@tinycloud/sdk-core 3.8.1-beta.1 → 3.9.0-beta.3

package/dist/held-credentials/index.cjs

@@ -42,13 +42,18 @@ __export(held_credentials_exports, {
   PRESENTATION_STATEMENT: () => PRESENTATION_STATEMENT,
   SD_HASH_RESOURCE_PREFIX: () => SD_HASH_RESOURCE_PREFIX,
   assertValidAudience: () => assertValidAudience,
+  buildHeldPresentationSiwe: () => buildHeldPresentationSiwe,
+  checkReturnedPresentation: () => checkReturnedPresentation,
   normaliseEmail: () => normaliseEmail,
   parseIssuerSet: () => parseIssuerSet,
   parsePkhDid: () => parsePkhDid,
   pkhPrincipalsEqual: () => pkhPrincipalsEqual,
   randomNonce: () => randomNonce,
   registryKey: () => registryKey,
+  sdHash: () => sdHash,
+  selectDisclosures: () => selectDisclosures,
   toChecksumAddress: () => toChecksumAddress,
+  verifyHeldEmailCredential: () => verifyHeldEmailCredential,
   verifyHeldPresentation: () => verifyHeldPresentation
 });
 module.exports = __toCommonJS(held_credentials_exports);
@@ -502,86 +507,7 @@ function parseIssuerSet(raw, options) {
   return new IssuerSet(CONSTRUCT, raw.version, entries);
 }
 
-// src/held-credentials/siwe.ts
-var PRESENTATION_STATEMENT = "Present a TinyCloud held credential";
-var SD_HASH_RESOURCE_PREFIX = "urn:tinycloud:sd-hash:";
-var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
-function parseRfc3339(value) {
-  const m = RFC3339.exec(value);
-  if (!m) return null;
-  const [year, month, day, hour, minute, second] = [m[1], m[2], m[3], m[4], m[5], m[6]].map(Number);
-  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return null;
-  const date = /* @__PURE__ */ new Date(0);
-  date.setUTCFullYear(year, month - 1, day);
-  if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day) return null;
-  let offsetMinutes = 0;
-  if (m[8] !== void 0) {
-    const oh = Number(m[9]), om = Number(m[10]);
-    if (oh > 23 || om > 59) return null;
-    offsetMinutes = (m[8] === "-" ? -1 : 1) * (oh * 60 + om);
-  }
-  const millis = m[7] === void 0 ? 0 : Number(m[7].padEnd(3, "0").slice(0, 3));
-  date.setUTCHours(hour, minute, second, millis);
-  return date.getTime() - offsetMinutes * 6e4;
-}
-var AUDIENCE = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::([1-9][0-9]{0,4}))?$/;
-function assertValidAudience(audience) {
-  const match = AUDIENCE.exec(audience);
-  if (!match || match[1] !== void 0 && (Number(match[1]) > 65535 || match[1] === "443")) {
-    refuse("bad-config", "audience must be a lowercase host[:port] authority without a default port");
-  }
-}
-function parseStrictSiwe(message) {
-  const bad = (why) => refuse("bad-siwe", why);
-  const lines = message.split("\n");
-  const head = /^(\S+) wants you to sign in with your Ethereum account:$/.exec(lines[0] ?? "");
-  if (!head) bad("header line");
-  const address = lines[1] ?? "";
-  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) bad("address");
-  if (toChecksumAddress(address) !== address) bad("address must be EIP-55 checksummed");
-  if (lines[2] !== "") bad("layout");
-  const statement = lines[3];
-  if (statement === void 0 || statement === "") bad("statement");
-  if (lines[4] !== "") bad("layout");
-  let index = 5;
-  const field = (name, optional = false) => {
-    const line = lines[index];
-    const prefix = `${name}: `;
-    if (line === void 0 || !line.startsWith(prefix)) {
-      if (optional) return void 0;
-      return bad(`missing ${name}`);
-    }
-    index += 1;
-    const value = line.slice(prefix.length);
-    if (value === "") bad(`empty ${name}`);
-    return value;
-  };
-  const uri = field("URI");
-  const version = field("Version");
