyPair> {\n    const loadedKeyPair = await keyPairStorage.loadKeyPair();\n    if (loadedKeyPair) {\n      return importKeyPair(loadedKeyPair, subtleCrypto);\n    }\n\n    const keyPair = await generateKeyPair(subtleCrypto);\n    const exported = await exportKeyPair(keyPair, subtleCrypto);\n    await keyPairStorage.saveKeyPair(exported);\n    return keyPair;\n  }\n}\n","import type { JsonWebKeyPairStorage, JwkKeyPair } from \"./types.js\";\n\nexport class MemoryKeyStorage implements JsonWebKeyPairStorage {\n  private keyPair: JwkKeyPair | undefined;\n\n  constructor(keyPair?: JwkKeyPair) {\n    this.keyPair = keyPair;\n  }\n\n  loadKeyPair() {\n    return Promise.resolve(this.keyPair);\n  }\n\n  saveKeyPair(keyPair: JwkKeyPair) {\n    this.keyPair = keyPair;\n    return Promise.resolve();\n  }\n\n  removeKeyPair() {\n    this.keyPair = undefined;\n    return Promise.resolve();\n  }\n}\n","import type {\n  Action,\n  ActionSigningTarget,\n  AppActionSigner,\n  ISigner,\n  Operation,\n  Signature,\n  SignatureVerificationHandler,\n  UserActionSigner,\n} from \"@powerhousedao/shared/document-model\";\nimport {\n  actionSignerIdentity,\n  signActionV2,\n} from \"@powerhousedao/shared/document-model\";\nimport type { IRenownCrypto } from \"./index.js\";\n\nexport class InvalidSignatureError extends Error {\n  constructor() {\n    super(\"Invalid signature\");\n  }\n}\n\nexport class RenownCryptoSigner implements ISigner {\n  readonly app: AppActionSigner;\n\n  constructor(\n    private readonly crypto: IRenownCrypto,\n    private readonly appName: string,\n    public user?: UserActionSigner,\n  ) {\n    this.app = {\n      key: this.crypto.did,\n      name: this.appName,\n    };\n  }\n\n  get publicKey() {\n    return this.crypto.publicKey;\n  }\n\n  async sign(data: Uint8Array): Promise<Uint8Array> {\n    return this.crypto.sign(data);\n  }\n\n  async verify(data: Uint8Array, signature: Uint8Array): Promise<void> {\n    const isValid = await this.crypto.verify(data, signature);\n    if (!isValid) {\n      throw new InvalidSignatureError();\n    }\n  }\n\n  async signAction(\n    action: Action,\n    target: ActionSigningTarget,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    const hashField = action.context?.prevOpHash ?? \"\";\n    return this._signAction(action, target, hashField, abortSignal);\n  }\n\n  /**\n   * Signs an action including a predicted resulting state hash, packed into\n   * element [3] as `${prevStateHash}:${resultingStateHash}`.\n   */\n  async signActionWithResultingState(\n    action: Action,\n    target: ActionSigningTarget,\n    resultingStateHash: string,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    const prevStateHash = action.context?.prevOpHash ?? \"\";\n    const hashField = `${prevStateHash}:${resultingStateHash}`;\n    return this._signAction(action, target, hashField, abortSignal);\n  }\n\n  /**\n   * The pre-v2 tuple, over scope, type and input only. For peers and tests\n   * that still need one; it binds neither the document nor the signer.\n   */\n  async signActionLegacy(\n    action: Action,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n\n    const params: [string, string, string, string] = [\n      (new Date().getTime() / 1000).toFixed(0),\n      this.crypto.did,\n      await this.hashAction(action),\n      action.context?.prevOpHash ?? \"\",\n    ];\n    const signatureBytes = await this.crypto.sign(\n      this.buildSignatureMessage(params),\n    );\n\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n    return [...params, `0x${this.arrayBufferToHex(signatureBytes)}`];\n  }\n\n  private async _signAction(\n    action: Action,\n    target: ActionSigningTarget,\n    hashField: string,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n\n    const signature = await signActionV2({\n      action,\n      target,\n      signer: actionSignerIdentity(this),\n      sign: (message) => this.crypto.sign(message),\n      previousStateHash: hashField,\n    });\n\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n\n    return signature;\n  }\n\n  private async hashAction(action: Action): Promise<string> {\n    const payload = [\n      action.scope,\n      action.type,\n      JSON.stringify(action.input),\n    ].join(\"\");\n    const encoder = new TextEncoder();\n    const data = encoder.encode(payload);\n    const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n    return this.arrayBufferToBase64(hashBuffer);\n  }\n\n  private buildSignatureMessage(\n    params: [string, string, string, string],\n  ): Uint8Array {\n    const message = params.join(\"\");\n    const prefix = \"\\x19Signed Operation:\\n\" + message.length.toString();\n    const encoder = new TextEncoder();\n    return encoder.encode(prefix + message);\n  }\n\n  private arrayBufferToHex(buffer: Uint8Array | ArrayBuffer): string {\n    const bytes =\n      buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);\n    return Array.from(bytes)\n      .map((byte) => byte.toString(16).padStart(2, \"0\"))\n      .join(\"\");\n  }\n\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\n    const bytes = new Uint8Array(buffer);\n    let binary = \"\";\n    for (let i = 0; i < bytes.length; i++) {\n      binary += String.fromCharCode(bytes[i]);\n    }\n    return btoa(binary);\n  }\n}\n\n/**\n * Creates a signature verification handler that verifies signatures using the Web Crypto API.