@tari-project/ootle-wallet-daemon-signer 0.1.0

package/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2023, The Tari Developer Community
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,102 @@
+# @tari-project/ootle-wallet-daemon-signer
+
+Remote `Signer` for the Tari Ootle SDK — delegates signing to a running
+`tari_ootle_walletd` process via JRPC. The secret key never enters JavaScript
+memory.
+
+## Runtime support
+
+| Package                                    | Browser | Node ≥ 22            | Notes                              |
+| ------------------------------------------ | ------- | -------------------- | ---------------------------------- |
+| `@tari-project/ootle-wallet-daemon-signer` | ✓       | ✓ (with `authToken`) | WebAuthn passkeys are browser-only |
+
+> **Node note:** Node ≥ 22 currently requires
+> `NODE_OPTIONS=--experimental-wasm-modules` when running under `tsx` or plain
+> `node` because the SDK loads `@tari-project/ootle-wasm` as an ES module. See
+> [`examples/node/README.md`](../../examples/node/README.md) for the rationale
+> and forward plan.
+
+## Browser vs Node
+
+The daemon's auth method is configured server-side and decides the runtime
+profile of this signer.
+
+### Browser
+
+The daemon's auth method is typically `"webauthn"` — passkeys via
+`navigator.credentials`. Pass just the URL and `WalletDaemonSigner.connect`
+runs the WebAuthn flow automatically:
+
+```ts
+import { WalletDaemonSigner } from "@tari-project/ootle-wallet-daemon-signer";
+
+const signer = await WalletDaemonSigner.connect({ url: "http://localhost:18103" });
+```
+
+### Node
+
+WebAuthn is browser-only. If the daemon is configured for `method: "webauthn"`
+and you call `connect({ url })` from Node, the SDK throws the canonical
+actionable error:
+
+```text
+WebAuthn is browser-only. Run in a browser, or pass `authToken` explicitly to `WalletDaemonSigner.connect({ url, authToken })` from Node.
+```
+
+The Node answer is to **pre-fetch the auth token via your own flow** (or use
+the daemon's `method: "none"` if you control its config) and pass it
+explicitly to `connect`:
+
+```ts
+import { WalletDaemonSigner } from "@tari-project/ootle-wallet-daemon-signer";
+
+const signer = await WalletDaemonSigner.connect({
+  url: "http://localhost:18103",
+  authToken: process.env.OOTLE_DAEMON_AUTH_TOKEN, // pre-fetched out-of-band
+});
+```
+
+When `authToken` is supplied, the signer bypasses the WebAuthn challenge
+entirely and presents the token directly to the daemon.
+
+## Install
+
+```sh
+pnpm add @tari-project/ootle-wallet-daemon-signer
+```
+
+## Hello world
+
+Connect, read the account address, and sign a transaction:
+
+```ts
+import { WalletDaemonSigner } from "@tari-project/ootle-wallet-daemon-signer";
+
+const signer = await WalletDaemonSigner.connect({
+  url: "http://localhost:18103",
+  authToken: process.env.OOTLE_DAEMON_AUTH_TOKEN,
+});
+
+const address = await signer.getAddress();
+const publicKey = await signer.getPublicKey();
+
+const signatures = await signer.signTransaction(unsignedTx);
+```
+
+For the in-browser passkey flow end-to-end, see the
+[`connect-button/`](../../examples/connect-button/) example app.
+
+## Deep dive
+
+For the full `WalletDaemonSignerOptions` surface and the daemon-side
+`tari_ootle_walletd` invocation, see the
+[root README's "`@tari-project/ootle-wallet-daemon-signer`" section](../../README.md#tari-projectootle-wallet-daemon-signer).
+
+## Examples
+
+Runnable browser apps and Node scripts live under
+[`examples/`](../../examples/README.md). The
+[`connect-button/`](../../examples/connect-button/) React app demonstrates the
+browser passkey flow; for headless Node usage see
+[`examples/node/README.md`](../../examples/node/README.md) and pass an
+`authToken` as shown above.

package/dist/index.d.ts

@@ -0,0 +1,121 @@
+import { JrpcPermission } from '@tari-project/ootle-ts-bindings';
+import { Signer } from '@tari-project/ootle';
+import { TransactionSignature } from '@tari-project/ootle-ts-bindings';
+import { UnsignedTransactionV1 } from '@tari-project/ootle-ts-bindings';
+import { WalletDaemonClient } from '@tari-project/wallet_jrpc_client';
+
+/**
+ * Authenticate with the wallet daemon, automatically handling the configured
+ * auth method ("none" or "webauthn").
