@renown/sdk 6.2.3-dev.9 → 6.2.3

package/dist/{signer-DrjINLqt.js → signer-GzTlZLjR.js}

@@ -1,77 +1,8 @@
-import { a as DEFAULT_RENOWN_NETWORK_ID } from "./constants-BexAR53F.js";
-import { createVerifiableCredentialJwt, verifyCredential } from "did-jwt-vc";
-import { Resolver } from "did-resolver";
-import { getResolver } from "key-did-resolver";
+import { a as DEFAULT_RENOWN_NETWORK_ID } from "./constants-DVOF17NB.js";
+import { n as createAuthBearerToken } from "./utils-DLQ5VVqT.js";
+import { actionSignerIdentity, signActionV2 } from "@powerhousedao/shared/document-model";
 import { fromString, toString } from "uint8arrays";
 import { encodeDIDFromPub, getPublicKey } from "@didtools/key-webcrypto";
-//#region src/utils.ts
-/**
-* Parse a DID:pkh string to extract network, chain ID, and address information
-* @param did - The DID string in format "did:pkh:networkId:chainId:address"
-* @returns Parsed DID information
-* @throws Error if the DID format is invalid
-*/
-function parsePkhDid(did) {
-	const parts = did.split(":");
-	if (!did.startsWith("did:pkh:") || parts.length !== 5) throw new Error("Invalid pkh did");
-	const [, , networkId, chainIdStr, address] = parts;
-	if (!address.startsWith("0x")) throw new Error(`Invalid address: ${address}`);
-	const chainId = Number(chainIdStr);
-	if (isNaN(chainId)) throw new Error(`Invalid chain id: ${chainIdStr}`);
-	return {
-		chainId,
-		networkId,
-		address
-	};
-}
-async function verifyAuthBearerToken(jwt, options) {
-	try {
-		const now = parseInt(String(Date.now() / 1e3));
-		const verified = await verifyCredential(jwt, getResolver$1(), {
-			...options?.audience !== void 0 && { audience: options.audience },
-			policies: {
-				now: parseInt(String(Date.now() / 1e3)),
-				expirationDate: true,
-				issuanceDate: true
-			}
-		});
-		if (verified.payload.exp && verified.payload.exp < now) return false;
-		assertIsAuthCredential(verified);
-		return verified;
-	} catch (e) {
-		console.error(e);
-		return false;
-	}
-}
-function assertIsAuthCredential(credential) {
-	const subjectKeys = Object.keys(credential.verifiableCredential.credentialSubject);
-	if (![
-		"address",
-		"chainId",
-		"networkId"
-	].every((key) => subjectKeys.includes(key))) throw new Error("Invalid Auth Credential Subject:" + JSON.stringify(credential.verifiableCredential.credentialSubject, null, 2));
-}
-async function createAuthBearerToken(chainId, networkId, address, issuer, options) {
-	return await createVerifiableCredentialJwt({
-		sub: issuer.did,
-		vc: {
-			"@context": ["https://www.w3.org/2018/credentials/v1"],
-			type: ["VerifiableCredential"],
-			credentialSubject: {
-				chainId,
-				networkId,
-				address
-			}
-		},
-		aud: options?.aud
-	}, issuer, { expiresIn: options?.expiresIn });
-}
-const getResolver$1 = () => {
-	const keyResolver = getResolver();
-	if (!keyResolver) throw new Error("Failed to get key resolver");
-	return new Resolver(keyResolver);
-};
-//#endregion
 //#region src/crypto/utils.ts
 const ECDSA_ALGORITHM = {
 	name: "ECDSA",
@@ -145,7 +76,8 @@ var RenownCrypto = class RenownCrypto {
 		return {
 			did: this.did,
 			signer: async (data) => {
-				return toString(await this.sign(typeof data === "string" ? new TextEncoder().encode(data) : data), "base64url");
+				const signature = await this.sign(typeof data === "string" ? new TextEncoder().encode(data) : data);
+				return toString(signature, "base64url");
 			},
 			alg: "ES256"
 		};
@@ -216,6 +148,9 @@ var InvalidSignatureError = class extends Error {
 	}
 };
 var RenownCryptoSigner = class {
+	crypto;
+	appName;
+	user;
 	app;
 	constructor(crypto, appName, user) {
 		this.crypto = crypto;
@@ -235,48 +170,45 @@ var RenownCryptoSigner = class {
 	async verify(data, signature) {
 		if (!await this.crypto.verify(data, signature)) throw new InvalidSignatureError();
 	}
-	async signAction(action, abortSignal) {
+	async signAction(action, target, abortSignal) {
 		const hashField = action.context?.prevOpHash ?? "";
-		return this._signAction(action, hashField, abortSignal);
+		return this._signAction(action, target, hashField, abortSignal);
 	}
 	/**
-	* Signs an action including a predicted resulting state hash.
-	*
-	* The resulting hash is packed into the signature tuple's 4th element (index 3)
-	* using the format: `${prevStateHash}:${resultingStateHash}`
-	*
-	* This allows offline verification of documents without reducer logic:
-	* - Verifier can check that the signature is valid for the claimed resulting state
-	* - Verifier can compare claimed resulting state to actual operation.hash
-	*
-	* @param action - The action to sign
-	* @param resultingStateHash - The predicted hash of document state AFTER this action runs
-	* @param abortSignal - Optional abort signal
-	* @returns A Signature tuple with the resulting hash encoded in element [3]
+	* Signs an action including a predicted resulting state hash, packed into
+	* element [3] as `${prevStateHash}:${resultingStateHash}`.
 	*/
-	async signActionWithResultingState(action, resultingStateHash, abortSignal) {
+	async signActionWithResultingState(action, target, resultingStateHash, abortSignal) {
 		const hashField = `${action.context?.prevOpHash ?? ""}:${resultingStateHash}`;
-		return this._signAction(action, hashField, abortSignal);
+		return this._signAction(action, target, hashField, abortSignal);
 	}
 	/**
-	* Internal signing implementation shared by signAction and signActionWithResultingState.
+	* The pre-v2 tuple, over scope, type and input only. For peers and tests
+	* that still need one; it binds neither the document nor the signer.