\n * The verification uses ECDSA with P-256 curve and SHA-256 hash, matching the RenownCrypto signing algorithm.\n */\nexport function createSignatureVerifier(\n  requireSignature = false,\n): SignatureVerificationHandler {\n  return async (operation: Operation, publicKey: string): Promise<boolean> => {\n    const signer = operation.action.context?.signer;\n    if (!signer || !publicKey) {\n      return !requireSignature;\n    }\n\n    const signatures = signer.signatures;\n    if (signatures.length === 0) {\n      return false;\n    }\n\n    const signature = signatures[signatures.length - 1];\n    const [timestamp, signerKey, hash, prevStateHash, signatureHex] = signature;\n\n    if (signerKey !== publicKey) {\n      return false;\n    }\n\n    const params: [string, string, string, string] = [\n      timestamp,\n      signerKey,\n      hash,\n      prevStateHash,\n    ];\n    const message = buildSignatureMessage(params);\n    const signatureBytes = hexToUint8Array(signatureHex);\n\n    const cryptoKey = await importPublicKey(publicKey);\n\n    const isValid = await crypto.subtle.verify(\n      { name: \"ECDSA\", hash: \"SHA-256\" },\n      cryptoKey,\n      signatureBytes.buffer as ArrayBuffer,\n      message.buffer as ArrayBuffer,\n    );\n\n    return isValid;\n  };\n}\n\nfunction buildSignatureMessage(\n  params: [string, string, string, string],\n): Uint8Array {\n  const message = params.join(\"\");\n  const prefix = \"\\x19Signed Operation:\\n\" + message.length.toString();\n  const encoder = new TextEncoder();\n  return encoder.encode(prefix + message);\n}\n\nfunction hexToUint8Array(hex: string): Uint8Array {\n  const cleanHex = hex.startsWith(\"0x\") ? hex.slice(2) : hex;\n  const bytes = new Uint8Array(cleanHex.length / 2);\n  for (let i = 0; i < cleanHex.length; i += 2) {\n    bytes[i / 2] = parseInt(cleanHex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nasync function importPublicKey(did: string): Promise<CryptoKey> {\n  const keyData = extractKeyFromDid(did);\n  return crypto.subtle.importKey(\n    \"raw\",\n    keyData.buffer as ArrayBuffer,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n}\n\nfunction extractKeyFromDid(did: string): Uint8Array {\n  const parts = did.split(\":\");\n  if (parts.length < 3 || parts[0] !== \"did\" || parts[1] !== \"key\") {\n    throw new Error(`Invalid DID format: ${did}`);\n  }\n\n  const multibaseKey = parts[2];\n  if (!multibaseKey.startsWith(\"z\")) {\n    throw new Error(`Unsupported multibase encoding: ${multibaseKey[0]}`);\n  }\n\n  const decoded = base58Decode(multibaseKey.slice(1));\n\n  if (decoded[0] !== 0x80 || decoded[1] !== 0x24) {\n    throw new Error(\"Not a P-256 public key multicodec\");\n  }\n\n  const compressedKey = decoded.slice(2);\n  return decompressP256PublicKey(compressedKey);\n}\n\nfunction base58Decode(input: string): Uint8Array {\n  const ALPHABET = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n  const ALPHABET_MAP = new Map<string, number>();\n  for (let i = 0; i < ALPHABET.length; i++) {\n    ALPHABET_MAP.set(ALPHABET[i], i);\n  }\n\n  if (input.length === 0) {\n    return new Uint8Array(0);\n  }\n\n  const bytes: number[] = [0];\n  for (const char of input) {\n    const value = ALPHABET_MAP.get(char);\n    if (value === undefined) {\n      throw new Error(`Invalid base58 character: ${char}`);\n    }\n\n    let carry = value;\n    for (let j = 0; j < bytes.length; j++) {\n      carry += bytes[j] * 58;\n      bytes[j] = carry & 0xff;\n      carry >>= 8;\n    }\n\n    while (carry > 0) {\n      bytes.push(carry & 0xff);\n      carry >>= 8;\n    }\n  }\n\n  for (const char of input) {\n    if (char !== \"1\") break;\n    bytes.push(0);\n  }\n\n  return new Uint8Array(bytes.reverse());\n}\n\nfunction decompressP256PublicKey(compressed: Uint8Array): Uint8Array {\n  if (compressed.length !== 33) {\n    throw new Error(`Invalid compressed key length: ${compressed.length}`);\n  }\n\n  const prefix = compressed[0];\n  if (prefix !== 0x02 && prefix !== 0x03) {\n    throw new Error(`Invalid compression prefix: ${prefix}`);\n  }\n\n  const p = BigInt(\n    \"0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff\",\n  );\n  const a = BigInt(\n    \"0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc\",\n  );\n  const b = BigInt(\n    \"0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b\",\n  );\n\n  let x = BigInt(0);\n  for (let i = 1; i < compressed.length; i++) {\n    x = (x << BigInt(8)) | BigInt(compressed[i]);\n  }\n\n  const ySquared = (modPow(x, BigInt(3), p) + a * x + b) % p;\n  let y = modPow(ySquared, (p + BigInt(1)) / BigInt(4), p);\n\n  const isYEven = y % BigInt(2) === BigInt(0);\n  const shouldBeEven = prefix === 0x02;\n  if (isYEven !