@renown/sdk 6.2.3-dev.5 → 6.2.3-dev.50

package/dist/signer-trust-H1rNzUcd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-trust-H1rNzUcd.js","names":["bindsTo"],"sources":["../src/discovery.ts","../src/switchboard.ts","../src/credential.ts","../src/signer-trust.ts"],"sourcesContent":["export interface ResolveSwitchboardEndpointOptions {\n  // Explicit Switchboard GraphQL endpoint. When set, used directly.\n  switchboardUrl?: string;\n  // Renown base URL to ask for a switchboard endpoint when none is explicit.\n  baseUrl?: string;\n  // Max time (ms) to wait for the discovery probe before falling back to REST.\n  timeoutMs?: number;\n}\n\n// Legacy Renown instances accept the connection but never respond to the\n// discovery request; without a bound, `fetch` hangs and blocks startup.\nconst DEFAULT_DISCOVERY_TIMEOUT_MS = 3000;\n\n// Shape returned by the Renown app's `/api/switchboard` discovery endpoint.\ninterface DiscoveryResponse {\n  endpoint?: string;\n}\n\n// Resolve the Switchboard GraphQL endpoint: explicit `switchboardUrl` wins,\n// else discover via `{baseUrl}/api/switchboard`; undefined means use REST.\nexport async function resolveSwitchboardEndpoint(\n  options: ResolveSwitchboardEndpointOptions,\n): Promise<string | undefined> {\n  const { switchboardUrl, baseUrl, timeoutMs } = options;\n\n  if (switchboardUrl) {\n    return switchboardUrl;\n  }\n\n  if (!baseUrl) {\n    return undefined;\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(\n    () => controller.abort(),\n    timeoutMs ?? DEFAULT_DISCOVERY_TIMEOUT_MS,\n  );\n\n  try {\n    const url = new URL(\"/api/switchboard\", baseUrl);\n    const response = await fetch(url, {\n      method: \"GET\",\n      signal: controller.signal,\n    });\n    if (!response.ok) {\n      return undefined;\n    }\n    const body = (await response.json()) as DiscoveryResponse;\n    return body.endpoint || undefined;\n  } catch {\n    // Old Renown instances never answer (or lack the endpoint); the abort\n    // timeout rejects here so we fall back to the REST flow instead of hanging.\n    return undefined;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n","import {\n  createAction,\n  type Action,\n} from \"@powerhousedao/shared/document-model\";\nimport { CREDENTIAL_TYPES } from \"./constants.js\";\nimport type {\n  PowerhouseVerifiableCredential,\n  ProfileFetcher,\n  RenownProfile,\n} from \"./types.js\";\n\n/** Thrown by `signIn` when the instance has no switchboard to write the\n * credential to, so a host can fall back to the Renown redirect flow. */\nexport class MissingSwitchboardError extends Error {\n  constructor() {\n    super(\n      \"signIn requires a switchboard endpoint. Set switchboardUrl or a discoverable baseUrl.\",\n    );\n    this.name = \"MissingSwitchboardError\";\n  }\n\n  /** `instanceof` fails across duplicate SDK copies, so match by name too. */\n  static is(error: unknown): error is MissingSwitchboardError {\n    return (\n      error instanceof MissingSwitchboardError ||\n      (error instanceof Error && error.name === \"MissingSwitchboardError\")\n    );\n  }\n}\n\n// Per-user drive convention shared with the Renown app: `renown-<address>`.\n// The read-model ignores driveId, but we pass it for parity.\nfunction userDriveId(address: string): string {\n  return `renown-${address.toLowerCase()}`;\n}\n\n// Flat row returned by the `renownCredentials` read-model query.\ninterface ReadRenownCredential {\n  documentId: string;\n  credentialId: string;\n  context: string[];\n  type: string[];\n  issuerId: string;\n  issuerEthereumAddress: string;\n  issuanceDate: string;\n  expirationDate: string | null;\n  credentialSubjectId: string | null;\n  credentialSubjectApp: string;\n  credentialStatusId: string | null;\n  credentialStatusType: string | null;\n  credentialSchemaId: string;\n  credentialSchemaType: string;\n  proofVerificationMethod: string;\n  proofEthereumAddress: string;\n  proofCreated: string;\n  proofPurpose: string;\n  proofType: string;\n  proofValue: string;\n  proofEip712Domain: string;\n  proofEip712PrimaryType: string;\n  revoked: boolean;\n}\n\n// Flat row returned by the `renownUsers` read-model query.\ninterface ReadRenownUser {\n  documentId: string;\n  username: string | null;\n  ethAddress: string | null;\n  userImage: string | null;\n  createdAt: string;\n  updatedAt: string;\n}\n\nconst CREDENTIALS_QUERY = /* GraphQL */ `\n  query RenownCredentials($input: RenownCredentialsInput!) {\n    renownCredentials(input: $input) {\n      documentId\n      credentialId\n      context\n      type\n      issuerId\n      issuerEthereumAddress\n      issuanceDate\n      expirationDate\n      credentialSubjectId\n      credentialSubjectApp\n      credentialStatusId\n      credentialStatusType\n      credentialSchemaId\n      credentialSchemaType\n      proofVerificationMethod\n      proofEthereumAddress\n      proofCreated\n      proofPurpose\n      proofType\n      proofValue\n      proofEip712Domain\n      proofEip712PrimaryType\n      revoked\n    }\n  }\n`;\n\nconst USERS_QUERY = /* GraphQL */ `\n  query RenownUsers($input: RenownUsersInput!) {\n    renownUsers(input: $input) {\n      documentId\n      username\n      ethAddress\n      userImage\n      createdAt\n      updatedAt\n    }\n  }\n`;\n\nconst CREATE_EMPTY_DOCUMENT_MUTATION = /* GraphQL */ `\n  mutation CreateEmptyDocument(\n    $documentType: String!\n    $parentIdentifier: String\n  ) {\n    createEmptyDocument(\n      documentType: $documentType\n      parentIdentifier: $parentIdentifier\n    ) {\n      id\n    }\n  }\n`;\n\nconst MUTATE_DOCUMENT_MUTATION = /* GraphQL */ `\n  mutation MutateDocument(\n    $documentIdentifier: String!\n    $actions: [ActionInput!]!\n  ) {\n    mutateDocument: execute(\n      documentIdentifier: $documentIdentifier\n      actions: $actions\n    ) {\n      id\n    }\n  }\n`;\n\n/* Switchboards older than 6.2.2-dev.54 have no `execute`; their `mutateDocument`\n   takes the same envelopes as untyped JSON. Same selection, so one result shape. */\nconst LEGACY_MUTATE_DOCUMENT_MUTATION = /* GraphQL */ `\n  mutation MutateDocument(\n    $documentIdentifier: String!\n    $actions: [JSONObject!]!\n  ) {\n    mutateDocument(documentIdentifier: $documentIdentifier, actions: $actions) {\n      id\n    }\n  }\n`;\n\n// graphql-js validation failure for a field the server's schema lacks.\nfunction isUnknownExecuteField(error: unknown): boolean {\n  return (\n    error instanceof Error &&\n    /Cannot query field \"execute\" on type \"Mutation\"/.test(error.message)\n  );\n}\n\n// Dedicated renown-package mutations that write through the reactor client,\n// bypassing the authorization policy so unauthenticated sign-in can bootstrap.\nconst ISSUE_CREDENTIAL_MUTATION = /* GraphQL */ `\n  mutation RenownIssueCredential(\n    $input: RenownCredential_InitInput!\n    $username: String\n    $userImage: String\n    $userDocId: PHID\n  ) {\n    renown_issueCredential(\n      input: $input\n      username: $username\n      userImage: $userImage\n      userDocId: $userDocId\n    )\n  }\n`;\n\nconst UPSERT_PROFILE_MUTATION = /* GraphQL */ `\n  mutation RenownUpsertProfile(\n    $address: String!\n    $username: String\n    $userImage: String\n    $signature: String\n    $timestamp: String\n  ) {\n    renown_upsertProfile(\n      address: $address\n      username: $username\n      userImage: $userImage\n      signature: $signature\n      timestamp: $timestamp\n    )\n  }\n`;\n\nconst REVOKE_CREDENTIAL_MUTATION = /* GraphQL */ `\n  mutation RenownRevokeCredential(\n    $credentialId: String!\n    $signature: String\n    $timestamp: String\n  ) {\n    renown_revokeCredential(\n      credentialId: $credentialId\n      signature: $signature\n      timestamp: $timestamp\n    )\n  }\n`;\n\n/** How a caller authorizes a Renown write: a login (bearer) token for the\n * address, or that address's `personal_sign` over the canonical message\n * (`revokeMessage` / `profileMessage`) with the ISO-8601 timestamp it signed. */\nexport type RenownWriteAuth =\n  | { token: string }\n  | { signature: string; timestamp: string };\n\n// Split a RenownWriteAuth into the bearer token and the signature variables.\nfunction authParts(auth: RenownWriteAuth): {\n  token?: string;\n  signed: { signature?: string; timestamp?: string };\n} {\n  return \"token\" in auth\n    ? { token: auth.token, signed: {} }\n    : {\n        signed: { signature: auth.signature, timestamp: auth.timestamp },\n      };\n}\n\nconst RENOWN_CREDENTIAL_DOC_TYPE = \"powerhouse/renown-credential\";\nconst RENOWN_USER_DOC_TYPE = \"powerhouse/renown-user\";\n\n// A `\"name\"` quote as graphql-js writes it; `\\\"` too, for transports that\n// relay the errors JSON-encoded inside their own message.\nfunction quoted(name: string): string {\n  return `\\\\\\\\?\"${name}\\\\\\\\?\"`;\n}\n\n// True when `error` says the switchboard's schema lacks `field` itself (or\n// one of `types`) — an older renown-package without the renown-auth subgraph.\n// Anything else, including a NEW server's input-coercion failure such as\n// `Variable \"$input\" got invalid value …; Field \"x\" is not defined by type\n// \"RenownCredential_InitInput\"`, is a rejection and must not fall back.\nfunction isUnknownSchemaError(\n  error: unknown,\n  field: string,\n  ...types: string[]\n): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  if (new RegExp(`Cannot query field ${quoted(field)}`).test(message)) {\n    return true;\n  }\n  return (\n    !message.includes(\"got invalid value\") &&\n    types.some((type) =>\n      new RegExp(`Unknown type ${quoted(type)}`).test(message),\n    )\n  );\n}\n\n// Rebuild the nested EIP-712 verifiable credential from a flat read-model row.\nfunction reshapeCredential(\n  row: ReadRenownCredential,\n): PowerhouseVerifiableCredential {\n  // `proofEip712Domain` is stored as a JSON string ({ version, chainId }).\n  const domain = JSON.parse(row.proofEip712Domain) as {\n    version: string;\n    chainId: number;\n  };\n\n  return {\n    \"@context\": row.context,\n    type: row.type,\n    id: row.credentialId,\n    issuer: {\n      id: row.issuerId,\n      ethereumAddress: row.issuerEthereumAddress as `0x${string}`,\n    },\n    credentialSubject: {\n      id: row.credentialSubjectId ?? \"\",\n      app: row.credentialSubjectApp,\n    },\n    credentialSchema: {\n      id: row.credentialSchemaId,\n      type: row.credentialSchemaType,\n    },\n    ...(row.credentialStatusId\n      ? {\n          credentialStatus: {\n            id: row.credentialStatusId,\n            type: row.credentialStatusType ?? \"\",\n          },\n        }\n      : {}),\n    issuanceDate: row.issuanceDate,\n    expirationDate: row.expirationDate ?? \"\",\n    proof: {\n      type: row.proofType,\n      created: row.proofCreated,\n      verificationMethod: row.proofVerificationMethod,\n      proofPurpose: row.proofPurpose,\n      proofValue: row.proofValue,\n      ethereumAddress: row.proofEthereumAddress as `0x${string}`,\n      eip712: {\n        domain,\n        types: CREDENTIAL_TYPES,\n        primaryType: \"VerifiableCredential\",\n      },\n    },\n  };\n}\n\n// The chain id in a `did:pkh:<net>:<chainId>:<address>` issuer id.\nfunction issuerChainId(issuerId: string): string | undefined {\n  return issuerId.split(\":\")[3];\n}\n\n// The address in a `did:pkh:<net>:<chainId>:<address>` issuer id.\nfunction issuerDidAddress(issuerId: string): string | undefined {\n  return issuerId.split(\":\")[4];\n}\n\n// Re-check the delegation binding instead of trusting the read-model's\n// `did`/`ethAddress` filters, matching the REST path in `credential.ts`.\nfunction bindsTo(\n  row: ReadRenownCredential,\n  address: string,\n  chainId: number,\n  appDid: string,\n): boolean {\n  return !row.revoked && issuedTo(row, address, chainId, appDid);\n}\n\nfunction issuedTo(\n  row: ReadRenownCredential,\n  address: string,\n  chainId: number,\n  appDid: string,\n): boolean {\n  const expected = address.toLowerCase();\n  return (\n    row.credentialSubjectId === appDid &&\n    issuerChainId(row.issuerId) === String(chainId) &&\n    issuerDidAddress(row.issuerId)?.toLowerCase() === expected &&\n    row.issuerEthereumAddress.toLowerCase() === expected\n  );\n}\n\n/** Per-request options: `token` is a Renown bearer token that authenticates\n * the request (sent as `Authorization: Bearer <token>` over HTTP). */\nexport interface SwitchboardRequestOptions {\n  token?: string;\n}\n\n/** Runs a GraphQL document against a Switchboard and resolves its `data`;\n * throws on transport or GraphQL errors. */\nexport type SwitchboardRequestFn = (\n  query: string,\n  variables: Record<string, unknown>,\n  options?: SwitchboardRequestOptions,\n) => Promise<unknown>;\n\n/** Where a SwitchboardClient reads from: an HTTP endpoint or a local executor. */\nexport type SwitchboardSource = string | SwitchboardRequestFn;\n\n// Reads and writes a Switchboard reactor's `renown-read-model` subgraph and\n// document mutations over GraphQL, replacing the Renown Next.js REST proxy.\nexport class SwitchboardClient {\n  #endpoint: string | undefined;\n  #transport: SwitchboardRequestFn;\n  // Set once the switchboard has rejected `execute`, so later writes skip the probe.\n  #legacyMutate = false;\n\n  constructor(source: SwitchboardSource) {\n    if (typeof source === \"string\") {\n      this.#endpoint = source;\n      this.#transport = (query, variables, options) =>\n        this.#post(source, query, variables, options?.token);\n    } else {\n      this.#transport = source;\n    }\n  }\n\n  /** The HTTP endpoint, or undefined when reading through a local executor. */\n  get endpoint(): string | undefined {\n    return this.#endpoint;\n  }\n\n  async #post(\n    endpoint: string,\n    query: string,\n    variables: Record<string, unknown>,\n    token?: string,\n  ): Promise<unknown> {\n    const response = await fetch(endpoint, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        ...(token ? { Authorization: `Bearer ${token}` } : {}),\n      },\n      body: JSON.stringify({ query, variables }),\n    });\n    /* A validation failure comes back as 400 WITH a GraphQL error body, so read\n       it before judging the status: the messages say what was wrong, the code\n       only that something was. */\n    const body = (await response.json().catch(() => undefined)) as\n      | { data?: unknown; errors?: { message: string }[] }\n      | undefined;\n    if (body?.errors?.length) {\n      throw new Error(body.errors.map((e) => e.message).join(\"; \"));\n    }\n    if (!response.ok || !body) {\n      throw new Error(`Switchboard request failed: ${response.status}`);\n    }\n    // `#request` rejects an empty `data` for every transport, HTTP or local.\n    return body.data;\n  }\n\n  async #request<T>(\n    query: string,\n    variables: Record<string, unknown>,\n    token?: string,\n  ): Promise<T> {\n    const data = await (token\n      ? this.