hivesigner 4.0.0 → 4.1.0

package/README.md

@@ -4,7 +4,7 @@
 
 # HiveSigner SDK
 
-The official HiveSigner JavaScript SDK, written in Typescript. Library supports both callback and promise functions. Learn more about integration: https://docs.hivesigner.com.
+The official HiveSigner JavaScript SDK, written in Typescript. Library supports both callback and promise functions. Learn more about integration: https://hivesigner.com/docs.
 
 ## Upgrading to v4
 
@@ -49,7 +49,7 @@ or
 
 For general information about HiveSigner and setting up your app you can checkout the developer documentation.
 
-**[Developers documentation](https://hivesigner.com/developers)**
+**[Developers documentation](https://hivesigner.com/docs)**
 
 ## SDK methods
 
@@ -93,6 +93,20 @@ After logging in, HiveSigner will redirect the user to the "redirect_uri" specif
 - __expires_in__: The number of seconds until the access token expires.
 - __username__: The username of the current user.
 
+### Mobile and desktop apps: PKCE
+An app that cannot keep a client secret (a mobile or desktop app) uses the code flow with PKCE. It may then use its own scheme as the callback, such as `myapp://callback`, registered on its app account.
+```js
+import { Client, createPkcePair } from 'hivesigner';
+
+const client = new Client({ app: 'myapp', callbackURL: 'myapp://callback', responseType: 'code', scope: ['posting'] });
+
+const { codeVerifier, codeChallenge } = await createPkcePair(); // keep codeVerifier in memory
+const link = client.getLoginURL(state, undefined, { codeChallenge });
+// open link, then on myapp://callback?code=CODE&state=STATE:
+const { access_token, username } = await client.exchangeCode(code, codeVerifier);
+```
+The code can be exchanged once, within 10 minutes, and only with the verifier. A native app gets no refresh token. A server can pass its client secret as the third argument of `exchangeCode`. `createPkcePair` needs Web Crypto: Node.js 20+ or a modern browser. In React Native, add a `crypto.getRandomValues` and `crypto.subtle` polyfill, or make the pair with a native library and pass the challenge to `getLoginURL`. The rest of the SDK still runs on Node.js 18. Full guide: https://hivesigner.com/docs/pkce
+
 ### Get user profile
 Once a user is logged in to your app you can call the following method to get the details of their account:
 ```

package/lib/client.d.ts

@@ -1,4 +1,4 @@
-import { CallbackFunction, ClientConfig, LoginOptions, Operation, SendResponse } from './types';
+import { CallbackFunction, ClientConfig, LoginOptions, Operation, SendResponse, TokenResponse } from './types';
 export declare class Client {
     apiURL: string;
     app: string;
@@ -14,8 +14,25 @@ export declare class Client {
     setAccessToken(accessToken: string): this;
     removeAccessToken(): this;
     setScope(scope: string[]): this;
-    getLoginURL(state: string, account?: string): string;
+    /**
+     * The authorize URL. Pass `options.codeChallenge` (from createPkcePair) to
+     * protect a code flow sign-in with PKCE, which a native app needs for a
+     * custom scheme callback such as `myapp://callback`.
+     */
+    getLoginURL(state: string, account?: string, options?: {
+        codeChallenge?: string;
+    }): string;
     login(options: LoginOptions): void;
+    /**
+     * Exchange a code for tokens at /api/oauth2/token. With PKCE send the
+     * verifier; a native app sends no secret and gets no refresh token. A
+     * server may pass its client secret as well.
+     *
+     * Sent WITHOUT the Authorization header: the API reads that header before
+     * the body, so a token this client already holds would be read instead of
+     * the code.
