@xrpl-wallet-kit/auth 0.1.0

package/README.md

@@ -0,0 +1,184 @@
+# @xrpl-wallet-kit/auth
+
+Sign-In with Wallet helpers for XRPL Wallet Kit.
+
+This package is intentionally split from `@xrpl-wallet-kit/core`: core signs messages, while auth handles nonce, message formatting, server verification, auth state, and sign-out. The main entry is client-safe. XRPL verifier dependencies live behind the `./verifiers` subpath and should only be imported on the server.
+
+## Install
+
+```bash
+npm install @xrpl-wallet-kit/auth @xrpl-wallet-kit/core
+```
+
+For server-side XRPL verification, install the optional peers in your server package:
+
+```bash
+npm install ripple-keypairs verify-xrpl-signature xrpl
+```
+
+## Client Usage
+
+```ts
+import { createWalletAuth, formatAuthMessage } from "@xrpl-wallet-kit/auth";
+
+const auth = createWalletAuth(manager, {
+  async getNonce() {
+    const res = await fetch("/api/auth/nonce", { credentials: "include" });
+    const body = await res.json();
+    return body.nonce;
+  },
+  createMessage(params) {
+    return formatAuthMessage(params);
+  },
+  async verify(params) {
+    const res = await fetch("/api/auth/verify", {
+      method: "POST",
+      credentials: "include",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(params)
+    });
+    return res.ok;
+  },
+  async signOut() {
+    await fetch("/api/auth/signout", { method: "POST", credentials: "include" });
+  }
+}, {
+  domain: window.location.host,
+  uri: window.location.origin,
+  chainId: "xrpl:0",
+  statement: "Sign in to Example App"
+});
+
+auth.on("change", (state) => {
+  console.log(state.status, state.address);
+});
+
+await auth.signIn();
+```
+
+The dApp does not branch by wallet id. `manager.signMessage()` delegates to the active adapter and returns the normalized proof shape:
+
+```ts
+{
+  signatureKind: "signature" | "signedTx",
+  proof: string,
+  signature?: string,
+  txBlob?: string,
+  publicKey?: string
+}
+```
+
+## Pre-Issued Nonce
+
+If your dApp already issued a nonce before the user clicks sign-in, return that nonce from `getNonce()`. This is common in SSR pages, legacy apps, or flows where the nonce is rendered into the page by the server.
+
+```ts
+import { createWalletAuth, formatAuthMessage } from "@xrpl-wallet-kit/auth";
+
+const preIssuedNonce = window.__AUTH_NONCE__;
+
+const auth = createWalletAuth(manager, {
+  async getNonce() {
+    return preIssuedNonce;
+  },
+  createMessage(params) {
+    return formatAuthMessage(params);
+  },
+  async verify(params) {
+    const res = await fetch("/api/auth/verify", {
+      method: "POST",
+      credentials: "include",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(params)
+    });
+    return res.ok;
+  }
+}, {
+  domain: window.location.host,
+  uri: window.location.origin,
+  chainId: "xrpl:0",
+  statement: "Sign in to Example App"
+});
+
+await auth.signIn();
+```
+
+The server must still generate, store, validate, and invalidate the nonce. Do not treat a browser-generated nonce as trusted authentication state.
+
+```js
+app.get("/login", (req, res) => {
+  const nonce = createSecureNonce();
+  req.session.authNonce = nonce;
+  res.render("login", { authNonce: nonce });
+});
+
+app.post("/api/auth/verify", async (req, res) => {
+  const parsed = parseAuthMessage(req.body.message);
+
+  if (parsed.nonce !== req.session.authNonce) {
+    return res.status(400).json({ ok: false, error: "Invalid nonce" });
+  }
+
+  // Verify req.body proof here, then create the app session.
+  req.session.authNonce = null;
+  res.json({ ok: true });
+});
+```
+
+## Server Verification
+
+```ts
+import { createXrplSignatureVerifier } from "@xrpl-wallet-kit/auth/verifiers";
+
+const verifier = createXrplSignatureVerifier({
+  nodeUrl: "wss://xrplcluster.com"
+});
+
+const ok = await verifier.verify({
+  address: body.address,
+  message: body.message,
+  signatureKind: body.signatureKind,
+  proof: body.proof,
+  signature: body.signature,
+  txBlob: body.txBlob,
+  publicKey: body.publicKey
+});
+```
+
+For `signatureKind: "signature"`, `publicKey` should be provided by the wallet/sign result. Ledger lookup via `account_info.account_data.PublicKey` is only a fallback. Do not use `RegularKey` as a public key.
+
+For `signatureKind: "signedTx"`, the verifier checks the signed transaction blob, signer address, transaction `Account`, and first memo text against the original auth message.
+
+## Legacy HTML / jQuery Pattern
+
+Legacy pages can use the same API from the browser bundle or ESM build. Keep the server verification endpoint separate:
+
+```js
+async function signInWithWalletKit(manager) {
+  const auth = XRPLWalletKitAuth.createWalletAuth(manager, {
+    async getNonce() {
+      return (await fetch("/api/auth/nonce", { credentials: "include" }).then((r) => r.json())).nonce;
+    },
+    createMessage(params) {
+      return XRPLWalletKitAuth.formatAuthMessage(params);
+    },
+    async verify(params) {
+      const response = await fetch("/api/auth/verify", {
+        method: "POST",
+        credentials: "include",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(params)
+      });
+      return response.ok;
+    }
+  }, {
+    domain: location.host,
+    uri: location.origin,
+    chainId: "xrpl:0"
+  });
+
+  return auth.signIn();
+}
+```
+
+Do not verify signatures in browser-only legacy code. The nonce must be generated, stored, validated, and invalidated by the server.