-  const chainId = field("Chain ID");
-  const nonce = field("Nonce");
-  const issuedAt = field("Issued At");
-  const expirationTime = field("Expiration Time", true);
-  const notBefore = field("Not Before", true);
-  if (lines[index]?.startsWith("Request ID: ")) bad("Request ID is not accepted");
-  const resources = [];
-  if (lines[index] === "Resources:") {
-    index += 1;
-    while (lines[index] !== void 0 && lines[index].startsWith("- ")) {
-      resources.push(lines[index].slice(2));
-      index += 1;
-    }
-  }
-  if (index !== lines.length) bad("trailing content");
-  if (!/^[0-9]+$/.test(chainId)) bad("chain id");
-  if (!/^[A-Za-z0-9]{8,}$/.test(nonce)) bad("nonce must be alphanumeric");
-  for (const [name, value] of [["Issued At", issuedAt], ["Expiration Time", expirationTime], ["Not Before", notBefore]]) {
-    if (value !== void 0 && parseRfc3339(value) === null) bad(`${name} is not RFC 3339`);
-  }
-  return { domain: head[1], address, statement, uri, version, chainId, nonce, issuedAt, expirationTime, notBefore, resources };
-}
-
-// src/held-credentials/verify.ts
+// src/held-credentials/credential.ts
 var SHARED_SIGNED = /* @__PURE__ */ new Set(["iss", "sub", "iat", "nbf", "exp", "jti", "vct", "profile", "profileVersion", "holderBinding", "status", "_sd_alg", "_sd"]);
 var RESERVED_CLAIMS = /* @__PURE__ */ new Set([...SHARED_SIGNED, "...", "cnf"]);
 var HELD_LIMITS = {
@@ -597,36 +523,14 @@ var HELD_LIMITS = {
 var HEADER_MEMBERS = /* @__PURE__ */ new Set(["alg", "typ", "kid"]);
 var JTI_UUID_V4 = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 function sdHash(sdJwt) {
+  if (typeof sdJwt !== "string" || !isAscii(sdJwt)) refuse("bad-presentation", "sdJwt must be an ASCII string");
   return encodeBase64Url((0, import_sha256.sha256)(asciiBytes(sdJwt)));
 }
 function isSafeInt(value) {
   return typeof value === "number" && Number.isSafeInteger(value);
 }
-async function verifyHeldPresentation(presentation, options) {
-  const { now, issuerSet, acceptedIssuers, acceptedProfiles, didMethods, audience, nonceStore, callerAccount } = options;
-  const rows = options.rows ?? DEFAULT_ROWS;
-  if (!(now instanceof Date) || Number.isNaN(now.getTime())) refuse("bad-config", "now must be a valid Date");
-  if (!IssuerSet.is(issuerSet)) refuse("bad-config", "issuerSet must come from parseIssuerSet");
-  if (!nonceStore || !didMethods || !Array.isArray(didMethods.issuer)) refuse("bad-config", "issuerSet, nonceStore and didMethods are required");
-  if (!Array.isArray(acceptedIssuers) || acceptedIssuers.length === 0) refuse("bad-config", "acceptedIssuers must not be empty");
-  if (!Array.isArray(acceptedProfiles) || acceptedProfiles.length === 0) refuse("bad-config", "acceptedProfiles must not be empty");
-  assertValidAudience(audience);
-  if (parsePkhDid(callerAccount) === null) refuse("bad-config", "callerAccount must be a did:pkh:eip155 account");
-  if (!isObject(presentation) || Object.keys(presentation).sort().join() !== "sdJwt,siwe") refuse("bad-presentation", "unexpected shape");
-  const { sdJwt, siwe } = presentation;
-  if (typeof sdJwt !== "string" || !isAscii(sdJwt)) refuse("bad-presentation", "sdJwt must be an ASCII string");
-  if (!isObject(siwe) || Object.keys(siwe).sort().join() !== "message,signature" || typeof siwe.message !== "string" || typeof siwe.signature !== "string") refuse("bad-presentation", "siwe shape");
-  const sdJwtText = sdJwt;
-  const siweMessage = siwe.message;
-  const siweSignature = siwe.signature;
-  if (sdJwtText.length > HELD_LIMITS.sdJwtChars) refuse("bad-presentation", "sdJwt is too long");