+ *
+ * For "none", a token is requested directly. Works in both browsers and Node.
+ * For "webauthn", the browser's WebAuthn API is used to register or login,
+ * then the resulting credential is exchanged for a token. **Browser-only** —
+ * in Node, pass `authToken` to `WalletDaemonSigner.connect({ url, authToken })`
+ * instead of calling this flow.
+ *
+ * @returns The JWT auth token.
+ * @throws {SignerError} if the daemon advertises an unsupported auth method, the
+ *   WebAuthn flow is invoked outside a browser, the WebAuthn challenge is malformed,
+ *   or the user cancels the WebAuthn prompt.
+ */
+export declare function authenticate(client: WalletDaemonClient, options?: AuthOptions): Promise<string>;
+
+export declare interface AuthOptions {
+    /** Permissions to request from the wallet daemon. Defaults to `["Admin"]`. */
+    permissions?: JrpcPermission[];
+    /** Application name used as the WebAuthn username/identifier. Defaults to `"tari-wallet-sdk"`. */
+    appName?: string;
+}
+
+export { WalletDaemonClient }
+
+/**
+ * A Signer that delegates signing to a running wallet daemon over its JRPC interface,
+ * using `@tari-project/wallet_jrpc_client` for all communication.
+ *
+ * The wallet daemon holds the secret key and returns signatures, so the key never
+ * lives in JavaScript memory. This signer is suitable for server-side or trusted
+ * environment usage where the wallet daemon is reachable.
+ *
+ * **Stealth boundary (intentionally not implemented).** Client-side stealth spending and
+ * scanning need the raw view secret, which the daemon never exports — it keeps the key and
+ * exposes its own *server-side* stealth JRPC instead (`stealthTransfer`, `stealthUtxosList`,
+ * `stealthUtxosDecryptValue`, `accountsAssociateStealthResource`, `viewVaultBalance` on
+ * `@tari-project/wallet_jrpc_client`). This signer therefore does **not** implement
+ * `Signer.addStealthSignature` and its {@link getViewSecret} throws. For client-side stealth
+ * spend, use {@link SecretKeyWallet}; for daemon-managed stealth, call the daemon's stealth
+ * JRPC methods directly. Daemon-delegated stealth wiring is future work.
+ */
+export declare class WalletDaemonSigner implements Signer {
+    private readonly client;
+    private _publicKey;
+    private _address;
+    private constructor();
+    /**
+     * Creates a new signer with the given auth token, without verifying connectivity.
+     * Prefer `connect()` for eager validation and automatic authentication.
+     */
+    static new(options: WalletDaemonSignerOptions & {
+        authToken: string;
+    }): WalletDaemonSigner;
+    /**
+     * Connect to the daemon and cache the public key / address.
+     *
+     * If no `authToken` is provided, automatically authenticates using the daemon's
+     * configured auth method. For WebAuthn, this triggers the browser's passkey
+     * registration or login flow.
+     */
+    static connect(options: WalletDaemonSignerOptions & AuthOptions): Promise<WalletDaemonSigner>;
+    getAddress(): Promise<string>;
+    getPublicKey(): Promise<Uint8Array>;
+    /**
+     * Signs `unsignedTx` via the daemon's `transactions.sign` JRPC. `sealPublicKey` is
+     * forwarded as hex so the daemon hashes the transaction with the SAME seal public key the
+     * SDK's seal step uses — otherwise the per-signer hash and the seal hash diverge and the
+     * engine rejects the envelope.
+     *
+     * TODO(daemon): the `transactions.sign` JRPC's acceptance of `seal_public_key` is unverified
+     * against a running `tari_ootle_walletd`, and there is no capability/version handshake on the
+     * typed client (v1.14.0 exposes only the generic `sendRequest`) to feature-detect support, so
+     * this call cannot fail fast the way {@link getViewSecret} does. If the daemon ignores the
+     * parameter and hashes with its own pk, the per-signer signatures will not verify and the
+     * failure surfaces only LATE — at submit time — as the opaque engine error
+     * `"Transaction has one or more invalid signature(s)"`, not here. An unconditional throw is
+     * deliberately NOT added: it would break a daemon build that *does* honour `seal_public_key`.
+     * Until a daemon-side capability signal lands (tracked by this TODO), use
+     * {@link SecretKeyWallet} for client-side signing — it is the supported signer for sealed
+     * transactions.