+     */
+    exchangeCode(code: string, codeVerifier?: string, clientSecret?: string): Promise<TokenResponse>;
     me(): Promise<SendResponse>;
     me(cb: CallbackFunction): Promise<SendResponse>;
     decode(memo: string): Promise<SendResponse>;

package/lib/hivesigner.min.js

@@ -1 +1 @@
-var hivesigner;(()=>{"use strict";var e={536(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.encodeMsg=t.encodeOps=t.encodeOp=t.encodeTx=t.resolveCallback=t.resolveTransaction=t.decode=void 0;var n=o(160);"undefined"==typeof btoa&&(o.g.btoa=function(e){return Buffer.from(e,"binary").toString("base64")}),"undefined"==typeof atob&&(o.g.atob=function(e){return Buffer.from(e,"base64").toString("binary")});var r={"/":"_",_:"/","+":"-","-":"+","=":".",".":"="},s=function(e){return btoa(unescape(encodeURIComponent(e))).replace(/(\+|\/|=)/g,function(e){return r[e]})},i=function(e){return decodeURIComponent(escape(atob(e.replace(/(-|_|\.)/g,function(e){return r[e]}))))};t.decode=function(e){var t=e.slice(0,5),o=new n(e.replace(/^hive:/,"http:"));if("hive:"!==t)throw new Error("Invalid protocol, expected 'hive:' got '"+t+"'");if("sign"!==o.host)throw new Error("Invalid action, expected 'sign' got '"+o.host+"'");var r,s,a=o.pathname.split("/").slice(1),c=a[0],l=a[1];try{r=JSON.parse(i(l))}catch(e){throw e.message="Invalid payload: "+e.message,e}switch(c){case"tx":case"msg":s=r;break;case"op":case"ops":s={ref_block_num:"__ref_block_num",ref_block_prefix:"__ref_block_prefix",expiration:"__expiration",extensions:[],operations:"ops"===c?r:[r]};break;default:throw new Error("Invalid signing action '"+c+"'")}var u=Object.fromEntries(o.query.substring(1).split("&").filter(Boolean).map(function(e){var t=e.split("="),o=t[0],n=t[1],r=void 0===n?"":n;return[decodeURIComponent(o),decodeURIComponent(r)]})),p={};return u.cb&&(p.callback=i(u.cb)),void 0!==u.nb&&(p.no_broadcast=!0),u.a&&(p.authority=u.a),u.s&&(p.signer=u.s),{tx:s,params:p}};var a=/(__(ref_block_(num|prefix)|expiration|signer))/g;t.resolveTransaction=function(e,t,o){var n=t.signer||o.preferred_signer;if(!o.signers.includes(n))throw new Error("Signer '"+n+"' not available");var r={__ref_block_num:o.ref_block_num,__ref_block_prefix:o.ref_block_prefix,__expiration:o.expiration,__signer:n},s=function(e){var t=typeof e;switch("object"===t&&Array.isArray(e)?t="array":null===e&&(t="null"),t){case"string":return e.replace(a,function(e){return r[e]});case"array":return e.map(s);case"object":for(var o={},n=0,i=Object.entries(e);n<i.length;n++){var c=i[n],l=c[0],u=c[1];o[l]=s(u)}return o;default:return e}};return{signer:n,tx:s(e)}};var c=/({{(sig|id|block|txn|data)}})/g;function l(e){var t=[];return e.no_broadcast&&t.push("nb="),e.signer&&t.push("s="+e.signer),e.callback&&t.push("cb="+s(e.callback)),e.authority&&t.push("a="+e.authority),t.length?"?"+t.join("&"):""}function u(e){return s(JSON.stringify(e,null,0))}t.resolveCallback=function(e,t){return e.replace(c,function(e,o,n){return t[n]||""})},t.encodeTx=function(e,t){return void 0===t&&(t={}),"hive://sign/tx/"+u(e)+l(t)},t.encodeOp=function(e,t){return void 0===t&&(t={}),"hive://sign/op/"+u(e)+l(t)},t.encodeOps=function(e,t){return void 0===t&&(t={}),"hive://sign/ops/"+u(e)+l(t)},t.encodeMsg=function(e,t){return void 0===t&&(t={}),"hive://sign/msg/"+u(e)+l(t)}},992(e,t){var o=Object.prototype.hasOwnProperty;function n(e){try{return decodeURIComponent(e.replace(/\+/g," "))}catch(e){return null}}function r(e){try{return encodeURIComponent(e)}catch(e){return null}}t.stringify=function(e,t){t=t||"";var n,s,i=[];for(s in"string"!