@renown/sdk 6.2.3-dev.5 → 6.2.3-dev.50

package/dist/signer-trust-H1rNzUcd.js

@@ -0,0 +1,708 @@
+import { a as DEFAULT_RENOWN_NETWORK_ID, r as CREDENTIAL_TYPES } from "./constants-DVOF17NB.js";
+import { a as verifyAuthBearerToken } from "./utils-DLQ5VVqT.js";
+import { recoverTypedDataAddress } from "viem";
+import { createAction } from "@powerhousedao/shared/document-model";
+//#region src/discovery.ts
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 3e3;
+async function resolveSwitchboardEndpoint(options) {
+	const { switchboardUrl, baseUrl, timeoutMs } = options;
+	if (switchboardUrl) return switchboardUrl;
+	if (!baseUrl) return;
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs ?? DEFAULT_DISCOVERY_TIMEOUT_MS);
+	try {
+		const url = new URL("/api/switchboard", baseUrl);
+		const response = await fetch(url, {
+			method: "GET",
+			signal: controller.signal
+		});
+		if (!response.ok) return;
+		return (await response.json()).endpoint || void 0;
+	} catch {
+		return;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+//#endregion
+//#region src/switchboard.ts
+/** Thrown by `signIn` when the instance has no switchboard to write the
+* credential to, so a host can fall back to the Renown redirect flow. */
+var MissingSwitchboardError = class MissingSwitchboardError extends Error {
+	constructor() {
+		super("signIn requires a switchboard endpoint. Set switchboardUrl or a discoverable baseUrl.");
+		this.name = "MissingSwitchboardError";
+	}
+	/** `instanceof` fails across duplicate SDK copies, so match by name too. */
+	static is(error) {
+		return error instanceof MissingSwitchboardError || error instanceof Error && error.name === "MissingSwitchboardError";
+	}
+};
+function userDriveId(address) {
+	return `renown-${address.toLowerCase()}`;
+}
+const CREDENTIALS_QUERY = `
+  query RenownCredentials($input: RenownCredentialsInput!) {
+    renownCredentials(input: $input) {
+      documentId
+      credentialId
+      context
+      type
+      issuerId
+      issuerEthereumAddress
+      issuanceDate
+      expirationDate
+      credentialSubjectId
+      credentialSubjectApp
+      credentialStatusId
+      credentialStatusType
+      credentialSchemaId
+      credentialSchemaType
+      proofVerificationMethod
+      proofEthereumAddress
+      proofCreated
+      proofPurpose
+      proofType
+      proofValue
+      proofEip712Domain
+      proofEip712PrimaryType
+      revoked
+    }
+  }
+`;
+const USERS_QUERY = `
+  query RenownUsers($input: RenownUsersInput!) {
+    renownUsers(input: $input) {
+      documentId
+      username
+      ethAddress
+      userImage
+      createdAt
+      updatedAt
+    }
+  }
+`;
+const CREATE_EMPTY_DOCUMENT_MUTATION = `
+  mutation CreateEmptyDocument(
+    $documentType: String!
+    $parentIdentifier: String
+  ) {
+    createEmptyDocument(
+      documentType: $documentType
+      parentIdentifier: $parentIdentifier
+    ) {
+      id
+    }
+  }
+`;
+const MUTATE_DOCUMENT_MUTATION = `
+  mutation MutateDocument(
+    $documentIdentifier: String!
+    $actions: [ActionInput!]!
+  ) {
+    mutateDocument: execute(
+      documentIdentifier: $documentIdentifier
+      actions: $actions
+    ) {
+      id
+    }
+  }
+`;
+const LEGACY_MUTATE_DOCUMENT_MUTATION = `
+  mutation MutateDocument(
+    $documentIdentifier: String!
+    $actions: [JSONObject!]!