 	*/
-	async _signAction(action, hashField, abortSignal) {
-		if (abortSignal?.aborted) throw new Error("Signing aborted");
-		const timestamp = ((/* @__PURE__ */ new Date()).getTime() / 1e3).toFixed(0);
-		const hash = await this.hashAction(action);
+	async signActionLegacy(action, abortSignal) {
 		if (abortSignal?.aborted) throw new Error("Signing aborted");
 		const params = [
-			timestamp,
+			((/* @__PURE__ */ new Date()).getTime() / 1e3).toFixed(0),
 			this.crypto.did,
-			hash,
-			hashField
+			await this.hashAction(action),
+			action.context?.prevOpHash ?? ""
 		];
-		const message = this.buildSignatureMessage(params);
-		const signatureBytes = await this.crypto.sign(message);
-		const signatureHex = `0x${this.arrayBufferToHex(signatureBytes)}`;
+		const signatureBytes = await this.crypto.sign(this.buildSignatureMessage(params));
+		if (abortSignal?.aborted) throw new Error("Signing aborted");
+		return [...params, `0x${this.arrayBufferToHex(signatureBytes)}`];
+	}
+	async _signAction(action, target, hashField, abortSignal) {
+		if (abortSignal?.aborted) throw new Error("Signing aborted");
+		const signature = await signActionV2({
+			action,
+			target,
+			signer: actionSignerIdentity(this),
+			sign: (message) => this.crypto.sign(message),
+			previousStateHash: hashField
+		});
 		if (abortSignal?.aborted) throw new Error("Signing aborted");
-		return [...params, signatureHex];
+		return signature;
 	}
 	async hashAction(action) {
 		const payload = [
@@ -361,7 +293,7 @@ function base58Decode(input) {
 	const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 	const ALPHABET_MAP = /* @__PURE__ */ new Map();
 	for (let i = 0; i < 58; i++) ALPHABET_MAP.set(ALPHABET[i], i);
-	if (input.length === 0) return new Uint8Array(0);
+	if (input.length === 0) return /* @__PURE__ */ new Uint8Array(0);
 	const bytes = [0];
 	for (const char of input) {
 		const value = ALPHABET_MAP.get(char);
@@ -394,7 +326,7 @@ function decompressP256PublicKey(compressed) {
 	for (let i = 1; i < compressed.length; i++) x = x << BigInt(8) | BigInt(compressed[i]);
 	let y = modPow((modPow(x, BigInt(3), p) + a * x + b) % p, (p + BigInt(1)) / BigInt(4), p);
 	if (y % BigInt(2) === BigInt(0) !== (prefix === 2)) y = p - y;
-	const uncompressed = new Uint8Array(65);
+	const uncompressed = /* @__PURE__ */ new Uint8Array(65);
 	uncompressed[0] = 4;
 	const xBytes = bigIntToBytes(x, 32);
 	const yBytes = bigIntToBytes(y, 32);
@@ -462,6 +394,6 @@ function signatureHasResultingHash(signature) {
 	return extractResultingHashFromSignature(signature) !== void 0;
 }
 //#endregion
-export { signatureHasResultingHash as a, ConnectCrypto as c, createAuthBearerToken as d, getResolver$1 as f, parseSignatureHashField as i, RenownCrypto as l, verifyAuthBearerToken as m, createSignatureVerifier as n, MemoryKeyStorage as o, parsePkhDid as p, extractResultingHashFromSignature as r, RenownCryptoBuilder as s, RenownCryptoSigner as t, assertIsAuthCredential as u };
+export { signatureHasResultingHash as a, ConnectCrypto as c, parseSignatureHashField as i, RenownCrypto as l, createSignatureVerifier as n, MemoryKeyStorage as o, extractResultingHashFromSignature as r, RenownCryptoBuilder as s, RenownCryptoSigner as t };
 
-//# sourceMappingURL=signer-DrjINLqt.js.map
+//# sourceMappingURL=signer-GzTlZLjR.js.map

package/dist/signer-GzTlZLjR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-GzTlZLjR.js","names":[],"sources":["../src/crypto/utils.ts","../src/crypto/renown-crypto.ts","../src/crypto/renown-crypto-builder.ts","../src/crypto/memory-key-storage.ts","../src/crypto/signer.ts"],"sourcesContent":["import { encodeDIDFromPub, getPublicKey } from \"@didtools/key-webcrypto\";\nimport type { DID, JwkKeyPair } from \"./types.js\";\n\nexport const ECDSA_ALGORITHM: EcKeyAlgorithm = {\n  name: \"ECDSA\",\n  namedCurve: \"P-256\",\n};\n\nexport const ECDSA_SIGN_ALGORITHM = {\n  name: \"ECDSA\",\n  namedCurve: \"P-256\",\n  hash: \"SHA-256\",\n};\n\nexport async function parseDid(keyPair: CryptoKeyPair): Promise<DID> {\n  return encodeDIDFromPub(await getPublicKey(keyPair)) as DID;\n}\n\nexport async function exportKeyPair(\n  keyPair: CryptoKeyPair,\n  subtleCrypto: SubtleCrypto,\n): Promise<JwkKeyPair> {\n  return {\n    publicKey: await subtleCrypto.exportKey(\"jwk\", keyPair.publicKey),\n    privateKey: await subtleCrypto.exportKey(\"jwk\", keyPair.privateKey),\n  };\n}\n\nexport async function importKeyPair(\n  jwkKeyPair: JwkKeyPair,\n  subtleCrypto: SubtleCrypto,\n  algorithm: EcKeyAlgorithm = ECDSA_ALGORITHM,\n): Promise<CryptoKeyPair> {\n  return {\n    publicKey: await subtleCrypto.importKey(\n      \"jwk\",\n      jwkKeyPair.publicKey,\n      algorithm,\n      true,\n      [\"verify\"],\n    ),\n    privateKey: await