+     */
+    signTransaction(unsignedTx: UnsignedTransactionV1, sealPublicKey: Uint8Array): Promise<TransactionSignature[]>;
+    /**
+     * The daemon never exports its view secret, so client-side stealth scanning/spending is
+     * unsupported via this signer. Always throws — see the class doc for the server-side
+     * stealth JRPC alternative. {@link Signer.addStealthSignature} is likewise not implemented.
+     *
+     * @throws {SignerError} always — the daemon never exports its view secret.
+     */
+    getViewSecret(): Promise<Uint8Array>;
+    /**
+     * Fetches the default account info from the daemon and caches it on this signer.
+     * Re-calls are idempotent — once cached, subsequent calls do not re-fetch.
+     *
+     * @throws {SignerError} if the daemon's `accounts.get_default` response is missing the
+     *   public key or address.
+     */
+    fetchAccountInfo(): Promise<void>;
+    private ensureAccountInfo;
+}
+
+export declare interface WalletDaemonSignerOptions {
+    /** Base URL of the wallet daemon HTTP endpoint, e.g. "http://localhost:18103" */
+    url: string;
+    /**
+     * Token used to authenticate JRPC calls to the wallet daemon.
+     * If omitted, {@link WalletDaemonSigner.connect} will automatically authenticate
+     * using the daemon's configured auth method (none or WebAuthn).
+     */
+    authToken?: string;
+}
+
+export { }

package/dist/index.js

@@ -0,0 +1,407 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+import { SignerError as e, assertByteLength as t, fromHexStr as n, toHexStr as r } from "@tari-project/ootle";
+BigInt.prototype.toJSON = function() {
+  return this > BigInt(2 ** 53 - 1) ? this.toString() : Number(this);
+};
+var i = class e2 {
+  constructor(e4) {
+    __publicField(this, "url");
+    this.url = e4;
+  }
+  static new(t2) {
+    return new e2(t2);
+  }
+  async sendRequest(e4, t2) {
+    let n2 = { "Content-Type": "application/json" };
+    (t2 == null ? void 0 : t2.token) && (n2.Authorization = `Bearer ${t2.token}`);
+    let r2 = new AbortController(), i3 = r2.signal, a2 = (t2 == null ? void 0 : t2.timeout_millis) ? setTimeout(() => {
+      r2.abort("Timeout");
+    }, t2.timeout_millis) : null, o2 = await fetch(this.url, {
+      method: "POST",
+      body: JSON.stringify(e4),
+      headers: n2,
+      signal: i3
+    });
+    if (a2 && clearTimeout(a2), !o2.ok) {
+      let e5 = await o2.text();
+      throw Error(`HTTP error ${o2.status}: ${e5}`);
+    }
+    return await o2.json();
+  }
+}, a = class e3 {
+  constructor(e4) {
+    __publicField(this, "token");
+    __publicField(this, "transport");
+    __publicField(this, "id");
+    __publicField(this, "reauthEnabled", true);
+    this.token = null, this.transport = e4, this.id = 0;
+  }
+  static new(t2) {
+    return new e3(t2);
+  }
+  static usingFetchTransport(t2) {
+    return e3.new(i.new(t2));
+  }
+  setReauthenticationEnabled(e4) {
+    this.reauthEnabled = e4;
+  }
+  isAuthenticated() {
+    return !!this.token;
+  }
+  setToken(e4) {
+    this.token = e4;
+  }
+  getToken() {
+    return this.token;
+  }
+  getTransport() {
+    return this.transport;
+  }
+  authGetMethod() {
+    return this.sendRequest("auth.method", {});
+  }
+  authListSessions(e4) {
+    return this.sendRequest("auth.list_sessions", e4);
+  }
+  async authRequest(e4, t2) {
+    let n2 = {
+      permissions: e4,
+      credentials: t2
+    };
+    return (await this.sendRequest("auth.request", n2)).token;
+  }
+  authRevoke(e4) {
+    return this.sendRequest("auth.revoke", e4);
+  }
+  authRefresh() {
+    return this.sendRequest("auth.refresh");
+  }
+  walletGetInfo() {
+    return this.sendRequest("wallet.get_info", {});
+  }
+  accountsCreate(e4) {
+    return this.sendRequest("accounts.create", e4);
+  }
+  accountsRename(e4) {