+  ) {
+    mutateDocument(documentIdentifier: $documentIdentifier, actions: $actions) {
+      id
+    }
+  }
+`;
+function isUnknownExecuteField(error) {
+	return error instanceof Error && /Cannot query field "execute" on type "Mutation"/.test(error.message);
+}
+const ISSUE_CREDENTIAL_MUTATION = `
+  mutation RenownIssueCredential(
+    $input: RenownCredential_InitInput!
+    $username: String
+    $userImage: String
+    $userDocId: PHID
+  ) {
+    renown_issueCredential(
+      input: $input
+      username: $username
+      userImage: $userImage
+      userDocId: $userDocId
+    )
+  }
+`;
+const UPSERT_PROFILE_MUTATION = `
+  mutation RenownUpsertProfile(
+    $address: String!
+    $username: String
+    $userImage: String
+    $signature: String
+    $timestamp: String
+  ) {
+    renown_upsertProfile(
+      address: $address
+      username: $username
+      userImage: $userImage
+      signature: $signature
+      timestamp: $timestamp
+    )
+  }
+`;
+const REVOKE_CREDENTIAL_MUTATION = `
+  mutation RenownRevokeCredential(
+    $credentialId: String!
+    $signature: String
+    $timestamp: String
+  ) {
+    renown_revokeCredential(
+      credentialId: $credentialId
+      signature: $signature
+      timestamp: $timestamp
+    )
+  }
+`;
+function authParts(auth) {
+	return "token" in auth ? {
+		token: auth.token,
+		signed: {}
+	} : { signed: {
+		signature: auth.signature,
+		timestamp: auth.timestamp
+	} };
+}
+const RENOWN_CREDENTIAL_DOC_TYPE = "powerhouse/renown-credential";
+const RENOWN_USER_DOC_TYPE = "powerhouse/renown-user";
+function quoted(name) {
+	return `\\\\?"${name}\\\\?"`;
+}
+function isUnknownSchemaError(error, field, ...types) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (new RegExp(`Cannot query field ${quoted(field)}`).test(message)) return true;
+	return !message.includes("got invalid value") && types.some((type) => new RegExp(`Unknown type ${quoted(type)}`).test(message));
+}
+function reshapeCredential(row) {
+	const domain = JSON.parse(row.proofEip712Domain);
+	return {
+		"@context": row.context,
+		type: row.type,
+		id: row.credentialId,
+		issuer: {
+			id: row.issuerId,
+			ethereumAddress: row.issuerEthereumAddress
+		},
+		credentialSubject: {
+			id: row.credentialSubjectId ?? "",
+			app: row.credentialSubjectApp
+		},
+		credentialSchema: {
+			id: row.credentialSchemaId,
+			type: row.credentialSchemaType
+		},
+		...row.credentialStatusId ? { credentialStatus: {
+			id: row.credentialStatusId,
+			type: row.credentialStatusType ?? ""
+		} } : {},
+		issuanceDate: row.issuanceDate,
+		expirationDate: row.expirationDate ?? "",
+		proof: {
+			type: row.proofType,
+			created: row.proofCreated,
+			verificationMethod: row.proofVerificationMethod,
+			proofPurpose: row.proofPurpose,
+			proofValue: row.proofValue,
+			ethereumAddress: row.proofEthereumAddress,
+			eip712: {
+				domain,
+				types: CREDENTIAL_TYPES,
+				primaryType: "VerifiableCredential"
+			}
+		}
+	};
+}
+function issuerChainId(issuerId) {
+	return issuerId.split(":")[3];
+}
+function issuerDidAddress(issuerId) {
+	return issuerId.split(":")[4];
+}
+function bindsTo$1(row, address, chainId, appDid) {
+	return !row.revoked && issuedTo(row, address, chainId, appDid);
+}
+function issuedTo(row, address, chainId, appDid) {
+	const expected = address.toLowerCase();