#transport(query, variables, { token })\n      : this.#transport(query, variables));\n    if (!data) {\n      throw new Error(\"Switchboard returned no data\");\n    }\n    return data as T;\n  }\n\n  // Fetch the active delegation credential for (address, chainId) that delegates\n  // to `appDid`: re-check the binding, drop expired, return most recent.\n  async getCredential(params: {\n    address: string;\n    chainId: number;\n    appDid: string;\n  }): Promise<PowerhouseVerifiableCredential | undefined> {\n    const { address, chainId, appDid } = params;\n    const { renownCredentials } = await this.#request<{\n      renownCredentials: ReadRenownCredential[];\n    }>(CREDENTIALS_QUERY, {\n      input: {\n        driveId: userDriveId(address),\n        ethAddress: address.toLowerCase(),\n        did: appDid,\n        includeRevoked: false,\n      },\n    });\n\n    const now = Date.now();\n    const candidates = renownCredentials\n      .filter((row) => bindsTo(row, address, chainId, appDid))\n      .filter((row) => {\n        if (!row.expirationDate) return true;\n        const expiresAt = Date.parse(row.expirationDate);\n        return !Number.isNaN(expiresAt) && expiresAt > now;\n      })\n      .sort((a, b) => Date.parse(b.issuanceDate) - Date.parse(a.issuanceDate));\n\n    const mostRecent = candidates.at(0);\n    return mostRecent ? reshapeCredential(mostRecent) : undefined;\n  }\n\n  // Every credential (address, chainId) issued to `appDid`, revoked and expired\n  // included: that the address once delegated to the key does not change.\n  async getIssuedCredentials(params: {\n    address: string;\n    chainId: number;\n    appDid: string;\n  }): Promise<PowerhouseVerifiableCredential[]> {\n    const { address, chainId, appDid } = params;\n    const { renownCredentials } = await this.#request<{\n      renownCredentials: ReadRenownCredential[];\n    }>(CREDENTIALS_QUERY, {\n      input: {\n        driveId: userDriveId(address),\n        ethAddress: address.toLowerCase(),\n        did: appDid,\n        includeRevoked: true,\n      },\n    });\n\n    const credentials: PowerhouseVerifiableCredential[] = [];\n    for (const row of renownCredentials) {\n      if (!issuedTo(row, address, chainId, appDid)) continue;\n      try {\n        credentials.push(reshapeCredential(row));\n      } catch {\n        // A row whose proof domain does not parse cannot verify.\n      }\n    }\n    return credentials;\n  }\n\n  // Look up a Renown profile by ethereum address via the `renownUsers` query.\n  async getProfileByAddress(\n    address: string,\n  ): Promise<RenownProfile | undefined> {\n    const { renownUsers } = await this.#request<{\n      renownUsers: ReadRenownUser[];\n    }>(USERS_QUERY, {\n      input: {\n        driveId: userDriveId(address),\n        ethAddresses: [address.toLowerCase()],\n      },\n    });\n\n    const user = renownUsers.at(0);\n    if (!user) return undefined;\n    return {\n      documentId: user.documentId,\n      username: user.username,\n      ethAddress: user.ethAddress,\n      userImage: user.userImage,\n      createdAt: user.createdAt,\n      updatedAt: user.updatedAt,\n    };\n  }\n\n  // Create an empty document of the given type; returns its document id.\n  // Pass a bearer token to authenticate the write when auth is enabled.\n  async createEmptyDocument(\n    documentType: string,\n    parentIdentifier?: string,\n    token?: string,\n  ): Promise<string> {\n    const { createEmptyDocument } = await this.#request<{\n      createEmptyDocument: { id: string };\n    }>(\n      CREATE_EMPTY_DOCUMENT_MUTATION,\n      { documentType, parentIdentifier },\n      token,\n    );\n    return createEmptyDocument.id;\n  }\n\n  // Apply reactor action envelopes to a document; returns its document id.\n  // Pass a bearer token to authenticate the write when auth is enabled.\n  async mutateDocument(\n    documentIdentifier: string,\n    actions: Action[],\n    token?: string,\n  ): Promise<string> {\n    const variables = { documentIdentifier, actions };\n    if (!this.#legacyMutate) {\n      try {\n        const { mutateDocument } = await this.#request<{\n          mutateDocument: { id: string };\n        }>(MUTATE_DOCUMENT_MUTATION, variables, token);\n        return mutateDocument.id;\n      } catch (error) {\n        if (!isUnknownExecuteField(error)) throw error;\n        this.#legacyMutate = true;\n      }\n    }\n    const { mutateDocument } = await this.#request<{\n      mutateDocument: { id: string };\n    }>(LEGACY_MUTATE_DOCUMENT_MUTATION, variables, token);\n    return mutateDocument.id;\n  }\n\n  // Issue a signed credential via the renown-package `renown_issueCredential`\n  // mutation, which validates the proof and writes without requiring auth.\n  async issueCredential(\n    credential: PowerhouseVerifiableCredential,\n    parentIdentifier?: string,\n  ): Promise<string> {\n    const input: Record<string, unknown> = {\n      id: credential.id,\n      context: credential[\"@context\"],\n      type: credential.type,\n      issuer: {\n        id: credential.issuer.id,\n        ethereumAddress: credential.issuer.ethereumAddress,\n      },\n      credentialSubject: {\n        id: credential.credentialSubject.id,\n        app: credential.credentialSubject.app,\n      },\n      credentialSchema: {\n        id: credential.credentialSchema.id,\n        type: credential.credentialSchema.type,\n      },\n      issuanceDate: credential.issuanceDate,\n      expirationDate: credential.expirationDate || undefined,\n      proof: {\n        type: credential.proof.type,\n        created: credential.proof.created,\n        verificationMethod: credential.proof.verificationMethod,\n        proofPurpose: credential.proof.proofPurpose,\n        proofValue: credential.proof.proofValue,\n        ethereumAddress: credential.proof.ethereumAddress,\n        eip712: {\n          domain: {\n            version: credential.proof.eip712.domain.version,\n            chainId: credential.proof.eip712.domain.chainId,\n          },\n          primaryType: credential.proof.eip712.primaryType,\n        },\n      },\n    };\n    try {\n      const { renown_issueCredential } = await this.#request<{\n        renown_issueCredential: string;\n      }>(ISSUE_CREDENTIAL_MUTATION, { input });\n      return renown_issueCredential;\n    } catch (error) {\n      // Fallback for a switchboard on an older renown-package without the\n      // issuance subgraph: write via the generic reactor mutations instead.\n      if (\n        !isUnknownSchemaError(\n          error,\n          \"renown_issueCredential\",\n          \"RenownCredential_InitInput\",\n        )\n      ) {\n        throw error;\n      }\n      const documentId = await this.createEmptyDocument(\n        RENOWN_CREDENTIAL_DOC_TYPE,\n        parentIdentifier,\n      );\n      await this.mutateDocument(documentId, [createAction(\"INIT\", input)]);\n      return documentId;\n    }\n  }\n\n  // Create or update the RenownUser profile for an address via the\n  // renown-package `renown_upsertProfile` mutation, authorized by a login token\n  // for the address or its personal_sign of `profileMessage`. Returns the\n  // profile document id.\n  async upsertUserProfile(\n    address: string,\n    profile: { username?: string; userImage?: string },\n    auth: RenownWriteAuth,\n  ): Promise<string> {\n    const { token, signed } = authParts(auth);\n    try {\n      const { renown_upsertProfile } = await this.#request<{\n        renown_upsertProfile: string;\n      }>(\n        UPSERT_PROFILE_MUTATION,\n        {\n          address,\n          username: profile.username,\n          userImage: profile.userImage,\n          ...signed,\n        },\n        token,\n      );\n      return renown_upsertProfile;\n    } catch (error) {\n      // Fallback for a switchboard on an older renown-package without the\n      // renown-auth subgraph: write via the generic reactor mutations instead.\n      if (!isUnknownSchemaError(error, \"renown_upsertProfile\")) throw error;\n      return this.#legacyUpsertUserProfile(address, profile, token);\n    }\n  }\n\n  async #legacyUpsertUserProfile(\n    address: string,\n    profile: { username?: string; userImage?: string },\n    token?: string,\n  ): Promise<string> {\n    const updates: Action[] = [];\n    if (profile.username != null) {\n      updates.push(\n        createAction(\"SET_USERNAME\", { username: profile.username }),\n      );\n    }\n    if (profile.userImage != null) {\n      updates.push(\n        createAction(\"SET_USER_IMAGE\", { userImage: profile.userImage }),\n      );\n    }\n\n    const existing = await this.getProfileByAddress(address);\n    if (existing) {\n      if (updates.length)\n        await this.mutateDocument(existing.documentId, updates, token);\n      return existing.documentId;\n    }\n\n    const documentId = await this.createEmptyDocument(\n      RENOWN_USER_DOC_TYPE,\n      undefined,\n      token,\n    );\n    await this.mutateDocument(\n      documentId,\n      [createAction(\"SET_ETH_ADDRESS\", { ethAddress: address }), ...updates],\n      token,\n    );\n    return documentId;\n  }\n\n  // Revoke a credential by its VC id (`credential.id`, not its document id) via\n  // the renown-package `renown_revokeCredential` mutation, authorized by a\n  // login token for the issuer or its personal_sign of `revokeMessage`.\n  async revokeCredential(\n    credentialId: string,\n    auth: RenownWriteAuth,\n  ): Promise<void> {\n    const { token, signed } = authParts(auth);\n    try {\n      await this.#request<{ renown_revokeCredential: boolean }>(\n        REVOKE_CREDENTIAL_MUTATION,\n        { credentialId, ...signed },\n        token,\n      );\n    } catch (error) {\n      // Fallback for a switchboard on an older renown-package without the\n      // renown-auth subgraph: REVOKE the credential's documents directly.\n      if (!isUnknownSchemaError(error, \"renown_revokeCredential\")) throw error;\n      await this.#legacyRevokeCredential(credentialId, token);\n    }\n  }\n\n  async #legacyRevokeCredential(\n    credentialId: string,\n    token?: string,\n  ): Promise<void> {\n    // The read model has no lookup by VC id, so scan the live credentials.\n    const { renownCredentials } = await this.#request<{\n      renownCredentials: ReadRenownCredential[];\n    }>(CREDENTIALS_QUERY, { input: { includeRevoked: false } }, token);\n    const documentIds = renownCredentials\n      .filter((row) => row.credentialId === credentialId)\n      .map((row) => row.documentId);\n    if (!documentIds.length) {\n      throw new Error(`Credential not found: ${credentialId}`);\n    }\n    const revokedAt = new Date().toISOString();\n    for (const documentId of documentIds) {\n      await this.mutateDocument(\n        documentId,\n        [createAction(\"REVOKE\", { revokedAt, reason: null })],\n        token,\n      );\n    }\n  }\n\n  // A ProfileFetcher backed by this client; used as the default when the\n  // direct-switchboard flow is active. The `baseUrl` argument is ignored.\n  profileFetcher: ProfileFetcher = (user) =>\n    this.getProfileByAddress(user.address).catch(() => undefined);\n}\n","import { recoverTypedDataAddress } from \"viem\";\nimport {\n  CREDENTIAL_TYPES,\n  DEFAULT_RENOWN_NETWORK_ID,\n  DEFAULT_RENOWN_URL,\n} from \"./constants.js\";\nimport { resolveSwitchboardEndpoint } from \"./discovery.js\";\nimport {\n  SwitchboardClient,\n  type SwitchboardRequestFn,\n  type SwitchboardSource,\n} from \"./switchboard.js\";\nimport type { IProof, PowerhouseVerifiableCredential } from \"./types.js\";\nimport { verifyAuthBearerToken } from \"./utils.js\";\n\n/* Local structural aliases (EIP-712 standard shapes) so renown's public .d.ts\n * never names viem — a viem type in the surface drags viem's whole closure in. */\ntype Hex = `0x${string}`;\ntype TypedDataDomain = {\n  name?: string;\n  version?: string;\n  chainId?: number;\n  verifyingContract?: Hex;\n  salt?: Hex;\n};\ntype TypedDataParameter = { name: string; type: string };\n\n/** EIP-712 domain as signed by the credential issuer. */\nexport type CredentialDomain = {\n  version: string;\n  chainId: number;\n};\n\n/** The credential body that is EIP-712 signed (everything except `proof`). */\nexport type CredentialMessage = {\n  \"@context\": string[];\n  type: string[];\n  id: string;\n  issuer: { id: string; ethereumAddress: Hex };\n  credentialSubject: { id: string; app: string };\n  credentialSchema: { id: string; type: string };\n  issuanceDate: string;\n  expirationDate: string;\n};\n\n/** Typed-data signer; matches the loose shape used by wallet adapters. */\nexport type SignCredentialTypedData = (args: {\n  domain: TypedDataDomain;\n  types: Record<string, readonly TypedDataParameter[]>;\n  primaryType: string;\n  message: Record<string, unknown>;\n}) => Promise<Hex>;\n\nexport interface BuildCredentialParams {\n  signTypedData: SignCredentialTypedData;\n  address: Hex;\n  chainId: number;\n  app: string;\n  /** Credential subject id: the app/client DID the credential delegates to. */\n  appId: string;\n  expiresInDays?: number;\n}\n\n/** Assemble a Renown delegation VC and sign it with the provided signer. */\nexport async function buildAndSignCredential(\n  params: BuildCredentialParams,\n): Promise<PowerhouseVerifiableCredential> {\n  const {\n    signTypedData,\n    address,\n    chainId,\n    app,\n    appId,\n    expiresInDays = 7,\n  } = params;\n\n  const issuerId = `did:pkh:${DEFAULT_RENOWN_NETWORK_ID}:${chainId}:${address.toLowerCase()}`;\n  const credentialId = `urn:uuid:${globalThis.crypto.randomUUID()}`;\n  const now = new Date();\n  const expirationDate = new Date(\n    now.getTime() + expiresInDays * 24 * 60 * 60 * 1000,\n  );\n\n  const message: CredentialMessage = {\n    \"@context\": [\"https://www.w3.org/2018/credentials/v1\"],\n    type: [\"VerifiableCredential\", \"RenownCredential\"],\n    id: credentialId,\n    issuer: { id: issuerId, ethereumAddress: address },\n    credentialSubject: { id: appId, app },\n    credentialSchema: {\n      id: \"https://renown.id/schemas/renown-credential/v1\",\n      type: \"JsonSchemaValidator2018\",\n    },\n    issuanceDate: now.toISOString(),\n    expirationDate: expirationDate.toISOString(),\n  };\n\n  const domain: CredentialDomain = { version: \"1\", chainId };\n\n  // viem and most wallet adapters reserve EIP712Domain and derive it from\n  // `domain` — passing it explicitly makes them throw.