-  if (siweMessage.length > HELD_LIMITS.siweMessageChars) refuse("bad-presentation", "siwe message is too long");
-  if (siweSignature.length > HELD_LIMITS.siweSignatureChars) refuse("bad-presentation", "siwe signature is too long");
-  const message = parseStrictSiwe(siweMessage);
-  if (message.domain !== audience) refuse("bad-siwe", "domain is not this verifier's audience");
-  if (!/^[0-9A-Za-z]{22,}$/.test(message.nonce)) refuse("bad-nonce", "nonce must be at least 22 base62 characters (or 32 hex)");
-  const consumed = await nonceStore.consume(audience, message.nonce, callerAccount);
-  if (!consumed.existed) refuse("nonce-replayed", "nonce is unknown, already used, or bound to another account");
+function checkHeldCredential(sdJwtText, policy) {
+  const { now, issuerSet, acceptedIssuers, acceptedProfiles, didMethods, rows } = policy;
   const parts = sdJwtText.split("~");
   if (parts.length < 2 || parts[parts.length - 1] !== "") refuse("bad-presentation", "sdJwt must end with ~ and carry no key-binding JWT");
   const [jwt, ...disclosureParts] = parts.slice(0, -1);
@@ -713,6 +617,183 @@ async function verifyHeldPresentation(presentation, options) {
     claims[name] = value;
   }
   row.validateDisclosed(claims);
+  return {
+    issuer: issuerDid,
+    subject,
+    subjectPkh,
+    issuedAt: new Date(iat * 1e3),
+    expiresAt: new Date(exp * 1e3),
+    credentialId: payload.jti,
+    profile,
+    profileVersion,
+    vct,
+    claims
+  };
+}
+function toVerifiedCredential(checked) {
+  return {
+    issuer: checked.issuer,
+    subject: canonicalPkhDid(checked.subject),
+    subjectAddress: registryKey(checked.subject),
+    expiresAt: checked.expiresAt,
+    credentialId: checked.credentialId,
+    profile: checked.profile,
+    profileVersion: checked.profileVersion,
+    vct: checked.vct,
+    claims: checked.claims
+  };
+}
+function verifyHeldEmailCredential(sdJwt, options) {
+  const { now, issuerSet, acceptedIssuers, didMethods, owner } = options;
+  if (!(now instanceof Date) || Number.isNaN(now.getTime())) refuse("bad-config", "now must be a valid Date");
+  if (!IssuerSet.is(issuerSet)) refuse("bad-config", "issuerSet must come from parseIssuerSet");
+  if (!didMethods || !Array.isArray(didMethods.issuer)) refuse("bad-config", "didMethods is required");
+  if (!Array.isArray(acceptedIssuers) || acceptedIssuers.length === 0) refuse("bad-config", "acceptedIssuers must not be empty");
+  if (parsePkhDid(owner) === null) refuse("bad-config", "owner must be a did:pkh:eip155 account");
+  if (typeof sdJwt !== "string" || !isAscii(sdJwt)) refuse("bad-presentation", "sdJwt must be an ASCII string");
+  if (sdJwt.length > HELD_LIMITS.sdJwtChars) refuse("bad-presentation", "sdJwt is too long");
+  const checked = checkHeldCredential(sdJwt, {
+    now,
+    issuerSet,
+    acceptedIssuers,
+    didMethods,
+    acceptedProfiles: [{ profile: EMAIL_HELD_ROW.profile, profileVersion: EMAIL_HELD_ROW.profileVersion }],
+    rows: [EMAIL_HELD_ROW]
+  });
+  if (!pkhPrincipalsEqual(owner, checked.subject)) refuse("nonce-account-mismatch", "subject is not the authenticated owner");
+  return { ...toVerifiedCredential(checked), issuedAt: checked.issuedAt };
+}
+function selectDisclosures(sdJwt, names) {
+  if (typeof sdJwt !== "string") refuse("bad-presentation", "sdJwt must be a string");
+  if (names.length === 0 || new Set(names).size !== names.length) refuse("bad-config", "names must be non-empty and unique");
+  const parts = sdJwt.split("~");
+  if (parts.length < 2 || parts[parts.length - 1] !== "") refuse("bad-presentation", "sdJwt must end with ~ and carry no key-binding JWT");