=typeof t&&(t="?"),e)if(o.call(e,s)){if((n=e[s])||null!=n&&!isNaN(n)||(n=""),s=r(s),n=r(n),null===s||null===n)continue;i.push(s+"="+n)}return i.length?t+i.join("&"):""},t.parse=function(e){for(var t,o=/([^=?#&]+)=?([^&]*)/g,r={};t=o.exec(e);){var s=n(t[1]),i=n(t[2]);null===s||null===i||s in r||(r[s]=i)}return r}},63(e){e.exports=function(e,t){if(t=t.split(":")[0],!(e=+e))return!1;switch(t){case"http":case"ws":return 80!==e;case"https":case"wss":return 443!==e;case"ftp":return 21!==e;case"gopher":return 70!==e;case"file":return!1}return 0!==e}},469(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.Client=void 0;const n=o(629),r=o(779);t.Client=class{constructor(e){this.apiURL=e.apiURL||n.API_URL,this.app=e.app,this.callbackURL=e.callbackURL,this.accessToken=e.accessToken,this.scope=e.scope,this.responseType=e.responseType}setBaseURL(){return console.warn('The function "setBaseUrl" is deprecated, the base URL is always "https://hivesigner.com", you can only change the API URL with "setApiURL"'),this}setApiURL(e){return this.apiURL=e,this}setApp(e){return this.app=e,this}setCallbackURL(e){return this.callbackURL=e,this}setAccessToken(e){return this.accessToken=e,this}removeAccessToken(){return delete this.accessToken,this}setScope(e){return this.scope=e,this}getLoginURL(e,t){const o=encodeURIComponent(this.callbackURL);let r=`${n.BASE_URL}/oauth2/authorize?client_id=${this.app}&redirect_uri=${o}`;return"code"===this.responseType&&(r+=`&response_type=${this.responseType}`),this.scope&&(r+=`&scope=${this.scope.join(",")}`),e&&(r+=`&state=${encodeURIComponent(e)}`),t&&(r+=`&account=${encodeURIComponent(t)}`),r}login(e){(0,r.isBrowser)()&&(window.location=this.getLoginURL(e.state))}me(e){return this.send("me","POST",{},e)}decode(e,t){return this.send("decode","POST",{memo:e},t)}vote(e,t,o,n,r){const s={voter:e,author:t,permlink:o,weight:n};return this.broadcast([["vote",s]],r)}comment(e,t,o,n,r,s,i,a){let c=i;"string"!=typeof i&&(c=JSON.stringify(i));const l={parent_author:e,parent_permlink:t,author:o,permlink:n,title:r,body:s,json_metadata:c};return this.broadcast([["comment",l]],a)}deleteComment(e,t,o){const n={author:e,permlink:t};return this.broadcast([["delete_comment",n]],o)}customJson(e,t,o,n,r){const s={required_auths:e,required_posting_auths:t,id:o,json:n};return this.broadcast([["custom_json",s]],r)}reblog(e,t,o,n){const r=["reblog",{account:e,author:t,permlink:o}];return this.customJson([],[e],"follow",JSON.stringify(r),n)}follow(e,t,o){const n=["follow",{follower:e,following:t,what:["blog"]}];return this.customJson([],[e],"follow",JSON.stringify(n),o)}unfollow(e,t,o){const n=["follow",{follower:e,following:t,what:[]}];return this.customJson([],[e],"follow",JSON.stringify(n),o)}ignore(e,t,o){const n=["follow",{follower:e,following:t,what:["ignore"]}];return this.customJson([],[e],"follow",JSON.stringify(n),o)}claimRewardBalance(e,t,o,n,r){const s={account:e,reward_hive:t,reward_hbd:o,reward_vests:n};return this.broadcast([["claim_reward_balance",s]],r)}async revokeToken(e){return await this.send("oauth2/token/revoke","POST",{token:this.accessToken},e),this.removeAccessToken()}updateUserMetadata(e={},t){return console.warn('The function "updateUserMetadata" is deprecated.'),this.send("me","PUT",{user_metadata:e},t)}async send(e,t,o,n){const r=`${this.apiURL}/api/${e}`;if(!n)return this.makeRequest(r,t,o);try{return n(null,await this.makeRequest(r,t,o))}catch(e){return n(e,null)}}broadcast(e,t){return this.send("broadcast","POST",{operations:e},t)}async makeRequest(e,t,o){if("function"!