\n  const { EIP712Domain, ...signTypes } = CREDENTIAL_TYPES;\n  void EIP712Domain;\n  const signature = await signTypedData({\n    domain,\n    types: signTypes,\n    primaryType: \"VerifiableCredential\",\n    message,\n  });\n\n  return {\n    ...message,\n    proof: {\n      type: \"EthereumEip712Signature2021\",\n      created: message.issuanceDate,\n      verificationMethod: issuerId,\n      proofPurpose: \"assertionMethod\",\n      proofValue: signature,\n      ethereumAddress: address,\n      eip712: {\n        domain,\n        types: CREDENTIAL_TYPES,\n        primaryType: \"VerifiableCredential\",\n      },\n    },\n  };\n}\n\n/** Recover the address that signed a credential's EIP-712 proof. */\nexport async function recoverCredentialSigner(\n  credential: PowerhouseVerifiableCredential,\n): Promise<Hex> {\n  const { proof, ...message } = credential;\n  // Drop EIP712Domain so viem derives it from `domain`; viem ignores\n  // message keys not present in the types, so the proof is excluded too.\n  const { EIP712Domain, ...types } = CREDENTIAL_TYPES;\n  void EIP712Domain;\n  return recoverTypedDataAddress({\n    domain: proof.eip712.domain,\n    types,\n    primaryType: \"VerifiableCredential\",\n    message,\n    signature: proof.proofValue as Hex,\n  } as Parameters<typeof recoverTypedDataAddress>[0]);\n}\n\n/** True when the proof was signed by the credential's declared issuer address. */\nexport async function verifyCredentialSignature(\n  credential: PowerhouseVerifiableCredential,\n): Promise<boolean> {\n  try {\n    const recovered = await recoverCredentialSigner(credential);\n    return (\n      recovered.toLowerCase() ===\n      credential.issuer.ethereumAddress.toLowerCase()\n    );\n  } catch {\n    // Malformed proof (bad hex, missing fields) is an invalid signature.\n    return false;\n  }\n}\n\n// The deployed Renown API may omit proof.eip712.domain; it's canonical\n// (version \"1\", the credential's chainId), so reconstruct it before verifying.\nfunction withEip712Domain(\n  credential: PowerhouseVerifiableCredential,\n  chainId: number,\n): PowerhouseVerifiableCredential {\n  const eip712 = credential.proof.eip712 as\n    | Partial<IProof[\"eip712\"]>\n    | undefined;\n  if (eip712?.domain) return credential;\n  return {\n    ...credential,\n    proof: {\n      ...credential.proof,\n      eip712: {\n        domain: { version: \"1\", chainId },\n        types: CREDENTIAL_TYPES,\n        primaryType: \"VerifiableCredential\",\n      },\n    },\n  };\n}\n\nexport interface FetchDelegationCredentialOptions {\n  /** Ethereum address that must have issued the credential. */\n  address: string;\n  /** Chain id the credential must be scoped to. */\n  chainId: number;\n  /** App/client DID the credential must delegate to (credentialSubject.id). */\n  appDid: string;\n  /** Renown service base URL. Defaults to DEFAULT_RENOWN_URL. */\n  baseUrl?: string;\n  /** Switchboard GraphQL endpoint; when reachable, read the reactor directly. */\n  switchboardUrl?: string;\n  /** In-process Switchboard reader; wins over any URL and skips discovery. */\n  switchboardRequest?: SwitchboardRequestFn;\n  /** Probe {baseUrl}/api/switchboard for an endpoint (default true). */\n  discover?: boolean;\n  /** Re-verify the EIP-712 proof signature (default true). */\n  verifySignature?: boolean;\n}\n\n// Fetch + binding/expiry-validate the credential over the Renown REST API.\nasync function fetchDelegationCredentialRest(params: {\n  address: string;\n  chainId: number;\n  appDid: string;\n  baseUrl: string;\n}): Promise<PowerhouseVerifiableCredential | undefined> {\n  const { address, chainId, appDid, baseUrl } = params;\n  const url = new URL(\n    `/api/auth/credential?address=${encodeURIComponent(address)}&chainId=${encodeURIComponent(chainId)}&connectId=${encodeURIComponent(appDid)}&appId=${encodeURIComponent(appDid)}`,\n    baseUrl,\n  );\n  const response = await fetch(url, { method: \"GET\" });\n  if (!response.ok) return undefined;\n  const { credential } = (await response.json()) as {\n    credential?: PowerhouseVerifiableCredential;\n  };\n  if (!credential) return undefined;\n\n  // Binding: delegates to this app DID, issued by this address on this chain\n  // (issuer.id = did:pkh:<networkId>:<chainId>:<address>).\n  const [, , , issuerChainId, issuerAddress] = credential.issuer.id.split(\":\");\n  if (\n    credential.credentialSubject.id !== appDid ||\n    issuerChainId !== String(chainId) ||\n    issuerAddress.toLowerCase() !== address.toLowerCase() ||\n    credential.issuer.ethereumAddress.toLowerCase() !== address.toLowerCase()\n  ) {\n    return undefined;\n  }\n\n  // Reject an expired credential (revocation drops it from the endpoint\n  // instead); a malformed date (NaN) counts as invalid, not non-expiring.\n  if (credential.expirationDate) {\n    const expiresAt = Date.parse(credential.expirationDate);\n    if (Number.isNaN(expiresAt) || expiresAt <= Date.now()) {\n      return undefined;\n    }\n  }\n\n  return credential;\n}\n\n/** True when the credential's EIP-712 proof, on `chainId`, was signed by its\n * issuer address. Binding and expiry are the caller's to check. */\nexport async function verifyDelegationProof(\n  credential: PowerhouseVerifiableCredential,\n  chainId: number,\n): Promise<boolean> {\n  const withDomain = withEip712Domain(credential, chainId);\n  return (\n    withDomain.proof.eip712.domain.chainId === chainId &&\n    (await verifyCredentialSignature(withDomain))\n  );\n}\n\n// Optionally re-verify the EIP-712 proof; returns the credential or undefined.\nasync function finalizeCredential(\n  credential: PowerhouseVerifiableCredential,\n  chainId: number,\n  verifySignature: boolean,\n): Promise<PowerhouseVerifiableCredential | undefined> {\n  if (!verifySignature) return credential;\n  if (!(await verifyDelegationProof(credential, chainId))) {\n    return undefined;\n  }\n  return withEip712Domain(credential, chainId);\n}\n\n// Fetch the Renown delegation credential for (address, chainId) and validate it\n// delegates to `appDid`; returns it, or undefined if absent/invalid. No throw.\nexport async function fetchDelegationCredential(\n  options: FetchDelegationCredentialOptions,\n): Promise<PowerhouseVerifiableCredential | undefined> {\n  const {\n    address,\n    chainId,\n    appDid,\n    switchboardUrl,\n    switchboardRequest,\n    discover = true,\n    verifySignature = true,\n  } = options;\n  const explicitBaseUrl = options.baseUrl;\n  const baseUrl = explicitBaseUrl ?? DEFAULT_RENOWN_URL;\n  try {\n    // A local reader or explicit switchboardUrl is used directly; otherwise\n    // discover from the base URL unless the caller already resolved it.\n    const source: SwitchboardSource | undefined =\n      switchboardRequest ??\n      (switchboardUrl\n        ? switchboardUrl\n        : discover && explicitBaseUrl\n          ? await resolveSwitchboardEndpoint({ baseUrl })\n          : undefined);\n\n    const credential = source\n      ? await new SwitchboardClient(source).getCredential({\n          address,\n          chainId,\n          appDid,\n        })\n      : await fetchDelegationCredentialRest({\n          address,\n          chainId,\n          appDid,\n          baseUrl,\n        });\n\n    if (!credential) return undefined;\n    return await finalizeCredential(credential, chainId, verifySignature);\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface VerifiedAuthCredential {\n  address: string;\n  chainId: number;\n  networkId: string;\n  /** Owner identity: the pkh DID (did:pkh:<net>:<chainId>:<address>). */\n  did: string;\n  /** App/client DID the bearer token was issued by. */\n  appDid: string;\n  credential: PowerhouseVerifiableCredential;\n}\n\nexport interface VerifyAuthCredentialOptions {\n  /** Expected `aud` claim on the bearer token. */\n  audience?: string;\n  /** Renown service base URL. */\n  renownUrl?: string;\n  /** Switchboard GraphQL endpoint; when reachable, read the reactor directly. */\n  switchboardUrl?: string;\n  /** In-process Switchboard reader; wins over any URL and skips discovery. */\n  switchboardRequest?: SwitchboardRequestFn;\n  /** Re-verify the credential's EIP-712 proof (default true). */\n  verifySignature?: boolean;\n}\n\n// Verify a renown bearer token end to end: check the JWT, then fetch+verify the\n// matching credential. Resolves the owner identity, or undefined. No throw.\nexport async function verifyAuthCredential(\n  jwt: string,\n  options: VerifyAuthCredentialOptions = {},\n): Promise<VerifiedAuthCredential | undefined> {\n  const verified = await verifyAuthBearerToken(jwt, {\n    audience: options.audience,\n  });\n  if (!verified) return undefined;\n\n  const { address, chainId, networkId } =\n    verified.verifiableCredential.credentialSubject;\n  const appDid = verified.issuer;\n  const credential = await fetchDelegationCredential({\n    address,\n    chainId,\n    appDid,\n    baseUrl: options.renownUrl,\n    switchboardUrl: options.switchboardUrl,\n    switchboardRequest: options.switchboardRequest,\n    verifySignature: options.verifySignature,\n  });\n  if (!credential) return undefined;\n\n  return {\n    address,\n    chainId,\n    networkId,\n    did: credential.issuer.id,\n    appDid,\n    credential,\n  };\n}\n","import type { ActionSigner } from \"@powerhousedao/shared/document-model\";\nimport { DEFAULT_RENOWN_URL } from \"./constants.js\";\nimport { verifyDelegationProof } from \"./credential.js\";\nimport { SwitchboardClient, type SwitchboardSource } from \"./switchboard.js\";\nimport type { PowerhouseVerifiableCredential } from \"./types.js\";\n\ntype SignerUser = ActionSigner[\"user\"];\n\n/** A signer whose `app.key` and `user` are read on every ask. */\nexport interface RenownOwnSigner {\n  readonly app?: { readonly key: string };\n  readonly user?: SignerUser;\n}\n\nexport interface RenownTrustPolicyOptions {\n  /** Serves the renown read model; without it, Renown's REST API is read. */\n  switchboard?: SwitchboardSource;\n  /** Renown base URL for the REST lookup. Defaults to DEFAULT_RENOWN_URL. */\n  renownUrl?: string;\n  /** This node's signer, read on every ask; its key signing as its current user is accepted without a lookup. Wins over `self`. */\n  ownSigner?: RenownOwnSigner;\n  /**\n   * A snapshot of this node's key and user, for a pooled worker whose signer\n   * cannot cross the thread boundary. Only matches the worker's own key.\n   */\n  self?: { key: string; user: SignerUser };\n  /** How many acceptances are remembered. Defaults to 10000. */\n  maxAccepted?: number;\n  /** How long a refusal is remembered before asking again. Defaults to 60s. */\n  refusalTtlMs?: number;\n}\n\n/** Structurally a reactor `SignatureTrustPolicy`. */\nexport interface RenownTrustPolicy {\n  authorizeSigner(\n    signer: ActionSigner,\n    key: string,\n    documentId: string,\n  ): Promise<boolean>;\n}\n\nconst DEFAULT_MAX_ACCEPTED = 10_000;\nconst DEFAULT_REFUSAL_TTL_MS = 60_000;\n\n/**\n * Accepts a key the user's EIP-712 Renown credential delegates to, ignoring\n * expiry and revocation. Verdicts are cached per (address, key); this node's\n * own key is checked before the cache and never cached.\n */\nexport function createRenownTrustPolicy(\n  options: RenownTrustPolicyOptions = {},\n): RenownTrustPolicy {\n  const maxAccepted = options.maxAccepted ?? DEFAULT_MAX_ACCEPTED;\n  const refusalTtlMs = options.refusalTtlMs ?? DEFAULT_REFUSAL_TTL_MS;\n  const client = options.switchboard\n    ? new SwitchboardClient(options.switchboard)\n    : undefined;\n  const renownUrl = options.renownUrl ?? DEFAULT_RENOWN_URL;\n\n  const accepted = new Set<string>();\n  const refusedUntil = new Map<string, number>();\n  const pending = new Map<string, Promise<boolean>>();\n\n  const issued = (\n    user: SignerUser,\n    key: string,\n  ): Promise<PowerhouseVerifiableCredential[]> =>\n    client\n      ? client.getIssuedCredentials({\n          address: user.address,\n          chainId: user.chainId,\n          appDid: key,\n        })\n      : fetchIssuedCredentialRest(user, key, renownUrl);\n\n  async function lookup(user: SignerUser, key: string): Promise<boolean> {\n    for (const credential of await issued(user, key)) {\n      if (\n        bindsTo(credential, user, key) &&\n        (await verifyDelegationProof(credential, user.chainId))\n      ) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  function remember(entry: string, verdict: boolean): void {\n    if (verdict) {\n      if (accepted.size >= maxAccepted) {\n        const oldest = accepted.values().next().value;\n        if (oldest !== undefined) accepted.delete(oldest);\n      }\n      accepted.add(entry);\n      refusedUntil.delete(entry);\n    } else {\n      refusedUntil.set(entry, Date.now() + refusalTtlMs);\n    }\n  }\n\n  return {\n    authorizeSigner(signer, key) {\n      const user = signer.user as SignerUser | undefined;\n      const self = ownIdentity(options);\n      if (self && isSelf(self, user, key)) {\n        return Promise.resolve(true);\n      }\n      if (!user || !isLookupable(user, key)) {\n        return Promise.resolve(false);\n      }\n\n      const entry = `${user.networkId}|${user.chainId}|${user.address.toLowerCase()}|${key}`;\n      if (accepted.has(entry)) {\n        return Promise.resolve(true);\n      }\n      const until = refusedUntil.get(entry);\n      if (until !== undefined && until > Date.now()) {\n        return Promise.resolve(false);\n      }\n      const inFlight = pending.get(entry);\n      if (inFlight) {\n        return inFlight;\n      }\n\n      const verdict = lookup(user, key).then(\n        (result) => {\n          pending.delete(entry);\n          remember(entry, result);\n          return result;\n        },\n        (error: unknown) => {\n          pending.delete(entry);\n          throw error;\n        },\n      );\n      pending.set(entry, verdict);\n      return verdict;\n    },\n  };\n}\n\nfunction ownIdentity(\n  options: RenownTrustPolicyOptions,\n): RenownTrustPolicyOptions[\"self\"] {\n  if (!options.ownSigner) {\n    return options.self;\n  }\n  const { app, user } = options.ownSigner;\n  return {\n    key: app?.key ?? \"\",\n    user: {\n      address: user?.address ?? \"\",\n      networkId: user?.networkId ?? \"\",\n      chainId: user?.chainId ?? 0,\n    },\n  };\n}\n\nfunction isSelf(\n  self: NonNullable<RenownTrustPolicyOptions[\"self\"]>,\n  user: SignerUser | undefined,\n  key: string,\n): boolean {\n  return (\n    self.key !== \"\" &&\n    key === self.key &&\n    (user?.address ?? \"\").toLowerCase() === self.user.address.toLowerCase() &&\n    (user?.networkId ?? \"\") === self.user.networkId &&\n    (user?.chainId ?? 0) === self.user.chainId\n  );\n}\n\nfunction isLookupable(user: SignerUser, key: string): boolean {\n  return (\n    key.startsWith(\"did:key:\") &&\n    /^0x[0-9a-fA-F]{40}$/.test(user.address) &&\n    user.networkId !== \"\" &&\n    Number.isInteger(user.chainId) &&\n    user.chainId > 0\n  );\n}\n\nfunction bindsTo(\n  credential: PowerhouseVerifiableCredential,\n  user: SignerUser,\n  key: string,\n): boolean {\n  const address = user.address.toLowerCase();\n  const issuer = credential.issuer.id.split(\":\");\n  if (issuer.length !