== shouldBeEven) {\n    y = p - y;\n  }\n\n  const uncompressed = new Uint8Array(65);\n  uncompressed[0] = 0x04;\n\n  const xBytes = bigIntToBytes(x, 32);\n  const yBytes = bigIntToBytes(y, 32);\n\n  uncompressed.set(xBytes, 1);\n  uncompressed.set(yBytes, 33);\n\n  return uncompressed;\n}\n\nfunction modPow(base: bigint, exp: bigint, mod: bigint): bigint {\n  let result = BigInt(1);\n  base = base % mod;\n  while (exp > BigInt(0)) {\n    if (exp % BigInt(2) === BigInt(1)) {\n      result = (result * base) % mod;\n    }\n    exp = exp >> BigInt(1);\n    base = (base * base) % mod;\n  }\n  return result;\n}\n\nfunction bigIntToBytes(n: bigint, length: number): Uint8Array {\n  const bytes = new Uint8Array(length);\n  for (let i = length - 1; i >= 0; i--) {\n    bytes[i] = Number(n & BigInt(0xff));\n    n = n >> BigInt(8);\n  }\n  return bytes;\n}\n\n/**\n * Parses the hash field (element [3]) from a signature tuple.\n *\n * Supports two formats:\n * - Old format: just `prevStateHash` (no colon)\n * - New format: `prevStateHash:resultingStateHash` (colon-separated)\n *\n * @param hashField - The 4th element of a Signature tuple\n * @returns Object with prevStateHash and optional resultingStateHash\n */\nexport function parseSignatureHashField(hashField: string): {\n  prevStateHash: string;\n  resultingStateHash: string | undefined;\n} {\n  const colonIndex = hashField.indexOf(\":\");\n\n  if (colonIndex === -1) {\n    return {\n      prevStateHash: hashField,\n      resultingStateHash: undefined,\n    };\n  }\n\n  return {\n    prevStateHash: hashField.substring(0, colonIndex),\n    resultingStateHash: hashField.substring(colonIndex + 1),\n  };\n}\n\n/**\n * Extracts the resulting state hash from a signature, if present.\n *\n * @param signature - A Signature tuple\n * @returns The resulting state hash, or undefined if not present\n */\nexport function extractResultingHashFromSignature(\n  signature: Signature,\n): string | undefined {\n  const hashField = signature[3];\n  const { resultingStateHash } = parseSignatureHashField(hashField);\n  return resultingStateHash;\n}\n\n/**\n * Checks if a signature includes a resulting state hash.\n *\n * @param signature - A Signature tuple\n * @returns true if the signature includes a resulting state hash\n */\nexport function signatureHasResultingHash(signature: Signature): boolean {\n  return extractResultingHashFromSignature(signature) !== undefined;\n}\n"],"mappings":";;;;;;AAGA,MAAa,kBAAkC;CAC7C,MAAM;CACN,YAAY;AACd;AAEA,MAAa,uBAAuB;CAClC,MAAM;CACN,YAAY;CACZ,MAAM;AACR;AAEA,eAAsB,SAAS,SAAsC;CACnE,OAAO,iBAAiB,MAAM,aAAa,OAAO,CAAC;AACrD;AAEA,eAAsB,cACpB,SACA,cACqB;CACrB,OAAO;EACL,WAAW,MAAM,aAAa,UAAU,OAAO,QAAQ,SAAS;EAChE,YAAY,MAAM,aAAa,UAAU,OAAO,QAAQ,UAAU;CACpE;AACF;AAEA,eAAsB,cACpB,YACA,cACA,YAA4B,iBACJ;CACxB,OAAO;EACL,WAAW,MAAM,aAAa,UAC5B,OACA,WAAW,WACX,WACA,MACA,CAAC,QAAQ,CACX;EACA,YAAY,MAAM,aAAa,UAC7B,OACA,WAAW,YACX,WACA,MACA,CAAC,MAAM,CACT;CACF;AACF;AAEA,eAAsB,gBACpB,cACA,YAA4B,iBACJ;CACxB,OAAO,aAAa,YAAY,WAAW,MAAM,CAAC,QAAQ,QAAQ,CAAC;AACrE;;;AC9CA,IAAa,eAAb,MAAa,aAAsC;CACjD;CACA;CACA;CAEA;;CAEA;CAEA,OAAO,YAAY;CACnB,OAAO,gBAAgB;CAEvB,YACE,gBACA,QACA,SACA,KACA,UAAU,GACV;EACA,KAAK,kBAAkB;EACvB,KAAK,gBAAgB;EACrB,KAAK,WAAW;EAChB,KAAK,MAAM;EACX,KAAK,UAAU;CACjB;CAEA,IAAI,YAAY;EACd,OAAO,KAAK,SAAS;CACvB;CAEA,MAAM,eACJ,SACA,SACiB;EACjB,OAAO,MAAM,sBACX,KAAK,SACL,2BACA,WAAW,KAAK,KAChB,KAAK,QACL,OACF;CACF;CAEA,MAAM,YAA2B;EAC/B,MAAM,KAAK,gBAAgB,cAAc;CAC3C;CAEA,eAAe,GAAuB;EACpC,OAAO,WAAW,GAAG,OAAO;CAC9B;CAEA,MAAM,KAAK,MAAgD;EACzD,MAAM,YACJ,OAAO,SAAS,WAAW,KAAK,eAAe,IAAI,IAAI;EAEzD,MAAM,cAAc,MAAM,KAAK,cAAc,KAC3C,aAAa,eACb,KAAK,SAAS,YACd,UAAU,MACZ;EAEA,OAAO,IAAI,WAAW,WAAW;CACnC;CAEA,MAAM,OAAO,MAAkB,WAAyC;EACtE,OAAO,KAAK,cAAc,OACxB;GAAE,MAAM;GAAS,MAAM;EAAU,GACjC,KAAK,SAAS,WACd,UAAU,QACV,KAAK,MACP;CACF;CAEA,IAAI,SAAiB;EACnB,OAAO;GACL,KAAK,KAAK;GACV,QAAQ,OAAO,SAA8B;IAC3C,MAAM,YAAY,MAAM,KAAK,KAC3B,OAAO,SAAS,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,IAAI,IAC9D;IACA,OAAO,SAAS,WAAW,WAAW;GACxC;GACA,KAAK;EACP;CACF;AACF;;;;AAKA,IAAa,gBAAb,cAAmC,aAAa,CAAC;;;AC3FjD,IAAa,sBAAb,MAAiC;CAC/B;CACA;CACA;CAEA,mBAAmB,SAAsC;EACvD,KAAK,iBAAiB;EACtB,OAAO;CACT;CAEA,iBAAiB,QAA4B;EAC3C,KAAK,eAAe;EACpB,OAAO;CACT;CAIA,YAAY,SAAuB;EACjC,KAAK,UAAU;EACf,OAAO;CACT;CAEA,MAAM,QAA+B;EACnC,IAAI,CAAC,KAAK,gBACR,MAAM,IAAI,MACR,iEACF;EAGF,MAAM,eAAe,KAAK,gBAAgB,WAAW,OAAO;EAC5D,MAAM,UAAU,MAAM,KAAK,mBACzB,cACA,KAAK,cACP;EACA,MAAM,MAAM,MAAM,SAAS,OAAO;EAElC,OAAO,IAAI,aACT,KAAK,gBACL,cACA,SACA,KACA,KAAK,OACP;CACF;CAEA,MAAM,mBACJ,cACA,gBACwB;EACxB,MAAM,gBAAgB,MAAM,eAAe,YAAY;EACvD,IAAI,eACF,OAAO,cAAc,eAAe,YAAY;EAGlD,MAAM,UAAU,MAAM,gBAAgB,YAAY;EAClD,MAAM,WAAW,MAAM,cAAc,SAAS,YAAY;EAC1D,MAAM,eAAe,YAAY,QAAQ;EACzC,OAAO;CACT;AACF;;;AClEA,IAAa,mBAAb,MAA+D;CAC7D;CAEA,YAAY,SAAsB;EAChC,KAAK,UAAU;CACjB;CAEA,cAAc;EACZ,OAAO,QAAQ,QAAQ,KAAK,OAAO;CACrC;CAEA,YAAY,SAAqB;EAC/B,KAAK,UAAU;EACf,OAAO,QAAQ,QAAQ;CACzB;CAEA,gBAAgB;EACd,KAAK,UAAU,KAAA;EACf,OAAO,QAAQ,QAAQ;CACzB;AACF;;;ACNA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,cAAc;EACZ,MAAM,mBAAmB;CAC3B;AACF;AAEA,IAAa,qBAAb,MAAmD;CAI9B;CACA;CACV;CALT;CAEA,YACE,QACA,SACA,MACA;EAHiB,KAAA,SAAA;EACA,KAAA,UAAA;EACV,KAAA,OAAA;EAEP,KAAK,MAAM;GACT,KAAK,KAAK,OAAO;GACjB,MAAM,KAAK;EACb;CACF;CAEA,IAAI,YAAY;EACd,OAAO,KAAK,OAAO;CACrB;CAEA,MAAM,KAAK,MAAuC;EAChD,OAAO,KAAK,OAAO,KAAK