subtleCrypto.importKey(\n      \"jwk\",\n      jwkKeyPair.privateKey,\n      algorithm,\n      true,\n      [\"sign\"],\n    ),\n  };\n}\n\nexport async function generateKeyPair(\n  subtleCrypto: SubtleCrypto,\n  algorithm: EcKeyAlgorithm = ECDSA_ALGORITHM,\n): Promise<CryptoKeyPair> {\n  return subtleCrypto.generateKey(algorithm, true, [\"sign\", \"verify\"]);\n}\n","import { fromString, toString } from \"uint8arrays\";\nimport {\n  DEFAULT_RENOWN_CHAIN_ID,\n  DEFAULT_RENOWN_NETWORK_ID,\n} from \"../constants.js\";\nimport type { CreateBearerTokenOptions, Issuer } from \"../types.js\";\nimport { createAuthBearerToken } from \"../utils.js\";\nimport type { DID, IRenownCrypto, JsonWebKeyPairStorage } from \"./types.js\";\nimport { ECDSA_ALGORITHM, ECDSA_SIGN_ALGORITHM } from \"./utils.js\";\n\nexport class RenownCrypto implements IRenownCrypto {\n  #subtleCrypto: SubtleCrypto;\n  #keyPair: CryptoKeyPair;\n  #keyPairStorage: JsonWebKeyPairStorage;\n\n  readonly did: DID;\n  /** Chain id the bearer token is scoped to; keep it equal to the issuing Renown instance's. */\n  readonly chainId: number;\n\n  static algorithm = ECDSA_ALGORITHM;\n  static signAlgorithm = ECDSA_SIGN_ALGORITHM;\n\n  constructor(\n    keyPairStorage: JsonWebKeyPairStorage,\n    crypto: SubtleCrypto,\n    keyPair: CryptoKeyPair,\n    did: DID,\n    chainId = Number(DEFAULT_RENOWN_CHAIN_ID),\n  ) {\n    this.#keyPairStorage = keyPairStorage;\n    this.#subtleCrypto = crypto;\n    this.#keyPair = keyPair;\n    this.did = did;\n    this.chainId = chainId;\n  }\n\n  get publicKey() {\n    return this.#keyPair.publicKey;\n  }\n\n  async getBearerToken(\n    address: string | undefined,\n    options?: CreateBearerTokenOptions,\n  ): Promise<string> {\n    return await createAuthBearerToken(\n      this.chainId,\n      DEFAULT_RENOWN_NETWORK_ID,\n      address || this.did,\n      this.issuer,\n      options,\n    );\n  }\n\n  async removeDid(): Promise<void> {\n    await this.#keyPairStorage.removeKeyPair();\n  }\n\n  #stringToBytes(s: string): Uint8Array {\n    return fromString(s, \"utf-8\");\n  }\n\n  async sign(data: Uint8Array | string): Promise<Uint8Array> {\n    const dataBytes: Uint8Array =\n      typeof data === \"string\" ? this.#stringToBytes(data) : data;\n\n    const arrayBuffer = await this.#subtleCrypto.sign(\n      RenownCrypto.signAlgorithm,\n      this.#keyPair.privateKey,\n      dataBytes.buffer as ArrayBuffer,\n    );\n\n    return new Uint8Array(arrayBuffer);\n  }\n\n  async verify(data: Uint8Array, signature: Uint8Array): Promise<boolean> {\n    return this.#subtleCrypto.verify(\n      { name: \"ECDSA\", hash: \"SHA-256\" },\n      this.#keyPair.publicKey,\n      signature.buffer as ArrayBuffer,\n      data.buffer as ArrayBuffer,\n    );\n  }\n\n  get issuer(): Issuer {\n    return {\n      did: this.did,\n      signer: async (data: string | Uint8Array) => {\n        const signature = await this.sign(\n          typeof data === \"string\" ? new TextEncoder().encode(data) : data,\n        );\n        return toString(signature, \"base64url\");\n      },\n      alg: \"ES256\",\n    };\n  }\n}\n\n/**\n * @deprecated Use RenownCrypto instead\n */\nexport class ConnectCrypto extends RenownCrypto {}\n","import { RenownCrypto } from \"./renown-crypto.js\";\nimport type { JsonWebKeyPairStorage } from \"./types.js\";\nimport {\n  exportKeyPair,\n  generateKeyPair,\n  importKeyPair,\n  parseDid,\n} from \"./utils.js\";\n\nexport class RenownCryptoBuilder {\n  private keyPairStorage?: JsonWebKeyPairStorage;\n  private subtleCrypto?: SubtleCrypto;\n  private chainId?: number;\n\n  withKeyPairStorage(storage: JsonWebKeyPairStorage): this {\n    this.keyPairStorage = storage;\n    return this;\n  }\n\n  withSubtleCrypto(crypto: SubtleCrypto): this {\n    this.subtleCrypto = crypto;\n    return this;\n  }\n\n  // Scopes the bearer token to a chain (default 1). Match the Renown instance\n  // issuing credentials, or the token and the credential disagree.\n  withChainId(chainId: number): this {\n    this.chainId = chainId;\n    return this;\n  }\n\n  async build(): Promise<RenownCrypto> {\n    if (!this.keyPairStorage) {\n      throw new Error(\n        \"KeyPairStorage is required. Use withKeyPairStorage() to set it.\",\n      );\n    }\n\n    const subtleCrypto = this.subtleCrypto ?? globalThis.crypto.subtle;\n    const keyPair = await this.