== 5) return false;\n  const [scheme, method, networkId, chainId, issuerAddress] = issuer;\n  return (\n    credential.credentialSubject.id === key &&\n    scheme === \"did\" &&\n    method === \"pkh\" &&\n    networkId === user.networkId &&\n    chainId === String(user.chainId) &&\n    issuerAddress.toLowerCase() === address &&\n    credential.issuer.ethereumAddress.toLowerCase() === address\n  );\n}\n\n// Renown's REST endpoint answers with the active credential only.\nasync function fetchIssuedCredentialRest(\n  user: SignerUser,\n  key: string,\n  renownUrl: string,\n): Promise<PowerhouseVerifiableCredential[]> {\n  const url = new URL(\"/api/auth/credential\", renownUrl);\n  url.searchParams.set(\"address\", user.address);\n  url.searchParams.set(\"chainId\", String(user.chainId));\n  url.searchParams.set(\"connectId\", key);\n  url.searchParams.set(\"appId\", key);\n  const response = await fetch(url, { method: \"GET\" });\n  if (response.status === 404) {\n    return [];\n  }\n  if (!response.ok) {\n    throw new Error(`Renown credential lookup failed: ${response.status}`);\n  }\n  const { credential } = (await response.json()) as {\n    credential?: PowerhouseVerifiableCredential | null;\n  };\n  return credential ? [credential] : [];\n}\n"],"mappings":";;;;;AAWA,MAAM,+BAA+B;AASrC,eAAsB,2BACpB,SAC6B;CAC7B,MAAM,EAAE,gBAAgB,SAAS,cAAc;CAE/C,IAAI,gBACF,OAAO;CAGT,IAAI,CAAC,SACH;CAGF,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,iBACR,WAAW,MAAM,GACvB,aAAa,4BACf;CAEA,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,oBAAoB,OAAO;EAC/C,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,CAAC,SAAS,IACZ;EAGF,QAAO,MADa,SAAS,KAAK,EAAA,CACtB,YAAY,KAAA;CAC1B,QAAQ;EAGN;CACF,UAAU;EACR,aAAa,OAAO;CACtB;AACF;;;;;AC5CA,IAAa,0BAAb,MAAa,gCAAgC,MAAM;CACjD,cAAc;EACZ,MACE,uFACF;EACA,KAAK,OAAO;CACd;;CAGA,OAAO,GAAG,OAAkD;EAC1D,OACE,iBAAiB,2BAChB,iBAAiB,SAAS,MAAM,SAAS;CAE9C;AACF;AAIA,SAAS,YAAY,SAAyB;CAC5C,OAAO,UAAU,QAAQ,YAAY;AACvC;AAuCA,MAAM,oBAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BxC,MAAM,cAA4B;;;;;;;;;;;;AAalC,MAAM,iCAA+C;;;;;;;;;;;;;AAcrD,MAAM,2BAAyC;;;;;;;;;;;;;AAgB/C,MAAM,kCAAgD;;;;;;;;;;AAYtD,SAAS,sBAAsB,OAAyB;CACtD,OACE,iBAAiB,SACjB,kDAAkD,KAAK,MAAM,OAAO;AAExE;AAIA,MAAM,4BAA0C;;;;;;;;;;;;;;;AAgBhD,MAAM,0BAAwC;;;;;;;;;;;;;;;;;AAkB9C,MAAM,6BAA2C;;;;;;;;;;;;;AAsBjD,SAAS,UAAU,MAGjB;CACA,OAAO,WAAW,OACd;EAAE,OAAO,KAAK;EAAO,QAAQ,CAAC;CAAE,IAChC,EACE,QAAQ;EAAE,WAAW,KAAK;EAAW,WAAW,KAAK;CAAU,EACjE;AACN;AAEA,MAAM,6BAA6B;AACnC,MAAM,uBAAuB;AAI7B,SAAS,OAAO,MAAsB;CACpC,OAAO,SAAS,KAAK;AACvB;AAOA,SAAS,qBACP,OACA,OACA,GAAG,OACM;CACT,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACrE,IAAI,IAAI,OAAO,sBAAsB,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO,GAChE,OAAO;CAET,OACE,CAAC,QAAQ,SAAS,mBAAmB,KACrC,MAAM,MAAM,SACV,IAAI,OAAO,gBAAgB,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO,CACzD;AAEJ;AAGA,SAAS,kBACP,KACgC;CAEhC,MAAM,SAAS,KAAK,MAAM,IAAI,iBAAiB;CAK/C,OAAO;EACL,YAAY,IAAI;EAChB,MAAM,IAAI;EACV,IAAI,IAAI;EACR,QAAQ;GACN,IAAI,IAAI;GACR,iBAAiB,IAAI;EACvB;EACA,mBAAmB;GACjB,IAAI,IAAI,uBAAuB;GAC/B,KAAK,IAAI;EACX;EACA,kBAAkB;GAChB,IAAI,IAAI;GACR,MAAM,IAAI;EACZ;EACA,GAAI,IAAI,qBACJ,EACE,kBAAkB;GAChB,IAAI,IAAI;GACR,MAAM,IAAI,wBAAwB;EACpC,EACF,IACA,CAAC;EACL,cAAc,IAAI;EAClB,gBAAgB,IAAI,kBAAkB;EACtC,OAAO;GACL,MAAM,IAAI;GACV,SAAS,IAAI;GACb,oBAAoB,IAAI;GACxB,cAAc,IAAI;GAClB,YAAY,IAAI;GAChB,iBAAiB,IAAI;GACrB,QAAQ;IACN;IACA,OAAO;IACP,aAAa;GACf;EACF;CACF;AACF;AAGA,SAAS,cAAc,UAAsC;CAC3D,OAAO,SAAS,MAAM,GAAG,CAAC,CAAC;AAC7B;AAGA,SAAS,iBAAiB,UAAsC;CAC9D,OAAO,SAAS,MAAM,GAAG,CAAC,CAAC;AAC7B;AAIA,SAASA,UACP,KACA,SACA,SACA,QACS;CACT,OAAO,CAAC,IAAI,WAAW,SAAS,KAAK,SAAS,SAAS,MAAM;AAC/D;AAEA,SAAS,SACP,KACA,SACA,SACA,QACS;CACT,MAAM,WAAW,QAAQ,YAAY;CACrC,OACE,IAAI,wBAAwB,UAC5B,cAAc,IAAI,QAAQ,MAAM,OAAO,OAAO,KAC9C,iBAAiB,IAAI,QAAQ,CAAC,EAAE,YAAY,MAAM,YAClD,IAAI,sBAAsB,YAAY,MAAM;AAEhD;AAqBA,IAAa,oBAAb,MAA+B;CAC7B;CACA;CAEA,gBAAgB;CAEhB,YAAY,QAA2B;EACrC,IAAI,OAAO,WAAW,UAAU;GAC9B,KAAK,YAAY;GACjB,KAAK,cAAc,OAAO,WAAW,YACnC,KAAK,MAAM,QAAQ,OAAO,WAAW,SAAS,KAAK;EACvD,OACE,KAAK,aAAa;CAEtB;;CAGA,IAAI,WAA+B;EACjC,OAAO,KAAK;CACd;CAEA,MAAM,MACJ,UACA,OACA,WACA,OACkB;EAClB,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,GAAI,QAAQ,EAAE,eAAe,UAAU,QAAQ,IAAI,CAAC;GACtD;GACA,MAAM,KAAK,UAAU;IAAE;IAAO;GAAU,CAAC;EAC3C,CAAC;EAID,MAAM,OAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;EAGzD,IAAI,MAAM,QAAQ,QAChB,MAAM,IAAI,MAAM,KAAK,OAAO,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;EAE9D,IAAI,CAAC,SAAS,MAAM,CAAC,MACnB,MAAM,IAAI,MAAM,+BAA+B,SAAS,QAAQ;EAGlE,OAAO,KAAK;CACd;CAEA,MAAM,SACJ,OACA,WACA,OACY;EACZ,MAAM,OAAO,OAAO,QAChB,KAAK,WAAW,OAAO,WAAW,EAAE,MAAM,CAAC,IAC3C,KAAK,WAAW,OAAO,SAAS;EACpC,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO;CACT;CAIA,MAAM,cAAc,QAIoC;EACtD,MAAM,EAAE,SAAS,SAAS,WAAW;EACrC,MAAM,EAAE,sBAAsB,MAAM,KAAK,SAEtC,mBAAmB,EACpB,OAAO;GACL,SAAS,YAAY,OAAO;GAC5B,YAAY,QAAQ,YAAY;GAChC,KAAK;GACL,gBAAgB;EAClB,EACF,CAAC;EAED,MAAM,MAAM,KAAK,IAAI;EAUrB,MAAM,aATa,kBAChB,QAAQ,QAAQA,UAAQ,KAAK,SAAS,SAAS,MAAM,CAAC,CAAC,CACvD,QAAQ,QAAQ;GACf,IAAI,CAAC,IAAI,gBAAgB,OAAO;GAChC,MAAM,YAAY,KAAK,MAAM,IAAI,cAAc;GAC/C,OAAO,CAAC,OAAO,MAAM,SAAS,KAAK,YAAY;EACjD,CAAC,CAAC,CACD,MAAM,GAAG,MAAM,KAAK,MAAM,EAAE,YAAY,IAAI,KAAK,MAAM,EAAE,YAAY,CAE5C,CAAC,CAAC,GAAG,CAAC;EAClC,OAAO,aAAa,kBAAkB,UAAU,IAAI,KAAA;CACtD;CAIA,MAAM,qBAAqB,QAImB;EAC5C,MAAM,EAAE,SAAS,SAAS,WAAW;EACrC,MAAM,EAAE,sBAAsB,MAAM,KAAK,SAEtC,mBAAmB,EACpB,OAAO;GACL,SAAS,YAAY,OAAO;GAC5B,YAAY,QAAQ,YAAY;GAChC,KAAK;GACL,gBAAgB;EAClB,EACF,CAAC;EAED,MAAM,cAAgD,CAAC;EACvD,KAAK,MAAM,OAAO,mBAAmB;GACnC,IAAI,CAAC,SAAS,KAAK,SAAS,SAAS,MAAM,GAAG;GAC9C,IAAI;IACF,YAAY,KAAK,kBAAkB,GAAG,CAAC;GACzC,QAAQ,CAER;EACF;EACA,OAAO;CACT;CAGA,MAAM,oBACJ,SACoC;EACpC,MAAM,EAAE,gBAAgB,MAAM,KAAK,SAEhC,aAAa,EACd,OAAO;GACL,SAAS,YAAY,OAAO;GAC5B,cAAc,CAAC,QAAQ,YAAY,CAAC;EACtC,EACF,CAAC;EAED,MAAM,OAAO,YAAY,GAAG,CAAC;EAC7B,IAAI,CAAC,MAAM,OAAO,KAAA;EAClB,OAAO;GACL,YAAY,KAAK;GACjB,UAAU,KAAK;GACf,YAAY,KAAK;GACjB,WAAW,KAAK;GAChB,WAAW,KAAK;GAChB,WAAW,KAAK;EAClB;CACF;CAIA,MAAM,oBACJ,cACA,kBACA,OACiB;EACjB,MAAM,EAAE,wBAAwB,MAAM,KAAK,SAGzC,gCACA;GAAE;GAAc;EAAiB,GACjC,KACF;EACA,OAAO,oBAAoB;CAC7B;CAIA,MAAM,eACJ,oBACA,SACA,OACiB;EACjB,MAAM,YAAY;GAAE;GAAoB;EAAQ;EAChD,IAAI,CAAC,KAAK,eACR,IAAI;GACF,MAAM,EAAE,mBAAmB,MAAM,KAAK,SAEnC,0BAA0B,WAAW,KAAK;GAC7C,OAAO,eAAe;EACxB,SAAS,OAAO;GACd,IAAI,CAAC,sBAAsB,KAAK,GAAG,MAAM;GACzC,KAAK,gBAAgB;EACvB;EAEF,MAAM,EAAE,mBAAmB,MAAM,KAAK,SAEnC,iCAAiC,WAAW,KAAK;EACpD,OAAO,eAAe;CACxB;CAIA,MAAM,gBACJ,YACA,kBACiB;EACjB,MAAM,QAAiC;GACrC,IAAI,WAAW;GACf,SAAS,WAAW;GACpB,MAAM,WAAW;GACjB,QAAQ;IACN,IAAI,WAAW,OAAO;IACtB,iBAAiB,WAAW,OAAO;GACrC;GACA,mBAAmB;IACjB,IAAI,WAAW,kBAAkB;IACjC,KAAK,WAAW,kBAAkB;GACpC;GACA,kBAAkB;IAChB,IAAI,WAAW,iBAAiB;IAChC,MAAM,WAAW,iBAAiB;GACpC;GACA,cAAc,WAAW;GACzB,gBAAgB,WAAW,kBAAkB,KAAA;GAC7C,OAAO;IACL,MAAM,WAAW,MAAM;IACvB,SAAS,WAAW,MAAM;IAC1B,oBAAoB,WAAW,MAAM;IACrC,cAAc,WAAW,MAAM;IAC/B,YAAY,WAAW,MAAM;IAC7B,iBAAiB,WAAW,MAAM;IAClC,QAAQ;KACN,QAAQ;MACN,SAAS,WAAW,MAAM,OAAO,OAAO;MACxC,SAAS,WAAW,MAAM,OAAO,OAAO;KAC1C;KACA,aAAa,WAAW,MAAM,OAAO;IACvC;GACF;EACF;EACA,IAAI;GACF,MAAM,EAAE,2BAA2B,MAAM,KAAK,SAE3C,2BAA2B,EAAE,MAAM,CAAC;GACvC,OAAO;EACT,SAAS,OAAO;GAGd,IACE,CAAC,qBACC,OACA,0BACA,4BACF,GAEA,MAAM;GAER,MAAM,aAAa,MAAM,KAAK,oBAC5B,4BACA,gBACF;GACA,MAAM,KAAK,eAAe,YAAY,CAAC,aAAa,QAAQ,KAAK,CAAC,CAAC;GACnE,OAAO;EACT;CACF;CAMA,MAAM,kBACJ,SACA,SACA,MACiB;EACjB,MAAM,EAAE,OAAO,WAAW,UAAU,IAAI;EACxC,IAAI;GACF,MAAM,EAAE,yBAAyB,MAAM,KAAK,SAG1C,yBACA;IACE;IACA,UAAU,QAAQ;IAClB,WAAW,QAAQ;IACnB,GAAG;GACL,GACA,KACF;GACA,OAAO;EACT,SAAS,OAAO;GAGd,IAAI,CAAC,qBAAqB,OAAO,sBAAsB,GAAG,MAAM;GAChE,OAAO,KAAK,yBAAyB,SAAS,SAAS,KAAK;EAC9D;CACF;CAEA,MAAM,yBACJ,SACA,SACA,OACiB;EACjB,MAAM,UAAoB,CAAC;EAC3B,IAAI,QAAQ,YAAY,MACtB,QAAQ,KACN,aAAa,gBAAgB,EAAE,UAAU,QAAQ,SAAS,CAAC,CAC7D;EAEF,IAAI,QAAQ,aAAa,MACvB,QAAQ,KACN,aAAa,kBAAkB,EAAE,WAAW,QAAQ,UAAU,CAAC,CACjE;EAGF,MAAM,WAAW,MAAM,KAAK,oBAAoB,OAAO;EACvD,IAAI,UAAU;GACZ,IAAI,QAAQ,QACV,MAAM,KAAK,eAAe,SAAS,YAAY,SAAS,KAAK;GAC/D,OAAO,SAAS;EAClB;EAEA,MAAM,aAAa,MAAM,KAAK,oBAC5B,sBACA,KAAA,GACA,KACF;EACA,MAAM,KAAK,eACT,YACA,CAAC,aAAa,mBAAmB,EAAE,YAAY,QAAQ,CAAC,GAAG,GAAG,OAAO,GACrE,KACF;EACA,OAAO;CACT;CAKA,MAAM,iBACJ,cACA,MACe;EACf,MAAM,EAAE,OAAO,WAAW,UAAU,IAAI;EACxC,IAAI;GACF,MAAM,KAAK,SACT,4BACA;IAAE;IAAc,GAAG;GAAO,GAC1B,KACF;EACF,SAAS,OAAO;GAGd,IAAI,CAAC,qBAAqB,OAAO,yBAAyB,GAAG,MAAM;GACnE,MAAM,KAAK,wBAAwB,cAAc,KAAK;EACxD;CACF;CAEA,MAAM,wBACJ,cACA,OACe;EAEf,MAAM,EAAE,sBAAsB,MAAM,KAAK,SAEtC,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,MAAM,EAAE,GAAG,KAAK;EACjE,MAAM,cAAc,kBACjB,QAAQ,QAAQ,IAAI,iBAAiB,YAAY,CAAC,CAClD,KAAK,QAAQ,IAAI,UAAU;EAC9B,IAAI,CAAC,YAAY,QACf,MAAM,IAAI,MAAM,yBAAyB,cAAc;EAEzD,MAAM,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;EACzC,KAAK,MAAM,cAAc,aACvB,MAAM,KAAK,eACT,YACA,CAAC,aAAa,UAAU;GAAE;GAAW,QAAQ;EAAK,CAAC,CAAC,GACpD,KACF;CAEJ;CAIA,kBAAkC,SAChC,KAAK,oBAAoB,KAAK,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;AAChE;;;;ACjrBA,eAAsB,uBACpB,QACyC;CACzC,MAAM,EACJ,eACA,SACA,SACA,KACA,OACA,gBAAgB,MACd;CAEJ,MAAM,WAAW,WAAW,0BAA0B,GAAG,QAAQ,GAAG,QAAQ,YAAY;CACxF,MAAM,eAAe,YAAY,WAAW,OAAO,WAAW;CAC9D,MAAM,sBAAM,IAAI,KAAK;CACrB,MAAM,iBAAiB,IAAI,KACzB,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK,KAAK,GACjD;CAEA,MAAM,UAA6B;EACjC,YAAY,CAAC,wCAAwC;EACrD,MAAM,CAAC,wBAAwB,kBAAkB;EACjD,IAAI;EACJ,QAAQ;GAAE,IAAI;GAAU,iBAAiB;EAAQ;EACjD,mBAAmB;GAAE,IAAI;GAAO;EAAI;EACpC,kBAAkB;GAChB,IAAI;GACJ,MAAM;EACR;EACA,cAAc,IAAI,YAAY;EAC9B,gBAAgB,eAAe,YAAY;CAC7C;CAEA,MAAM,SAA2B;EAAE,SAAS;EAAK;CAAQ;CAIzD,MAAM,EAAE,cAAc,GAAG,cAAc;CAEvC,MAAM,YAAY,MAAM,cAAc;EACpC;EACA,OAAO;EACP,aAAa;EACb;CACF,CAAC;CAED,OAAO;EACL,GAAG;EACH,OAAO;GACL,MAAM;GACN,SAAS,QAAQ;GACjB,oBAAoB;GACpB,cAAc;GACd,YAAY;GACZ,iBAAiB;GACjB,QAAQ;IACN;IACA,OAAO;IACP,aAAa;GACf;EACF;CACF;AACF;;AAGA,eAAsB,wBACpB,YACc;CACd,MAAM,EAAE,OAAO,GAAG,YAAY;CAG9B,MAAM,EAAE,cAAc,GAAG,UAAU;CAEnC,OAAO,wBAAwB;EAC7B,QAAQ,MAAM,OAAO;EACrB;EACA,aAAa;EACb;EACA,WAAW,MAAM;CACnB,CAAkD;AACpD;;AAGA,eAAsB,0BACpB,YACkB;CAClB,IAAI;EAEF,QACE,MAFsB,wBAAwB,UAAU,EAAA,CAE9C,YAAY,MACtB,WAAW,OAAO,gBAAgB,YAAY;CAElD,QAAQ;EAEN,OAAO;CACT;AACF;AAIA,SAAS,iBACP,YACA,SACgC;CAIhC,IAHe,WAAW,MAAM,QAGpB,QAAQ,OAAO;CAC3B,OAAO;EACL,GAAG;EACH,OAAO;GACL,GAAG,WAAW;GACd,QAAQ;IACN,QAAQ;KAAE,SAAS;KAAK;IAAQ;IAChC,OAAO;IACP,aAAa;GACf;EACF;CACF;AACF;AAsBA,eAAe,8BAA8B,QAKW;CACtD,MAAM,EAAE,SAAS,SAAS,QAAQ,YAAY;CAC9C,MAAM,MAAM,IAAI,IACd,gCAAgC,mBAAmB,OAAO,EAAE,WAAW,mBAAmB,OAAO,EAAE,aAAa,mBAAmB,MAAM,EAAE,SAAS,mBAAmB,MAAM,KAC7K,OACF;CACA,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,CAAC;CACnD,IAAI,CAAC,SAAS,IAAI,OAAO,KAAA;CACzB,MAAM,EAAE,eAAgB,MAAM,SAAS,KAAK;CAG5C,IAAI,CAAC,YAAY,OAAO,KAAA;CAIxB,MAAM,OAAO,eAAe,iBAAiB,WAAW,OAAO,GAAG,MAAM,GAAG;CAC3E,IACE,WAAW,kBAAkB,OAAO,UACpC,kBAAkB,OAAO,OAAO,KAChC,cAAc,YAAY,MAAM,QAAQ,YAAY,KACpD,WAAW,OAAO,gBAAgB,YAAY,MAAM,QAAQ,YAAY,GAExE;CAKF,IAAI,WAAW,gBAAgB;EAC7B,MAAM,YAAY,KAAK,MAAM,WAAW,cAAc;EACtD,IAAI,OAAO,MAAM,SAAS,KAAK,aAAa,KAAK,IAAI,GACnD;CAEJ;CAEA,OAAO;AACT;;;AAIA,eAAsB,sBACpB,YACA,SACkB;CAClB,MAAM,aAAa,iBAAiB,YAAY,OAAO;CACvD,OACE,WAAW,MAAM,OAAO,OAAO,YAAY,WAC1C,MAAM,0BAA0B,UAAU;AAE/C;AAGA,eAAe,mBACb,YACA,SACA,iBACqD;CACrD,IAAI,CAAC,iBAAiB,OAAO;CAC7B,IAAI,CAAE,MAAM,sBAAsB,YAAY,OAAO,GACnD;CAEF,OAAO,iBAAiB,YAAY,OAAO;AAC7C;AAIA,eAAsB,0BACpB,SACqD;CACrD,MAAM,EACJ,SACA,SACA,QACA,gBACA,oBACA,WAAW,MACX,kBAAkB,SAChB;CACJ,MAAM,kBAAkB,QAAQ;CAChC,MAAM,UAAU,mBAAA;CAChB,IAAI;EAGF,MAAM,SACJ,uBACC,iBACG,iBACA,YAAY,kBACV,MAAM,2BAA2B,EAAE,QAAQ,CAAC,IAC5C,KAAA;EAER,MAAM,aAAa,SACf,MAAM,IAAI,kBAAkB,MAAM,CAAC,CAAC,cAAc;GAChD;GACA;GACA;EACF,CAAC,IACD,MAAM,8BAA8B;GAClC;GACA;GACA;GACA;EACF,CAAC;EAEL,IAAI,CAAC,YAAY,OAAO,KAAA;EACxB,OAAO,MAAM,mBAAmB,YAAY,SAAS,eAAe;CACtE,QAAQ;EACN;CACF;AACF;AA4BA,eAAsB,qBACpB,KACA,UAAuC,CAAC,GACK;CAC7C,MAAM,WAAW,MAAM,sBAAsB,KAAK,EAChD,UAAU,QAAQ,SACpB,CAAC;CACD,IAAI,CAAC,UAAU,OAAO,KAAA;CAEtB,MAAM,EAAE,SAAS,SAAS,cACxB,SAAS,qBAAqB;CAChC,MAAM,SAAS,SAAS;CACxB,MAAM,aAAa,MAAM,0BAA0B;EACjD;EACA;EACA;EACA,SAAS,QAAQ;EACjB,gBAAgB,QAAQ;EACxB,oBAAoB,QAAQ;EAC5B,iBAAiB,QAAQ;CAC3B,CAAC;CACD,IAAI,CAAC,YAAY,OAAO,KAAA;CAExB,OAAO;EACL;EACA;EACA;EACA,KAAK,WAAW,OAAO;EACvB;EACA;CACF;AACF;;;AChVA,MAAM,uBAAuB;AAC7B,MAAM,yBAAyB;;;;;;AAO/B,SAAgB,wBACd,UAAoC,CAAC,GAClB;CACnB,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,eAAe,QAAQ,gBAAgB;CAC7C,MAAM,SAAS,QAAQ,cACnB,IAAI,kBAAkB,QAAQ,WAAW,IACzC,KAAA;CACJ,MAAM,YAAY,QAAQ,aAAA;CAE1B,MAAM,2BAAW,IAAI,IAAY;CACjC,MAAM,+BAAe,IAAI,IAAoB;CAC7C,MAAM,0BAAU,IAAI,IAA8B;CAElD,MAAM,UACJ,MACA,QAEA,SACI,OAAO,qBAAqB;EAC1B,SAAS,KAAK;EACd,SAAS,KAAK;EACd,QAAQ;CACV,CAAC,IACD,0BAA0B,MAAM,KAAK,SAAS;CAEpD,eAAe,OAAO,MAAkB,KAA+B;EACrE,KAAK,MAAM,cAAc,MAAM,OAAO,MAAM,GAAG,GAC7C,IACE,QAAQ,YAAY,MAAM,GAAG,KAC5B,MAAM,sBAAsB,YAAY,KAAK,OAAO,GAErD,OAAO;EAGX,OAAO;CACT;CAEA,SAAS,SAAS,OAAe,SAAwB;EACvD,IAAI,SAAS;GACX,IAAI,SAAS,QAAQ,aAAa;IAChC,MAAM,SAAS,SAAS,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAW,KAAA,GAAW,SAAS,OAAO,MAAM;GAClD;GACA,SAAS,IAAI,KAAK;GAClB,aAAa,OAAO,KAAK;EAC3B,OACE,aAAa,IAAI,OAAO,KAAK,IAAI,IAAI,YAAY;CAErD;CAEA,OAAO,EACL,gBAAgB,QAAQ,KAAK;EAC3B,MAAM,OAAO,OAAO;EACpB,MAAM,OAAO,YAAY,OAAO;EAChC,IAAI,QAAQ,OAAO,MAAM,MAAM,GAAG,GAChC,OAAO,QAAQ,QAAQ,IAAI;EAE7B,IAAI,CAAC,QAAQ,CAAC,aAAa,MAAM,GAAG,GAClC,OAAO,QAAQ,QAAQ,KAAK;EAG9B,MAAM,QAAQ,GAAG,KAAK,UAAU,GAAG,KAAK,QAAQ,GAAG,KAAK,QAAQ,YAAY,EAAE,GAAG;EACjF,IAAI,SAAS,IAAI,KAAK,GACpB,OAAO,QAAQ,QAAQ,IAAI;EAE7B,MAAM,QAAQ,aAAa,IAAI,KAAK;EACpC,IAAI,UAAU,KAAA,KAAa,QAAQ,KAAK,IAAI,GAC1C,OAAO,QAAQ,QAAQ,KAAK;EAE9B,MAAM,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,UACF,OAAO;EAGT,MAAM,UAAU,OAAO,MAAM,GAAG,CAAC,CAAC,MAC/B,WAAW;GACV,QAAQ,OAAO,KAAK;GACpB,SAAS,OAAO,MAAM;GACtB,OAAO;EACT,IACC,UAAmB;GAClB,QAAQ,OAAO,KAAK;GACpB,MAAM;EACR,CACF;EACA,QAAQ,IAAI,OAAO,OAAO;EAC1B,OAAO;CACT,EACF;AACF;AAEA,SAAS,YACP,SACkC;CAClC,IAAI,CAAC,QAAQ,WACX,OAAO,QAAQ;CAEjB,MAAM,EAAE,KAAK,SAAS,QAAQ;CAC9B,OAAO;EACL,KAAK,KAAK,OAAO;EACjB,MAAM;GACJ,SAAS,MAAM,WAAW;GAC1B,WAAW,MAAM,aAAa;GAC9B,SAAS,MAAM,WAAW;EAC5B;CACF;AACF;AAEA,SAAS,OACP,MACA,MACA,KACS;CACT,OACE,KAAK,QAAQ,MACb,QAAQ,KAAK,QACZ,MAAM,WAAW,GAAA,CAAI,YAAY,MAAM,KAAK,KAAK,QAAQ,YAAY,MACrE,MAAM,aAAa,QAAQ,KAAK,KAAK,cACrC,MAAM,WAAW,OAAO,KAAK,KAAK;AAEvC;AAEA,SAAS,aAAa,MAAkB,KAAsB;CAC5D,OACE,IAAI,WAAW,UAAU,KACzB,sBAAsB,KAAK,KAAK,OAAO,KACvC,KAAK,cAAc,MACnB,OAAO,UAAU,KAAK,OAAO,KAC7B,KAAK,UAAU;AAEnB;AAEA,SAAS,QACP,YACA,MACA,KACS;CACT,MAAM,UAAU,KAAK,QAAQ,YAAY;CACzC,MAAM,SAAS,WAAW,OAAO,GAAG,MAAM,GAAG;CAC7C,IAAI,OAAO,WAAW,GAAG,OAAO;CAChC,MAAM,CAAC,QAAQ,QAAQ,WAAW,SAAS,iBAAiB;CAC5D,OACE,WAAW,kBAAkB,OAAO,OACpC,WAAW,SACX,WAAW,SACX,cAAc,KAAK,aACnB,YAAY,OAAO,KAAK,OAAO,KAC/B,cAAc,YAAY,MAAM,WAChC,WAAW,OAAO,gBAAgB,YAAY,MAAM;AAExD;AAGA,eAAe,0BACb,MACA,KACA,WAC2C;CAC3C,MAAM,MAAM,IAAI,IAAI,wBAAwB,SAAS;CACrD,IAAI,aAAa,IAAI,WAAW,KAAK,OAAO;CAC5C,IAAI,aAAa,IAAI,WAAW,OAAO,KAAK,OAAO,CAAC;CACpD,IAAI,aAAa,IAAI,aAAa,GAAG;CACrC,IAAI,aAAa,IAAI,SAAS,GAAG;CACjC,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,CAAC;CACnD,IAAI,SAAS,WAAW,KACtB,OAAO,CAAC;CAEV,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,oCAAoC,SAAS,QAAQ;CAEvE,MAAM,EAAE,eAAgB,MAAM,SAAS,KAAK;CAG5C,OAAO,aAAa,CAAC,UAAU,IAAI,CAAC;AACtC"}