+  const [jwt, ...disclosures] = parts.slice(0, -1);
+  const kept = [];
+  const found = /* @__PURE__ */ new Set();
+  for (const disclosure of disclosures) {
+    const decoded = parseStrictJson(decodeUtf8(decodeBase64Url(disclosure, "bad-disclosure"), "bad-disclosure"), "bad-disclosure");
+    if (!Array.isArray(decoded) || decoded.length !== 3 || typeof decoded[1] !== "string") refuse("bad-disclosure", "disclosure must be [salt, name, value]");
+    const name = decoded[1];
+    if (names.includes(name)) {
+      if (found.has(name)) refuse("bad-disclosure", `duplicate disclosure for ${name}`);
+      kept.push(disclosure);
+      found.add(name);
+    }
+  }
+  for (const name of names) if (!found.has(name)) refuse("bad-disclosure", `no disclosure for ${name}`);
+  return [jwt, ...kept, ""].join("~");
+}
+
+// src/held-credentials/siwe.ts
+var PRESENTATION_STATEMENT = "Present a TinyCloud held credential";
+var SD_HASH_RESOURCE_PREFIX = "urn:tinycloud:sd-hash:";
+var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+function parseRfc3339(value) {
+  const m = RFC3339.exec(value);
+  if (!m) return null;
+  const [year, month, day, hour, minute, second] = [m[1], m[2], m[3], m[4], m[5], m[6]].map(Number);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return null;
+  const date = /* @__PURE__ */ new Date(0);
+  date.setUTCFullYear(year, month - 1, day);
+  if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day) return null;
+  let offsetMinutes = 0;
+  if (m[8] !== void 0) {
+    const oh = Number(m[9]), om = Number(m[10]);
+    if (oh > 23 || om > 59) return null;
+    offsetMinutes = (m[8] === "-" ? -1 : 1) * (oh * 60 + om);
+  }
+  const millis = m[7] === void 0 ? 0 : Number(m[7].padEnd(3, "0").slice(0, 3));
+  date.setUTCHours(hour, minute, second, millis);
+  return date.getTime() - offsetMinutes * 6e4;
+}
+var AUDIENCE = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::([1-9][0-9]{0,4}))?$/;
+function assertValidAudience(audience) {
+  const match = AUDIENCE.exec(audience);
+  if (!match || match[1] !== void 0 && (Number(match[1]) > 65535 || match[1] === "443")) {
+    refuse("bad-config", "audience must be a lowercase host[:port] authority without a default port");
+  }
+}
+function parseStrictSiwe(message) {
+  const bad = (why) => refuse("bad-siwe", why);
+  const lines = message.split("\n");
+  const head = /^(\S+) wants you to sign in with your Ethereum account:$/.exec(lines[0] ?? "");
+  if (!head) bad("header line");
+  const address = lines[1] ?? "";
+  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) bad("address");
+  if (toChecksumAddress(address) !== address) bad("address must be EIP-55 checksummed");
+  if (lines[2] !== "") bad("layout");
+  const statement = lines[3];
+  if (statement === void 0 || statement === "") bad("statement");
+  if (lines[4] !== "") bad("layout");
+  let index = 5;
+  const field = (name, optional = false) => {
+    const line = lines[index];
+    const prefix = `${name}: `;
+    if (line === void 0 || !line.startsWith(prefix)) {
+      if (optional) return void 0;
+      return bad(`missing ${name}`);
+    }
+    index += 1;
+    const value = line.slice(prefix.length);
+    if (value === "") bad(`empty ${name}`);
+    return value;
+  };
+  const uri = field("URI");
+  const version = field("Version");
+  const chainId = field("Chain ID");
+  const nonce = field("Nonce");
+  const issuedAt = field("Issued At");
+  const expirationTime = field("Expiration Time", true);
+  const notBefore = field("Not Before", true);