=typeof globalThis.fetch)throw new Error("hivesigner: fetch is not available. Node.js 18+ or a modern browser is required. If you are in an older environment, provide a global fetch polyfill.");const n=await globalThis.fetch(e,{method:t,headers:{Accept:"application/json, text/plain, */*","Content-Type":"application/json",Authorization:this.accessToken},body:JSON.stringify(o)}),r=await n.json();if(200!==n.status||r.error)throw r;return r}}},944(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.API_URL=void 0,t.API_URL="https://hivesigner.com"},69(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.BASE_URL=void 0,t.BASE_URL="https://hivesigner.com"},290(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.BETA_URL=void 0,t.BETA_URL="https://hivesigner.com"},629(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(944),t),r(o(69),t),r(o(290),t)},261(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(7),t)},7(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.Initialize=void 0;const n=o(469);t.Initialize=function(e){return console.warn('The function "Initialize" is deprecated, please use the class "Client" instead.'),new n.Client(e)}},440(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(469),t),r(o(49),t),r(o(261),t);const s=o(469),i=o(261),a=o(49);t.default={Client:s.Client,Initialize:i.Initialize,sendTransaction:a.sendTransaction,sendOperations:a.sendOperations,sendOperation:a.sendOperation,sign:a.sign}},49(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(893),t),r(o(640),t),r(o(243),t),r(o(887),t)},640(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sendOperation=void 0;const n=o(629),r=o(536),s=o(779);t.sendOperation=function(e,t,o){const i=(0,r.encodeOp)(e,t).replace("hive://",`${n.BETA_URL}/`);return o&&(0,s.isBrowser)()?window.open(i,"_blank").focus():i}},243(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sendOperations=void 0;const n=o(536),r=o(779),s=o(629);t.sendOperations=function(e,t,o){const i=(0,n.encodeOps)(e,t).replace("hive://",`${s.BETA_URL}/`);return o&&(0,r.isBrowser)()?window.open(i,"_blank").focus():i}},887(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sendTransaction=void 0;const n=o(536),r=o(629),s=o(779);t.sendTransaction=function(e,t,o){const i=(0,n.encodeTx)(e,t).replace("hive://",`${r.BETA_URL}/`);return o&&(0,s.isBrowser)()?window.open(i,"_blank").focus():i}},893(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sign=void 0;const n=o(629);t.sign=function(e,t,o){if(console.warn('The function "sign" is deprecated.'),"string"!=typeof e||"object"!=typeof t||null===t)return{error:"invalid_request",error_description:"Request has an invalid format"};let r=`${n.BASE_URL}/sign/${e}?`;return r+=Object.keys(t).map(e=>`${e}=${encodeURIComponent(t[e])}`).join("&"),r+=o?`&redirect_uri=${encodeURIComponent(o)}`:"",r}},779(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(790),t)},790(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.isBrowser=void 0,t.isBrowser=function(){return"undefined"!=typeof window&&!!window}},160(e,t,o){var n=o(63),r=o(992),s=/^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/,i=/[\n\r\t]/g,a=/^[A-Za-z][A-Za-z0-9+-.]*:\/\//,c=/:\d+$/,l=/^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i,u=/^[a-zA-Z]:/;function p(e){return(e||"").toString().replace(s,"")}var d=[["#","hash"],["?","query"],function(e,t){return v(t.protocol)?e.replace(/\\/g,"/"):e},["/","pathname"],["@","auth",1],[NaN,"host",void 0,1,1],[/:(\d*)$/,"port",void 0,1],[NaN,"hostname",void 0,1,1]],h={hash:1,query:1};function f(e){var t,n=("undefined"!