package/dist/trust.d.ts

@@ -0,0 +1,3 @@
+import { i as createRenownTrustPolicy, n as RenownTrustPolicy, o as resolveSwitchboardEndpoint, r as RenownTrustPolicyOptions, t as RenownOwnSigner } from "./signer-trust-FmbMTn39.js";
+export { RenownOwnSigner, RenownTrustPolicy, RenownTrustPolicyOptions, createRenownTrustPolicy, resolveSwitchboardEndpoint };
+export {};

package/dist/trust.js

@@ -0,0 +1,2 @@
+import { t as createRenownTrustPolicy, u as resolveSwitchboardEndpoint } from "./signer-trust-H1rNzUcd.js";
+export { createRenownTrustPolicy, resolveSwitchboardEndpoint };

package/dist/{types-C-hJrsQg.d.ts → types-7xgrEnx7.d.ts}

@@ -1,6 +1,5 @@
-import { at as SignCredentialTypedData } from "./types-BGQKPoUr.js";
+import { at as SignCredentialTypedData } from "./types-Ceiz2dkk.js";
 import { ComponentType, ReactNode } from "react";
-
 //#region src/wallet/types.d.ts
 declare const LoginMethod: {
   readonly WALLET: "wallet";
@@ -56,4 +55,5 @@ type WalletAdapterFactory<Config = unknown> = (config: Config) => WalletAdapterI
 type WalletAdapterProvider<Config = unknown> = (config: Config) => WalletAdapterDescriptor;
 //#endregion
 export { WalletAdapterImpl as a, WalletController as c, WalletThemeColors as d, normalizeWalletTheme as f, WalletAdapterFactory as i, WalletSession as l, WalletAdapter as n, WalletAdapterMeta as o, WalletAdapterDescriptor as r, WalletAdapterProvider as s, LoginMethod as t, WalletTheme as u };
-//# sourceMappingURL=types-C-hJrsQg.d.ts.map
+export {};
+//# sourceMappingURL=types-7xgrEnx7.d.ts.map

package/dist/types-7xgrEnx7.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-7xgrEnx7.d.ts","names":[],"sources":["../src/wallet/types.ts"],"mappings":";;;cAKa;WACX;WACA;WACA;WACA;;KAGU,sBAAsB,0BAA0B;UAI3C;EACf;EACA;;KAIU;EAGL;IAA2B;iBAGlB,qBAAqB,OAAO;EAC1C;EACA;EACA;;UAYe;EACf;EACA;EACA,eAAe;EAGf;;UAIe;EACf,QAAQ,SAAS,cAAc,QAAQ;EACvC,cAAc;EACd,cAAc;EAGd,WACE,WAAW,SAAS;;UAMP;EACf;EAGA;EAGA,kBAAkB;;UAIH;EAGf,UAAU;IAAgB,UAAU;IAAW,QAAQ;;EAEvD,qBAAqB;;UAIN,sBAAsB;EACrC,MAAM;;UAKS;EACf,MAAM;EACN,YAAY,QAAQ;;KAGV,qBAAqB,qBAC/B,QAAQ,WACL;KAEO,sBAAsB,qBAChC,QAAQ,WACL"}

package/dist/{types-BGQKPoUr.d.ts → types-Ceiz2dkk.d.ts}

@@ -1,5 +1,4 @@
 import { Action, ISigner as ISigner$1, User, UserActionSigner as UserActionSigner$1 } from "@powerhousedao/shared/document-model";
-
 //#region src/constants.d.ts
 declare const DEFAULT_RENOWN_URL = "https://www.renown.id";
 declare const DEFAULT_RENOWN_NETWORK_ID = "eip155";
@@ -126,9 +125,23 @@ declare class MissingSwitchboardError extends Error {
   /** `instanceof` fails across duplicate SDK copies, so match by name too. */
   static is(error: unknown): error is MissingSwitchboardError;
 }
+/** How a caller authorizes a Renown write: a login (bearer) token for the
+ * address, or that address's `personal_sign` over the canonical message
+ * (`revokeMessage` / `profileMessage`) with the ISO-8601 timestamp it signed. */
+type RenownWriteAuth = {
+  token: string;
+} | {
+  signature: string;
+  timestamp: string;
+};
+/** Per-request options: `token` is a Renown bearer token that authenticates
+ * the request (sent as `Authorization: Bearer <token>` over HTTP). */
+interface SwitchboardRequestOptions {
+  token?: string;
+}
 /** Runs a GraphQL document against a Switchboard and resolves its `data`;
  * throws on transport or GraphQL errors. */
-type SwitchboardRequestFn = (query: string, variables: Record<string, unknown>) => Promise<unknown>;
+type SwitchboardRequestFn = (query: string, variables: Record<string, unknown>, options?: SwitchboardRequestOptions) => Promise<unknown>;
 /** Where a SwitchboardClient reads from: an HTTP endpoint or a local executor. */
 type SwitchboardSource = string | SwitchboardRequestFn;
 declare class SwitchboardClient {
@@ -141,15 +154,20 @@ declare class SwitchboardClient {
     chainId: number;
     appDid: string;
   }): Promise<PowerhouseVerifiableCredential | undefined>;
+  getIssuedCredentials(params: {
+    address: string;
+    chainId: number;
+    appDid: string;
+  }): Promise<PowerhouseVerifiableCredential[]>;
   getProfileByAddress(address: string): Promise<RenownProfile | undefined>;
-  createEmptyDocument(documentType: string, parentIdentifier?: string): Promise<string>;
-  mutateDocument(documentIdentifier: string, actions: Action[]): Promise<string>;
+  createEmptyDocument(documentType: string, parentIdentifier?: string, token?: string): Promise<string>;
+  mutateDocument(documentIdentifier: string, actions: Action[], token?: string): Promise<string>;
   issueCredential(credential: PowerhouseVerifiableCredential, parentIdentifier?: string): Promise<string>;
-  findOrCreateUser(address: string, profile?: {
+  upsertUserProfile(address: string, profile: {
     username?: string;
     userImage?: string;
-  }): Promise<string>;
-  revokeCredential(documentId: string, reason?: string): Promise<void>;
+  }, auth: RenownWriteAuth): Promise<string>;
+  revokeCredential(credentialId: string, auth: RenownWriteAuth): Promise<void>;
   profileFetcher: ProfileFetcher;
 }
 //#endregion
@@ -231,6 +249,9 @@ interface FetchDelegationCredentialOptions {
   /** Re-verify the EIP-712 proof signature (default true). */
   verifySignature?: boolean;
 }
+/** True when the credential's EIP-712 proof, on `chainId`, was signed by its
+ * issuer address. Binding and expiry are the caller's to check. */
+declare function verifyDelegationProof(credential: PowerhouseVerifiableCredential, chainId: number): Promise<boolean>;
 declare function fetchDelegationCredential(options: FetchDelegationCredentialOptions): Promise<PowerhouseVerifiableCredential | undefined>;
 interface VerifiedAuthCredential {
   address: string;
@@ -353,9 +374,10 @@ type DIDDocument = {
   alsoKnownAs?: string[];
   controller?: string | string[];
   verificationMethod?: VerificationMethod[];
-  service?: Service[]; /** @deprecated */
+  service?: Service[];
+  /** @deprecated */
   publicKey?: VerificationMethod[];
-} & { [x in KeyCapabilitySection]?: (string | VerificationMethod)[] };
+} & { [x in KeyCapabilitySection]?: (string | VerificationMethod)[]; };
 interface Service {
   id: string;
   type: string;
@@ -445,7 +467,8 @@ type RenownProfile = {
   documentId: string;
   username: string | null;
   ethAddress: string | null;
-  userImage: string | null; /** Absent on a profile seeded from the session cookie (see RenownSessionProfile). */
+  userImage: string | null;
+  /** Absent on a profile seeded from the session cookie (see RenownSessionProfile). */
   createdAt?: string;
   updatedAt?: string;
 };
@@ -599,5 +622,6 @@ interface IRenownCrypto {
  */
 interface IConnectCrypto extends IRenownCrypto {}
 //#endregion
-export { MemoryStorage as $, LoginStatus as A, Service as B, InternalUser as C, DOMAIN_TYPE as Ct, JWTVerifyPolicies as D, VERIFIABLE_CREDENTIAL_EIP712_TYPE as Dt, JWTVerified as E, RENOWN_SESSION_COOKIE as Et, RenownEventEmitter as F, User$1 as G, SignInParams as H, RenownEvents as I, VerificationMethod as J, UserActionSigner$1 as K, RenownProfile as L, PowerhouseVerifiableCredential as M, ProfileFetcher as N, JsonWebKey$1 as O, Proof as P, BaseStorage as Q, RenownStorage as R, IVerifiableCredential as S, DEFAULT_RENOWN_URL as St, JWTPayload as T, RENOWN_READ_MODEL_SUBGRAPH as Tt, Signer as U, ServiceEndpoint as V, Unsubscribe as W, VerifiedJWT as X, VerifiedCredential as Y, W3CCredential as Z, IPowerhouseCredentialSubject as _, CREDENTIAL_SCHEMA_EIP712_TYPE as _t, JwkKeyPair as a, SignCredentialTypedData as at, IRenown as b, DEFAULT_RENOWN_CHAIN_ID as bt, ConditionWeightedThreshold as c, buildAndSignCredential as ct, DIDDocument as d, verifyAuthCredential as dt, IEventEmitter as et, DIDDocumentMetadata as f, verifyCredentialSignature as ft, IAuthCredentialSubject as g, SwitchboardSource as gt, EcdsaSignature as h, SwitchboardRequestFn as ht, JsonWebKeyPairStorage as i, FetchDelegationCredentialOptions as it, PKHDid as j, KeyCapabilitySection as k, CreateBearerTokenOptions as l, fetchDelegationCredential as lt, DIDResolutionResult as m, SwitchboardClient as mt, IConnectCrypto as n, CredentialDomain as nt, AuthVerifiableCredential as o, VerifiedAuthCredential as ot, DIDResolutionMetadata as p, MissingSwitchboardError as pt, Verifiable as q, IRenownCrypto as r, CredentialMessage as rt, AuthVerifiedCredential as s, VerifyAuthCredentialOptions as st, DID as t, BuildCredentialParams as tt, CredentialStatus as u, recoverCredentialSigner as ut, IPowerhouseIssuerType as v, CREDENTIAL_SUBJECT_TYPE as vt, Issuer as w, ISSUER_TYPE as wt, ISigner$1 as x, DEFAULT_RENOWN_NETWORK_ID as xt, IProof as y, CREDENTIAL_TYPES as yt, RenownStorageMap as z };
-//# sourceMappingURL=types-BGQKPoUr.d.ts.map
+export { MemoryStorage as $, LoginStatus as A, VERIFIABLE_CREDENTIAL_EIP712_TYPE as At, Service as B, InternalUser as C, DEFAULT_RENOWN_CHAIN_ID as Ct, JWTVerifyPolicies as D, ISSUER_TYPE as Dt, JWTVerified as E, DOMAIN_TYPE as Et, RenownEventEmitter as F, User$1 as G, SignInParams as H, RenownEvents as I, VerificationMethod as J, UserActionSigner$1 as K, RenownProfile as L, PowerhouseVerifiableCredential as M, ProfileFetcher as N, JsonWebKey$1 as O, RENOWN_READ_MODEL_SUBGRAPH as Ot, Proof as P, BaseStorage as Q, RenownStorage as R, IVerifiableCredential as S, CREDENTIAL_TYPES as St, JWTPayload as T, DEFAULT_RENOWN_URL as Tt, Signer as U, ServiceEndpoint as V, Unsubscribe as W, VerifiedJWT as X, VerifiedCredential as Y, W3CCredential as Z, IPowerhouseCredentialSubject as _, SwitchboardRequestFn as _t, JwkKeyPair as a, SignCredentialTypedData as at, IRenown as b, CREDENTIAL_SCHEMA_EIP712_TYPE as bt, ConditionWeightedThreshold as c, buildAndSignCredential as ct, DIDDocument as d, verifyAuthCredential as dt, IEventEmitter as et, DIDDocumentMetadata as f, verifyCredentialSignature as ft, IAuthCredentialSubject as g, SwitchboardClient as gt, EcdsaSignature as h, RenownWriteAuth as ht, JsonWebKeyPairStorage as i, FetchDelegationCredentialOptions as it, PKHDid as j, KeyCapabilitySection as k, RENOWN_SESSION_COOKIE as kt, CreateBearerTokenOptions as l, fetchDelegationCredential as lt, DIDResolutionResult as m, MissingSwitchboardError as mt, IConnectCrypto as n, CredentialDomain as nt, AuthVerifiableCredential as o, VerifiedAuthCredential as ot, DIDResolutionMetadata as p, verifyDelegationProof as pt, Verifiable as q, IRenownCrypto as r, CredentialMessage as rt, AuthVerifiedCredential as s, VerifyAuthCredentialOptions as st, DID as t, BuildCredentialParams as tt, CredentialStatus as u, recoverCredentialSigner as ut, IPowerhouseIssuerType as v, SwitchboardRequestOptions as vt, Issuer as w, DEFAULT_RENOWN_NETWORK_ID as wt, ISigner$1 as x, CREDENTIAL_SUBJECT_TYPE as xt, IProof as y, SwitchboardSource as yt, RenownStorageMap as z };
+export {};
+//# sourceMappingURL=types-Ceiz2dkk.d.ts.map