package/dist/auth.d.ts

@@ -0,0 +1,3 @@
+import type { WalletAuth, WalletAuthAdapter, WalletAuthManager, WalletAuthOptions } from "./types";
+export declare function createWalletAuth(manager: WalletAuthManager, adapter: WalletAuthAdapter, options?: WalletAuthOptions): WalletAuth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAA2B,iBAAiB,EAAE,iBAAiB,EAA2C,MAAM,SAAS,CAAC;AAKrK,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,UAAU,CAEZ"}

package/dist/auth.js

@@ -0,0 +1,145 @@
+import { WalletKitError, WalletKitErrorCode } from "@xrpl-wallet-kit/core";
+import { isWalletAuthSignInResult } from "./types";
+const DEFAULT_EXPIRES_IN_SECONDS = 3600;
+export function createWalletAuth(manager, adapter, options = {}) {
+    return new WalletAuthController(manager, adapter, options);
+}
+class WalletAuthController {
+    constructor(manager, adapter, defaults) {
+        this.manager = manager;
+        this.adapter = adapter;
+        this.defaults = defaults;
+        this.state = {
+            status: "unauthenticated",
+            address: null,
+            error: null
+        };
+        this.listeners = new Set();
+        this.destroyed = false;
+        this.signing = false;
+    }
+    getState() {
+        return { ...this.state };
+    }
+    async signIn(options = {}) {
+        this.ensureActive();
+        if (this.signing)
+            throw new Error("A sign-in request is already in progress.");
+        const merged = { ...this.defaults, ...options };
+        const initialSession = this.manager.getSession();
+        const account = this.manager.getAccount();
+        if (!account)
+            throw new Error("No active wallet session. Connect a wallet first.");
+        if (!this.manager.getCapabilities()?.signMessage) {
+            throw new Error("Active wallet adapter does not support message signing.");
+        }
+        this.signing = true;
+        this.setState({ status: "loading", address: account.address, error: null });
+        try {
+            const nonce = await this.adapter.getNonce();
+            const issuedAt = new Date();
+            const expirationTime = new Date(issuedAt.getTime() + (merged.expiresIn ?? DEFAULT_EXPIRES_IN_SECONDS) * 1000);
+            const message = this.adapter.createMessage({
+                address: account.address,
+                nonce,
+                domain: merged.domain ?? resolveDefaultDomain(),
+                uri: merged.uri ?? resolveDefaultUri(),
+                chainId: merged.chainId,
+                statement: merged.statement,
+                issuedAt: issuedAt.toISOString(),
+                expirationTime: expirationTime.toISOString(),
+                version: "1"
+            });
+            if (this.manager.getSession() !== initialSession) {
+                throw new Error("Wallet session changed during sign-in.");
+            }
+            const signResult = await this.manager.signMessage({ message, account });
+            if (!isWalletAuthSignInResult(signResult)) {
+                throw new Error("Wallet did not return a verifiable signature proof.");
+            }
+            const verifyOk = await this.adapter.verify({
+                message,
+                signatureKind: signResult.signatureKind,
+                proof: signResult.proof,
+                signature: signResult.signature,
+                txBlob: signResult.txBlob,
+                address: account.address,
+                publicKey: signResult.publicKey,
+                raw: signResult.raw
+            });
+            if (!verifyOk)
+                throw new Error("Authentication rejected by server.");
+            const result = {
+                address: account.address,
+                message,
+                signatureKind: signResult.signatureKind,
+                proof: signResult.proof,
+                signature: signResult.signature,
+                txBlob: signResult.txBlob,
+                publicKey: signResult.publicKey,