+    return this.sendRequest("accounts.rename", e4);
+  }
+  burnProofsList(e4) {
+    return this.sendRequest("burn_proofs.list", e4);
+  }
+  accountsClaimBurn(e4) {
+    return this.sendRequest("accounts.claim_burn", e4);
+  }
+  accountsAssociateStealthResource(e4) {
+    return this.sendRequest("accounts.associate_stealth_resource", e4);
+  }
+  accountsGetBalances(e4) {
+    return this.sendRequest("accounts.get_balances", e4);
+  }
+  accountsList(e4) {
+    return this.sendRequest("accounts.list", e4);
+  }
+  accountsGet(e4) {
+    return this.sendRequest("accounts.get", e4);
+  }
+  accountsTransfer(e4) {
+    return this.sendRequest("accounts.transfer", e4);
+  }
+  confidentialTransfer(e4) {
+    return this.sendRequest("accounts.confidential_transfer", e4);
+  }
+  stealthTransfer(e4) {
+    return this.sendRequest("accounts.stealth_transfer", e4);
+  }
+  accountsGetDefault(e4) {
+    return this.sendRequest("accounts.get_default", e4);
+  }
+  accountsSetDefault(e4) {
+    return this.sendRequest("accounts.set_default", e4);
+  }
+  submitTransaction(e4) {
+    return this.sendRequest("transactions.submit", e4);
+  }
+  submitTransactionDryRun(e4) {
+    return this.sendRequest("transactions.submit_dry_run", e4);
+  }
+  submitTransactionManifest(e4) {
+    return this.sendRequest("transactions.submit_manifest", e4);
+  }
+  publishTemplate(e4) {
+    return this.sendRequest("transactions.publish_template", e4);
+  }
+  substatesGet(e4) {
+    return this.sendRequest("substates.get", e4);
+  }
+  substatesList(e4) {
+    return this.sendRequest("substates.list", e4);
+  }
+  transactionsList(e4) {
+    return this.sendRequest("transactions.list", e4);
+  }
+  transactionsGet(e4) {
+    return this.sendRequest("transactions.get", e4);
+  }
+  getTransactionResult(e4) {
+    return this.sendRequest("transactions.get_result", e4);
+  }
+  waitForTransactionResult(e4) {
+    return this.sendRequest("transactions.wait_result", e4);
+  }
+  templatesGet(e4) {
+    return this.sendRequest("templates.get", e4);
+  }
+  templatesListAuthored(e4) {
+    return this.sendRequest("templates.list_authored", e4);
+  }
+  createFreeTestCoins(e4) {
+    return this.sendRequest("accounts.create_free_test_coins", e4);
+  }
+  createKey(e4) {
+    return this.sendRequest("keys.create", e4);
+  }
+  keysSetActive(e4) {
+    return this.sendRequest("keys.set_active", e4);
+  }
+  listKeys(e4) {
+    return this.sendRequest("keys.list", e4);
+  }
+  viewVaultBalance(e4) {
+    return this.sendRequest("confidential.view_vault_balance", e4);
+  }
+  nftsList(e4) {
+    return this.sendRequest("nfts.list", e4);
+  }
+  nftTransfer(e4) {
+    return this.sendRequest("nfts.transfer", e4);
+  }
+  mintFaucetNfts(e4) {
+    return this.sendRequest("nfts.mint_faucet_nft", e4);
+  }
+  validatorsClaimFees(e4) {
+    return this.sendRequest("validators.claim_fees", e4);
+  }
+  validatorsGetFees(e4) {
+    return this.sendRequest("validators.get_fees", e4);
+  }
+  webrtcStart(e4) {
+    return this.sendRequest("webrtc.start", e4);
+  }
+  settingsGet() {
+    return this.sendRequest("settings.get");
+  }
+  settingsSet(e4) {
+    return this.sendRequest("settings.set", e4);
+  }
+  webauthnAlreadyRegistered(e4) {
+    return this.sendRequest("webauthn.already_registered", e4);
+  }
+  webauthnStartRegistration(e4) {
+    return this.sendRequest("webauthn.reg_start", e4);
+  }
+  webauthnFinishRegistration(e4) {
+    return this.sendRequest("webauthn.reg_finish", e4);
+  }
+  webauthnAuthStart(e4) {
+    return this.sendRequest("webauthn.auth_start", e4);
+  }
+  stealthUtxosList(e4) {
+    return this.sendRequest("stealth_utxos.list", e4);
+  }
+  stealthUtxosDecryptValue(e4) {
+    return this.sendRequest("stealth_utxos.decrypt_value", e4);
+  }
+  async sendRequest(e4, t2 = null) {
+    let n2 = this.id++, r2 = await this.transport.sendRequest({