package/dist/types-Ceiz2dkk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-Ceiz2dkk.d.ts","names":[],"sources":["../src/constants.ts","../src/switchboard.ts","../src/credential.ts","../src/event/types.ts","../src/storage/common.ts","../src/types.ts","../src/crypto/types.ts"],"mappings":";;cAAa;cACA;cACA;;cAGA;;;cAIA;cAEA;WACT;WAAiB;;WACjB;WAAiB;;cAGR;WACT;WAAkB;;WAClB;WAAc;;WACd;WAAY;;WACZ;WAAgB;;WAChB;WAA2B;;WAC3B;WAA0B;;WAC1B;WAAsB;;WACtB;WAAwB;;cAGf;WACT;WAAY;;WACZ;WAAc;;cAGL;WACT;WAAa;;WACb;WAAY;;cAGH;WACT;WAAY;;WACZ;WAAyB;;cAGhB;WACX;aA/BQ;aAAiB;;aACjB;aAAiB;;WA+BzB;aA3BQ;aAAkB;;aAClB;aAAc;;aACd;aAAY;;aACZ;aAAgB;;aAChB;aAA2B;;aAC3B;aAA0B;;aAC1B;aAAsB;;aACtB;aAAwB;;WAqBhC;aAjBQ;aAAY;;aACZ;aAAc;;WAiBtB;aAbQ;aAAa;;aACb;aAAY;;WAapB;aATQ;aAAY;;aACZ;aAAyB;;;;;;;cC1BtB,gCAAgC;EAC3C;;SAQO,GAAG,iBAAiB,SAAS;;;;;KAoM1B;EACN;;EACA;EAAmB;;;;UAuIR;EACf;;;;KAKU,wBACV,eACA,WAAW,yBACX,UAAU,8BACP;;KAGO,6BAA6B;cAI5B;;EAMX,YAAY,QAAQ;;MAWhB;EAkDE,cAAc;IAClB;IACA;IACA;MACE,QAAQ;EA6BN,qBAAqB;IACzB;IACA;IACA;MACE,QAAQ;EA0BN,oBACJ,kBACC,QAAQ;EAwBL,oBACJ,sBACA,2BACA,iBACC;EAaG,eACJ,4BACA,SAAS,UACT,iBACC;EAqBG,gBACJ,YAAY,gCACZ,4BACC;EAiEG,kBACJ,iBACA;IAAW;IAAmB;KAC9B,MAAM,kBACL;EAgEG,iBACJ,sBACA,MAAM,kBACL;EA0CH,gBAAgB;;;;KC9tBb;KACA;EACH;EACA;EACA;EACA,oBAAoB;EACpB,OAAO;;KAEJ;EAAuB;EAAc;;;KAG9B;EACV;EACA;;;KAIU;EACV;EACA;EACA;EACA;IAAU;IAAY,iBAAiB;;EACvC;IAAqB;IAAY;;EACjC;IAAoB;IAAY;;EAChC;EACA;;;KAIU,2BAA2B;EACrC,QAAQ;EACR,OAAO,wBAAwB;EAC/B;EACA,SAAS;MACL,QAAQ;UAEG;EACf,eAAe;EACf,SAAS;EACT;EACA;;EAEA;EACA;;;iBAIoB,uBACpB,QAAQ,wBACP,QAAQ;;iBA+DW,wBACpB,YAAY,iCACX,QAAQ;;iBAgBW,0BACpB,YAAY,iCACX;UAoCc;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,qBAAqB;;EAErB;;EAEA;;;;iBAgDoB,sBACpB,YAAY,gCACZ,kBACC;iBAuBmB,0BACpB,SAAS,mCACR,QAAQ;UA2CM;EACf;EACA;EACA;;EAEA;;EAEA;EACA,YAAY;;UAGG;;EAEf;;EAEA;;EAEA;;EAEA,qBAAqB;;EAErB;;iBAKoB,qBACpB,aACA,UAAS,8BACR,QAAQ;;;UC7VM,cAAc,eAAe;;;;;;;EAO5C,GAAG,gBAAgB,QACjB,OAAO,GACP,WAAW,MAAM,OAAO;;;;;;EAQ1B,KAAK,gBAAgB,QAAQ,OAAO,GAAG,MAAM,OAAO;;;;UCjBrC,SACf,UAAU,0BAA0B,yBACpC,kBAAkB,UAAU;EAE5B,IAAI,KAAK,MAAM,EAAE;EACjB,IAAI,KAAK,KAAK,QAAQ,EAAE;EACxB,OAAO,KAAK;;uBAGQ,YACpB,UAAU,0BAA0B,yBACpC,kBAAkB,UAAU,cACjB,SAAS;WACX,IAAI,KAAK,MAAM,EAAE;WACjB,IAAI,KAAK,KAAK,QAAQ,EAAE;WACxB,OAAO,KAAK;;cAGV,cACX,UAAU,0BAA0B,yBACpC,kBAAkB,UAAU,WACpB,YAAY;mBACH;EAEjB,IAAI,KAAK,MAAG,EAAA;EAIZ,IAAI,KAAK,KAAK,QAAQ,EAAE;EAQxB,OAAO,KAAK;;;;UCZG;EACf;EACA;EACA;;KAGU,UACV,eAAe,eACZ,QAAQ;UAEI;EACf;EACA;EACA;EACA;EACA;EACA;EACA;GACC;;UAGc;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf;EACA,SAAS,QAAQ;EACjB,qBAAqB;EACrB;EACA,QAAQ;EACR;EACA,WAAW;;UAKI;EACf;EACA,uBAAuB;EACvB,aAAa;EACb,qBAAqB;;UAGN;EACf;EACA;GAMC;;UAGc;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GACC;;KAGS;KAOA;EACV;EACA;EACA;EACA;EACA,qBAAqB;EACrB,UAAU;;EAEV,YAAY;OAEX,KAAK,kCAAkC;UAGzB;EACf;EACA;EACA,iBAAiB,kBAAkB;GAClC;;KAGS,2BAA2B;UAEtB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GACC;;UAGc;EACf;EACA;EACA;EACA;EACA;EACA,eAAe;EACf;EACA;EACA;EACA;EACA,cAAc;EACd,eAAe;EACf;EACA,qBAAqB;EACrB,6BAA6B;EAC7B;EACA;EACA;EACA;;UAGe;EACf,WAAW;EACX;;UAKe;EACf;EACA,QAAQ;EACR;;UAGe;EACf;GACC;;KAGS,WAAW,KAAK,SAAS;WAC1B,OAAO;;UAGD;EACf;EACA;;KAGU;EACV;EACA;EACA;EACA;IAAU;KAAa;;EACvB;EACA;EACA;IACE;KACC;;EAEH,mBAAmB;EACnB;EACA;GACC;;KAGS,cAAc;KAEd,qBAAqB;EAC/B,sBAAsB,WAAW;;KAGvB;EACV;EACA;EACA;EACA;;EAEA;EACA;;KAIU,eAAe;EACzB;EACA,YAAY;EACZ,UAAU;;KAIA,SAAO;;;;;;;KAQP,kBACV,MAAM,QACN,oBACG,QAAQ;UAEI;;EAEf;;EAEA;;EAEA,eAAe;;EAEf;;EAEA;;EAEA;;KAGU;KAEA;KAMA;EAAqB,MAAM;;KAE3B,gBAAgB,SAAS;KAEzB;EACV,MAAM;EACN,QAAQ;;KAGE,qBAAqB,cAAc;UAE9B,gBAAgB,KAAK;WAC3B;WACA,MAAM;WACN,QAAQ;EACjB,QAAQ,oBAAoB,QAAQ;EACpC,SAAS,QAAQ,iBAAiB,QAAQ;EAC1C,cAAc;;EAEd,kBAAkB;;EAElB,sBAAsB;WACb,QAAQ;WACR,QAAQ;WACR;WACA,gBAAgB;EACzB,oBAAoB,kBAAkB,gBAAgB;EACtD,iBACE,SAAS,0BACT,sBACG;;KAGF,WAAW;EACd;IACE;KAEC,qBAAqB;EACxB;IACE;UAEM;EACR;EACA;;UAGQ,6BAA6B,SAAS;EAC9C;EACA;EACA;EACA,QAAQ,WAAW;EACnB;EACA;EACA,mBAAmB,qBAAqB;EACxC,mBAAmB;EACnB,kBAAkB;;UAGH;EACf;EACA;EACA;EACA;EACA;EACA;EACA;IACE;MACE;MACA;;IAEF,cAAc;IACd;;;UAIa,sBACf,SACA,gBACQ,6BAA6B,SAAS;EAC9C,OAAO;;UAGQ;EACf;EACA;;UAGe;EACf;;KAGU,iCAAiC,sBAC3C,8BACA;UAGe;EACf;EACA;EACA;;KAGU,2BAA2B,sBACrC,wBACA;KAGU,yBAAyB;EACnC,sBAAsB,WAAW;;KAGvB;EACV;EACA;EACA;;UAGe;EACf;EACA;;;;KC9XU;EACV,WAAW;EACX,YAAY;;UAGG;EACf,eAAe,QAAQ;EACvB,YAAY,SAAS,aAAa;EAClC,iBAAiB;;KAGP;UAEK;EACf,KAAK;;EAEL;EACA,WAAW;EACX,aAAa;EACb,OAAO,MAAM,eAAe,QAAQ;EACpC,SAAS,MAAM,YAAY,WAAW,eAAe;EACrD,QAAQ;EACR,iBACE,6BACA,UAAU,6BACP;;;;;UAMU,uBAAuB"}

package/dist/{types-DInveFLz.d.ts → types-DRnq2URw.d.ts}

@@ -1,5 +1,4 @@
-import { c as WalletController, l as WalletSession, o as WalletAdapterMeta, t as LoginMethod } from "./types-C-hJrsQg.js";
-
+import { c as WalletController, l as WalletSession, o as WalletAdapterMeta, t as LoginMethod } from "./types-7xgrEnx7.js";
 //#region src/wallet/privy/meta.d.ts
 /** Structural subset of viem's `Chain`, so any `viem/chains` / `wagmi/chains` export fits regardless of the host's viem version. */
 interface PrivyChain {
@@ -60,4 +59,5 @@ interface PrivyWalletController extends WalletController {
 }
 //#endregion
 export { DEFAULT_PRIVY_METHODS as a, PrivyLoginMethod as c, SendCodeOptions as i, privyAdapterMeta as l, PrivyEmailStatus as n, PHRenownPrivyAdapterConfig as o, PrivyWalletController as r, PrivyChain as s, PrivyAuthState as t, resolvePrivyMethods as u };
-//# sourceMappingURL=types-DInveFLz.d.ts.map
+export {};
+//# sourceMappingURL=types-DRnq2URw.d.ts.map

package/dist/types-DRnq2URw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-DRnq2URw.d.ts","names":[],"sources":["../src/wallet/privy/meta.ts","../src/wallet/privy/types.ts"],"mappings":";;;UAGiB;EACf;EACA;EACA;IAAkB;IAAc;IAAgB;;EAChD;IAAW;MAAW;;;;KAKZ;cAUC,uBAAuB;UAMnB;EACf;EACA;;EAEA,UAAU;;EAEV,QAAQ;;EAER;;iBAKc,oBAAoB,qBAAqB;cAe5C,kBAAkB,KAAK;;;;KClDxB;;UASK;;EAEf;;EAEA;;EAEA;EACA,aAAa;EACb,aAAa;;UAGE;;EAEf;;;UAIe,8BAA8B;;EAE7C,SAAS,eAAe,UAAU,kBAAkB;;EAEpD,cAAc,eAAe,QAAQ;EACrC,YAAY;EACZ,eAAe,WAAW,OAAO"}

package/dist/{types-C_qc_62W.js → types-Dwy6khXb.js}

@@ -17,4 +17,4 @@ function normalizeWalletTheme(theme) {
 //#endregion
 export { normalizeWalletTheme as n, LoginMethod as t };
 
-//# sourceMappingURL=types-C_qc_62W.js.map
+//# sourceMappingURL=types-Dwy6khXb.js.map

package/dist/{types-C_qc_62W.js.map → types-Dwy6khXb.js.map}

@@ -1 +1 @@
-{"version":3,"file":"types-C_qc_62W.js","names":[],"sources":["../src/wallet/types.ts"],"sourcesContent":["import type { ComponentType, ReactNode } from \"react\";\nimport type { SignCredentialTypedData } from \"../credential.js\";\n\n// Const object rather than an enum so config can be authored with plain string\n// literals (`methods: [\"google\"]`) while `LoginMethod.GOOGLE` still works.\nexport const LoginMethod = {\n  WALLET: \"wallet\",\n  GOOGLE: \"google\",\n  EMAIL: \"email\",\n  APPLE: \"apple\",\n} as const;\n\nexport type LoginMethod = (typeof LoginMethod)[keyof typeof LoginMethod];\n\n// Colors the host passes into an adapter Provider so its wallet UI matches.\n// The adapter stays agnostic to how the host derives them (CSS tokens, etc.).\nexport interface WalletThemeColors {\n  accentColor?: string;\n  accentColorForeground?: string;\n}\n\n// The theme the host passes at runtime: a bare mode, or a mode plus colors.\nexport type WalletTheme =\n  | \"light\"\n  | \"dark\"\n  | ({ mode: \"light\" | \"dark\" } & WalletThemeColors);\n\n// Normalize a WalletTheme (or undefined) to a mode + colors the adapters use.\nexport function normalizeWalletTheme(theme: WalletTheme | undefined): {\n  mode: \"light\" | \"dark\";\n  accentColor?: string;\n  accentColorForeground?: string;\n} {\n  if (theme === undefined) return { mode: \"light\" };\n  if (typeof theme === \"string\") return { mode: theme };\n  return {\n    mode: theme.mode,\n    accentColor: theme.accentColor,\n    accentColorForeground: theme.accentColorForeground,\n  };\n}\n\n// The signer surface signIn needs, produced by an adapter after the user connects.\nexport interface WalletSession {\n  address: `0x${string}`;\n  chainId: number;\n  signTypedData: SignCredentialTypedData;\n  // Capability, not policy: the session can sign without a user prompt (e.g. a\n  // Privy embedded wallet). Whether/when to sign silently is the host's call.\n  canSignSilently?: boolean;\n}\n\n// Imperative controls returned by an adapter's React hook (used inside its Provider).\nexport interface WalletController {\n  connect(method?: LoginMethod): Promise<WalletSession>;\n  disconnect(): Promise<void>;\n  getSession(): WalletSession | undefined;\n  // Optional push stream of session changes (fires immediately with the current\n  // one), so a host can complete sign-in on an OAuth return with no live connect().\n  subscribe?(\n    listener: (session: WalletSession | undefined) => void,\n  ): () => void;\n}\n\n// Identity + capabilities, declared once per adapter in a dependency-free module\n// so a host can list methods and detect a redirect return with no wallet library.\nexport interface WalletAdapterMeta {\n  id: string;\n  // URL params the adapter leaves when a full-page OAuth login returns; empty for\n  // adapters with no redirect flow.\n  redirectReturnParams: string[];\n  // Must be known before load(): the login UI renders buttons before any wallet\n  // library is fetched.\n  supportedMethods: LoginMethod[];\n}\n\n// Behaviour only — what an adapter factory returns. Identity lives in the meta.\nexport interface WalletAdapterImpl {\n  // React provider that must wrap the app subtree for this adapter to work; the\n  // host passes its current theme so the adapter's UI can match.\n  Provider: ComponentType<{ children: ReactNode; theme?: WalletTheme }>;\n  // Hook returning imperative controls; MUST be called inside <Provider>.\n  useController: () => WalletController;\n}\n\n// What the host consumes: resolveAdapters pairs an impl with its meta.\nexport interface WalletAdapter extends WalletAdapterImpl {\n  meta: WalletAdapterMeta;\n}\n\n// An adapter's light entry: eager meta plus a lazy loader that pulls the factory\n// and its wallet library only once login is activated.\nexport interface WalletAdapterDescriptor {\n  meta: WalletAdapterMeta;\n  load: () => Promise<WalletAdapterImpl>;\n}\n\nexport type WalletAdapterFactory<Config = unknown> = (\n  config: Config,\n) => WalletAdapterImpl;\n\nexport type WalletAdapterProvider<Config = unknown> = (\n  config: Config,\n) => WalletAdapterDescriptor;\n"],"mappings":";AAKA,MAAa,cAAc;CACzB,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,OAAO;CACR;AAkBD,SAAgB,qBAAqB,OAInC;AACA,KAAI,UAAU,KAAA,EAAW,QAAO,EAAE,MAAM,SAAS;AACjD,KAAI,OAAO,UAAU,SAAU,QAAO,EAAE,MAAM,OAAO;AACrD,QAAO;EACL,MAAM,MAAM;EACZ,aAAa,MAAM;EACnB,uBAAuB,MAAM;EAC9B"}
+{"version":3,"file":"types-Dwy6khXb.js","names":[],"sources":["../src/wallet/types.ts"],"sourcesContent":["import type { ComponentType, ReactNode } from \"react\";\nimport type { SignCredentialTypedData } from \"../credential.js\";\n\n// Const object rather than an enum so config can be authored with plain string\n// literals (`methods: [\"google\"]`) while `LoginMethod.GOOGLE` still works.\nexport const LoginMethod = {\n  WALLET: \"wallet\",\n  GOOGLE: \"google\",\n  EMAIL: \"email\",\n  APPLE: \"apple\",\n} as const;\n\nexport type LoginMethod = (typeof LoginMethod)[keyof typeof LoginMethod];\n\n// Colors the host passes into an adapter Provider so its wallet UI matches.\n// The adapter stays agnostic to how the host derives them (CSS tokens, etc.).\nexport interface WalletThemeColors {\n  accentColor?: string;\n  accentColorForeground?: string;\n}\n\n// The theme the host passes at runtime: a bare mode, or a mode plus colors.\nexport type WalletTheme =\n  | \"light\"\n  | \"dark\"\n  | ({ mode: \"light\" | \"dark\" } & WalletThemeColors);\n\n// Normalize a WalletTheme (or undefined) to a mode + colors the adapters use.\nexport function normalizeWalletTheme(theme: WalletTheme | undefined): {\n  mode: \"light\" | \"dark\";\n  accentColor?: string;\n  accentColorForeground?: string;\n} {\n  if (theme === undefined) return { mode: \"light\" };\n  if (typeof theme === \"string\") return { mode: theme };\n  return {\n    mode: theme.mode,\n    accentColor: theme.accentColor,\n    accentColorForeground: theme.accentColorForeground,\n  };\n}\n\n// The signer surface signIn needs, produced by an adapter after the user connects.\nexport interface WalletSession {\n  address: `0x${string}`;\n  chainId: number;\n  signTypedData: SignCredentialTypedData;\n  // Capability, not policy: the session can sign without a user prompt (e.g. a\n  // Privy embedded wallet). Whether/when to sign silently is the host's call.\n  canSignSilently?: boolean;\n}\n\n// Imperative controls returned by an adapter's React hook (used inside its Provider).\nexport interface WalletController {\n  connect(method?: LoginMethod): Promise<WalletSession>;\n  disconnect(): Promise<void>;\n  getSession(): WalletSession | undefined;\n  // Optional push stream of session changes (fires immediately with the current\n  // one), so a host can complete sign-in on an OAuth return with no live connect().\n  subscribe?(\n    listener: (session: WalletSession | undefined) => void,\n  ): () => void;\n}\n\n// Identity + capabilities, declared once per adapter in a dependency-free module\n// so a host can list methods and detect a redirect return with no wallet library.\nexport interface WalletAdapterMeta {\n  id: string;\n  // URL params the adapter leaves when a full-page OAuth login returns; empty for\n  // adapters with no redirect flow.\n  redirectReturnParams: string[];\n  // Must be known before load(): the login UI renders buttons before any wallet\n  // library is fetched.\n  supportedMethods: LoginMethod[];\n}\n\n// Behaviour only — what an adapter factory returns. Identity lives in the meta.\nexport interface WalletAdapterImpl {\n  // React provider that must wrap the app subtree for this adapter to work; the\n  // host passes its current theme so the adapter's UI can match.\n  Provider: ComponentType<{ children: ReactNode; theme?: WalletTheme }>;\n  // Hook returning imperative controls; MUST be called inside <Provider>.\n  useController: () => WalletController;\n}\n\n// What the host consumes: resolveAdapters pairs an impl with its meta.\nexport interface WalletAdapter extends WalletAdapterImpl {\n  meta: WalletAdapterMeta;\n}\n\n// An adapter's light entry: eager meta plus a lazy loader that pulls the factory\n// and its wallet library only once login is activated.\nexport interface WalletAdapterDescriptor {\n  meta: WalletAdapterMeta;\n  load: () => Promise<WalletAdapterImpl>;\n}\n\nexport type WalletAdapterFactory<Config = unknown> = (\n  config: Config,\n) => WalletAdapterImpl;\n\nexport type WalletAdapterProvider<Config = unknown> = (\n  config: Config,\n) => WalletAdapterDescriptor;\n"],"mappings":";AAKA,MAAa,cAAc;CACzB,QAAQ;CACR,QAAQ;CACR,OAAO;CACP,OAAO;AACT;AAkBA,SAAgB,qBAAqB,OAInC;CACA,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,MAAM,QAAQ;CAChD,IAAI,OAAO,UAAU,UAAU,OAAO,EAAE,MAAM,MAAM;CACpD,OAAO;EACL,MAAM,MAAM;EACZ,aAAa,MAAM;EACnB,uBAAuB,MAAM;CAC/B;AACF"}