=typeof window?window:void 0!==o.g?o.g:"undefined"!=typeof self?self:{}).location||{},r={},s=typeof(e=e||n);if("blob:"===e.protocol)r=new g(unescape(e.pathname),{});else if("string"===s)for(t in r=new g(e,{}),h)delete r[t];else if("object"===s){for(t in e)t in h||(r[t]=e[t]);void 0===r.slashes&&(r.slashes=a.test(e.href))}return r}function v(e){return"file:"===e||"ftp:"===e||"http:"===e||"https:"===e||"ws:"===e||"wss:"===e}function b(e,t){e=(e=p(e)).replace(i,""),t=t||{};var o,n=l.exec(e),r=n[1]?n[1].toLowerCase():"",s=!!n[2],a=!!n[3],c=0;return s?a?(o=n[2]+n[3]+n[4],c=n[2].length+n[3].length):(o=n[2]+n[4],c=n[2].length):a?(o=n[3]+n[4],c=n[3].length):o=n[4],"file:"===r?c>=2&&(o=o.slice(2)):v(r)?o=n[4]:r?s&&(o=o.slice(2)):c>=2&&v(t.protocol)&&(o=n[4]),{protocol:r,slashes:s||v(r),slashesCount:c,rest:o}}function g(e,t,o){if(e=(e=p(e)).replace(i,""),!(this instanceof g))return new g(e,t,o);var s,a,c,l,h,_,m=d.slice(),w=typeof t,y=this,O=0;for("object"!==w&&"string"!==w&&(o=t,t=null),o&&"function"!=typeof o&&(o=r.parse),s=!(a=b(e||"",t=f(t))).protocol&&!a.slashes,y.slashes=a.slashes||s&&t.slashes,y.protocol=a.protocol||t.protocol||"",e=a.rest,("file:"===a.protocol&&(2!==a.slashesCount||u.test(e))||!a.slashes&&(a.protocol||a.slashesCount<2||!v(y.protocol)))&&(m[3]=[/(.*)/,"pathname"]);O<m.length;O++)"function"!=typeof(l=m[O])?(c=l[0],_=l[1],c!=c?y[_]=e:"string"==typeof c?~(h="@"===c?e.lastIndexOf(c):e.indexOf(c))&&("number"==typeof l[2]?(y[_]=e.slice(0,h),e=e.slice(h+l[2])):(y[_]=e.slice(h),e=e.slice(0,h))):(h=c.exec(e))&&(y[_]=h[1],e=e.slice(0,h.index)),y[_]=y[_]||s&&l[3]&&t[_]||"",l[4]&&(y[_]=y[_].toLowerCase())):e=l(e,y);o&&(y.query=o(y.query)),s&&t.slashes&&"/"!==y.pathname.charAt(0)&&(""!==y.pathname||""!==t.pathname)&&(y.pathname=function(e,t){if(""===e)return t;for(var o=(t||"/").split("/").slice(0,-1).concat(e.split("/")),n=o.length,r=o[n-1],s=!1,i=0;n--;)"."===o[n]?o.splice(n,1):".."===o[n]?(o.splice(n,1),i++):i&&(0===n&&(s=!0),o.splice(n,1),i--);return s&&o.unshift(""),"."!==r&&".."!==r||o.push(""),o.join("/")}(y.pathname,t.pathname)),"/"!==y.pathname.charAt(0)&&v(y.protocol)&&(y.pathname="/"+y.pathname),n(y.port,y.protocol)||(y.host=y.hostname,y.port=""),y.username=y.password="",y.auth&&(~(h=y.auth.indexOf(":"))?(y.username=y.auth.slice(0,h),y.username=encodeURIComponent(decodeURIComponent(y.username)),y.password=y.auth.slice(h+1),y.password=encodeURIComponent(decodeURIComponent(y.password))):y.username=encodeURIComponent(decodeURIComponent(y.auth)),y.auth=y.password?y.username+":"+y.password:y.username),y.origin="file:"!==y.protocol&&v(y.protocol)&&y.host?y.protocol+"//"+y.host:"null",y.href=y.toString()}g.prototype={set:function(e,t,o){var s=this;switch(e){case"query":"string"==typeof t&&t.length&&(t=(o||r.parse)(t)),s[e]=t;break;case"port":s[e]=t,n(t,s.protocol)?t&&(s.host=s.hostname+":"+t):(s.host=s.hostname,s[e]="");break;case"hostname":s[e]=t,s.port&&(t+=":"+s.port),s.host=t;break;case"host":s[e]=t,c.test(t)?(t=t.split(":"),s.port=t.pop(),s.hostname=t.join(":")):(s.hostname=t,s.port="");break;case"protocol":s.protocol=t.toLowerCase(),s.slashes=!o;break;case"pathname":case"hash":if(t){var i="pathname"===e?"/":"#";s[e]=t.charAt(0)!==i?i+t:t}else s[e]=t;break;case"username":case"password":s[e]=encodeURIComponent(t);break;case"auth":var a=t.indexOf(":");~a?