+      method: e4,
+      jsonrpc: "2.0",
+      id: n2,
+      params: t2 || {}
+    }, {
+      token: this.token,
+      timeout_millis: null
+    });
+    if (!this.reauthEnabled) {
+      if (r2.error) throw Error(`RPC Error ${r2.error.code}: ${r2.error.message}`, { cause: {
+        method: e4,
+        ...r2.error
+      } });
+      return r2.result;
+    }
+    if ((r2 == null ? void 0 : r2.error) && r2.error.code === 401) {
+      let n3 = Error(`RPC Error ${r2.error.code}: ${r2.error.message}`, { cause: {
+        method: e4,
+        ...r2.error
+      } });
+      if (e4.startsWith("auth.")) throw console.warn("Token refresh failed"), this.token = null, n3;
+      let i3 = this.id++, a2 = await this.transport.sendRequest({
+        method: "auth.refresh",
+        jsonrpc: "2.0",
+        id: i3,
+        params: {}
+      });
+      if (a2.error) throw console.debug("Refresh resp", a2), this.token = null, n3;
+      console.debug("Token refreshed successfully. Retrying original request."), this.token = a2.result.token, r2 = await this.transport.sendRequest({
+        method: e4,
+        jsonrpc: "2.0",
+        id: i3,
+        params: t2 || {}
+      }, {
+        token: this.token,
+        timeout_millis: null
+      });
+    }
+    if (r2.error) throw Error(`RPC Error ${r2.error.code}: ${r2.error.message}`, { cause: {
+      method: e4,
+      ...r2.error
+    } });
+    return r2.result;
+  }
+}, o = "tari-wallet-sdk", s = ["Admin"];
+function c(e4) {
+  let t2 = e4.replace(/-/g, "+").replace(/_/g, "/"), n2 = t2.padEnd(Math.ceil(t2.length / 4) * 4, "=");
+  return Uint8Array.from(atob(n2), (e5) => e5.charCodeAt(0));
+}
+async function l(t2, n2) {
+  let r2 = (n2 == null ? void 0 : n2.permissions) ?? s, i3 = (n2 == null ? void 0 : n2.appName) ?? o, { method: a2 } = await t2.authGetMethod();
+  switch (a2) {
+    case "none":
+      return t2.authRequest(r2, "None");
+    case "webauthn":
+      return u(t2, i3, r2);
+    default:
+      throw new e(`Unsupported wallet daemon auth method: ${a2}. Configure the daemon for one of: "none" or "webauthn", and pass that value to WalletDaemonSigner.connect.`);
+  }
+}
+async function u(t2, n2, r2) {
+  if (globalThis.navigator === void 0 || !globalThis.navigator.credentials) throw new e("WebAuthn is browser-only. Run in a browser, or pass `authToken` explicitly to `WalletDaemonSigner.connect({ url, authToken })` from Node.");
+  let { registered: i3 } = await t2.webauthnAlreadyRegistered({ username: n2 });
+  return i3 ? d(t2, n2, r2) : f(t2, n2, r2);
+}
+async function d(t2, n2, r2) {
+  var _a;
+  let i3 = await t2.webauthnAuthStart({ username: n2 });
+  if (!i3.challenge) throw new e("WebAuthn auth start: missing challenge");
+  let a2 = i3.challenge;
+  if (!((_a = a2.publicKey) == null ? void 0 : _a.challenge)) throw new e("WebAuthn auth start: malformed challenge response");
+  let { publicKey: o2 } = a2, s2 = c(o2.challenge), l2 = (o2.allowCredentials ?? []).map((e4) => ({
+    id: c(e4.id),
+    type: e4.type
+  })), u2 = await navigator.credentials.get({ publicKey: {
+    challenge: s2,
+    allowCredentials: l2,
+    timeout: 6e4,
+    userVerification: "required"
+  } });
+  if (!u2) throw new e("WebAuthn authentication was cancelled");
+  return t2.authRequest(r2, { WebAuthN: {
+    session_id: i3.session_id,
+    credential: u2
+  } });
+}
+async function f(t2, n2, r2) {
+  var _a, _b, _c;
+  let i3 = await t2.webauthnStartRegistration({ username: n2 });
+  if (!i3.public_key) throw new e("WebAuthn registration start: missing public_key");
+  let a2 = i3.public_key;
+  if (!a2.challenge) throw new e("WebAuthn registration start: malformed public_key response");
+  let o2 = c(a2.challenge), s2 = await navigator.credentials.create({ publicKey: {
+    rp: {