+                raw: signResult.raw
+            };
+            this.setState({ status: "authenticated", address: account.address, error: null });
+            return result;
+        }
+        catch (error) {
+            this.setState({ status: "error", address: null, error });
+            throw normalizeAuthError(error);
+        }
+        finally {
+            this.signing = false;
+        }
+    }
+    async signOut() {
+        try {
+            await this.adapter.signOut?.();
+        }
+        finally {
+            this.setState({ status: "unauthenticated", address: null, error: null });
+        }
+    }
+    on(event, handler) {
+        this.ensureActive();
+        if (event !== "change")
+            return () => { };
+        this.listeners.add(handler);
+        return () => this.off(event, handler);
+    }
+    off(event, handler) {
+        if (event !== "change")
+            return;
+        this.listeners.delete(handler);
+    }
+    destroy() {
+        this.destroyed = true;
+        this.listeners.clear();
+    }
+    setState(state) {
+        this.state = state;
+        for (const listener of this.listeners)
+            listener(this.getState());
+    }
+    ensureActive() {
+        if (this.destroyed)
+            throw new Error("WalletAuth instance has been destroyed.");
+    }
+}
+function resolveDefaultDomain() {
+    if (typeof window !== "undefined" && window.location.host)
+        return window.location.host;
+    return "localhost";
+}
+function resolveDefaultUri() {
+    if (typeof window !== "undefined" && window.location.origin)
+        return window.location.origin;
+    return "http://localhost";
+}
+function normalizeAuthError(error) {
+    if (error instanceof WalletKitError)
+        return error;
+    const message = error instanceof Error ? error.message : String(error);
+    if (/reject|denied|cancelled|canceled|closed/i.test(message)) {
+        return new WalletKitError(WalletKitErrorCode.SIGN_REJECTED, "Signing request was rejected", { cause: error });
+    }
+    return error;
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { createWalletAuth } from "./auth";
+export { formatAuthMessage, parseAuthMessage, validateAuthMessage } from "./message";
+export { generateNonce } from "./nonce";
+export type { ParsedWalletAuthMessage, SignatureVerifier, WalletAuth, WalletAuthAdapter, WalletAuthChangeHandler, WalletAuthManager, WalletAuthMessageParams, WalletAuthOptions, WalletAuthSignInResult, WalletAuthState, WalletAuthStatus, WalletAuthVerifyParams } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createWalletAuth } from "./auth";
+export { formatAuthMessage, parseAuthMessage, validateAuthMessage } from "./message";
+export { generateNonce } from "./nonce";

package/dist/message.d.ts

@@ -0,0 +1,18 @@
+import type { ParsedWalletAuthMessage, WalletAuthMessageParams } from "./types";
+export interface WalletAuthValidationOptions {
+    expectedDomain?: string;
+    expectedUri?: string;
+    expectedAddress?: string;
+    now?: Date;
+    maxAgeSeconds?: number;
+    isNonceUsed?: (nonce: string) => boolean | Promise<boolean>;
+}
+export interface WalletAuthValidationResult {
+    valid: boolean;
+    errors: string[];
+    message?: ParsedWalletAuthMessage;
+}
+export declare function formatAuthMessage(params: WalletAuthMessageParams): string;
+export declare function parseAuthMessage(message: string): ParsedWalletAuthMessage;
+export declare function validateAuthMessage(message: string, options?: WalletAuthValidationOptions): Promise<WalletAuthValidationResult>;
+//# sourceMappingURL=message.d.ts.map

package/dist/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../src/message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEhF,MAAM,WAAW,2BAA2B;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,uBAAuB,CAAC;CACnC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAsBzE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAsCzE;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAwCzI"}