+	return row.credentialSubjectId === appDid && issuerChainId(row.issuerId) === String(chainId) && issuerDidAddress(row.issuerId)?.toLowerCase() === expected && row.issuerEthereumAddress.toLowerCase() === expected;
+}
+var SwitchboardClient = class {
+	#endpoint;
+	#transport;
+	#legacyMutate = false;
+	constructor(source) {
+		if (typeof source === "string") {
+			this.#endpoint = source;
+			this.#transport = (query, variables, options) => this.#post(source, query, variables, options?.token);
+		} else this.#transport = source;
+	}
+	/** The HTTP endpoint, or undefined when reading through a local executor. */
+	get endpoint() {
+		return this.#endpoint;
+	}
+	async #post(endpoint, query, variables, token) {
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...token ? { Authorization: `Bearer ${token}` } : {}
+			},
+			body: JSON.stringify({
+				query,
+				variables
+			})
+		});
+		const body = await response.json().catch(() => void 0);
+		if (body?.errors?.length) throw new Error(body.errors.map((e) => e.message).join("; "));
+		if (!response.ok || !body) throw new Error(`Switchboard request failed: ${response.status}`);
+		return body.data;
+	}
+	async #request(query, variables, token) {
+		const data = await (token ? this.#transport(query, variables, { token }) : this.#transport(query, variables));
+		if (!data) throw new Error("Switchboard returned no data");
+		return data;
+	}
+	async getCredential(params) {
+		const { address, chainId, appDid } = params;
+		const { renownCredentials } = await this.#request(CREDENTIALS_QUERY, { input: {
+			driveId: userDriveId(address),
+			ethAddress: address.toLowerCase(),
+			did: appDid,
+			includeRevoked: false
+		} });
+		const now = Date.now();
+		const mostRecent = renownCredentials.filter((row) => bindsTo$1(row, address, chainId, appDid)).filter((row) => {
+			if (!row.expirationDate) return true;
+			const expiresAt = Date.parse(row.expirationDate);
+			return !Number.isNaN(expiresAt) && expiresAt > now;
+		}).sort((a, b) => Date.parse(b.issuanceDate) - Date.parse(a.issuanceDate)).at(0);
+		return mostRecent ? reshapeCredential(mostRecent) : void 0;
+	}
+	async getIssuedCredentials(params) {
+		const { address, chainId, appDid } = params;
+		const { renownCredentials } = await this.#request(CREDENTIALS_QUERY, { input: {
+			driveId: userDriveId(address),
+			ethAddress: address.toLowerCase(),
+			did: appDid,
+			includeRevoked: true
+		} });
+		const credentials = [];
+		for (const row of renownCredentials) {
+			if (!issuedTo(row, address, chainId, appDid)) continue;
+			try {
+				credentials.push(reshapeCredential(row));
+			} catch {}
+		}
+		return credentials;
+	}
+	async getProfileByAddress(address) {
+		const { renownUsers } = await this.#request(USERS_QUERY, { input: {
+			driveId: userDriveId(address),
+			ethAddresses: [address.toLowerCase()]
+		} });
+		const user = renownUsers.at(0);
+		if (!user) return void 0;
+		return {
+			documentId: user.documentId,
+			username: user.username,
+			ethAddress: user.ethAddress,
+			userImage: user.userImage,
+			createdAt: user.createdAt,
+			updatedAt: user.updatedAt
+		};
+	}
+	async createEmptyDocument(documentType, parentIdentifier, token) {
+		const { createEmptyDocument } = await this.#request(CREATE_EMPTY_DOCUMENT_MUTATION, {
+			documentType,
+			parentIdentifier
+		}, token);
+		return createEmptyDocument.id;
+	}
+	async mutateDocument(documentIdentifier, actions, token) {
+		const variables = {
+			documentIdentifier,
+			actions
+		};