+      name: ((_a = a2.rp) == null ? void 0 : _a.name) ?? "Tari Wallet",
+      id: ((_b = a2.rp) == null ? void 0 : _b.id) ?? ((_c = globalThis.location) == null ? void 0 : _c.hostname)
+    },
+    user: {
+      id: Uint8Array.from(n2, (e4) => e4.charCodeAt(0)),
+      name: n2,
+      displayName: n2
+    },
+    challenge: o2,
+    pubKeyCredParams: a2.pubKeyCredParams ?? [
+      {
+        type: "public-key",
+        alg: -8
+      },
+      {
+        type: "public-key",
+        alg: -7
+      },
+      {
+        type: "public-key",
+        alg: -257
+      }
+    ],
+    timeout: 6e4,
+    excludeCredentials: [],
+    attestation: "none",
+    authenticatorSelection: { userVerification: "required" }
+  } });
+  if (!s2) throw new e("WebAuthn registration was cancelled");
+  let { token: l2 } = await t2.webauthnFinishRegistration({
+    session_id: i3.session_id,
+    credential: s2,
+    requested_permissions: r2
+  });
+  return l2;
+}
+var p = class i2 {
+  constructor(e4) {
+    __publicField(this, "client");
+    __publicField(this, "_publicKey", null);
+    __publicField(this, "_address", null);
+    this.client = e4;
+  }
+  static new(e4) {
+    let t2 = a.usingFetchTransport(e4.url);
+    return t2.setToken(e4.authToken), new i2(t2);
+  }
+  static async connect(e4) {
+    let t2 = a.usingFetchTransport(e4.url);
+    if (e4.authToken) t2.setToken(e4.authToken);
+    else {
+      let n3 = await l(t2, e4);
+      t2.setToken(n3);
+    }
+    t2.setReauthenticationEnabled(true);
+    let n2 = new i2(t2);
+    return await n2.fetchAccountInfo(), n2;
+  }
+  async getAddress() {
+    return (await this.ensureAccountInfo()).address;
+  }
+  async getPublicKey() {
+    return (await this.ensureAccountInfo()).publicKey;
+  }
+  async signTransaction(e4, n2) {
+    return t(n2, 32, "WalletDaemonSigner.signTransaction sealPublicKey"), (await this.client.sendRequest("transactions.sign", {
+      transaction: e4,
+      seal_public_key: r(n2)
+    })).signatures;
+  }
+  getViewSecret() {
+    return Promise.reject(new e("WalletDaemonSigner cannot export a view secret: daemon stealth is server-side. Use the daemon's stealth JRPC methods (e.g. stealthTransfer, stealthUtxosList), or use SecretKeyWallet for client-side stealth spending."));
+  }
+  async fetchAccountInfo() {
+    await this.ensureAccountInfo();
+  }
+  async ensureAccountInfo() {
+    var _a;
+    if (this._publicKey !== null && this._address !== null) return {
+      publicKey: this._publicKey,
+      address: this._address
+    };
+    let r2 = await this.client.accountsGetDefault({});
+    if (!((_a = r2.account) == null ? void 0 : _a.owner_public_key) || !r2.address) throw new e("Wallet daemon response missing public_key or address");
+    let i3 = t(n(r2.account.owner_public_key), 32, "daemon publicKey"), a2 = r2.address;
+    return this._publicKey = i3, this._address = a2, {
+      publicKey: i3,
+      address: a2
+    };
+  }
+};
+export {
+  a as WalletDaemonClient,
+  p as WalletDaemonSigner,
+  l as authenticate
+};

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@tari-project/ootle-wallet-daemon-signer",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "browser": "./dist/index.js",
+      "node": "./dist/index.js",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@tari-project/ootle-ts-bindings": "^1.30.0",
+    "@tari-project/wallet_jrpc_client": "^1.14.0",
+    "@tari-project/ootle": "0.1.0"
+  },
+  "devDependencies": {
+    "@microsoft/api-extractor": "^7.57.7",
+    "@types/node": "^25.5.0",
+    "typescript": "^5.9.3",
+    "unplugin-dts": "^1.0.0-beta.6",
+    "vite": "^8.0.1",
+    "vite-plugin-top-level-await": "^1.6.0",
+    "vite-plugin-wasm": "^3.6.0",
+    "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "build": "tsc -b && vite build",
+    "test": "vitest run --passWithNoTests"
+  }
+}