+  if (lines[index]?.startsWith("Request ID: ")) bad("Request ID is not accepted");
+  const resources = [];
+  if (lines[index] === "Resources:") {
+    index += 1;
+    while (lines[index] !== void 0 && lines[index].startsWith("- ")) {
+      resources.push(lines[index].slice(2));
+      index += 1;
+    }
+  }
+  if (index !== lines.length) bad("trailing content");
+  if (!/^[0-9]+$/.test(chainId)) bad("chain id");
+  if (!/^[A-Za-z0-9]{8,}$/.test(nonce)) bad("nonce must be alphanumeric");
+  for (const [name, value] of [["Issued At", issuedAt], ["Expiration Time", expirationTime], ["Not Before", notBefore]]) {
+    if (value !== void 0 && parseRfc3339(value) === null) bad(`${name} is not RFC 3339`);
+  }
+  return { domain: head[1], address, statement, uri, version, chainId, nonce, issuedAt, expirationTime, notBefore, resources };
+}
+
+// src/held-credentials/verify.ts
+async function verifyHeldPresentation(presentation, options) {
+  const { now, issuerSet, acceptedIssuers, acceptedProfiles, didMethods, audience, nonceStore, callerAccount } = options;
+  const rows = options.rows ?? DEFAULT_ROWS;
+  if (!(now instanceof Date) || Number.isNaN(now.getTime())) refuse("bad-config", "now must be a valid Date");
+  if (!IssuerSet.is(issuerSet)) refuse("bad-config", "issuerSet must come from parseIssuerSet");
+  if (!nonceStore || !didMethods || !Array.isArray(didMethods.issuer)) refuse("bad-config", "issuerSet, nonceStore and didMethods are required");
+  if (!Array.isArray(acceptedIssuers) || acceptedIssuers.length === 0) refuse("bad-config", "acceptedIssuers must not be empty");
+  if (!Array.isArray(acceptedProfiles) || acceptedProfiles.length === 0) refuse("bad-config", "acceptedProfiles must not be empty");
+  assertValidAudience(audience);
+  if (parsePkhDid(callerAccount) === null) refuse("bad-config", "callerAccount must be a did:pkh:eip155 account");
+  if (!isObject(presentation) || Object.keys(presentation).sort().join() !== "sdJwt,siwe") refuse("bad-presentation", "unexpected shape");
+  const { sdJwt, siwe } = presentation;
+  if (typeof sdJwt !== "string" || !isAscii(sdJwt)) refuse("bad-presentation", "sdJwt must be an ASCII string");
+  if (!isObject(siwe) || Object.keys(siwe).sort().join() !== "message,signature" || typeof siwe.message !== "string" || typeof siwe.signature !== "string") refuse("bad-presentation", "siwe shape");
+  const sdJwtText = sdJwt;
+  const siweMessage = siwe.message;
+  const siweSignature = siwe.signature;
+  if (sdJwtText.length > HELD_LIMITS.sdJwtChars) refuse("bad-presentation", "sdJwt is too long");
+  if (siweMessage.length > HELD_LIMITS.siweMessageChars) refuse("bad-presentation", "siwe message is too long");
+  if (siweSignature.length > HELD_LIMITS.siweSignatureChars) refuse("bad-presentation", "siwe signature is too long");
+  const message = parseStrictSiwe(siweMessage);
+  if (message.domain !== audience) refuse("bad-siwe", "domain is not this verifier's audience");
+  if (!/^[0-9A-Za-z]{22,}$/.test(message.nonce)) refuse("bad-nonce", "nonce must be at least 22 base62 characters (or 32 hex)");
+  const consumed = await nonceStore.consume(audience, message.nonce, callerAccount);
+  if (!consumed.existed) refuse("nonce-replayed", "nonce is unknown, already used, or bound to another account");
+  const checked = checkHeldCredential(sdJwtText, { now, issuerSet, acceptedIssuers, acceptedProfiles, didMethods, rows });
+  const subject = checked.subject;
+  const subjectPkh = checked.subjectPkh;
+  const nowMs = now.getTime();
   let origin;
   try {
     const url = new URL(message.uri);