+		if (!this.#legacyMutate) try {
+			const { mutateDocument } = await this.#request(MUTATE_DOCUMENT_MUTATION, variables, token);
+			return mutateDocument.id;
+		} catch (error) {
+			if (!isUnknownExecuteField(error)) throw error;
+			this.#legacyMutate = true;
+		}
+		const { mutateDocument } = await this.#request(LEGACY_MUTATE_DOCUMENT_MUTATION, variables, token);
+		return mutateDocument.id;
+	}
+	async issueCredential(credential, parentIdentifier) {
+		const input = {
+			id: credential.id,
+			context: credential["@context"],
+			type: credential.type,
+			issuer: {
+				id: credential.issuer.id,
+				ethereumAddress: credential.issuer.ethereumAddress
+			},
+			credentialSubject: {
+				id: credential.credentialSubject.id,
+				app: credential.credentialSubject.app
+			},
+			credentialSchema: {
+				id: credential.credentialSchema.id,
+				type: credential.credentialSchema.type
+			},
+			issuanceDate: credential.issuanceDate,
+			expirationDate: credential.expirationDate || void 0,
+			proof: {
+				type: credential.proof.type,
+				created: credential.proof.created,
+				verificationMethod: credential.proof.verificationMethod,
+				proofPurpose: credential.proof.proofPurpose,
+				proofValue: credential.proof.proofValue,
+				ethereumAddress: credential.proof.ethereumAddress,
+				eip712: {
+					domain: {
+						version: credential.proof.eip712.domain.version,
+						chainId: credential.proof.eip712.domain.chainId
+					},
+					primaryType: credential.proof.eip712.primaryType
+				}
+			}
+		};
+		try {
+			const { renown_issueCredential } = await this.#request(ISSUE_CREDENTIAL_MUTATION, { input });
+			return renown_issueCredential;
+		} catch (error) {
+			if (!isUnknownSchemaError(error, "renown_issueCredential", "RenownCredential_InitInput")) throw error;
+			const documentId = await this.createEmptyDocument(RENOWN_CREDENTIAL_DOC_TYPE, parentIdentifier);
+			await this.mutateDocument(documentId, [createAction("INIT", input)]);
+			return documentId;
+		}
+	}
+	async upsertUserProfile(address, profile, auth) {
+		const { token, signed } = authParts(auth);
+		try {
+			const { renown_upsertProfile } = await this.#request(UPSERT_PROFILE_MUTATION, {
+				address,
+				username: profile.username,
+				userImage: profile.userImage,
+				...signed
+			}, token);
+			return renown_upsertProfile;
+		} catch (error) {
+			if (!isUnknownSchemaError(error, "renown_upsertProfile")) throw error;
+			return this.#legacyUpsertUserProfile(address, profile, token);
+		}
+	}
+	async #legacyUpsertUserProfile(address, profile, token) {
+		const updates = [];
+		if (profile.username != null) updates.push(createAction("SET_USERNAME", { username: profile.username }));
+		if (profile.userImage != null) updates.push(createAction("SET_USER_IMAGE", { userImage: profile.userImage }));
+		const existing = await this.getProfileByAddress(address);
+		if (existing) {
+			if (updates.length) await this.mutateDocument(existing.documentId, updates, token);
+			return existing.documentId;
+		}
+		const documentId = await this.createEmptyDocument(RENOWN_USER_DOC_TYPE, void 0, token);
+		await this.mutateDocument(documentId, [createAction("SET_ETH_ADDRESS", { ethAddress: address }), ...updates], token);
+		return documentId;
+	}
+	async revokeCredential(credentialId, auth) {
+		const { token, signed } = authParts(auth);
+		try {
+			await this.#request(REVOKE_CREDENTIAL_MUTATION, {
+				credentialId,