package/dist/message.js

@@ -0,0 +1,107 @@
+export function formatAuthMessage(params) {
+    const lines = [
+        `${params.domain} wants you to sign in with your wallet:`,
+        params.address,
+        ""
+    ];
+    if (params.statement) {
+        lines.push(params.statement, "");
+    }
+    lines.push(`URI: ${params.uri}`, `Version: ${params.version}`, `Nonce: ${params.nonce}`, `Issued At: ${params.issuedAt}`);
+    if (params.chainId)
+        lines.push(`Chain ID: ${params.chainId}`);
+    if (params.expirationTime)
+        lines.push(`Expiration Time: ${params.expirationTime}`);
+    return lines.join("\n");
+}
+export function parseAuthMessage(message) {
+    const lines = message.split(/\r?\n/);
+    const header = lines[0] ?? "";
+    const domain = header.endsWith(" wants you to sign in with your wallet:")
+        ? header.slice(0, -" wants you to sign in with your wallet:".length)
+        : "";
+    const address = lines[1] ?? "";
+    const fields = new Map();
+    const statementLines = [];
+    let inStatement = false;
+    for (let index = 2; index < lines.length; index += 1) {
+        const line = lines[index] ?? "";
+        const fieldMatch = /^([A-Za-z ]+):\s*(.*)$/.exec(line);
+        if (fieldMatch && ["URI", "Version", "Nonce", "Issued At", "Chain ID", "Expiration Time"].includes(fieldMatch[1])) {
+            fields.set(fieldMatch[1], fieldMatch[2]);
+            inStatement = false;
+            continue;
+        }
+        if (line.length > 0 || inStatement) {
+            statementLines.push(line);
+            inStatement = true;
+        }
+    }
+    const statement = trimBlankLines(statementLines).join("\n") || undefined;
+    return {
+        domain,
+        address,
+        statement,
+        uri: fields.get("URI") ?? "",
+        version: fields.get("Version") ?? "",
+        nonce: fields.get("Nonce") ?? "",
+        issuedAt: fields.get("Issued At") ?? "",
+        chainId: fields.get("Chain ID") || undefined,
+        expirationTime: fields.get("Expiration Time") || undefined
+    };
+}
+export async function validateAuthMessage(message, options = {}) {
+    const parsed = parseAuthMessage(message);
+    const errors = [];
+    const now = options.now ?? new Date();
+    if (!parsed.domain)
+        errors.push("Missing or invalid domain.");
+    if (!parsed.address)
+        errors.push("Missing address.");
+    if (!parsed.uri)
+        errors.push("Missing URI.");
+    if (!parsed.version)
+        errors.push("Missing version.");
+    if (!parsed.nonce)
+        errors.push("Missing nonce.");
+    if (!parsed.issuedAt || Number.isNaN(Date.parse(parsed.issuedAt)))
+        errors.push("Missing or invalid issuedAt.");
+    if (options.expectedDomain && parsed.domain !== options.expectedDomain)
+        errors.push("Domain does not match.");
+    if (options.expectedUri && parsed.uri !== options.expectedUri)
+        errors.push("URI does not match.");
+    if (options.expectedAddress && parsed.address !== options.expectedAddress)
+        errors.push("Address does not match.");
+    if (parsed.expirationTime) {
+        const expiresAt = Date.parse(parsed.expirationTime);
+        if (Number.isNaN(expiresAt)) {
+            errors.push("Invalid expirationTime.");
+        }
+        else if (expiresAt <= now.getTime()) {
+            errors.push("Message has expired.");
+        }
+    }
+    if (parsed.issuedAt && !Number.isNaN(Date.parse(parsed.issuedAt)) && options.maxAgeSeconds !== undefined) {
+        const issuedAt = Date.parse(parsed.issuedAt);
+        if (now.getTime() - issuedAt > options.maxAgeSeconds * 1000) {
+            errors.push("Message is older than maxAgeSeconds.");
+        }
+    }
+    if (options.isNonceUsed && parsed.nonce && await options.isNonceUsed(parsed.nonce)) {
+        errors.push("Nonce has already been used.");
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        message: parsed
+    };
+}
+function trimBlankLines(lines) {
+    let start = 0;
+    let end = lines.length;
+    while (start < end && lines[start] === "")
+        start += 1;
+    while (end > start && lines[end - 1] === "")
+        end -= 1;
+    return lines.slice(start, end);
+}