,IAAI;CAC9B;CAEA,MAAM,OAAO,MAAkB,WAAsC;EAEnE,IAAI,CAAC,MADiB,KAAK,OAAO,OAAO,MAAM,SAAS,GAEtD,MAAM,IAAI,sBAAsB;CAEpC;CAEA,MAAM,WACJ,QACA,QACA,aACoB;EACpB,MAAM,YAAY,OAAO,SAAS,cAAc;EAChD,OAAO,KAAK,YAAY,QAAQ,QAAQ,WAAW,WAAW;CAChE;;;;;CAMA,MAAM,6BACJ,QACA,QACA,oBACA,aACoB;EAEpB,MAAM,YAAY,GADI,OAAO,SAAS,cAAc,GACjB,GAAG;EACtC,OAAO,KAAK,YAAY,QAAQ,QAAQ,WAAW,WAAW;CAChE;;;;;CAMA,MAAM,iBACJ,QACA,aACoB;EACpB,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAGnC,MAAM,SAA2C;qBAC9C,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI,IAAA,CAAM,QAAQ,CAAC;GACvC,KAAK,OAAO;GACZ,MAAM,KAAK,WAAW,MAAM;GAC5B,OAAO,SAAS,cAAc;EAChC;EACA,MAAM,iBAAiB,MAAM,KAAK,OAAO,KACvC,KAAK,sBAAsB,MAAM,CACnC;EAEA,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAEnC,OAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,iBAAiB,cAAc,GAAG;CACjE;CAEA,MAAc,YACZ,QACA,QACA,WACA,aACoB;EACpB,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAGnC,MAAM,YAAY,MAAM,aAAa;GACnC;GACA;GACA,QAAQ,qBAAqB,IAAI;GACjC,OAAO,YAAY,KAAK,OAAO,KAAK,OAAO;GAC3C,mBAAmB;EACrB,CAAC;EAED,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAGnC,OAAO;CACT;CAEA,MAAc,WAAW,QAAiC;EACxD,MAAM,UAAU;GACd,OAAO;GACP,OAAO;GACP,KAAK,UAAU,OAAO,KAAK;EAC7B,CAAC,CAAC,KAAK,EAAE;EAET,MAAM,OAAO,IADO,YACD,CAAC,CAAC,OAAO,OAAO;EACnC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;EAC7D,OAAO,KAAK,oBAAoB,UAAU;CAC5C;CAEA,sBACE,QACY;EACZ,MAAM,UAAU,OAAO,KAAK,EAAE;EAC9B,MAAM,SAAS,yBAA4B,QAAQ,OAAO,SAAS;EAEnE,OAAO,IADa,YACP,CAAC,CAAC,OAAO,SAAS,OAAO;CACxC;CAEA,iBAAyB,QAA0C;EACjE,MAAM,QACJ,kBAAkB,aAAa,SAAS,IAAI,WAAW,MAAM;EAC/D,OAAO,MAAM,KAAK,KAAK,CAAC,CACrB,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CACjD,KAAK,EAAE;CACZ;CAEA,oBAA4B,QAA6B;EACvD,MAAM,QAAQ,IAAI,WAAW,MAAM;EACnC,IAAI,SAAS;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,UAAU,OAAO,aAAa,MAAM,EAAE;EAExC,OAAO,KAAK,MAAM;CACpB;AACF;;;;;AAMA,SAAgB,wBACd,mBAAmB,OACW;CAC9B,OAAO,OAAO,WAAsB,cAAwC;EAC1E,MAAM,SAAS,UAAU,OAAO,SAAS;EACzC,IAAI,CAAC,UAAU,CAAC,WACd,OAAO,CAAC;EAGV,MAAM,aAAa,OAAO;EAC1B,IAAI,WAAW,WAAW,GACxB,OAAO;EAIT,MAAM,CAAC,WAAW,WAAW,MAAM,eAAe,gBADhC,WAAW,WAAW,SAAS;EAGjD,IAAI,cAAc,WAChB,OAAO;EAST,MAAM,UAAU,sBAAsB;GALpC;GACA;GACA;GACA;EAEyC,CAAC;EAC5C,MAAM,iBAAiB,gBAAgB,YAAY;EAEnD,MAAM,YAAY,MAAM,gBAAgB,SAAS;EASjD,OAAO,MAPe,OAAO,OAAO,OAClC;GAAE,MAAM;GAAS,MAAM;EAAU,GACjC,WACA,eAAe,QACf,QAAQ,MACV;CAGF;AACF;AAEA,SAAS,sBACP,QACY;CACZ,MAAM,UAAU,OAAO,KAAK,EAAE;CAC9B,MAAM,SAAS,yBAA4B,QAAQ,OAAO,SAAS;CAEnE,OAAO,IADa,YACP,CAAC,CAAC,OAAO,SAAS,OAAO;AACxC;AAEA,SAAS,gBAAgB,KAAyB;CAChD,MAAM,WAAW,IAAI,WAAW,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI;CACvD,MAAM,QAAQ,IAAI,WAAW,SAAS,SAAS,CAAC;CAChD,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK,GACxC,MAAM,IAAI,KAAK,SAAS,SAAS,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;CAE1D,OAAO;AACT;AAEA,eAAe,gBAAgB,KAAiC;CAC9D,MAAM,UAAU,kBAAkB,GAAG;CACrC,OAAO,OAAO,OAAO,UACnB,OACA,QAAQ,QACR;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,MACA,CAAC,QAAQ,CACX;AACF;AAEA,SAAS,kBAAkB,KAAyB;CAClD,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM,OAAO,OACzD,MAAM,IAAI,MAAM,uBAAuB,KAAK;CAG9C,MAAM,eAAe,MAAM;CAC3B,IAAI,CAAC,aAAa,WAAW,GAAG,GAC9B,MAAM,IAAI,MAAM,mCAAmC,aAAa,IAAI;CAGtE,MAAM,UAAU,aAAa,aAAa,MAAM,CAAC,CAAC;CAElD,IAAI,QAAQ,OAAO,OAAQ,QAAQ,OAAO,IACxC,MAAM,IAAI,MAAM,mCAAmC;CAIrD,OAAO,wBADe,QAAQ,MAAM,CACO,CAAC;AAC9C;AAEA,SAAS,aAAa,OAA2B;CAC/C,MAAM,WAAW;CACjB,MAAM,+BAAe,IAAI,IAAoB;CAC7C,KAAK,IAAI,IAAI,GAAG,IAAI,IAAiB,KACnC,aAAa,IAAI,SAAS,IAAI,CAAC;CAGjC,IAAI,MAAM,WAAW,GACnB,uBAAO,IAAI,WAAW,CAAC;CAGzB,MAAM,QAAkB,CAAC,CAAC;CAC1B,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,aAAa,IAAI,IAAI;EACnC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,6BAA6B,MAAM;EAGrD,IAAI,QAAQ;EACZ,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,SAAS,MAAM,KAAK;GACpB,MAAM,KAAK,QAAQ;GACnB,UAAU;EACZ;EAEA,OAAO,QAAQ,GAAG;GAChB,MAAM,KAAK,QAAQ,GAAI;GACvB,UAAU;EACZ;CACF;CAEA,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,SAAS,KAAK;EAClB,MAAM,KAAK,CAAC;CACd;CAEA,OAAO,IAAI,WAAW,MAAM,QAAQ,CAAC;AACvC;AAEA,SAAS,wBAAwB,YAAoC;CACnE,IAAI,WAAW,WAAW,IACxB,MAAM,IAAI,MAAM,kCAAkC,WAAW,QAAQ;CAGvE,MAAM,SAAS,WAAW;CAC1B,IAAI,WAAW,KAAQ,WAAW,GAChC,MAAM,IAAI,MAAM,+BAA+B,QAAQ;CAGzD,MAAM,IAAI,OACR,oEACF;CACA,MAAM,IAAI,OACR,oEACF;CACA,MAAM,IAAI,OACR,oEACF;CAEA,IAAI,IAAI,OAAO,CAAC;CAChB,KAAK,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,KACrC,IAAK,KAAK,OAAO,CAAC,IAAK,OAAO,WAAW,EAAE;CAI7C,IAAI,IAAI,QADU,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,IAC/B,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;CAIvD,IAFgB,IAAI,OAAO,CAAC,MAAM,OAAO,CAAC,OACrB,WAAW,IAE9B,IAAI,IAAI;CAGV,MAAM,+BAAe,IAAI,WAAW,EAAE;CACtC,aAAa,KAAK;CAElB,MAAM,SAAS,cAAc,GAAG,EAAE;CAClC,MAAM,SAAS,cAAc,GAAG,EAAE;CAElC,aAAa,IAAI,QAAQ,CAAC;CAC1B,aAAa,IAAI,QAAQ,EAAE;CAE3B,OAAO;AACT;AAEA,SAAS,OAAO,MAAc,KAAa,KAAqB;CAC9D,IAAI,SAAS,OAAO,CAAC;CACrB,OAAO,OAAO;CACd,OAAO,MAAM,OAAO,CAAC,GAAG;EACtB,IAAI,MAAM,OAAO,CAAC,MAAM,OAAO,CAAC,GAC9B,SAAU,SAAS,OAAQ;EAE7B,MAAM,OAAO,OAAO,CAAC;EACrB,OAAQ,OAAO,OAAQ;CACzB;CACA,OAAO;AACT;AAEA,SAAS,cAAc,GAAW,QAA4B;CAC5D,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,KAAK,IAAI,IAAI,SAAS,GAAG,KAAK,GAAG,KAAK;EACpC,MAAM,KAAK,OAAO,IAAI,OAAO,GAAI,CAAC;EAClC,IAAI,KAAK,OAAO,CAAC;CACnB;CACA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,wBAAwB,WAGtC;CACA,MAAM,aAAa,UAAU,QAAQ,GAAG;CAExC,IAAI,eAAe,IACjB,OAAO;EACL,eAAe;EACf,oBAAoB,KAAA;CACtB;CAGF,OAAO;EACL,eAAe,UAAU,UAAU,GAAG,UAAU;EAChD,oBAAoB,UAAU,UAAU,aAAa,CAAC;CACxD;AACF;;;;;;;AAQA,SAAgB,kCACd,WACoB;CACpB,MAAM,YAAY,UAAU;CAC5B,MAAM,EAAE,uBAAuB,wBAAwB,SAAS;CAChE,OAAO;AACT;;;;;;;AAQA,SAAgB,0BAA0B,WAA+B;CACvE,OAAO,kCAAkC,SAAS,MAAM,KAAA;AAC1D"}