#initializeKeyPair(\n      subtleCrypto,\n      this.keyPairStorage,\n    );\n    const did = await parseDid(keyPair);\n\n    return new RenownCrypto(\n      this.keyPairStorage,\n      subtleCrypto,\n      keyPair,\n      did,\n      this.chainId,\n    );\n  }\n\n  async #initializeKeyPair(\n    subtleCrypto: SubtleCrypto,\n    keyPairStorage: JsonWebKeyPairStorage,\n  ): Promise<CryptoKeyPair> {\n    const loadedKeyPair = await keyPairStorage.loadKeyPair();\n    if (loadedKeyPair) {\n      return importKeyPair(loadedKeyPair, subtleCrypto);\n    }\n\n    const keyPair = await generateKeyPair(subtleCrypto);\n    const exported = await exportKeyPair(keyPair, subtleCrypto);\n    await keyPairStorage.saveKeyPair(exported);\n    return keyPair;\n  }\n}\n","import type { JsonWebKeyPairStorage, JwkKeyPair } from \"./types.js\";\n\nexport class MemoryKeyStorage implements JsonWebKeyPairStorage {\n  private keyPair: JwkKeyPair | undefined;\n\n  constructor(keyPair?: JwkKeyPair) {\n    this.keyPair = keyPair;\n  }\n\n  loadKeyPair() {\n    return Promise.resolve(this.keyPair);\n  }\n\n  saveKeyPair(keyPair: JwkKeyPair) {\n    this.keyPair = keyPair;\n    return Promise.resolve();\n  }\n\n  removeKeyPair() {\n    this.keyPair = undefined;\n    return Promise.resolve();\n  }\n}\n","import type {\n  Action,\n  ActionSigningTarget,\n  AppActionSigner,\n  ISigner,\n  Operation,\n  Signature,\n  SignatureVerificationHandler,\n  UserActionSigner,\n} from \"@powerhousedao/shared/document-model\";\nimport {\n  actionSignerIdentity,\n  signActionV2,\n} from \"@powerhousedao/shared/document-model\";\nimport type { IRenownCrypto } from \"./index.js\";\n\nexport class InvalidSignatureError extends Error {\n  constructor() {\n    super(\"Invalid signature\");\n  }\n}\n\nexport class RenownCryptoSigner implements ISigner {\n  readonly app: AppActionSigner;\n\n  constructor(\n    private readonly crypto: IRenownCrypto,\n    private readonly appName: string,\n    public user?: UserActionSigner,\n  ) {\n    this.app = {\n      key: this.crypto.did,\n      name: this.appName,\n    };\n  }\n\n  get publicKey() {\n    return this.crypto.publicKey;\n  }\n\n  async sign(data: Uint8Array): Promise<Uint8Array> {\n    return this.crypto.sign(data);\n  }\n\n  async verify(data: Uint8Array, signature: Uint8Array): Promise<void> {\n    const isValid = await this.crypto.verify(data, signature);\n    if (!isValid) {\n      throw new InvalidSignatureError();\n    }\n  }\n\n  async signAction(\n    action: Action,\n    target: ActionSigningTarget,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    const hashField = action.context?.prevOpHash ?? \"\";\n    return this._signAction(action, target, hashField, abortSignal);\n  }\n\n  /**\n   * Signs an action including a predicted resulting state hash, packed into\n   * element [3] as `${prevStateHash}:${resultingStateHash}`.\n   */\n  async signActionWithResultingState(\n    action: Action,\n    target: ActionSigningTarget,\n    resultingStateHash: string,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    const prevStateHash = action.context?.prevOpHash ?? \"\";\n    const hashField = `${prevStateHash}:${resultingStateHash}`;\n    return this._signAction(action, target, hashField, abortSignal);\n  }\n\n  /**\n   * The pre-v2 tuple, over scope, type and input only. For peers and tests\n   * that still need one; it binds neither the document nor the signer.\n   */\n  async signActionLegacy(\n    action: Action,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n\n    const params: [string, string, string, string] = [\n      (new Date().getTime() / 1000).toFixed(0),\n      this.crypto.did,\n      await this.hashAction(action),\n      action.context?.prevOpHash ?? \"\",\n    ];\n    const signatureBytes = await this.crypto.sign(\n      this.buildSignatureMessage(params),\n    );\n\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n    return [...params, `0x${this.arrayBufferToHex(signatureBytes)}`];\n  }\n\n  private async _signAction(\n    action: Action,\n    target: ActionSigningTarget,\n    hashField: string,\n    abortSignal?: AbortSignal,\n  ): Promise<Signature> {\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n\n    const signature = await signActionV2({\n      action,\n      target,\n      signer: actionSignerIdentity(this),\n      sign: (message) => this.crypto.sign(message),\n      previousStateHash: hashField,\n    });\n\n    if (abortSignal?.aborted) {\n      throw new Error(\"Signing aborted\");\n    }\n\n    return signature;\n  }\n\n  private async hashAction(action: Action): Promise<string> {\n    const payload = [\n      action.scope,\n      action.type,\n      JSON.stringify(action.input),\n    ].join(\"\");\n    const encoder = new TextEncoder();\n    const data = encoder.encode(payload);\n    const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n    return this.arrayBufferToBase64(hashBuffer);\n  }\n\n  private buildSignatureMessage(\n    params: [string, string, string, string],\n  ): Uint8Array {\n    const message = params.join(\"\");\n    const prefix = \"\\x19Signed Operation:\\n\" + message.length.toString();\n    const encoder = new TextEncoder();\n    return encoder.encode(prefix + message);\n  }\n\n  private arrayBufferToHex(buffer: Uint8Array | ArrayBuffer): string {\n    const bytes =\n      buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);\n    return Array.from(bytes)\n      .map((byte) => byte.toString(16).padStart(2, \"0\"))\n      .join(\"\");\n  }\n\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\n    const bytes = new Uint8Array(buffer);\n    let binary = \"\";\n    for (let i = 0; i < bytes.length; i++) {\n      binary += String.fromCharCode(bytes[i]);\n    }\n    return btoa(binary);\n  }\n}\n\n/**\n * Creates a signature verification handler that verifies signatures using the Web Crypto API.