package/dist/nonce.d.ts

@@ -0,0 +1,5 @@
+export interface GenerateNonceOptions {
+    bytes?: number;
+}
+export declare function generateNonce(options?: GenerateNonceOptions): string;
+//# sourceMappingURL=nonce.d.ts.map

package/dist/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../src/nonce.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAexE"}

package/dist/nonce.js

@@ -0,0 +1,13 @@
+export function generateNonce(options = {}) {
+    const byteLength = Math.max(16, options.bytes ?? 24);
+    const cryptoApi = globalThis.crypto;
+    if (cryptoApi?.randomUUID && byteLength <= 16) {
+        return cryptoApi.randomUUID().replace(/-/g, "");
+    }
+    if (!cryptoApi?.getRandomValues) {
+        throw new Error("Secure random nonce generation requires crypto.getRandomValues().");
+    }
+    const bytes = new Uint8Array(byteLength);
+    cryptoApi.getRandomValues(bytes);
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/types.d.ts

@@ -0,0 +1,71 @@
+import type { SignatureKind, SignMessageResult, WalletManager } from "@xrpl-wallet-kit/core";
+export interface WalletAuthMessageParams {
+    address: string;
+    nonce: string;
+    domain: string;
+    uri: string;
+    chainId?: string;
+    statement?: string;
+    issuedAt: string;
+    expirationTime?: string;
+    version: string;
+}
+export interface ParsedWalletAuthMessage extends WalletAuthMessageParams {
+}
+export interface WalletAuthVerifyParams {
+    message: string;
+    signatureKind: SignatureKind;
+    proof: string;
+    signature?: string;
+    txBlob?: string;
+    address: string;
+    publicKey?: string;
+    raw?: unknown;
+}
+export interface WalletAuthAdapter {
+    getNonce(): Promise<string>;
+    createMessage(params: WalletAuthMessageParams): string;
+    verify(params: WalletAuthVerifyParams): Promise<boolean>;
+    signOut?(): Promise<void>;
+}
+export type WalletAuthStatus = "unauthenticated" | "loading" | "authenticated" | "error";
+export interface WalletAuthState {
+    status: WalletAuthStatus;
+    address: string | null;
+    error: unknown | null;
+}
+export interface WalletAuthOptions {
+    domain?: string;
+    uri?: string;
+    chainId?: string;
+    statement?: string;
+    expiresIn?: number;
+}
+export interface WalletAuthSignInResult {
+    address: string;
+    message: string;
+    signatureKind: SignatureKind;
+    proof: string;
+    signature?: string;
+    txBlob?: string;
+    publicKey?: string;
+    raw?: unknown;
+}
+export type WalletAuthChangeHandler = (state: WalletAuthState) => void;
+export interface WalletAuth {
+    getState(): WalletAuthState;
+    signIn(options?: WalletAuthOptions): Promise<WalletAuthSignInResult>;
+    signOut(): Promise<void>;
+    on(event: "change", handler: WalletAuthChangeHandler): () => void;
+    off(event: "change", handler: WalletAuthChangeHandler): void;
+    destroy(): void;
+}
+export interface SignatureVerifier {
+    verify(params: WalletAuthVerifyParams): Promise<boolean>;
+}
+export interface WalletAuthManager extends Pick<WalletManager, "getAccount" | "getCapabilities" | "getSession" | "signMessage"> {
+}
+export declare function isWalletAuthSignInResult(value: SignMessageResult): value is SignMessageResult & {
+    proof: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;CAAG;AAE3E,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAEvE,MAAM,WAAW,UAAU;IACzB,QAAQ,IAAI,eAAe,CAAC;IAC5B,MAAM,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,GAAG,MAAM,IAAI,CAAC;IAClE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC7D,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,iBAAiB,GAAG,YAAY,GAAG,aAAa,CAAC;CAAG;AAElI,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,KAAK,IAAI,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAEjH"}

package/dist/types.js

@@ -0,0 +1,3 @@
+export function isWalletAuthSignInResult(value) {
+    return typeof value.proof === "string" && value.proof.trim().length > 0;
+}