+				...signed
+			}, token);
+		} catch (error) {
+			if (!isUnknownSchemaError(error, "renown_revokeCredential")) throw error;
+			await this.#legacyRevokeCredential(credentialId, token);
+		}
+	}
+	async #legacyRevokeCredential(credentialId, token) {
+		const { renownCredentials } = await this.#request(CREDENTIALS_QUERY, { input: { includeRevoked: false } }, token);
+		const documentIds = renownCredentials.filter((row) => row.credentialId === credentialId).map((row) => row.documentId);
+		if (!documentIds.length) throw new Error(`Credential not found: ${credentialId}`);
+		const revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+		for (const documentId of documentIds) await this.mutateDocument(documentId, [createAction("REVOKE", {
+			revokedAt,
+			reason: null
+		})], token);
+	}
+	profileFetcher = (user) => this.getProfileByAddress(user.address).catch(() => void 0);
+};
+//#endregion
+//#region src/credential.ts
+/** Assemble a Renown delegation VC and sign it with the provided signer. */
+async function buildAndSignCredential(params) {
+	const { signTypedData, address, chainId, app, appId, expiresInDays = 7 } = params;
+	const issuerId = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;
+	const credentialId = `urn:uuid:${globalThis.crypto.randomUUID()}`;
+	const now = /* @__PURE__ */ new Date();
+	const expirationDate = new Date(now.getTime() + expiresInDays * 24 * 60 * 60 * 1e3);
+	const message = {
+		"@context": ["https://www.w3.org/2018/credentials/v1"],
+		type: ["VerifiableCredential", "RenownCredential"],
+		id: credentialId,
+		issuer: {
+			id: issuerId,
+			ethereumAddress: address
+		},
+		credentialSubject: {
+			id: appId,
+			app
+		},
+		credentialSchema: {
+			id: "https://renown.id/schemas/renown-credential/v1",
+			type: "JsonSchemaValidator2018"
+		},
+		issuanceDate: now.toISOString(),
+		expirationDate: expirationDate.toISOString()
+	};
+	const domain = {
+		version: "1",
+		chainId
+	};
+	const { EIP712Domain, ...signTypes } = CREDENTIAL_TYPES;
+	const signature = await signTypedData({
+		domain,
+		types: signTypes,
+		primaryType: "VerifiableCredential",
+		message
+	});
+	return {
+		...message,
+		proof: {
+			type: "EthereumEip712Signature2021",
+			created: message.issuanceDate,
+			verificationMethod: issuerId,
+			proofPurpose: "assertionMethod",
+			proofValue: signature,
+			ethereumAddress: address,
+			eip712: {
+				domain,
+				types: CREDENTIAL_TYPES,
+				primaryType: "VerifiableCredential"
+			}
+		}
+	};
+}
+/** Recover the address that signed a credential's EIP-712 proof. */
+async function recoverCredentialSigner(credential) {
+	const { proof, ...message } = credential;
+	const { EIP712Domain, ...types } = CREDENTIAL_TYPES;
+	return recoverTypedDataAddress({
+		domain: proof.eip712.domain,
+		types,
+		primaryType: "VerifiableCredential",
+		message,
+		signature: proof.proofValue
+	});
+}
+/** True when the proof was signed by the credential's declared issuer address. */
+async function verifyCredentialSignature(credential) {
+	try {
+		return (await recoverCredentialSigner(credential)).toLowerCase() === credential.issuer.ethereumAddress.toLowerCase();
+	} catch {
+		return false;
+	}
+}
+function withEip712Domain(credential, chainId) {
+	if (credential.proof.eip712?.domain) return credential;
+	return {
+		...credential,
+		proof: {
+			...credential.proof,
+			eip712: {
+				domain: {
+					version: "1",
+					chainId
+				},