package/dist/utils-DLQ5VVqT.js

@@ -0,0 +1,75 @@
+import { createVerifiableCredentialJwt, verifyCredential } from "did-jwt-vc";
+import { Resolver } from "did-resolver";
+import { getResolver } from "key-did-resolver";
+//#region src/utils.ts
+/**
+* Parse a DID:pkh string to extract network, chain ID, and address information
+* @param did - The DID string in format "did:pkh:networkId:chainId:address"
+* @returns Parsed DID information
+* @throws Error if the DID format is invalid
+*/
+function parsePkhDid(did) {
+	const parts = did.split(":");
+	if (!did.startsWith("did:pkh:") || parts.length !== 5) throw new Error("Invalid pkh did");
+	const [, , networkId, chainIdStr, address] = parts;
+	if (!address.startsWith("0x")) throw new Error(`Invalid address: ${address}`);
+	const chainId = Number(chainIdStr);
+	if (isNaN(chainId)) throw new Error(`Invalid chain id: ${chainIdStr}`);
+	return {
+		chainId,
+		networkId,
+		address
+	};
+}
+async function verifyAuthBearerToken(jwt, options) {
+	try {
+		const now = parseInt(String(Date.now() / 1e3));
+		const verified = await verifyCredential(jwt, getResolver$1(), {
+			...options?.audience !== void 0 && { audience: options.audience },
+			policies: {
+				now: parseInt(String(Date.now() / 1e3)),
+				expirationDate: true,
+				issuanceDate: true
+			}
+		});
+		if (verified.payload.exp && verified.payload.exp < now) return false;
+		assertIsAuthCredential(verified);
+		return verified;
+	} catch (e) {
+		console.error(e);
+		return false;
+	}
+}
+function assertIsAuthCredential(credential) {
+	const subjectKeys = Object.keys(credential.verifiableCredential.credentialSubject);
+	if (![
+		"address",
+		"chainId",
+		"networkId"
+	].every((key) => subjectKeys.includes(key))) throw new Error("Invalid Auth Credential Subject:" + JSON.stringify(credential.verifiableCredential.credentialSubject, null, 2));
+}
+async function createAuthBearerToken(chainId, networkId, address, issuer, options) {
+	const vcPayload = {
+		sub: issuer.did,
+		vc: {
+			"@context": ["https://www.w3.org/2018/credentials/v1"],
+			type: ["VerifiableCredential"],
+			credentialSubject: {
+				chainId,
+				networkId,
+				address
+			}
+		},
+		aud: options?.aud
+	};
+	return await createVerifiableCredentialJwt(vcPayload, issuer, { expiresIn: options?.expiresIn });
+}
+const getResolver$1 = () => {
+	const keyResolver = getResolver();
+	if (!keyResolver) throw new Error("Failed to get key resolver");
+	return new Resolver(keyResolver);
+};
+//#endregion
+export { verifyAuthBearerToken as a, parsePkhDid as i, createAuthBearerToken as n, getResolver$1 as r, assertIsAuthCredential as t };
+
+//# sourceMappingURL=utils-DLQ5VVqT.js.map

package/dist/utils-DLQ5VVqT.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-DLQ5VVqT.js","names":["getResolver","keyDidResolver"],"sources":["../src/utils.ts"],"sourcesContent":["import type { JwtCredentialPayload } from \"did-jwt-vc\";\nimport { createVerifiableCredentialJwt, verifyCredential } from \"did-jwt-vc\";\nimport { Resolver } from \"did-resolver\";\nimport { getResolver as keyDidResolver } from \"key-did-resolver\";\nimport type {\n  AuthVerifiedCredential,\n  CreateBearerTokenOptions,\n  IAuthCredentialSubject,\n  Issuer,\n  PKHDid,\n  VerifiedCredential,\n} from \"./types.js\";\n\nexport type ILogger = {\n  level: \"verbose\" | \"debug\" | \"info\" | \"warn\" | \"error\";\n\n  verbose: (message: string, ...replacements: any[]) => void;\n  debug: (message: string, ...replacements: any[]) => void;\n  info: (message: string, ...replacements: any[]) => void;\n  warn: (message: string, ...replacements: any[]) => void;\n  error: (message: string, ...replacements: any[]) => void;\n};\n\n/**\n * Parse a DID:pkh string to extract network, chain ID, and address information\n * @param did - The DID string in format \"did:pkh:networkId:chainId:address\"\n * @returns Parsed DID information\n * @throws Error if the DID format is invalid\n */\nexport function parsePkhDid(did: string): PKHDid {\n  const parts = did.split(\":\");\n  if (!did.startsWith(\"did:pkh:\") || parts.length !== 5) {\n    throw new Error(\"Invalid pkh did\");\n  }\n  const [, , networkId, chainIdStr, address] = parts;\n\n  if (!address.startsWith(\"0x\")) {\n    throw new Error(`Invalid address: ${address}`);\n  }\n\n  const chainId = Number(chainIdStr);\n  if (isNaN(chainId)) {\n    throw new Error(`Invalid chain id: ${chainIdStr}`);\n  }\n\n  return {\n    chainId,\n    networkId,\n    address: address as PKHDid[\"address\"],\n  };\n}\n\nexport interface VerifyAuthBearerTokenOptions {\n  /** Expected `aud` claim. Required when verifying tokens that include an\n   *  audience claim — did-jwt rejects them otherwise with\n   *  `invalid_config: JWT audience is required but your app address has not\n   *  been configured`. Tokens minted without `aud` are unaffected. */\n  audience?: string;\n}\n\nexport async function verifyAuthBearerToken(\n  jwt: string,\n  options?: VerifyAuthBearerTokenOptions,\n): Promise<false | AuthVerifiedCredential> {\n  try {\n    const now = parseInt(String(Date.now() / 1000));\n    const verified: VerifiedCredential = await verifyCredential(\n      jwt,\n      getResolver(),\n      {\n        ...(options?.audience !== undefined && { audience: options.audience }),\n        policies: {\n          now: parseInt(String(Date.now() / 1000)),\n          expirationDate: true,\n          issuanceDate: true,\n        },\n      },\n    );\n\n    if (verified.payload.exp && verified.payload.exp < now) {\n      return false;\n    }\n    assertIsAuthCredential(verified);\n    return verified;\n  } catch (e) {\n    console.error(e);\n    return false;\n  }\n}\n\nexport function assertIsAuthCredential(\n  credential: VerifiedCredential,\n): asserts credential is AuthVerifiedCredential {\n  const subjectKeys = Object.keys(\n    credential.verifiableCredential.credentialSubject,\n  );\n  if (\n    ![\"address\", \"chainId\", \"networkId\"].every((key) =>\n      subjectKeys.includes(key),\n    )\n  ) {\n    throw new Error(\n      \"Invalid Auth Credential Subject:\" +\n        JSON.stringify(\n          credential.verifiableCredential.credentialSubject,\n          null,\n          2,\n        ),\n    );\n  }\n}\n\nexport async function createAuthBearerToken(\n  chainId: number,\n  networkId: string,\n  address: string,\n  issuer: Issuer,\n  options?: CreateBearerTokenOptions,\n) {\n  const vcPayload: JwtCredentialPayload = {\n    sub: issuer.did,\n    vc: {\n      \"@context\": [\"https://www.w3.org/2018/credentials/v1\"],\n      type: [\"VerifiableCredential\"],\n      credentialSubject: {\n        chainId,\n        networkId,\n        address,\n      } satisfies IAuthCredentialSubject,\n    },\n    aud: options?.aud,\n  };\n\n  const jwt = await createVerifiableCredentialJwt(vcPayload, issuer, {\n    expiresIn: options?.expiresIn,\n  });\n  return jwt;\n}\n\nexport const getResolver = () => {\n  const keyResolver = keyDidResolver();\n  if (!keyResolver) {\n    throw new Error(\"Failed to get key resolver\");\n  }\n\n  return new Resolver(keyResolver);\n};\n"],"mappings":";;;;;;;;;;AA6BA,SAAgB,YAAY,KAAqB;CAC/C,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,CAAC,IAAI,WAAW,UAAU,KAAK,MAAM,WAAW,GAClD,MAAM,IAAI,MAAM,iBAAiB;CAEnC,MAAM,KAAK,WAAW,YAAY,WAAW;CAE7C,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC1B,MAAM,IAAI,MAAM,oBAAoB,SAAS;CAG/C,MAAM,UAAU,OAAO,UAAU;CACjC,IAAI,MAAM,OAAO,GACf,MAAM,IAAI,MAAM,qBAAqB,YAAY;CAGnD,OAAO;EACL;EACA;EACS;CACX;AACF;AAUA,eAAsB,sBACpB,KACA,SACyC;CACzC,IAAI;EACF,MAAM,MAAM,SAAS,OAAO,KAAK,IAAI,IAAI,GAAI,CAAC;EAC9C,MAAM,WAA+B,MAAM,iBACzC,KACAA,cAAY,GACZ;GACE,GAAI,SAAS,aAAa,KAAA,KAAa,EAAE,UAAU,QAAQ,SAAS;GACpE,UAAU;IACR,KAAK,SAAS,OAAO,KAAK,IAAI,IAAI,GAAI,CAAC;IACvC,gBAAgB;IAChB,cAAc;GAChB;EACF,CACF;EAEA,IAAI,SAAS,QAAQ,OAAO,SAAS,QAAQ,MAAM,KACjD,OAAO;EAET,uBAAuB,QAAQ;EAC/B,OAAO;CACT,SAAS,GAAG;EACV,QAAQ,MAAM,CAAC;EACf,OAAO;CACT;AACF;AAEA,SAAgB,uBACd,YAC8C;CAC9C,MAAM,cAAc,OAAO,KACzB,WAAW,qBAAqB,iBAClC;CACA,IACE,CAAC;EAAC;EAAW;EAAW;CAAW,CAAC,CAAC,OAAO,QAC1C,YAAY,SAAS,GAAG,CAC1B,GAEA,MAAM,IAAI,MACR,qCACE,KAAK,UACH,WAAW,qBAAqB,mBAChC,MACA,CACF,CACJ;AAEJ;AAEA,eAAsB,sBACpB,SACA,WACA,SACA,QACA,SACA;CACA,MAAM,YAAkC;EACtC,KAAK,OAAO;EACZ,IAAI;GACF,YAAY,CAAC,wCAAwC;GACrD,MAAM,CAAC,sBAAsB;GAC7B,mBAAmB;IACjB;IACA;IACA;GACF;EACF;EACA,KAAK,SAAS;CAChB;CAKA,OAAO,MAHW,8BAA8B,WAAW,QAAQ,EACjE,WAAW,SAAS,UACtB,CAAC;AAEH;AAEA,MAAaA,sBAAoB;CAC/B,MAAM,cAAcC,YAAe;CACnC,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,4BAA4B;CAG9C,OAAO,IAAI,SAAS,WAAW;AACjC"}

package/dist/{utils-DtWREYeO.d.ts → utils-DkVxP7Ug.d.ts}

@@ -1,6 +1,6 @@
-import { $ as MemoryStorage, A as LoginStatus, C as InternalUser, F as RenownEventEmitter, G as User, H as SignInParams, I as RenownEvents, N as ProfileFetcher, R as RenownStorage, Y as VerifiedCredential, b as IRenown, ht as SwitchboardRequestFn, i as JsonWebKeyPairStorage, j as PKHDid, l as CreateBearerTokenOptions, mt as SwitchboardClient, r as IRenownCrypto, s as AuthVerifiedCredential, w as Issuer, x as ISigner, z as RenownStorageMap } from "./types-BGQKPoUr.js";
+import { $ as MemoryStorage, A as LoginStatus, C as InternalUser, F as RenownEventEmitter, G as User, H as SignInParams, I as RenownEvents, N as ProfileFetcher, R as RenownStorage, Y as VerifiedCredential, _t as SwitchboardRequestFn, b as IRenown, gt as SwitchboardClient, i as JsonWebKeyPairStorage, j as PKHDid, l as CreateBearerTokenOptions, r as IRenownCrypto, s as AuthVerifiedCredential, w as Issuer, x as ISigner, z as RenownStorageMap } from "./types-Ceiz2dkk.js";
+import "./index-DbiBjqs6.js";
 import { Resolver } from "did-resolver";
-
 //#region src/common.d.ts
 declare class RenownMemoryStorage extends MemoryStorage<RenownStorageMap> {}
 declare class Renown implements IRenown {
@@ -25,14 +25,6 @@ declare class Renown implements IRenown {
   getBearerToken(options: CreateBearerTokenOptions): Promise<string>;
 }
 //#endregion
-//#region src/discovery.d.ts
-interface ResolveSwitchboardEndpointOptions {
-  switchboardUrl?: string;
-  baseUrl?: string;
-  timeoutMs?: number;
-}
-declare function resolveSwitchboardEndpoint(options: ResolveSwitchboardEndpointOptions): Promise<string | undefined>;
-//#endregion
 //#region src/renown-builder.d.ts
 interface RenownBuilderOptions {
   appName: string;
@@ -122,6 +114,20 @@ declare function createLocalCredentialVerifier(execute: SwitchboardRequestFn, op
 //#region src/profile.d.ts
 declare const fetchRenownProfile: ProfileFetcher;
 //#endregion
+//#region src/signed-message.d.ts
+declare const SIGNATURE_WINDOW_MS = 600000;
+/** Canonical message a caller signs to authorize revoking `credentialId`. */
+declare function revokeMessage(credentialId: string, timestamp: string): string;
+/**
+ * Canonical message a caller signs to authorize a profile upsert. The payload
+ * is hashed (rather than embedded raw) so the signed message has a fixed
+ * shape regardless of field content.
+ */
+declare function profileMessage(address: string, profile: {
+  username?: string | null;
+  userImage?: string | null;
+}, timestamp: string): Promise<string>;
+//#endregion
 //#region src/session.d.ts
 /** Server-side view of an authenticated Renown session. */
 interface RenownSession {
@@ -197,5 +203,6 @@ declare function assertIsAuthCredential(credential: VerifiedCredential): asserts
 declare function createAuthBearerToken(chainId: number, networkId: string, address: string, issuer: Issuer, options?: CreateBearerTokenOptions): Promise<string>;
 declare const getResolver: () => Resolver;
 //#endregion
-export { resolveSwitchboardEndpoint as C, ResolveSwitchboardEndpointOptions as S, RenownMemoryStorage as T, CredentialCheck as _, getResolver as a, BaseRenownBuilder as b, RenownSession as c, RenownSessionProfile as d, VerifyRenownSessionOptions as f, fetchRenownProfile as g, verifyRenownSession as h, createAuthBearerToken as i, RenownSessionClaims as l, serializeRenownSessionCookie as m, VerifyAuthBearerTokenOptions as n, parsePkhDid as o, readSessionClaims as p, assertIsAuthCredential as r, verifyAuthBearerToken as s, ILogger as t, RenownSessionCookie as u, LocalCredentialVerifierOptions as v, Renown as w, RenownBuilderOptions as x, createLocalCredentialVerifier as y };
-//# sourceMappingURL=utils-DtWREYeO.d.ts.map
+export { BaseRenownBuilder as C, RenownMemoryStorage as E, createLocalCredentialVerifier as S, Renown as T, profileMessage as _, getResolver as a, CredentialCheck as b, RenownSession as c, RenownSessionProfile as d, VerifyRenownSessionOptions as f, SIGNATURE_WINDOW_MS as g, verifyRenownSession as h, createAuthBearerToken as i, RenownSessionClaims as l, serializeRenownSessionCookie as m, VerifyAuthBearerTokenOptions as n, parsePkhDid as o, readSessionClaims as p, assertIsAuthCredential as r, verifyAuthBearerToken as s, ILogger as t, RenownSessionCookie as u, revokeMessage as v, RenownBuilderOptions as w, LocalCredentialVerifierOptions as x, fetchRenownProfile as y };
+export {};
+//# sourceMappingURL=utils-DkVxP7Ug.d.ts.map

package/dist/utils-DkVxP7Ug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils-DkVxP7Ug.d.ts","names":[],"sources":["../src/common.ts","../src/renown-builder.ts","../src/local-credential-verifier.ts","../src/profile.ts","../src/signed-message.ts","../src/session.ts","../src/utils.ts"],"mappings":";;;;cAoCa,4BAA4B,cAAc;cA8B1C,kBAAkB;;EAY7B,YACE,OAAO,eACP,cAAc,oBACd,QAAQ,eACR,iBACA,kBACA,iBAAiB,gBACjB,cAAc,mBACd;MA4BE;;MAKA;MAIA,QAtCY;MA0CZ,UAAM;MAIN,UAAM;MAIN,UAAM;MAIN;MAIA,kBAAc;EAkBZ,MAAM,kBAAkB,QAAQ;EAyBhC,OAAO,QAAQ,eAAe,QAAQ;EA6J5C,UAAM;EAQA,cAAc;EAsBd,kBAAkB;EAsCxB,GAAG,gBAAgB,cACjB,OAAO,GACP,WAAW,MAAM,aAAa;EAkC1B,kBAAkB,gBAAa,gBAlCL;EAsC1B,eAAe,SAAS,2BAAwB;;;;UCrbvC;EACf;EACA,UAAU;EACV,eAAe;EACf,SAAS;EACT,iBAAiB;EACjB;EACA;EACA,iBAAiB;;EAEjB;;;;;;;cAQW;;;;;EAcX,YAAY;;;;;EAQZ,YAAY,SAAS;;;;;EASrB,iBAAiB,cAAc;;;;;EAS/B,WAAW,QAAQ;;;;;;EAUnB,mBAAmB,gBAAgB;;;;;EASnC,YAAY;EAOZ,mBAAmB;EAOnB,YAAY;;;;;;;EAWZ,mBAAmB,gBAAgB;;;;;;EAU7B,SAAS,QAAQ;;;;SA2DhB,KAAK,SAAS,uBAAuB;;;;;KCrLlC,mBAAmB;EAC7B;EACA;EACA;MACI;UAEW;;EAEf,WAAW;;;;iBAKG,8BACd,SAAS,sBACT,UAAS,iCACR;;;cClBU,oBAAoB;;;cCMpB;;iBAiBG,cAAc,sBAAsB;;;;;;iBAS9B,eACpB,iBACA;EAAW;EAA0B;GACrC,oBACC;;;;UCjCc;;EAEf,MAAM;;EAEN;;EAEA;;;UAIe;EACf;EACA;;EAEA;EACA;EACA;;;UAIe;EACf;EACA,UAAU;;UAGK;;EAEf;;EAEA;;EAEA;;EAEA;;;UAIe;EACf;EACA;EACA;;EAEA;;;iBAIc,6BACd,OAAO;iBAwBO,kBACd,gBACC;iBA+BmB,oBACpB,eACA,UAAS,6BACR,QAAQ;;;KCnGC;EACV;EAEA,UAAU,oBAAoB;EAC9B,QAAQ,oBAAoB;EAC5B,OAAO,oBAAoB;EAC3B,OAAO,oBAAoB;EAC3B,QAAQ,oBAAoB;;;;;;;;iBASd,YAAY,cAAc;UAuBzB;;;;;EAKf;;iBAGoB,sBACpB,aACA,UAAU,+BACT,gBAAgB;iBA2BH,uBACd,YAAY,6BACH,cAAc;iBAoBH,sBACpB,iBACA,mBACA,iBACA,QAAQ,QACR,UAAU,2BAAwB;cAsBvB,mBAAW"}