package/dist/verifiers/index.d.ts

@@ -0,0 +1,3 @@
+export { createXrplSignatureVerifier } from "./xrpl";
+export type { XrplSignatureVerifierOptions } from "./xrpl";
+//# sourceMappingURL=index.d.ts.map

package/dist/verifiers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/verifiers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,QAAQ,CAAC;AACrD,YAAY,EAAE,4BAA4B,EAAE,MAAM,QAAQ,CAAC"}

package/dist/verifiers/index.js

@@ -0,0 +1 @@
+export { createXrplSignatureVerifier } from "./xrpl";

package/dist/verifiers/xrpl.d.ts

@@ -0,0 +1,54 @@
+import type { SignatureVerifier } from "../types";
+interface RippleKeypairsModule {
+    verify(messageHex: string, signature: string, publicKey: string): boolean;
+    deriveAddress(publicKey: string): string;
+}
+interface VerifyXrplSignatureModule {
+    verifySignature(txBlob: string): {
+        signatureValid?: boolean;
+        signedBy?: string;
+    } | boolean;
+}
+interface XrplModule {
+    decode(txBlob: string): XrplDecodedTransaction;
+    Client?: new (url: string) => XrplClient;
+}
+interface XrplClient {
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    request(request: {
+        command: "account_info";
+        account: string;
+    }): Promise<{
+        result?: {
+            account_data?: {
+                PublicKey?: string;
+            };
+        };
+        account_data?: {
+            PublicKey?: string;
+        };
+    }>;
+}
+interface XrplDecodedTransaction {
+    Account?: string;
+    Memos?: Array<{
+        Memo?: {
+            MemoData?: string;
+        };
+    }>;
+}
+export interface XrplSignatureVerifierOptions {
+    nodeUrl?: string;
+    hashMessage?: (message: string) => string;
+    nodeTimeout?: number;
+    dependencies?: {
+        rippleKeypairs?: RippleKeypairsModule;
+        verifyXrplSignature?: VerifyXrplSignatureModule;
+        xrpl?: XrplModule;
+        loadPeer?: <T>(name: string) => Promise<T>;
+    };
+}
+export declare function createXrplSignatureVerifier(options?: XrplSignatureVerifierOptions): SignatureVerifier;
+export {};
+//# sourceMappingURL=xrpl.d.ts.map

package/dist/verifiers/xrpl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xrpl.d.ts","sourceRoot":"","sources":["../../src/verifiers/xrpl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAA0B,MAAM,UAAU,CAAC;AAE1E,UAAU,oBAAoB;IAC5B,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1E,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1C;AAED,UAAU,yBAAyB;IACjC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;CAC5F;AAED,UAAU,UAAU;IAClB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAAC;IAC/C,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,MAAM,KAAK,UAAU,CAAC;CAC1C;AAED,UAAU,UAAU;IAClB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,CAAC,EAAE;YAAE,YAAY,CAAC,EAAE;gBAAE,SAAS,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;QAAC,YAAY,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACxK;AAED,UAAU,sBAAsB;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE;QACb,cAAc,CAAC,EAAE,oBAAoB,CAAC;QACtC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;QAChD,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAID,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,4BAAiC,GAAG,iBAAiB,CAOzG"}