+				types: CREDENTIAL_TYPES,
+				primaryType: "VerifiableCredential"
+			}
+		}
+	};
+}
+async function fetchDelegationCredentialRest(params) {
+	const { address, chainId, appDid, baseUrl } = params;
+	const url = new URL(`/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`, baseUrl);
+	const response = await fetch(url, { method: "GET" });
+	if (!response.ok) return void 0;
+	const { credential } = await response.json();
+	if (!credential) return void 0;
+	const [, , , issuerChainId, issuerAddress] = credential.issuer.id.split(":");
+	if (credential.credentialSubject.id !== appDid || issuerChainId !== String(chainId) || issuerAddress.toLowerCase() !== address.toLowerCase() || credential.issuer.ethereumAddress.toLowerCase() !== address.toLowerCase()) return;
+	if (credential.expirationDate) {
+		const expiresAt = Date.parse(credential.expirationDate);
+		if (Number.isNaN(expiresAt) || expiresAt <= Date.now()) return;
+	}
+	return credential;
+}
+/** True when the credential's EIP-712 proof, on `chainId`, was signed by its
+* issuer address. Binding and expiry are the caller's to check. */
+async function verifyDelegationProof(credential, chainId) {
+	const withDomain = withEip712Domain(credential, chainId);
+	return withDomain.proof.eip712.domain.chainId === chainId && await verifyCredentialSignature(withDomain);
+}
+async function finalizeCredential(credential, chainId, verifySignature) {
+	if (!verifySignature) return credential;
+	if (!await verifyDelegationProof(credential, chainId)) return;
+	return withEip712Domain(credential, chainId);
+}
+async function fetchDelegationCredential(options) {
+	const { address, chainId, appDid, switchboardUrl, switchboardRequest, discover = true, verifySignature = true } = options;
+	const explicitBaseUrl = options.baseUrl;
+	const baseUrl = explicitBaseUrl ?? "https://www.renown.id";
+	try {
+		const source = switchboardRequest ?? (switchboardUrl ? switchboardUrl : discover && explicitBaseUrl ? await resolveSwitchboardEndpoint({ baseUrl }) : void 0);
+		const credential = source ? await new SwitchboardClient(source).getCredential({
+			address,
+			chainId,
+			appDid
+		}) : await fetchDelegationCredentialRest({
+			address,
+			chainId,
+			appDid,
+			baseUrl
+		});
+		if (!credential) return void 0;
+		return await finalizeCredential(credential, chainId, verifySignature);
+	} catch {
+		return;
+	}
+}
+async function verifyAuthCredential(jwt, options = {}) {
+	const verified = await verifyAuthBearerToken(jwt, { audience: options.audience });
+	if (!verified) return void 0;
+	const { address, chainId, networkId } = verified.verifiableCredential.credentialSubject;
+	const appDid = verified.issuer;
+	const credential = await fetchDelegationCredential({
+		address,
+		chainId,
+		appDid,
+		baseUrl: options.renownUrl,
+		switchboardUrl: options.switchboardUrl,
+		switchboardRequest: options.switchboardRequest,
+		verifySignature: options.verifySignature
+	});
+	if (!credential) return void 0;
+	return {
+		address,
+		chainId,
+		networkId,
+		did: credential.issuer.id,
+		appDid,
+		credential
+	};
+}
+//#endregion
+//#region src/signer-trust.ts
+const DEFAULT_MAX_ACCEPTED = 1e4;
+const DEFAULT_REFUSAL_TTL_MS = 6e4;
+/**
+* Accepts a key the user's EIP-712 Renown credential delegates to, ignoring
+* expiry and revocation. Verdicts are cached per (address, key); this node's
+* own key is checked before the cache and never cached.