package/dist/{local-credential-verifier-CU8hmFlR.js → signer-trust-C6UJAsNJ.js}

@@ -1,5 +1,5 @@
-import { a as DEFAULT_RENOWN_NETWORK_ID, o as DEFAULT_RENOWN_URL, r as CREDENTIAL_TYPES } from "./constants-BexAR53F.js";
-import { m as verifyAuthBearerToken, p as parsePkhDid, s as RenownCryptoBuilder, t as RenownCryptoSigner } from "./signer-DrjINLqt.js";
+import { a as DEFAULT_RENOWN_NETWORK_ID, r as CREDENTIAL_TYPES } from "./constants-DVOF17NB.js";
+import { a as verifyAuthBearerToken } from "./utils-DLQ5VVqT.js";
 import { recoverTypedDataAddress } from "viem";
 import { createAction } from "@powerhousedao/shared/document-model";
 //#region src/discovery.ts
@@ -168,9 +168,12 @@ function issuerChainId(issuerId) {
 function issuerDidAddress(issuerId) {
 	return issuerId.split(":")[4];
 }
-function bindsTo(row, address, chainId, appDid) {
+function bindsTo$1(row, address, chainId, appDid) {
+	return !row.revoked && issuedTo(row, address, chainId, appDid);
+}
+function issuedTo(row, address, chainId, appDid) {
 	const expected = address.toLowerCase();
-	return !row.revoked && row.credentialSubjectId === appDid && issuerChainId(row.issuerId) === String(chainId) && issuerDidAddress(row.issuerId)?.toLowerCase() === expected && row.issuerEthereumAddress.toLowerCase() === expected;
+	return row.credentialSubjectId === appDid && issuerChainId(row.issuerId) === String(chainId) && issuerDidAddress(row.issuerId)?.toLowerCase() === expected && row.issuerEthereumAddress.toLowerCase() === expected;
 }
 var SwitchboardClient = class {
 	#endpoint;
@@ -214,13 +217,30 @@ var SwitchboardClient = class {
 			includeRevoked: false
 		} });
 		const now = Date.now();
-		const mostRecent = renownCredentials.filter((row) => bindsTo(row, address, chainId, appDid)).filter((row) => {
+		const mostRecent = renownCredentials.filter((row) => bindsTo$1(row, address, chainId, appDid)).filter((row) => {
 			if (!row.expirationDate) return true;
 			const expiresAt = Date.parse(row.expirationDate);
 			return !Number.isNaN(expiresAt) && expiresAt > now;
 		}).sort((a, b) => Date.parse(b.issuanceDate) - Date.parse(a.issuanceDate)).at(0);
 		return mostRecent ? reshapeCredential(mostRecent) : void 0;
 	}
+	async getIssuedCredentials(params) {
+		const { address, chainId, appDid } = params;
+		const { renownCredentials } = await this.#request(CREDENTIALS_QUERY, { input: {
+			driveId: userDriveId(address),
+			ethAddress: address.toLowerCase(),
+			did: appDid,
+			includeRevoked: true
+		} });
+		const credentials = [];
+		for (const row of renownCredentials) {
+			if (!issuedTo(row, address, chainId, appDid)) continue;
+			try {
+				credentials.push(reshapeCredential(row));
+			} catch {}
+		}
+		return credentials;
+	}
 	async getProfileByAddress(address) {
 		const { renownUsers } = await this.#request(USERS_QUERY, { input: {
 			driveId: userDriveId(address),
@@ -427,11 +447,16 @@ async function fetchDelegationCredentialRest(params) {
 	}
 	return credential;
 }
+/** True when the credential's EIP-712 proof, on `chainId`, was signed by its
+* issuer address. Binding and expiry are the caller's to check. */
+async function verifyDelegationProof(credential, chainId) {
+	const withDomain = withEip712Domain(credential, chainId);
+	return withDomain.proof.eip712.domain.chainId === chainId && await verifyCredentialSignature(withDomain);
+}
 async function finalizeCredential(credential, chainId, verifySignature) {
 	if (!verifySignature) return credential;
-	const withDomain = withEip712Domain(credential, chainId);
-	if (withDomain.proof.eip712.domain.chainId !== chainId || !await verifyCredentialSignature(withDomain)) return;
-	return withDomain;
+	if (!await verifyDelegationProof(credential, chainId)) return;
+	return withEip712Domain(credential, chainId);
 }
 async function fetchDelegationCredential(options) {
 	const { address, chainId, appDid, switchboardUrl, switchboardRequest, discover = true, verifySignature = true } = options;
@@ -480,428 +505,102 @@ async function verifyAuthCredential(jwt, options = {}) {
 	};
 }
 //#endregion
-//#region src/storage/common.ts
-var BaseStorage = class {};
-var MemoryStorage = class extends BaseStorage {
-	data = /* @__PURE__ */ new Map();
-	get(key) {
-		return this.data.get(key);
-	}
-	set(key, value) {
-		if (value === void 0) this.data.delete(key);
-		else this.data.set(key, value);
-	}
-	delete(key) {
-		this.data.delete(key);
-	}
-};
-//#endregion
-//#region src/common.ts
-var RenownMemoryStorage = class extends MemoryStorage {};
+//#region src/signer-trust.ts
+const DEFAULT_MAX_ACCEPTED = 1e4;
+const DEFAULT_REFUSAL_TTL_MS = 6e4;
 /**
-* The acting identity an action's signature carries.