(s.username=t.slice(0,a),s.username=encodeURIComponent(decodeURIComponent(s.username)),s.password=t.slice(a+1),s.password=encodeURIComponent(decodeURIComponent(s.password))):s.username=encodeURIComponent(decodeURIComponent(t))}for(var l=0;l<d.length;l++){var u=d[l];u[4]&&(s[u[1]]=s[u[1]].toLowerCase())}return s.auth=s.password?s.username+":"+s.password:s.username,s.origin="file:"!==s.protocol&&v(s.protocol)&&s.host?s.protocol+"//"+s.host:"null",s.href=s.toString(),s},toString:function(e){e&&"function"==typeof e||(e=r.stringify);var t,o=this,n=o.host,s=o.protocol;s&&":"!==s.charAt(s.length-1)&&(s+=":");var i=s+(o.protocol&&o.slashes||v(o.protocol)?"//":"");return o.username?(i+=o.username,o.password&&(i+=":"+o.password),i+="@"):o.password?(i+=":"+o.password,i+="@"):"file:"!==o.protocol&&v(o.protocol)&&!n&&"/"!==o.pathname&&(i+="@"),(":"===n[n.length-1]||c.test(o.hostname)&&!o.port)&&(n+=":"),i+=n+o.pathname,(t="object"==typeof o.query?e(o.query):o.query)&&(i+="?"!==t.charAt(0)?"?"+t:t),o.hash&&(i+=o.hash),i}},g.extractProtocol=b,g.location=f,g.trimLeft=p,g.qs=r,e.exports=g}},t={};function o(n){var r=t[n];if(void 0!==r)return r.exports;var s=t[n]={exports:{}};return e[n].call(s.exports,s,s.exports,o),s.exports}o.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}();var n=o(440);hivesigner=n})();
+var hivesigner;(()=>{"use strict";var e={536(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.encodeMsg=t.encodeOps=t.encodeOp=t.encodeTx=t.resolveCallback=t.resolveTransaction=t.decode=void 0;var n=o(160);"undefined"==typeof btoa&&(o.g.btoa=function(e){return Buffer.from(e,"binary").toString("base64")}),"undefined"==typeof atob&&(o.g.atob=function(e){return Buffer.from(e,"base64").toString("binary")});var r={"/":"_",_:"/","+":"-","-":"+","=":".",".":"="},s=function(e){return btoa(unescape(encodeURIComponent(e))).replace(/(\+|\/|=)/g,function(e){return r[e]})},i=function(e){return decodeURIComponent(escape(atob(e.replace(/(-|_|\.)/g,function(e){return r[e]}))))};t.decode=function(e){var t=e.slice(0,5),o=new n(e.replace(/^hive:/,"http:"));if("hive:"!==t)throw new Error("Invalid protocol, expected 'hive:' got '"+t+"'");if("sign"!==o.host)throw new Error("Invalid action, expected 'sign' got '"+o.host+"'");var r,s,a=o.pathname.split("/").slice(1),c=a[0],l=a[1];try{r=JSON.parse(i(l))}catch(e){throw e.message="Invalid payload: "+e.message,e}switch(c){case"tx":case"msg":s=r;break;case"op":case"ops":s={ref_block_num:"__ref_block_num",ref_block_prefix:"__ref_block_prefix",expiration:"__expiration",extensions:[],operations:"ops"===c?r:[r]};break;default:throw new Error("Invalid signing action '"+c+"'")}var u=Object.fromEntries(o.query.substring(1).split("&").filter(Boolean).map(function(e){var t=e.split("="),o=t[0],n=t[1],r=void 0===n?"":n;return[decodeURIComponent(o),decodeURIComponent(r)]})),p={};return u.cb&&(p.callback=i(u.cb)),void 0!==u.nb&&(p.no_broadcast=!0),u.a&&(p.authority=u.a),u.s&&(p.signer=u.s),{tx:s,params:p}};var a=/(__(ref_block_(num|prefix)|expiration|signer))/g;t.resolveTransaction=function(e,t,o){var n=t.signer||o.preferred_signer;if(!o.signers.includes(n))throw new Error("Signer '"+n+"' not available");var r={__ref_block_num:o.ref_block_num,__ref_block_prefix:o.ref_block_prefix,__expiration:o.expiration,__signer:n},s=function(e){var t=typeof e;switch("object"===t&&Array.isArray(e)?t="array":null===e&&(t="null"),t){case"string":return e.replace(a,function(e){return r[e]});case"array":return e.map(s);case"object":for(var o={},n=0,i=Object.entries(e);n<i.length;n++){var c=i[n],l=c[0],u=c[1];o[l]=s(u)}return o;default:return e}};return{signer:n,tx:s(e)}};var c=/({{(sig|id|block|txn|data)}})/g;function l(e){var t=[];return e.no_broadcast&&t.push("nb="),e.signer&&t.push("s="+e.signer),e.callback&&t.push("cb="+s(e.callback)),e.authority&&t.push("a="+e.authority),t.length?"