+*/
+function createRenownTrustPolicy(options = {}) {
+	const maxAccepted = options.maxAccepted ?? DEFAULT_MAX_ACCEPTED;
+	const refusalTtlMs = options.refusalTtlMs ?? DEFAULT_REFUSAL_TTL_MS;
+	const client = options.switchboard ? new SwitchboardClient(options.switchboard) : void 0;
+	const renownUrl = options.renownUrl ?? "https://www.renown.id";
+	const accepted = /* @__PURE__ */ new Set();
+	const refusedUntil = /* @__PURE__ */ new Map();
+	const pending = /* @__PURE__ */ new Map();
+	const issued = (user, key) => client ? client.getIssuedCredentials({
+		address: user.address,
+		chainId: user.chainId,
+		appDid: key
+	}) : fetchIssuedCredentialRest(user, key, renownUrl);
+	async function lookup(user, key) {
+		for (const credential of await issued(user, key)) if (bindsTo(credential, user, key) && await verifyDelegationProof(credential, user.chainId)) return true;
+		return false;
+	}
+	function remember(entry, verdict) {
+		if (verdict) {
+			if (accepted.size >= maxAccepted) {
+				const oldest = accepted.values().next().value;
+				if (oldest !== void 0) accepted.delete(oldest);
+			}
+			accepted.add(entry);
+			refusedUntil.delete(entry);
+		} else refusedUntil.set(entry, Date.now() + refusalTtlMs);
+	}
+	return { authorizeSigner(signer, key) {
+		const user = signer.user;
+		const self = ownIdentity(options);
+		if (self && isSelf(self, user, key)) return Promise.resolve(true);
+		if (!user || !isLookupable(user, key)) return Promise.resolve(false);
+		const entry = `${user.networkId}|${user.chainId}|${user.address.toLowerCase()}|${key}`;
+		if (accepted.has(entry)) return Promise.resolve(true);
+		const until = refusedUntil.get(entry);
+		if (until !== void 0 && until > Date.now()) return Promise.resolve(false);
+		const inFlight = pending.get(entry);
+		if (inFlight) return inFlight;
+		const verdict = lookup(user, key).then((result) => {
+			pending.delete(entry);
+			remember(entry, result);
+			return result;
+		}, (error) => {
+			pending.delete(entry);
+			throw error;
+		});
+		pending.set(entry, verdict);
+		return verdict;
+	} };
+}
+function ownIdentity(options) {
+	if (!options.ownSigner) return options.self;
+	const { app, user } = options.ownSigner;
+	return {
+		key: app?.key ?? "",
+		user: {
+			address: user?.address ?? "",
+			networkId: user?.networkId ?? "",
+			chainId: user?.chainId ?? 0
+		}
+	};
+}
+function isSelf(self, user, key) {
+	return self.key !== "" && key === self.key && (user?.address ?? "").toLowerCase() === self.user.address.toLowerCase() && (user?.networkId ?? "") === self.user.networkId && (user?.chainId ?? 0) === self.user.chainId;
+}
+function isLookupable(user, key) {
+	return key.startsWith("did:key:") && /^0x[0-9a-fA-F]{40}$/.test(user.address) && user.networkId !== "" && Number.isInteger(user.chainId) && user.chainId > 0;
+}
+function bindsTo(credential, user, key) {
+	const address = user.address.toLowerCase();
+	const issuer = credential.issuer.id.split(":");
+	if (issuer.length !== 5) return false;
+	const [scheme, method, networkId, chainId, issuerAddress] = issuer;
+	return credential.credentialSubject.id === key && scheme === "did" && method === "pkh" && networkId === user.networkId && chainId === String(user.chainId) && issuerAddress.toLowerCase() === address && credential.issuer.ethereumAddress.toLowerCase() === address;
+}
+async function fetchIssuedCredentialRest(user, key, renownUrl) {
+	const url = new URL("/api/auth/credential", renownUrl);
+	url.searchParams.set("address", user.address);
+	url.searchParams.set("chainId", String(user.chainId));
+	url.searchParams.set("connectId", key);
+	url.searchParams.set("appId", key);
+	const response = await fetch(url, { method: "GET" });
+	if (response.status === 404) return [];
+	if (!response.ok) throw new Error(`Renown credential lookup failed: ${response.status}`);
+	const { credential } = await response.json();
+	return credential ? [credential] : [];
+}
+//#endregion
+export { verifyAuthCredential as a, MissingSwitchboardError as c, recoverCredentialSigner as i, SwitchboardClient as l, buildAndSignCredential as n, verifyCredentialSignature as o, fetchDelegationCredential as r, verifyDelegationProof as s, createRenownTrustPolicy as t, resolveSwitchboardEndpoint as u };
+
+//# sourceMappingURL=signer-trust-H1rNzUcd.js.map