-*
-* `User` here is the whole session record — it also holds the DID, the
-* credential, the fetched profile and ENS info — while `UserActionSigner` is
-* what travels on a signed action, and it is deliberately just an address on a
-* chain. The reactor's `ReactorSignerUserInput` declares exactly these three
-* fields, and a GraphQL input object refuses a field it does not declare by
-* rejecting the WHOLE request, so handing the session record to the signer
-* makes every signed push fail before it reaches the reactor.
-*
-* Narrowed here rather than at the transport, because the session record has no
-* business being on an operation in the first place: it is stored on every
-* operation a local reactor writes, not only on the ones that go over a wire.
-*
-* The compiler cannot catch the difference — excess-property checks apply to
-* fresh object literals, never to a variable of a wider type — which is why
-* this is a function rather than a type annotation.
+* Accepts a key the user's EIP-712 Renown credential delegates to, ignoring
+* expiry and revocation. Verdicts are cached per (address, key); this node's
+* own key is checked before the cache and never cached.
 */
-function toActionSigner(user) {
-	if (!user) return void 0;
-	return {
+function createRenownTrustPolicy(options = {}) {
+	const maxAccepted = options.maxAccepted ?? DEFAULT_MAX_ACCEPTED;
+	const refusalTtlMs = options.refusalTtlMs ?? DEFAULT_REFUSAL_TTL_MS;
+	const client = options.switchboard ? new SwitchboardClient(options.switchboard) : void 0;
+	const renownUrl = options.renownUrl ?? "https://www.renown.id";
+	const accepted = /* @__PURE__ */ new Set();
+	const refusedUntil = /* @__PURE__ */ new Map();
+	const pending = /* @__PURE__ */ new Map();
+	const issued = (user, key) => client ? client.getIssuedCredentials({
 		address: user.address,
-		networkId: user.networkId,
-		chainId: user.chainId
-	};
-}
-var Renown = class {
-	#baseUrl;
-	#store;
-	#eventEmitter;
-	#appName;
-	#crypto;
-	#signer;
-	#profileFetcher;
-	#switchboard;
-	#chainId;
-	#status = "initial";
-	constructor(store, eventEmitter, crypto, appName, baseUrl = DEFAULT_RENOWN_URL, profileFetcher, switchboard, chainId = 1) {
-		this.#store = store;
-		this.#eventEmitter = eventEmitter;
-		this.#baseUrl = baseUrl;
-		this.#crypto = crypto;
-		this.#appName = appName;
-		this.#profileFetcher = profileFetcher;
-		this.#switchboard = switchboard;
-		this.#chainId = chainId;
-		const restoredUser = this.user;
-		this.#signer = new RenownCryptoSigner(crypto, this.#appName, toActionSigner(restoredUser));
-		if (restoredUser) this.#status = "authorized";
-		this.on("user", (user) => {
-			this.#signer.user = toActionSigner(user);
-		});
-	}
-	get baseUrl() {
-		return this.#baseUrl;
-	}
-	/** Chain id this app issues credentials on; a session from another chain is rejected by {@link signIn}. */
-	get chainId() {
-		return this.#chainId;
-	}
-	get user() {
-		return this.#store.get("user");
-	}
-	get status() {
-		return this.#status;
-	}
-	get signer() {
-		return this.#signer;
-	}
-	get crypto() {
-		return this.#crypto;
-	}
-	get did() {
-		return this.#crypto.did;
-	}
-	get profileFetcher() {
-		return this.#profileFetcher;
-	}
-	#updateStatus(status) {
-		this.#status = status;
-		this.#eventEmitter.emit("status", status);
-	}
-	#updateUser(user) {
-		if (user) this.#store.set("user", user);
-		else this.#store.delete("user");
-		this.#eventEmitter.emit("user", user);
+		chainId: user.chainId,
+		appDid: key
+	}) : fetchIssuedCredentialRest(user, key, renownUrl);
+	async function lookup(user, key) {
+		for (const credential of await issued(user, key)) if (bindsTo(credential, user, key) && await verifyDelegationProof(credential, user.chainId)) return true;
+		return false;
 	}
-	async login(userDid) {
-		this.#updateStatus("checking");
-		try {
-			const result = parsePkhDid(userDid);
-			const credential = await this.#getCredential(result.address, result.chainId, this.#crypto.did);
-			if (!credential) {
-				this.#updateUser(void 0);
-				throw new Error("Credential not found");
+	function remember(entry, verdict) {
+		if (verdict) {
+			if (accepted.size >= maxAccepted) {
+				const oldest = accepted.values().next().value;
+				if (oldest !== void 0) accepted.delete(oldest);
 			}
-			return await this.#completeLogin(userDid, result, credential);
-		} catch (error) {
-			this.#updateUser(void 0);
-			this.#updateStatus("not-authorized");
-			throw error;
-		}
-	}
-	async signIn(params) {
-		if (!this.#switchboard) throw new MissingSwitchboardError();
-		const { address, chainId, signTypedData, username, userImage, expiresInDays } = params;
-		if (chainId !== this.#chainId) throw new Error(`Renown signIn: wallet is on chain ${chainId}, but this app issues credentials on chain ${this.#chainId}. Switch networks and retry — signing here would create a separate identity for the same address.`);
-		this.#updateStatus("checking");
-		try {
-			const credential = await buildAndSignCredential({
-				signTypedData,
-				address,
-				chainId,
-				app: this.#appName,
-				appId: this.did,
-				expiresInDays
-			});
-			await this.#switchboard.issueCredential(credential);
-			await this.#switchboard.findOrCreateUser(address, {
-				username,
-				userImage
-			});
-			const userDid = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;
-			return await this.#completeLogin(userDid, parsePkhDid(userDid), credential);
-		} catch (error) {
-			this.#updateUser(void 0);
-			this.#updateStatus("not-authorized");
+			accepted.add(entry);
+			refusedUntil.delete(entry);
+		} else refusedUntil.set(entry, Date.now() + refusalTtlMs);
+	}
+	return { authorizeSigner(signer, key) {
+		const user = signer.user;
+		const self = ownIdentity(options);
+		if (self && isSelf(self, user, key)) return Promise.resolve(true);
+		if (!user || !isLookupable(user, key)) return Promise.resolve(false);
+		const entry = `${user.networkId}|${user.chainId}|${user.address.toLowerCase()}|${key}`;