\n * The verification uses ECDSA with P-256 curve and SHA-256 hash, matching the RenownCrypto signing algorithm.\n */\nexport function createSignatureVerifier(\n  requireSignature = false,\n): SignatureVerificationHandler {\n  return async (operation: Operation, publicKey: string): Promise<boolean> => {\n    const signer = operation.action.context?.signer;\n    if (!signer || !publicKey) {\n      return !requireSignature;\n    }\n\n    const signatures = signer.signatures;\n    if (signatures.length === 0) {\n      return false;\n    }\n\n    const signature = signatures[signatures.length - 1];\n    const [timestamp, signerKey, hash, prevStateHash, signatureHex] = signature;\n\n    if (signerKey !== publicKey) {\n      return false;\n    }\n\n    const params: [string, string, string, string] = [\n      timestamp,\n      signerKey,\n      hash,\n      prevStateHash,\n    ];\n    const message = buildSignatureMessage(params);\n    const signatureBytes = hexToUint8Array(signatureHex);\n\n    const cryptoKey = await importPublicKey(publicKey);\n\n    const isValid = await crypto.subtle.verify(\n      { name: \"ECDSA\", hash: \"SHA-256\" },\n      cryptoKey,\n      signatureBytes.buffer as ArrayBuffer,\n      message.buffer as ArrayBuffer,\n    );\n\n    return isValid;\n  };\n}\n\nfunction buildSignatureMessage(\n  params: [string, string, string, string],\n): Uint8Array {\n  const message = params.join(\"\");\n  const prefix = \"\\x19Signed Operation:\\n\" + message.length.toString();\n  const encoder = new TextEncoder();\n  return encoder.encode(prefix + message);\n}\n\nfunction hexToUint8Array(hex: string): Uint8Array {\n  const cleanHex = hex.startsWith(\"0x\") ? hex.slice(2) : hex;\n  const bytes = new Uint8Array(cleanHex.length / 2);\n  for (let i = 0; i < cleanHex.length; i += 2) {\n    bytes[i / 2] = parseInt(cleanHex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nasync function importPublicKey(did: string): Promise<CryptoKey> {\n  const keyData = extractKeyFromDid(did);\n  return crypto.subtle.importKey(\n    \"raw\",\n    keyData.buffer as ArrayBuffer,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n}\n\nfunction extractKeyFromDid(did: string): Uint8Array {\n  const parts = did.split(\":\");\n  if (parts.length < 3 || parts[0] !== \"did\" || parts[1] !== \"key\") {\n    throw new Error(`Invalid DID format: ${did}`);\n  }\n\n  const multibaseKey = parts[2];\n  if (!multibaseKey.startsWith(\"z\")) {\n    throw new Error(`Unsupported multibase encoding: ${multibaseKey[0]}`);\n  }\n\n  const decoded = base58Decode(multibaseKey.slice(1));\n\n  if (decoded[0] !== 0x80 || decoded[1] !== 0x24) {\n    throw new Error(\"Not a P-256 public key multicodec\");\n  }\n\n  const compressedKey = decoded.slice(2);\n  return decompressP256PublicKey(compressedKey);\n}\n\nfunction base58Decode(input: string): Uint8Array {\n  const ALPHABET = \"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz\";\n  const ALPHABET_MAP = new Map<string, number>();\n  for (let i = 0; i < ALPHABET.length; i++) {\n    ALPHABET_MAP.set(ALPHABET[i], i);\n  }\n\n  if (input.length === 0) {\n    return new Uint8Array(0);\n  }\n\n  const bytes: number[] = [0];\n  for (const char of input) {\n    const value = ALPHABET_MAP.get(char);\n    if (value === undefined) {\n      throw new Error(`Invalid base58 character: ${char}`);\n    }\n\n    let carry = value;\n    for (let j = 0; j < bytes.length; j++) {\n      carry += bytes[j] * 58;\n      bytes[j] = carry & 0xff;\n      carry >>= 8;\n    }\n\n    while (carry > 0) {\n      bytes.push(carry & 0xff);\n      carry >>= 8;\n    }\n  }\n\n  for (const char of input) {\n    if (char !== \"1\") break;\n    bytes.push(0);\n  }\n\n  return new Uint8Array(bytes.reverse());\n}\n\nfunction decompressP256PublicKey(compressed: Uint8Array): Uint8Array {\n  if (compressed.length !== 33) {\n    throw new Error(`Invalid compressed key length: ${compressed.length}`);\n  }\n\n  const prefix = compressed[0];\n  if (prefix !== 0x02 && prefix !