@@ -732,17 +813,7 @@ async function verifyHeldPresentation(presentation, options) {
   const recovered = recoverEip191Address(siweMessage, signatureBytes);
   if (recovered === null || recovered !== subjectPkh.address) refuse("bad-siwe-signature", "signature does not recover the credential subject");
   if (!pkhPrincipalsEqual(callerAccount, subject)) refuse("nonce-account-mismatch", "subject is not the authenticated caller");
-  return {
-    issuer: issuerDid,
-    subject: canonicalPkhDid(subject),
-    subjectAddress: registryKey(subject),
-    expiresAt: new Date(exp * 1e3),
-    credentialId: payload.jti,
-    profile,
-    profileVersion,
-    vct,
-    claims
-  };
+  return toVerifiedCredential(checked);
 }
 
 // src/held-credentials/nonce-store.ts
@@ -790,4 +861,103 @@ function normaliseEmail(email) {
   if (local === "") return null;
   return `${local}@${domain}`;
 }
+
+// src/held-credentials/presentation.ts
+var import_secp256k12 = require("@noble/curves/secp256k1");
+var NONCE_FORMAT = /^[0-9A-Za-z]{22,}$/;
+var SD_HASH_FORMAT = /^[A-Za-z0-9_-]{43}$/;
+var SIGNATURE_FORMAT = /^0x[0-9a-fA-F]{130}$/;
+var SECP256K1_HALF_ORDER = import_secp256k12.secp256k1.CURVE.n / 2n;
+function isValidDate(value) {
+  return value instanceof Date && !Number.isNaN(value.getTime());
+}
+function hasLowS(signature) {
+  return BigInt(`0x${signature.slice(66, 130)}`) <= SECP256K1_HALF_ORDER;
+}
+function wholeSecondRfc3339(value, field) {
+  if (value.getUTCMilliseconds() !== 0) refuse("bad-config", `${field} must be a whole second`);
+  return value.toISOString().replace(".000Z", "Z");
+}
+function rfc3339Millis(value) {
+  const millis = parseRfc3339(value);
+  if (millis === null) refuse("bad-siwe", "SIWE timestamp is not RFC 3339");
+  return millis;
+}
+async function buildHeldPresentationSiwe(input) {
+  const { audience, nonce, sdHash: hash, account, issuedAt, expirationTime, sign } = input;
+  if (typeof audience !== "string") refuse("bad-config", "audience must be a string");
+  assertValidAudience(audience);
+  const subject = parsePkhDid(account);
+  if (subject === null) refuse("bad-config", "account must be a did:pkh:eip155 account");
+  if (subject.chainId !== "1") refuse("bad-config", "held presentations are on chain 1");
+  if (typeof nonce !== "string" || !NONCE_FORMAT.test(nonce)) refuse("bad-config", "nonce must be at least 22 base62 characters");
+  if (typeof hash !== "string" || !SD_HASH_FORMAT.test(hash)) refuse("bad-config", "sdHash must be a base64url SHA-256");
+  if (!isValidDate(issuedAt)) refuse("bad-config", "issuedAt must be a valid Date");
+  if (expirationTime !== void 0 && !isValidDate(expirationTime)) refuse("bad-config", "expirationTime must be a valid Date");
+  if (expirationTime !== void 0 && expirationTime.getTime() <= issuedAt.getTime()) refuse("bad-config", "expirationTime must be after issuedAt");
+  if (typeof sign !== "function") refuse("bad-config", "sign is required");
+  const message = [
+    `${audience} wants you to sign in with your Ethereum account:`,
+    toChecksumAddress(subject.address),
+    "",
+    PRESENTATION_STATEMENT,
+    "",
+    `URI: https://${audience}`,
+    "Version: 1",
+    "Chain ID: 1",
+    `Nonce: ${nonce}`,
+    `Issued At: ${wholeSecondRfc3339(issuedAt, "issuedAt")}`,
+    ...expirationTime === void 0 ? [] : [`Expiration Time: ${wholeSecondRfc3339(expirationTime, "expirationTime")}`],
+    "Resources:",
+    `- ${SD_HASH_RESOURCE_PREFIX}${hash}`
+  ].join("\n");
+  parseStrictSiwe(message);
+  if (message.length > HELD_LIMITS.siweMessageChars) refuse("bad-config", "SIWE message exceeds the node limit");