package/dist/verifiers/xrpl.js

@@ -0,0 +1,111 @@
+const PEER_ERROR = "Install ripple-keypairs, verify-xrpl-signature, and xrpl to use @xrpl-wallet-kit/auth/verifiers.";
+export function createXrplSignatureVerifier(options = {}) {
+    return {
+        async verify(params) {
+            if (params.signatureKind === "signedTx")
+                return verifySignedTransaction(params, options);
+            return verifyCompactSignature(params, options);
+        }
+    };
+}
+async function verifyCompactSignature(params, options) {
+    const signature = params.signature ?? params.proof;
+    if (!signature)
+        return false;
+    const rippleKeypairs = options.dependencies?.rippleKeypairs ?? await loadPeer("ripple-keypairs", options);
+    const publicKey = params.publicKey ?? await resolveLedgerPublicKey(params.address, options);
+    if (!publicKey)
+        throw new Error("Cannot resolve public key for address.");
+    const messageHex = options.hashMessage ? options.hashMessage(params.message) : utf8ToHex(params.message);
+    try {
+        if (!rippleKeypairs.verify(messageHex, signature, publicKey))
+            return false;
+        return rippleKeypairs.deriveAddress(publicKey) === params.address;
+    }
+    catch {
+        return false;
+    }
+}
+async function verifySignedTransaction(params, options) {
+    const txBlob = params.txBlob ?? params.proof;
+    if (!txBlob)
+        return false;
+    const verifyModule = options.dependencies?.verifyXrplSignature ?? await loadPeer("verify-xrpl-signature", options);
+    const xrpl = options.dependencies?.xrpl ?? await loadPeer("xrpl", options);
+    const verifyResult = verifyModule.verifySignature(txBlob);
+    if (typeof verifyResult === "boolean") {
+        if (!verifyResult)
+            return false;
+    }
+    else {
+        if (verifyResult.signatureValid === false)
+            return false;
+        if (verifyResult.signedBy && verifyResult.signedBy !== params.address)
+            return false;
+    }
+    const tx = xrpl.decode(txBlob);
+    if (tx.Account !== params.address)
+        return false;
+    return extractFirstMemoText(tx) === params.message;
+}
+async function resolveLedgerPublicKey(address, options) {
+    if (!options.nodeUrl)
+        return undefined;
+    const xrpl = options.dependencies?.xrpl ?? await loadPeer("xrpl", options);
+    if (!xrpl.Client)
+        throw new Error(PEER_ERROR);
+    const client = new xrpl.Client(options.nodeUrl);
+    try {
+        await withTimeout(client.connect(), options.nodeTimeout ?? 5000);
+        const response = await withTimeout(client.request({ command: "account_info", account: address }), options.nodeTimeout ?? 5000);
+        return response.result?.account_data?.PublicKey ?? response.account_data?.PublicKey;
+    }
+    finally {
+        await client.disconnect().catch(() => undefined);
+    }
+}
+async function loadPeer(name, options) {
+    try {
+        if (options.dependencies?.loadPeer)
+            return await options.dependencies.loadPeer(name);
+        const mod = await import(name);
+        const maybeDefault = mod;
+        return (maybeDefault.default && typeof maybeDefault.default === "object" ? maybeDefault.default : mod);
+    }
+    catch (error) {
+        const peerError = new Error(PEER_ERROR);
+        peerError.cause = error;
+        throw peerError;
+    }
+}
+function utf8ToHex(value) {
+    const bytes = new TextEncoder().encode(value);
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("").toUpperCase();
+}
+function hexToUtf8(value) {
+    const normalized = value.length % 2 === 0 ? value : `0${value}`;
+    const bytes = new Uint8Array(normalized.length / 2);
+    for (let index = 0; index < bytes.length; index += 1) {
+        bytes[index] = Number.parseInt(normalized.slice(index * 2, index * 2 + 2), 16);
+    }
+    return new TextDecoder().decode(bytes);
+}
+function extractFirstMemoText(tx) {
+    const memoData = tx.Memos?.[0]?.Memo?.MemoData;
+    return memoData ? hexToUtf8(memoData) : undefined;
+}
+async function withTimeout(promise, timeoutMs) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`XRPL request timed out after ${timeoutMs}ms.`)), timeoutMs);
+            })
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@xrpl-wallet-kit/auth",
+  "version": "0.1.0",
+  "description": "Sign-In with Wallet helpers for XRPL Wallet Kit.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./verifiers": {
+      "types": "./dist/verifiers/index.d.ts",
+      "import": "./dist/verifiers/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@xrpl-wallet-kit/core": "0.1.0"
+  },
+  "peerDependencies": {
+    "ripple-keypairs": "^2.0.0",
+    "verify-xrpl-signature": "^9.2.0",
+    "xrpl": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "ripple-keypairs": {
+      "optional": true
+    },
+    "verify-xrpl-signature": {
+      "optional": true
+    },
+    "xrpl": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "ripple-keypairs": "^2.0.0",
+    "verify-xrpl-signature": "^9.2.0",
+    "xrpl": "^4.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XRPDomains/xrpl-wallet-kit.git"
+  },
+  "homepage": "https://github.com/XRPDomains/xrpl-wallet-kit#readme",
+  "bugs": {
+    "url": "https://github.com/XRPDomains/xrpl-wallet-kit/issues"
+  },
+  "keywords": [
+    "xrpl",
+    "wallet",
+    "wallet-auth",
+    "sign-in",
+    "web3"
+  ]
+}