== 0x03) {\n    throw new Error(`Invalid compression prefix: ${prefix}`);\n  }\n\n  const p = BigInt(\n    \"0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff\",\n  );\n  const a = BigInt(\n    \"0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc\",\n  );\n  const b = BigInt(\n    \"0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b\",\n  );\n\n  let x = BigInt(0);\n  for (let i = 1; i < compressed.length; i++) {\n    x = (x << BigInt(8)) | BigInt(compressed[i]);\n  }\n\n  const ySquared = (modPow(x, BigInt(3), p) + a * x + b) % p;\n  let y = modPow(ySquared, (p + BigInt(1)) / BigInt(4), p);\n\n  const isYEven = y % BigInt(2) === BigInt(0);\n  const shouldBeEven = prefix === 0x02;\n  if (isYEven !== shouldBeEven) {\n    y = p - y;\n  }\n\n  const uncompressed = new Uint8Array(65);\n  uncompressed[0] = 0x04;\n\n  const xBytes = bigIntToBytes(x, 32);\n  const yBytes = bigIntToBytes(y, 32);\n\n  uncompressed.set(xBytes, 1);\n  uncompressed.set(yBytes, 33);\n\n  return uncompressed;\n}\n\nfunction modPow(base: bigint, exp: bigint, mod: bigint): bigint {\n  let result = BigInt(1);\n  base = base % mod;\n  while (exp > BigInt(0)) {\n    if (exp % BigInt(2) === BigInt(1)) {\n      result = (result * base) % mod;\n    }\n    exp = exp >> BigInt(1);\n    base = (base * base) % mod;\n  }\n  return result;\n}\n\nfunction bigIntToBytes(n: bigint, length: number): Uint8Array {\n  const bytes = new Uint8Array(length);\n  for (let i = length - 1; i >= 0; i--) {\n    bytes[i] = Number(n & BigInt(0xff));\n    n = n >> BigInt(8);\n  }\n  return bytes;\n}\n\n/**\n * Parses the hash field (element [3]) from a signature tuple.\n *\n * Supports two formats:\n * - Old format: just `prevStateHash` (no colon)\n * - New format: `prevStateHash:resultingStateHash` (colon-separated)\n *\n * @param hashField - The 4th element of a Signature tuple\n * @returns Object with prevStateHash and optional resultingStateHash\n */\nexport function parseSignatureHashField(hashField: string): {\n  prevStateHash: string;\n  resultingStateHash: string | undefined;\n} {\n  const colonIndex = hashField.indexOf(\":\");\n\n  if (colonIndex === -1) {\n    return {\n      prevStateHash: hashField,\n      resultingStateHash: undefined,\n    };\n  }\n\n  return {\n    prevStateHash: hashField.substring(0, colonIndex),\n    resultingStateHash: hashField.substring(colonIndex + 1),\n  };\n}\n\n/**\n * Extracts the resulting state hash from a signature, if present.\n *\n * @param signature - A Signature tuple\n * @returns The resulting state hash, or undefined if not present\n */\nexport function extractResultingHashFromSignature(\n  signature: Signature,\n): string | undefined {\n  const hashField = signature[3];\n  const { resultingStateHash } = parseSignatureHashField(hashField);\n  return resultingStateHash;\n}\n\n/**\n * Checks if a signature includes a resulting state hash.\n *\n * @param signature - A Signature tuple\n * @returns true if the signature includes a resulting state hash\n */\nexport function signatureHasResultingHash(signature: Signature): boolean {\n  return extractResultingHashFromSignature(signature) !== undefined;\n}\n"],"mappings":";;;;;;AAGA,MAAa,kBAAkC;CAC7C,MAAM;CACN,YAAY;AACd;AAEA,MAAa,uBAAuB;CAClC,MAAM;CACN,YAAY;CACZ,MAAM;AACR;AAEA,eAAsB,SAAS,SAAsC;CACnE,OAAO,iBAAiB,MAAM,aAAa,OAAO,CAAC;AACrD;AAEA,eAAsB,cACpB,SACA,cACqB;CACrB,OAAO;EACL,WAAW,MAAM,aAAa,UAAU,OAAO,QAAQ,SAAS;EAChE,YAAY,MAAM,aAAa,UAAU,OAAO,QAAQ,UAAU;CACpE;AACF;AAEA,eAAsB,cACpB,YACA,cACA,YAA4B,iBACJ;CACxB,OAAO;EACL,WAAW,MAAM,aAAa,UAC5B,OACA,WAAW,WACX,WACA,MACA,CAAC,QAAQ,CACX;EACA,YAAY,MAAM,aAAa,UAC7B,OACA,WAAW,YACX,WACA,MACA,CAAC,MAAM,CACT;CACF;AACF;AAEA,eAAsB,gBACpB,cACA,YAA4B,iBACJ;CACxB,OAAO,aAAa,YAAY,WAAW,MAAM,CAAC,QAAQ,QAAQ,CAAC;AACrE;;;AC9CA,IAAa,eAAb,MAAa,aAAsC;CACjD;CACA;CACA;CAEA;;CAEA;CAEA,OAAO,YAAY;CACnB,OAAO,gBAAgB;CAEvB,YACE,gBACA,QACA,SACA,KACA,UAAU,GACV;EACA,KAAK,kBAAkB;EACvB,KAAK,gBAAgB;EACrB,KAAK,WAAW;EAChB,KAAK,MAAM;EACX,KAAK,UAAU;CACjB;CAEA,IAAI,YAAY;EACd,OAAO,KAAK,SAAS;CACvB;CAEA,MAAM,eACJ,SACA,SACiB;EACjB,OAAO,MAAM,sBACX,KAAK,SACL,2BACA,WAAW,KAAK,KAChB,KAAK,QACL,OACF;CACF;CAEA,MAAM,YAA2B;EAC/B,MAAM,KAAK,gBAAgB,cAAc;CAC3C;CAEA,eAAe,GAAuB;EACpC,OAAO,WAAW,GAAG,OAAO;CAC9B;CAEA,MAAM,KAAK,MAAgD;EACzD,MAAM,YACJ,OAAO,SAAS,WAAW,KAAK,eAAe,IAAI,IAAI;EAEzD,MAAM,cAAc,MAAM,KAAK,cAAc,KAC3C,aAAa,eACb,KAAK,SAAS,YACd,UAAU,MACZ;EAEA,OAAO,IAAI,WAAW,WAAW;CACnC;CAEA,MAAM,OAAO,MAAkB,WAAyC;EACtE,OAAO,KAAK,cAAc,OACxB;GAAE,MAAM;GAAS,MAAM;EAAU,GACjC,KAAK,SAAS,WACd,UAAU,QACV,KAAK,MACP;CACF;CAEA,IAAI,SAAiB;EACnB,OAAO;GACL,KAAK,KAAK;GACV,QAAQ,OAAO,SAA8B;IAC3C,MAAM,YAAY,MAAM,KAAK,KAC3B,OAAO,SAAS,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,IAAI,IAC9D;IACA,OAAO,SAAS,WAAW,WAAW;GACxC;GACA,KAAK;EACP;CACF;AACF;;;;AAKA,IAAa,gBAAb,cAAmC,aAAa,CAAC;;;AC3FjD,IAAa,sBAAb,MAAiC;CAC/B;CACA;CACA;CAEA,mBAAmB,SAAsC;EACvD,KAAK,iBAAiB;EACtB,OAAO;CACT;CAEA,iBAAiB,QAA4B;EAC3C,KAAK,eAAe;EACpB,OAAO;CACT;CAIA,YAAY,SAAuB;EACjC,KAAK,UAAU;EACf,OAAO;CACT;CAEA,MAAM,QAA+B;EACnC,IAAI,CAAC,KAAK,gBACR,MAAM,IAAI,MACR,iEACF;EAGF,MAAM,eAAe,KAAK,gBAAgB,WAAW,OAAO;EAC5D,MAAM,UAAU,MAAM,KAAK,mBACzB,cACA,KAAK,cACP;EACA,MAAM,MAAM,MAAM,SAAS,OAAO;EAElC,OAAO,IAAI,aACT,KAAK,gBACL,cACA,SACA,KACA,KAAK,OACP;CACF;CAEA,MAAM,mBACJ,cACA,gBACwB;EACxB,MAAM,gBAAgB,MAAM,eAAe,YAAY;EACvD,IAAI,eACF,OAAO,cAAc,eAAe,YAAY;EAGlD,MAAM,UAAU,MAAM,gBAAgB,YAAY;EAClD,MAAM,WAAW,MAAM,cAAc,SAAS,YAAY;EAC1D,MAAM,eAAe,YAAY,QAAQ;EACzC,OAAO;CACT;AACF;;;AClEA,IAAa,mBAAb,MAA+D;CAC7D;CAEA,YAAY,SAAsB;EAChC,KAAK,UAAU;CACjB;CAEA,cAAc;EACZ,OAAO,QAAQ,QAAQ,KAAK,OAAO;CACrC;CAEA,YAAY,SAAqB;EAC/B,KAAK,UAAU;EACf,OAAO,QAAQ,QAAQ;CACzB;CAEA,gBAAgB;EACd,KAAK,UAAU,KAAA;EACf,OAAO,QAAQ,QAAQ;CACzB;AACF;;;ACNA,IAAa,wBAAb,cAA2C,MAAM;CAC/C,cAAc;EACZ,MAAM,mBAAmB;CAC3B;AACF;AAEA,IAAa,qBAAb,MAAmD;CAI9B;CACA;CACV;CALT;CAEA,YACE,QACA,SACA,MACA;EAHiB,KAAA,SAAA;EACA,KAAA,UAAA;EACV,KAAA,OAAA;EAEP,KAAK,MAAM;GACT,KAAK,KAAK,OAAO;GACjB,MAAM,KAAK;EACb;CACF;CAEA,IAAI,YAAY;EACd,OAAO,KAAK,OAAO;CACrB;CAEA,MAAM,KAAK,MAAuC;EAChD,OAAO,KAAK,OAAO,KAAK,IAAI;CAC9B;CAEA,MAAM,OAAO,MAAkB,WAAsC;EAEnE,IAAI,CAAC,MADiB,KAAK,OAAO,OAAO,MAAM,SAAS,GAEtD,MAAM,IAAI,sBAAsB;CAEpC;CAEA,MAAM,WACJ,QACA,QACA,aACoB;EACpB,MAAM,YAAY,OAAO,SAAS,cAAc;EAChD,OAAO,KAAK,YAAY,QAAQ,QAAQ,WAAW,WAAW;CAChE;;;;;CAMA,MAAM,6BACJ,QACA,QACA,oBACA,aACoB;EAEpB,MAAM,YAAY,GADI,OAAO,SAAS,cAAc,GACjB,GAAG;EACtC,OAAO,KAAK,YAAY,QAAQ,QAAQ,WAAW,WAAW;CAChE;;;;;CAMA,MAAM,iBACJ,QACA,aACoB;EACpB,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAGnC,MAAM,SAA2C;qBAC9C,IAAI,KAAK,EAAA,CAAE,QAAQ,IAAI,IAAA,CAAM,QAAQ,CAAC;GACvC,KAAK,OAAO;GACZ,MAAM,KAAK,WAAW,MAAM;GAC5B,OAAO,SAAS,cAAc;EAChC;EACA,MAAM,iBAAiB,MAAM,KAAK,OAAO,KACvC,KAAK,sBAAsB,MAAM,CACnC;EAEA,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAEnC,OAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,iBAAiB,cAAc,GAAG;CACjE;CAEA,MAAc,YACZ,QACA,QACA,WACA,aACoB;EACpB,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAGnC,MAAM,YAAY,MAAM,aAAa;GACnC;GACA;GACA,QAAQ,qBAAqB,IAAI;GACjC,OAAO,YAAY,KAAK,OAAO,KAAK,OAAO;GAC3C,mBAAmB;EACrB,CAAC;EAED,IAAI,aAAa,SACf,MAAM,IAAI,MAAM,iBAAiB;EAGnC,OAAO;CACT;CAEA,MAAc,WAAW,QAAiC;EACxD,MAAM,UAAU;GACd,OAAO;GACP,OAAO;GACP,KAAK,UAAU,OAAO,KAAK;EAC7B,CAAC,CAAC,KAAK,EAAE;EAET,MAAM,OAAO,IADO,YACD,CAAC,CAAC,OAAO,OAAO;EACnC,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;EAC7D,OAAO,KAAK,oBAAoB,UAAU;CAC5C;CAEA,sBACE,QACY;EACZ,MAAM,UAAU,OAAO,KAAK,EAAE;EAC9B,MAAM,SAAS,yBAA4B,QAAQ,OAAO,SAAS;EAEnE,OAAO,IADa,YACP,CAAC,CAAC,OAAO,SAAS,OAAO;CACxC;CAEA,iBAAyB,QAA0C;EACjE,MAAM,QACJ,kBAAkB,aAAa,SAAS,IAAI,WAAW,MAAM;EAC/D,OAAO,MAAM,KAAK,KAAK,CAAC,CACrB,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CACjD,KAAK,EAAE;CACZ;CAEA,oBAA4B,QAA6B;EACvD,MAAM,QAAQ,IAAI,WAAW,MAAM;EACnC,IAAI,SAAS;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAChC,UAAU,OAAO,aAAa,MAAM,EAAE;EAExC,OAAO,KAAK,MAAM;CACpB;AACF;;;;;AAMA,SAAgB,wBACd,mBAAmB,OACW;CAC9B,OAAO,OAAO,WAAsB,cAAwC;EAC1E,MAAM,SAAS,UAAU,OAAO,SAAS;EACzC,IAAI,CAAC,UAAU,CAAC,WACd,OAAO,CAAC;EAGV,MAAM,aAAa,OAAO;EAC1B,IAAI,WAAW,WAAW,GACxB,OAAO;EAIT,MAAM,CAAC,WAAW,WAAW,MAAM,eAAe,gBADhC,WAAW,WAAW,SAAS;EAGjD,IAAI,cAAc,WAChB,OAAO;EAST,MAAM,UAAU,sBAAsB;GALpC;GACA;GACA;GACA;EAEyC,CAAC;EAC5C,MAAM,iBAAiB,gBAAgB,YAAY;EAEnD,MAAM,YAAY,MAAM,gBAAgB,SAAS;EASjD,OAAO,MAPe,OAAO,OAAO,OAClC;GAAE,MAAM;GAAS,MAAM;EAAU,GACjC,WACA,eAAe,QACf,QAAQ,MACV;CAGF;AACF;AAEA,SAAS,sBACP,QACY;CACZ,MAAM,UAAU,OAAO,KAAK,EAAE;CAC9B,MAAM,SAAS,yBAA4B,QAAQ,OAAO,SAAS;CAEnE,OAAO,IADa,YACP,CAAC,CAAC,OAAO,SAAS,OAAO;AACxC;AAEA,SAAS,gBAAgB,KAAyB;CAChD,MAAM,WAAW,IAAI,WAAW,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI;CACvD,MAAM,QAAQ,IAAI,WAAW,SAAS,SAAS,CAAC;CAChD,KAAK,IAAI,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK,GACxC,MAAM,IAAI,KAAK,SAAS,SAAS,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;CAE1D,OAAO;AACT;AAEA,eAAe,gBAAgB,KAAiC;CAC9D,MAAM,UAAU,kBAAkB,GAAG;CACrC,OAAO,OAAO,OAAO,UACnB,OACA,QAAQ,QACR;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,MACA,CAAC,QAAQ,CACX;AACF;AAEA,SAAS,kBAAkB,KAAyB;CAClD,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,IAAI,MAAM,SAAS,KAAK,MAAM,OAAO,SAAS,MAAM,OAAO,OACzD,MAAM,IAAI,MAAM,uBAAuB,KAAK;CAG9C,MAAM,eAAe,MAAM;CAC3B,IAAI,CAAC,aAAa,WAAW,GAAG,GAC9B,MAAM,IAAI,MAAM,mCAAmC,aAAa,IAAI;CAGtE,MAAM,UAAU,aAAa,aAAa,MAAM,CAAC,CAAC;CAElD,IAAI,QAAQ,OAAO,OAAQ,QAAQ,OAAO,IACxC,MAAM,IAAI,MAAM,mCAAmC;CAIrD,OAAO,wBADe,QAAQ,MAAM,CACO,CAAC;AAC9C;AAEA,SAAS,aAAa,OAA2B;CAC/C,MAAM,WAAW;CACjB,MAAM,+BAAe,IAAI,IAAoB;CAC7C,KAAK,IAAI,IAAI,GAAG,IAAI,IAAiB,KACnC,aAAa,IAAI,SAAS,IAAI,CAAC;CAGjC,IAAI,MAAM,WAAW,GACnB,uBAAO,IAAI,WAAW,CAAC;CAGzB,MAAM,QAAkB,CAAC,CAAC;CAC1B,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,QAAQ,aAAa,IAAI,IAAI;EACnC