+		if (accepted.has(entry)) return Promise.resolve(true);
+		const until = refusedUntil.get(entry);
+		if (until !== void 0 && until > Date.now()) return Promise.resolve(false);
+		const inFlight = pending.get(entry);
+		if (inFlight) return inFlight;
+		const verdict = lookup(user, key).then((result) => {
+			pending.delete(entry);
+			remember(entry, result);
+			return result;
+		}, (error) => {
+			pending.delete(entry);
 			throw error;
-		}
-	}
-	async #completeLogin(userDid, result, credential) {
-		if (!(credential.issuer.id === userDid && credential.credentialSubject.id === this.did)) throw new Error("Invalid credential");
-		const verifiableCredential = credential.proof.eip712?.domain ? credential : {
-			...credential,
-			proof: {
-				...credential.proof,
-				eip712: {
-					domain: {
-						version: "1",
-						chainId: result.chainId
-					},
-					types: CREDENTIAL_TYPES,
-					primaryType: "VerifiableCredential"
-				}
-			}
-		};
-		if (credential.issuer.ethereumAddress.toLowerCase() !== result.address.toLowerCase() || verifiableCredential.proof.eip712.domain.chainId !== result.chainId || !await verifyCredentialSignature(verifiableCredential)) throw new Error("Invalid credential signature");
-		const user = {
-			...result,
-			address: credential.issuer.ethereumAddress,
-			did: userDid,
-			credential: verifiableCredential
-		};
-		this.#updateUser(user);
-		this.#updateStatus("authorized");
-		if (this.#profileFetcher) this.#profileFetcher(user, this.#baseUrl).then((profile) => {
-			if (profile && this.user?.address === user.address && this.user.chainId === user.chainId) this.#updateUser({
-				...this.user,
-				profile,
-				ens: {
-					name: profile.username ?? void 0,
-					avatarUrl: profile.userImage ?? void 0
-				}
-			});
-		}).catch(console.error);
-		return user;
-	}
-	logout() {
-		this.#updateUser(void 0);
-		this.#updateStatus("initial");
-		return Promise.resolve();
-	}
-	async revalidate() {
-		const user = this.user;
-		if (!user) return false;
-		try {
-			if (!await this.#getCredential(user.address, user.chainId, this.#crypto.did)) {
-				await this.logout();
-				return false;
-			}
-			await this.refreshProfile();
-			return true;
-		} catch {
-			return true;
-		}
-	}
-	async refreshProfile() {
-		const user = this.user;
-		if (!user || !this.#profileFetcher) return false;
-		try {
-			const profile = await this.#profileFetcher(user, this.#baseUrl);
-			if (!profile) return false;
-			const current = this.user;
-			if (!current || current.address !== user.address || current.chainId !== user.chainId) return false;
-			if (current.profile !== void 0 && current.profile.documentId === profile.documentId && current.profile.username === profile.username && current.profile.userImage === profile.userImage) return false;
-			this.#updateUser({
-				...current,
-				profile,
-				ens: {
-					name: profile.username ?? void 0,
-					avatarUrl: profile.userImage ?? void 0
-				}
-			});
-			return true;
-		} catch {
-			return false;
-		}
-	}
-	on(event, listener) {
-		return this.#eventEmitter.on(event, listener);
-	}
-	async #getCredential(address, chainId, appDid) {
-		if (this.#switchboard) return this.#switchboard.getCredential({
-			address,
-			chainId,
-			appDid
-		});
-		if (!this.#baseUrl) throw new Error("RENOWN_URL is not set");
-		const url = new URL(`/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`, this.#baseUrl);
-		const response = await fetch(url, { method: "GET" });
-		if (response.ok) return (await response.json()).credential;
-		else throw new Error(`Failed to get credential: ${response.status}`);
-	}
-	async verifyBearerToken(token) {
-		return verifyAuthBearerToken(token);
-	}
-	async getBearerToken(options) {
-		if (!this.user) throw new Error("User not found");
-		return this.#crypto.getBearerToken(this.user.address, options);
-	}
-};
-//#endregion
-//#region src/event/memory.ts
-var MemoryEventEmitter = class {
-	#listeners = /* @__PURE__ */ new Map();
-	on(event, listener) {
-		if (!this.#listeners.has(event)) this.#listeners.set(event, /* @__PURE__ */ new Set());
-		this.#listeners.get(event).add(listener);
-		return () => {
-			this.#listeners.get(event)?.delete(listener);
-		};
-	}
-	emit(event, data) {
-		this.#listeners.get(event)?.forEach((listener) => listener(data));
-	}
-};
-//#endregion
-//#region src/profile.ts
-const fetchRenownProfile = async (user, baseUrl) => {
-	try {
-		const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/profile`, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({ ethAddress: user.address })
 		});
-		if (!response.ok) return;
-		return (await response.json()).profile ?? void 0;
-	} catch {
-		return;
-	}
-};
-//#endregion
-//#region src/renown-builder.ts
-/**
-* Base builder for creating Renown instances.
-* Use platform-specific builders (RenownBuilder from init.browser.js or init.node.js)
-* for pre-configured defaults.
-*/
-var BaseRenownBuilder = class BaseRenownBuilder {
-	#appName;
-	#storage;
-	#eventEmitter;
-	#crypto;
-	#keyPairStorage;
-	#baseUrl;
-	#switchboardUrl;
-	#profileFetcher;
-	#chainId;
-	/**
-	* @param appName - Application name used for signing context
-	*/
-	constructor(appName) {
-		this.#appName = appName;
-	}
-	/**
-	* Set custom storage for user data persistence.
-	* Defaults to in-memory storage if not set.
-	*/
-	withStorage(storage) {
-		this.#storage = storage;
-		return this;
-	}
-	/**
-	* Set custom event emitter for user state changes.
-	* Defaults to in-memory event emitter if not set.
-	*/
-	withEventEmitter(eventEmitter) {
-		this.#eventEmitter = eventEmitter;
-		return this;
-	}
-	/**
-	* Set a pre-built crypto instance.
-	* Either crypto or keyPairStorage must be provided.
-	*/
-	withCrypto(crypto) {
-		this.#crypto = crypto;
-		return this;
-	}
-	/**
-	* Set key pair storage for cryptographic keys.
-	* A crypto instance will be built from this storage.
-	* Either crypto or keyPairStorage must be provided.