+  const signature = await sign(message);
+  if (typeof signature !== "string" || !SIGNATURE_FORMAT.test(signature)) refuse("bad-config", "signer must return 0x-prefixed 65-byte hex");
+  if (!hasLowS(signature)) refuse("bad-siwe-signature", "signer must return a low-S signature");
+  const recovered = recoverEip191Address(message, hexToBytes(signature.slice(2), "bad-siwe-signature"));
+  if (recovered !== subject.address) refuse("bad-siwe-signature", "signer does not control the account");
+  return { message, signature };
+}
+function checkReturnedPresentation(presentation, options) {
+  const { now, audience, account } = options;
+  if (!isValidDate(now)) refuse("bad-config", "now must be a valid Date");
+  assertValidAudience(audience);
+  if (parsePkhDid(account) === null) refuse("bad-config", "account must be a did:pkh:eip155 account");
+  if (!isObject(presentation) || Object.keys(presentation).sort().join() !== "sdJwt,siwe") refuse("bad-presentation", "unexpected shape");
+  const { sdJwt, siwe } = presentation;
+  if (typeof sdJwt !== "string" || !isAscii(sdJwt) || sdJwt.length > HELD_LIMITS.sdJwtChars) refuse("bad-presentation", "sdJwt must be a bounded ASCII string");
+  if (!isObject(siwe) || Object.keys(siwe).sort().join() !== "message,signature" || typeof siwe.message !== "string" || typeof siwe.signature !== "string") {
+    refuse("bad-presentation", "siwe must carry message and signature");
+  }
+  const siweMessage = siwe.message;
+  const siweSignature = siwe.signature;
+  if (siweMessage.length > HELD_LIMITS.siweMessageChars) refuse("bad-presentation", "siwe message is too long");
+  if (!SIGNATURE_FORMAT.test(siweSignature) || !hasLowS(siweSignature)) refuse("bad-siwe-signature", "signature must be 0x-prefixed 65-byte low-S hex");
+  const parsed = parseStrictSiwe(siweMessage);
+  if (parsed.domain !== audience) refuse("bad-siwe", "domain is not the audience");
+  let origin;
+  try {
+    const url = new URL(parsed.uri);
+    origin = url.protocol === "https:" && !url.username && !url.password ? url.origin : void 0;
+  } catch {
+    origin = void 0;
+  }
+  if (origin !== `https://${audience}`) refuse("bad-siwe", "uri must be an https origin matching the audience");
+  if (parsed.version !== "1") refuse("bad-siwe", "version must be 1");
+  if (parsed.statement !== PRESENTATION_STATEMENT) refuse("bad-siwe", "unexpected statement");
+  if (parsed.chainId !== "1") refuse("bad-siwe", "chain id must be 1");
+  if (!NONCE_FORMAT.test(parsed.nonce)) refuse("bad-nonce", "nonce must be at least 22 base62 characters");
+  if (parsed.resources.length !== 1 || parsed.resources[0] !== `${SD_HASH_RESOURCE_PREFIX}${sdHash(sdJwt)}`) {
+    refuse("bad-siwe", "resources must be exactly the sd_hash of this presentation");
+  }
+  const nowMs = now.getTime();
+  if (parsed.expirationTime !== void 0 && nowMs >= rfc3339Millis(parsed.expirationTime)) refuse("bad-siwe", "SIWE has expired");
+  if (parsed.notBefore !== void 0 && nowMs < rfc3339Millis(parsed.notBefore)) refuse("bad-siwe", "SIWE is not yet valid");
+  if (!pkhPrincipalsEqual(`did:pkh:eip155:${parsed.chainId}:${parsed.address}`, account)) refuse("bad-siwe", "SIWE address is not the account");
+  const recovered = recoverEip191Address(siweMessage, hexToBytes(siweSignature.slice(2), "bad-siwe-signature"));
+  if (recovered === null || recovered !== parsed.address.toLowerCase()) refuse("bad-siwe-signature", "signature does not recover the SIWE address");
+  return { sdJwt, siwe: { message: siweMessage, signature: siweSignature } };
+}
 //# sourceMappingURL=index.cjs.map