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,6BAA6B,MAAM;EAGrD,IAAI,QAAQ;EACZ,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACrC,SAAS,MAAM,KAAK;GACpB,MAAM,KAAK,QAAQ;GACnB,UAAU;EACZ;EAEA,OAAO,QAAQ,GAAG;GAChB,MAAM,KAAK,QAAQ,GAAI;GACvB,UAAU;EACZ;CACF;CAEA,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,SAAS,KAAK;EAClB,MAAM,KAAK,CAAC;CACd;CAEA,OAAO,IAAI,WAAW,MAAM,QAAQ,CAAC;AACvC;AAEA,SAAS,wBAAwB,YAAoC;CACnE,IAAI,WAAW,WAAW,IACxB,MAAM,IAAI,MAAM,kCAAkC,WAAW,QAAQ;CAGvE,MAAM,SAAS,WAAW;CAC1B,IAAI,WAAW,KAAQ,WAAW,GAChC,MAAM,IAAI,MAAM,+BAA+B,QAAQ;CAGzD,MAAM,IAAI,OACR,oEACF;CACA,MAAM,IAAI,OACR,oEACF;CACA,MAAM,IAAI,OACR,oEACF;CAEA,IAAI,IAAI,OAAO,CAAC;CAChB,KAAK,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,KACrC,IAAK,KAAK,OAAO,CAAC,IAAK,OAAO,WAAW,EAAE;CAI7C,IAAI,IAAI,QADU,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,IAC/B,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;CAIvD,IAFgB,IAAI,OAAO,CAAC,MAAM,OAAO,CAAC,OACrB,WAAW,IAE9B,IAAI,IAAI;CAGV,MAAM,+BAAe,IAAI,WAAW,EAAE;CACtC,aAAa,KAAK;CAElB,MAAM,SAAS,cAAc,GAAG,EAAE;CAClC,MAAM,SAAS,cAAc,GAAG,EAAE;CAElC,aAAa,IAAI,QAAQ,CAAC;CAC1B,aAAa,IAAI,QAAQ,EAAE;CAE3B,OAAO;AACT;AAEA,SAAS,OAAO,MAAc,KAAa,KAAqB;CAC9D,IAAI,SAAS,OAAO,CAAC;CACrB,OAAO,OAAO;CACd,OAAO,MAAM,OAAO,CAAC,GAAG;EACtB,IAAI,MAAM,OAAO,CAAC,MAAM,OAAO,CAAC,GAC9B,SAAU,SAAS,OAAQ;EAE7B,MAAM,OAAO,OAAO,CAAC;EACrB,OAAQ,OAAO,OAAQ;CACzB;CACA,OAAO;AACT;AAEA,SAAS,cAAc,GAAW,QAA4B;CAC5D,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,KAAK,IAAI,IAAI,SAAS,GAAG,KAAK,GAAG,KAAK;EACpC,MAAM,KAAK,OAAO,IAAI,OAAO,GAAI,CAAC;EAClC,IAAI,KAAK,OAAO,CAAC;CACnB;CACA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,wBAAwB,WAGtC;CACA,MAAM,aAAa,UAAU,QAAQ,GAAG;CAExC,IAAI,eAAe,IACjB,OAAO;EACL,eAAe;EACf,oBAAoB,KAAA;CACtB;CAGF,OAAO;EACL,eAAe,UAAU,UAAU,GAAG,UAAU;EAChD,oBAAoB,UAAU,UAAU,aAAa,CAAC;CACxD;AACF;;;;;;;AAQA,SAAgB,kCACd,WACoB;CACpB,MAAM,YAAY,UAAU;CAC5B,MAAM,EAAE,uBAAuB,wBAAwB,SAAS;CAChE,OAAO;AACT;;;;;;;AAQA,SAAgB,0BAA0B,WAA+B;CACvE,OAAO,kCAAkC,SAAS,MAAM,KAAA;AAC1D"}

package/dist/signer-trust-FmbMTn39.d.ts

@@ -0,0 +1,53 @@
+import { yt as SwitchboardSource } from "./types-Ceiz2dkk.js";
+import { ActionSigner } from "@powerhousedao/shared/document-model";
+//#region src/discovery.d.ts
+interface ResolveSwitchboardEndpointOptions {
+  switchboardUrl?: string;
+  baseUrl?: string;
+  timeoutMs?: number;
+}
+declare function resolveSwitchboardEndpoint(options: ResolveSwitchboardEndpointOptions): Promise<string | undefined>;
+//#endregion
+//#region src/signer-trust.d.ts
+type SignerUser = ActionSigner["user"];
+/** A signer whose `app.key` and `user` are read on every ask. */
+interface RenownOwnSigner {
+  readonly app?: {
+    readonly key: string;
+  };
+  readonly user?: SignerUser;
+}
+interface RenownTrustPolicyOptions {
+  /** Serves the renown read model; without it, Renown's REST API is read. */
+  switchboard?: SwitchboardSource;
+  /** Renown base URL for the REST lookup. Defaults to DEFAULT_RENOWN_URL. */
+  renownUrl?: string;
+  /** This node's signer, read on every ask; its key signing as its current user is accepted without a lookup. Wins over `self`. */
+  ownSigner?: RenownOwnSigner;
+  /**
+   * A snapshot of this node's key and user, for a pooled worker whose signer
+   * cannot cross the thread boundary. Only matches the worker's own key.
+   */
+  self?: {
+    key: string;
+    user: SignerUser;
+  };
+  /** How many acceptances are remembered. Defaults to 10000. */
+  maxAccepted?: number;
+  /** How long a refusal is remembered before asking again. Defaults to 60s. */
+  refusalTtlMs?: number;
+}
+/** Structurally a reactor `SignatureTrustPolicy`. */
+interface RenownTrustPolicy {
+  authorizeSigner(signer: ActionSigner, key: string, documentId: string): Promise<boolean>;
+}
+/**
+ * Accepts a key the user's EIP-712 Renown credential delegates to, ignoring
+ * expiry and revocation. Verdicts are cached per (address, key); this node's
+ * own key is checked before the cache and never cached.
+ */
+declare function createRenownTrustPolicy(options?: RenownTrustPolicyOptions): RenownTrustPolicy;
+//#endregion
+export { ResolveSwitchboardEndpointOptions as a, createRenownTrustPolicy as i, RenownTrustPolicy as n, resolveSwitchboardEndpoint as o, RenownTrustPolicyOptions as r, RenownOwnSigner as t };
+export {};
+//# sourceMappingURL=signer-trust-FmbMTn39.d.ts.map

package/dist/signer-trust-FmbMTn39.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-trust-FmbMTn39.d.ts","names":[],"sources":["../src/discovery.ts","../src/signer-trust.ts"],"mappings":";;;UAAiB;EAEf;EAEA;EAEA;;iBAcoB,2BACpB,SAAS,oCACR;;;KChBE,aAAa;;UAGD;WACN;aAAiB;;WACjB,OAAO;;UAGD;;EAEf,cAAc;;EAEd;;EAEA,YAAY;;;;;EAKZ;IAAS;IAAa,MAAM;;;EAE5B;;EAEA;;;UAIe;EACf,gBACE,QAAQ,cACR,aACA,qBACC;;;;;;;iBAWW,wBACd,UAAS,2BACR"}