-	*/
-	withKeyPairStorage(keyPairStorage) {
-		this.#keyPairStorage = keyPairStorage;
-		return this;
-	}
-	/**
-	* Set the Renown server URL for credential verification.
-	* Defaults to https://www.renown.id
-	*/
-	withBaseUrl(baseUrl) {
-		this.#baseUrl = baseUrl;
-		return this;
-	}
-	withSwitchboardUrl(switchboardUrl) {
-		this.#switchboardUrl = switchboardUrl;
-		return this;
-	}
-	withChainId(chainId) {
-		this.#chainId = chainId;
-		return this;
-	}
-	/**
-	* Set a profile fetcher strategy for enriching user data after login.
-	* The fetcher receives the authenticated user and the base URL,
-	* and returns a RenownProfile. Called in the background after each login.
-	* Defaults to fetchRenownProfile which calls the Renown API.
-	*/
-	withProfileFetcher(profileFetcher) {
-		this.#profileFetcher = profileFetcher;
-		return this;
-	}
-	/**
-	* Build and initialize the Renown instance.
-	* If a user is stored, attempts to re-authenticate them.
-	* @throws Error if neither crypto nor keyPairStorage is provided
-	*/
-	async build() {
-		if (!this.#crypto && !this.#keyPairStorage) throw new Error("Either crypto or keyPairStorage is required. Use withCrypto() or withKeyPairStorage() to set one.");
-		const chainId = this.#chainId ?? 1;
-		const crypto = this.#crypto ?? await new RenownCryptoBuilder().withKeyPairStorage(this.#keyPairStorage).withChainId(chainId).build();
-		if (crypto.chainId !== void 0 && crypto.chainId !== chainId) console.warn(`Renown: the supplied crypto signs bearer tokens for chain ${crypto.chainId}, but credentials are issued on chain ${chainId}.`);
-		const storage = this.#storage ?? new RenownMemoryStorage();
-		const eventEmitter = this.#eventEmitter ?? new MemoryEventEmitter();
-		const baseUrl = this.#baseUrl ?? "https://www.renown.id";
-		const switchboardEndpoint = await resolveSwitchboardEndpoint({
-			switchboardUrl: this.#switchboardUrl,
-			baseUrl
-		});
-		const switchboard = switchboardEndpoint ? new SwitchboardClient(switchboardEndpoint) : void 0;
-		const profileFetcher = this.#profileFetcher ?? (switchboard ? switchboard.profileFetcher : fetchRenownProfile);
-		return new Renown(storage, eventEmitter, crypto, this.#appName, baseUrl, profileFetcher, switchboard, chainId);
-	}
-	/**
-	* Create a BaseRenownBuilder from options object for a more concise API
-	*/
-	static from(options) {
-		const builder = new BaseRenownBuilder(options.appName);
-		if (options.storage) builder.withStorage(options.storage);
-		if (options.eventEmitter) builder.withEventEmitter(options.eventEmitter);
-		if (options.crypto) builder.withCrypto(options.crypto);
-		if (options.keyPairStorage) builder.withKeyPairStorage(options.keyPairStorage);
-		if (options.baseUrl) builder.withBaseUrl(options.baseUrl);
-		if (options.switchboardUrl) builder.withSwitchboardUrl(options.switchboardUrl);
-		if (options.profileFetcher) builder.withProfileFetcher(options.profileFetcher);
-		if (options.chainId !== void 0) builder.withChainId(options.chainId);
-		return builder;
-	}
-};
-//#endregion
-//#region src/local-credential-verifier.ts
-/** A credential check that reads a Switchboard's own renown read model through
-* `execute`, rather than any Renown or Switchboard over HTTP. */
-function createLocalCredentialVerifier(execute, options = {}) {
-	const request = async (query, variables) => {
-		try {
-			return await execute(query, variables);
-		} catch (error) {
-			options.onError?.(error);
-			throw error;
+		pending.set(entry, verdict);
+		return verdict;
+	} };
+}
+function ownIdentity(options) {
+	if (!options.ownSigner) return options.self;
+	const { app, user } = options.ownSigner;
+	return {
+		key: app?.key ?? "",
+		user: {
+			address: user?.address ?? "",
+			networkId: user?.networkId ?? "",
+			chainId: user?.chainId ?? 0
 		}
 	};
-	return async ({ address, chainId, appId }) => {
-		return await fetchDelegationCredential({
-			address,
-			chainId,
-			appDid: appId,
-			switchboardRequest: request
-		}) !== void 0;
-	};
+}
+function isSelf(self, user, key) {
+	return self.key !== "" && key === self.key && (user?.address ?? "").toLowerCase() === self.user.address.toLowerCase() && (user?.networkId ?? "") === self.user.networkId && (user?.chainId ?? 0) === self.user.chainId;
+}
+function isLookupable(user, key) {
+	return key.startsWith("did:key:") && /^0x[0-9a-fA-F]{40}$/.test(user.address) && user.networkId !== "" && Number.isInteger(user.chainId) && user.chainId > 0;
+}
+function bindsTo(credential, user, key) {
+	const address = user.address.toLowerCase();
+	const issuer = credential.issuer.id.split(":");
+	if (issuer.length !== 5) return false;
+	const [scheme, method, networkId, chainId, issuerAddress] = issuer;
+	return credential.credentialSubject.id === key && scheme === "did" && method === "pkh" && networkId === user.networkId && chainId === String(user.chainId) && issuerAddress.toLowerCase() === address && credential.issuer.ethereumAddress.toLowerCase() === address;
+}
+async function fetchIssuedCredentialRest(user, key, renownUrl) {
+	const url = new URL("/api/auth/credential", renownUrl);
+	url.searchParams.set("address", user.address);
+	url.searchParams.set("chainId", String(user.chainId));
+	url.searchParams.set("connectId", key);
+	url.searchParams.set("appId", key);
+	const response = await fetch(url, { method: "GET" });
+	if (response.status === 404) return [];
+	if (!response.ok) throw new Error(`Renown credential lookup failed: ${response.status}`);
+	const { credential } = await response.json();
+	return credential ? [credential] : [];
 }
 //#endregion
-export { RenownMemoryStorage as a, fetchDelegationCredential as c, verifyCredentialSignature as d, MissingSwitchboardError as f, Renown as i, recoverCredentialSigner as l, resolveSwitchboardEndpoint as m, BaseRenownBuilder as n, BaseStorage as o, SwitchboardClient as p, fetchRenownProfile as r, buildAndSignCredential as s, createLocalCredentialVerifier as t, verifyAuthCredential as u };
+export { verifyAuthCredential as a, MissingSwitchboardError as c, recoverCredentialSigner as i, SwitchboardClient as l, buildAndSignCredential as n, verifyCredentialSignature as o, fetchDelegationCredential as r, verifyDelegationProof as s, createRenownTrustPolicy as t, resolveSwitchboardEndpoint as u };
 
-//# sourceMappingURL=local-credential-verifier-CU8hmFlR.js.map
+//# sourceMappingURL=signer-trust-C6UJAsNJ.js.map