package/dist/wallet/index.d.ts

@@ -1,8 +1,8 @@
-import { a as WalletAdapterImpl, c as WalletController, d as WalletThemeColors, f as normalizeWalletTheme, i as WalletAdapterFactory, l as WalletSession, n as WalletAdapter, o as WalletAdapterMeta, r as WalletAdapterDescriptor, s as WalletAdapterProvider, t as LoginMethod, u as WalletTheme } from "../types-C-hJrsQg.js";
-
+import { a as WalletAdapterImpl, c as WalletController, d as WalletThemeColors, f as normalizeWalletTheme, i as WalletAdapterFactory, l as WalletSession, n as WalletAdapter, o as WalletAdapterMeta, r as WalletAdapterDescriptor, s as WalletAdapterProvider, t as LoginMethod, u as WalletTheme } from "../types-7xgrEnx7.js";
 //#region src/wallet/controller.d.ts
-declare function isWalletRedirectReturn(search: string, metas: WalletAdapterMeta[]): boolean;
-declare function resolveAdapters(descriptors: WalletAdapterDescriptor[] | undefined): Promise<WalletAdapter[]>;
+export declare function isWalletRedirectReturn(search: string, metas: WalletAdapterMeta[]): boolean;
+export declare function resolveAdapters(descriptors: WalletAdapterDescriptor[] | undefined): Promise<WalletAdapter[]>;
 //#endregion
-export { LoginMethod, WalletAdapter, WalletAdapterDescriptor, WalletAdapterFactory, WalletAdapterImpl, WalletAdapterMeta, WalletAdapterProvider, WalletController, WalletSession, WalletTheme, WalletThemeColors, isWalletRedirectReturn, normalizeWalletTheme, resolveAdapters };
+export { LoginMethod, WalletAdapter, WalletAdapterDescriptor, WalletAdapterFactory, WalletAdapterImpl, WalletAdapterMeta, WalletAdapterProvider, WalletController, WalletSession, WalletTheme, WalletThemeColors, normalizeWalletTheme };
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/wallet/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/wallet/controller.ts"],"mappings":";;;iBAQgB,sBAAA,CACd,MAAA,UACA,KAAA,EAAO,iBAAA;AAAA,iBAUa,eAAA,CACpB,WAAA,EAAa,uBAAA,iBACZ,OAAA,CAAQ,aAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/wallet/controller.ts"],"mappings":";;wBAQgB,uBACd,gBACA,OAAO;wBAUa,gBACpB,aAAa,wCACZ,QAAQ"}

package/dist/wallet/index.js

@@ -1,4 +1,4 @@
-import { n as normalizeWalletTheme, t as LoginMethod } from "../types-C_qc_62W.js";
+import { n as normalizeWalletTheme, t as LoginMethod } from "../types-Dwy6khXb.js";
 //#region src/wallet/controller.ts
 function isWalletRedirectReturn(search, metas) {
 	const params = new URLSearchParams(search);

package/dist/wallet/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/wallet/controller.ts"],"sourcesContent":["import type {\n  WalletAdapter,\n  WalletAdapterDescriptor,\n  WalletAdapterMeta,\n} from \"./types.js\";\n\n// True when a URL search string looks like a wallet OAuth redirect return, per\n// each adapter's own declared params — no adapter-specific strings live here.\nexport function isWalletRedirectReturn(\n  search: string,\n  metas: WalletAdapterMeta[],\n): boolean {\n  const params = new URLSearchParams(search);\n  return metas.some((meta) =>\n    meta.redirectReturnParams.some((param) => params.has(param)),\n  );\n}\n\n// Load the descriptors the host passed in, pairing each resolved implementation\n// with its already-eager meta so identity is declared in exactly one place.\nexport async function resolveAdapters(\n  descriptors: WalletAdapterDescriptor[] | undefined,\n): Promise<WalletAdapter[]> {\n  if (!descriptors || descriptors.length === 0) return [];\n  // allSettled, not all: one broken loader must not take the others down.\n  const settled = await Promise.allSettled(\n    descriptors.map((descriptor) => descriptor.load()),\n  );\n\n  const adapters: WalletAdapter[] = [];\n  const failures: string[] = [];\n  settled.forEach((result, index) => {\n    const { meta } = descriptors[index];\n    if (result.status === \"fulfilled\") {\n      adapters.push({ ...result.value, meta });\n    } else {\n      failures.push(`${meta.id}: ${describeError(result.reason)}`);\n    }\n  });\n\n  if (adapters.length === 0) {\n    throw new Error(\n      `No wallet adapter could be loaded. ${failures.join(\"; \")}`,\n    );\n  }\n  if (failures.length > 0) {\n    console.error(\n      `[renown] Some wallet adapters failed to load. ${failures.join(\"; \")}`,\n    );\n  }\n  return adapters;\n}\n\nfunction describeError(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"],"mappings":";;AAQA,SAAgB,uBACd,QACA,OACS;CACT,MAAM,SAAS,IAAI,gBAAgB,OAAO;AAC1C,QAAO,MAAM,MAAM,SACjB,KAAK,qBAAqB,MAAM,UAAU,OAAO,IAAI,MAAM,CAAC,CAC7D;;AAKH,eAAsB,gBACpB,aAC0B;AAC1B,KAAI,CAAC,eAAe,YAAY,WAAW,EAAG,QAAO,EAAE;CAEvD,MAAM,UAAU,MAAM,QAAQ,WAC5B,YAAY,KAAK,eAAe,WAAW,MAAM,CAAC,CACnD;CAED,MAAM,WAA4B,EAAE;CACpC,MAAM,WAAqB,EAAE;AAC7B,SAAQ,SAAS,QAAQ,UAAU;EACjC,MAAM,EAAE,SAAS,YAAY;AAC7B,MAAI,OAAO,WAAW,YACpB,UAAS,KAAK;GAAE,GAAG,OAAO;GAAO;GAAM,CAAC;MAExC,UAAS,KAAK,GAAG,KAAK,GAAG,IAAI,cAAc,OAAO,OAAO,GAAG;GAE9D;AAEF,KAAI,SAAS,WAAW,EACtB,OAAM,IAAI,MACR,sCAAsC,SAAS,KAAK,KAAK,GAC1D;AAEH,KAAI,SAAS,SAAS,EACpB,SAAQ,MACN,iDAAiD,SAAS,KAAK,KAAK,GACrE;AAEH,QAAO;;AAGT,SAAS,cAAc,OAAwB;AAC7C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/wallet/controller.ts"],"sourcesContent":["import type {\n  WalletAdapter,\n  WalletAdapterDescriptor,\n  WalletAdapterMeta,\n} from \"./types.js\";\n\n// True when a URL search string looks like a wallet OAuth redirect return, per\n// each adapter's own declared params — no adapter-specific strings live here.\nexport function isWalletRedirectReturn(\n  search: string,\n  metas: WalletAdapterMeta[],\n): boolean {\n  const params = new URLSearchParams(search);\n  return metas.some((meta) =>\n    meta.redirectReturnParams.some((param) => params.has(param)),\n  );\n}\n\n// Load the descriptors the host passed in, pairing each resolved implementation\n// with its already-eager meta so identity is declared in exactly one place.\nexport async function resolveAdapters(\n  descriptors: WalletAdapterDescriptor[] | undefined,\n): Promise<WalletAdapter[]> {\n  if (!descriptors || descriptors.length === 0) return [];\n  // allSettled, not all: one broken loader must not take the others down.\n  const settled = await Promise.allSettled(\n    descriptors.map((descriptor) => descriptor.load()),\n  );\n\n  const adapters: WalletAdapter[] = [];\n  const failures: string[] = [];\n  settled.forEach((result, index) => {\n    const { meta } = descriptors[index];\n    if (result.status === \"fulfilled\") {\n      adapters.push({ ...result.value, meta });\n    } else {\n      failures.push(`${meta.id}: ${describeError(result.reason)}`);\n    }\n  });\n\n  if (adapters.length === 0) {\n    throw new Error(\n      `No wallet adapter could be loaded. ${failures.join(\"; \")}`,\n    );\n  }\n  if (failures.length > 0) {\n    console.error(\n      `[renown] Some wallet adapters failed to load. ${failures.join(\"; \")}`,\n    );\n  }\n  return adapters;\n}\n\nfunction describeError(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"],"mappings":";;AAQA,SAAgB,uBACd,QACA,OACS;CACT,MAAM,SAAS,IAAI,gBAAgB,MAAM;CACzC,OAAO,MAAM,MAAM,SACjB,KAAK,qBAAqB,MAAM,UAAU,OAAO,IAAI,KAAK,CAAC,CAC7D;AACF;AAIA,eAAsB,gBACpB,aAC0B;CAC1B,IAAI,CAAC,eAAe,YAAY,WAAW,GAAG,OAAO,CAAC;CAEtD,MAAM,UAAU,MAAM,QAAQ,WAC5B,YAAY,KAAK,eAAe,WAAW,KAAK,CAAC,CACnD;CAEA,MAAM,WAA4B,CAAC;CACnC,MAAM,WAAqB,CAAC;CAC5B,QAAQ,SAAS,QAAQ,UAAU;EACjC,MAAM,EAAE,SAAS,YAAY;EAC7B,IAAI,OAAO,WAAW,aACpB,SAAS,KAAK;GAAE,GAAG,OAAO;GAAO;EAAK,CAAC;OAEvC,SAAS,KAAK,GAAG,KAAK,GAAG,IAAI,cAAc,OAAO,MAAM,GAAG;CAE/D,CAAC;CAED,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,MACR,sCAAsC,SAAS,KAAK,IAAI,GAC1D;CAEF,IAAI,SAAS,SAAS,GACpB,QAAQ,MACN,iDAAiD,SAAS,KAAK,IAAI,GACrE;CAEF,OAAO;AACT;AAEA,SAAS,cAAc,OAAwB;CAC7C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D"}

package/dist/wallet/mock/factory.d.ts

@@ -1,9 +1,8 @@
-import { a as WalletAdapterImpl } from "../../types-C-hJrsQg.js";
-import { r as PHRenownMockAdapterConfig } from "../../meta-BesJP74N.js";
-
+import { a as WalletAdapterImpl } from "../../types-7xgrEnx7.js";
+import { r as PHRenownMockAdapterConfig } from "../../meta-Dpmn2Ywp.js";
 //#region src/wallet/mock/factory.d.ts
 /** Headless test/dev wallet adapter: `connect()` resolves immediately with a session backed by a viem local account (real EIP-712 signatures, no wallet UI or OAuth). **TEST/DEV ONLY; never enable in production** — it signs with a known key. See the reactor-browser README "Testing" and the Academy Renown auth guide. */
-declare function createMockAdapter(config: PHRenownMockAdapterConfig): WalletAdapterImpl;
+export declare function createMockAdapter(config: PHRenownMockAdapterConfig): WalletAdapterImpl;
 //#endregion
-export { createMockAdapter };
+export {};
 //# sourceMappingURL=factory.d.ts.map

package/dist/wallet/mock/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","names":[],"sources":["../../../src/wallet/mock/factory.ts"],"mappings":";;;;;iBAqBgB,iBAAA,CACd,MAAA,EAAQ,yBAAA,GACP,iBAAA"}
+{"version":3,"file":"factory.d.ts","names":[],"sources":["../../../src/wallet/mock/factory.ts"],"mappings":";;;;wBAqBgB,kBACd,QAAQ,4BACP"}

package/dist/wallet/mock/factory.js

@@ -1,4 +1,4 @@
-import { r as resolveMockMethods } from "../../meta-CHgd9Qd0.js";
+import { r as resolveMockMethods } from "../../meta-B2fHYlPD.js";
 import { privateKeyToAccount } from "viem/accounts";
 //#region src/wallet/mock/factory.ts
 const DEFAULT_TEST_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";

package/dist/wallet/mock/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","names":[],"sources":["../../../src/wallet/mock/factory.ts"],"sourcesContent":["import { privateKeyToAccount } from \"viem/accounts\";\nimport type { ComponentType, ReactNode } from \"react\";\nimport type { SignCredentialTypedData } from \"../../credential.js\";\nimport type {\n  WalletAdapterImpl,\n  WalletController,\n  WalletSession,\n} from \"../types.js\";\nimport { resolveMockMethods, type PHRenownMockAdapterConfig } from \"./meta.js\";\n\ntype Hex = `0x${string}`;\n\n// Well-known Anvil/Hardhat test account #0 private key. Default so tests need no\n// key; every connect resolves to its deterministic address.\nconst DEFAULT_TEST_KEY: Hex =\n  \"0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80\";\n\nconst MockProvider: ComponentType<{ children: ReactNode }> = (props) =>\n  props.children;\n\n/** Headless test/dev wallet adapter: `connect()` resolves immediately with a session backed by a viem local account (real EIP-712 signatures, no wallet UI or OAuth). **TEST/DEV ONLY; never enable in production** — it signs with a known key. See the reactor-browser README \"Testing\" and the Academy Renown auth guide. */\nexport function createMockAdapter(\n  config: PHRenownMockAdapterConfig,\n): WalletAdapterImpl {\n  const account = privateKeyToAccount(config.privateKey ?? DEFAULT_TEST_KEY);\n  const chainId = config.chainId ?? 1;\n  // Validated here too: the descriptor resolves these for its meta, but the\n  // factory is public API and may be called directly.\n  resolveMockMethods(config.methods);\n\n  const signTypedData: SignCredentialTypedData = (args) =>\n    account.signTypedData({\n      domain: args.domain,\n      types: args.types,\n      primaryType: args.primaryType,\n      message: args.message,\n    } as unknown as Parameters<typeof account.signTypedData>[0]);\n\n  const session: WalletSession = {\n    address: account.address,\n    chainId,\n    signTypedData,\n  };\n\n  const controller: WalletController = {\n    connect: () => Promise.resolve(session),\n    disconnect: () => Promise.resolve(),\n    getSession: () => session,\n  };\n\n  return { Provider: MockProvider, useController: () => controller };\n}\n"],"mappings":";;;AAcA,MAAM,mBACJ;AAEF,MAAM,gBAAwD,UAC5D,MAAM;;AAGR,SAAgB,kBACd,QACmB;CACnB,MAAM,UAAU,oBAAoB,OAAO,cAAc,iBAAiB;CAC1E,MAAM,UAAU,OAAO,WAAW;AAGlC,oBAAmB,OAAO,QAAQ;CAElC,MAAM,iBAA0C,SAC9C,QAAQ,cAAc;EACpB,QAAQ,KAAK;EACb,OAAO,KAAK;EACZ,aAAa,KAAK;EAClB,SAAS,KAAK;EACf,CAA2D;CAE9D,MAAM,UAAyB;EAC7B,SAAS,QAAQ;EACjB;EACA;EACD;CAED,MAAM,aAA+B;EACnC,eAAe,QAAQ,QAAQ,QAAQ;EACvC,kBAAkB,QAAQ,SAAS;EACnC,kBAAkB;EACnB;AAED,QAAO;EAAE,UAAU;EAAc,qBAAqB;EAAY"}
+{"version":3,"file":"factory.js","names":[],"sources":["../../../src/wallet/mock/factory.ts"],"sourcesContent":["import { privateKeyToAccount } from \"viem/accounts\";\nimport type { ComponentType, ReactNode } from \"react\";\nimport type { SignCredentialTypedData } from \"../../credential.js\";\nimport type {\n  WalletAdapterImpl,\n  WalletController,\n  WalletSession,\n} from \"../types.js\";\nimport { resolveMockMethods, type PHRenownMockAdapterConfig } from \"./meta.js\";\n\ntype Hex = `0x${string}`;\n\n// Well-known Anvil/Hardhat test account #0 private key. Default so tests need no\n// key; every connect resolves to its deterministic address.\nconst DEFAULT_TEST_KEY: Hex =\n  \"0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80\";\n\nconst MockProvider: ComponentType<{ children: ReactNode }> = (props) =>\n  props.children;\n\n/** Headless test/dev wallet adapter: `connect()` resolves immediately with a session backed by a viem local account (real EIP-712 signatures, no wallet UI or OAuth). **TEST/DEV ONLY; never enable in production** — it signs with a known key. See the reactor-browser README \"Testing\" and the Academy Renown auth guide. */\nexport function createMockAdapter(\n  config: PHRenownMockAdapterConfig,\n): WalletAdapterImpl {\n  const account = privateKeyToAccount(config.privateKey ?? DEFAULT_TEST_KEY);\n  const chainId = config.chainId ?? 1;\n  // Validated here too: the descriptor resolves these for its meta, but the\n  // factory is public API and may be called directly.\n  resolveMockMethods(config.methods);\n\n  const signTypedData: SignCredentialTypedData = (args) =>\n    account.signTypedData({\n      domain: args.domain,\n      types: args.types,\n      primaryType: args.primaryType,\n      message: args.message,\n    } as unknown as Parameters<typeof account.signTypedData>[0]);\n\n  const session: WalletSession = {\n    address: account.address,\n    chainId,\n    signTypedData,\n  };\n\n  const controller: WalletController = {\n    connect: () => Promise.resolve(session),\n    disconnect: () => Promise.resolve(),\n    getSession: () => session,\n  };\n\n  return { Provider: MockProvider, useController: () => controller };\n}\n"],"mappings":";;;AAcA,MAAM,mBACJ;AAEF,MAAM,gBAAwD,UAC5D,MAAM;;AAGR,SAAgB,kBACd,QACmB;CACnB,MAAM,UAAU,oBAAoB,OAAO,cAAc,gBAAgB;CACzE,MAAM,UAAU,OAAO,WAAW;CAGlC,mBAAmB,OAAO,OAAO;CAEjC,MAAM,iBAA0C,SAC9C,QAAQ,cAAc;EACpB,QAAQ,KAAK;EACb,OAAO,KAAK;EACZ,aAAa,KAAK;EAClB,SAAS,KAAK;CAChB,CAA2D;CAE7D,MAAM,UAAyB;EAC7B,SAAS,QAAQ;EACjB;EACA;CACF;CAEA,MAAM,aAA+B;EACnC,eAAe,QAAQ,QAAQ,OAAO;EACtC,kBAAkB,QAAQ,QAAQ;EAClC,kBAAkB;CACpB;CAEA,OAAO;EAAE,UAAU;EAAc,qBAAqB;CAAW;AACnE"}