?"+t.join("&"):""}function u(e){return s(JSON.stringify(e,null,0))}t.resolveCallback=function(e,t){return e.replace(c,function(e,o,n){return t[n]||""})},t.encodeTx=function(e,t){return void 0===t&&(t={}),"hive://sign/tx/"+u(e)+l(t)},t.encodeOp=function(e,t){return void 0===t&&(t={}),"hive://sign/op/"+u(e)+l(t)},t.encodeOps=function(e,t){return void 0===t&&(t={}),"hive://sign/ops/"+u(e)+l(t)},t.encodeMsg=function(e,t){return void 0===t&&(t={}),"hive://sign/msg/"+u(e)+l(t)}},992(e,t){var o=Object.prototype.hasOwnProperty;function n(e){try{return decodeURIComponent(e.replace(/\+/g," "))}catch(e){return null}}function r(e){try{return encodeURIComponent(e)}catch(e){return null}}t.stringify=function(e,t){t=t||"";var n,s,i=[];for(s in"string"!=typeof t&&(t="?"),e)if(o.call(e,s)){if((n=e[s])||null!=n&&!isNaN(n)||(n=""),s=r(s),n=r(n),null===s||null===n)continue;i.push(s+"="+n)}return i.length?t+i.join("&"):""},t.parse=function(e){for(var t,o=/([^=?#&]+)=?([^&]*)/g,r={};t=o.exec(e);){var s=n(t[1]),i=n(t[2]);null===s||null===i||s in r||(r[s]=i)}return r}},63(e){e.exports=function(e,t){if(t=t.split(":")[0],!(e=+e))return!1;switch(t){case"http":case"ws":return 80!==e;case"https":case"wss":return 443!==e;case"ftp":return 21!==e;case"gopher":return 70!==e;case"file":return!1}return 0!==e}},469(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.Client=void 0;const n=o(629),r=o(779);t.Client=class{constructor(e){this.apiURL=e.apiURL||n.API_URL,this.app=e.app,this.callbackURL=e.callbackURL,this.accessToken=e.accessToken,this.scope=e.scope,this.responseType=e.responseType}setBaseURL(){return console.warn('The function "setBaseUrl" is deprecated, the base URL is always "https://hivesigner.com", you can only change the API URL with "setApiURL"'),this}setApiURL(e){return this.apiURL=e,this}setApp(e){return this.app=e,this}setCallbackURL(e){return this.callbackURL=e,this}setAccessToken(e){return this.accessToken=e,this}removeAccessToken(){return delete this.accessToken,this}setScope(e){return this.scope=e,this}getLoginURL(e,t,o={}){const r=encodeURIComponent(this.callbackURL);let s=`${n.BASE_URL}/oauth2/authorize?client_id=${this.app}&redirect_uri=${r}`;return"code"===this.responseType&&(s+=`&response_type=${this.responseType}`),this.scope&&(s+=`&scope=${this.scope.join(",")}`),e&&(s+=`&state=${encodeURIComponent(e)}`),t&&(s+=`&account=${encodeURIComponent(t)}`),o.codeChallenge&&"code"===this.responseType&&(s+=`&code_challenge=${encodeURIComponent(o.codeChallenge)}&code_challenge_method=S256`),s}login(e){(0,r.isBrowser)()&&(window.location=this.getLoginURL(e.state,void 0,{codeChallenge:e.codeChallenge}))}async exchangeCode(e,t,o){const n={code:e};return t&&(n.code_verifier=t),o&&(n.client_secret=o),await this.makeRequest(`${this.apiURL}/api/oauth2/token`,"POST",n,!1)}me(e){return this.send("me","POST",{},e)}decode(e,t){return this.send("decode","POST",{memo:e},t)}vote(e,t,o,n,r){const s={voter:e,author:t,permlink:o,weight:n};return this.broadcast([["vote",s]],r)}comment(e,t,o,n,r,s,i,a){let c=i;"string"!=typeof i&&(c=JSON.stringify(i));const l={parent_author:e,parent_permlink:t,author:o,permlink:n,title:r,body:s,json_metadata:c};return this.broadcast([["comment",l]],a)}deleteComment(e,t,o){const n={author:e,permlink:t};return this.broadcast([["delete_comment",n]],o)}customJson(e,t,o,n,r){const s={required_auths:e,required_posting_auths:t,id:o,json:n};return this.broadcast([["custom_json",s]],r)}reblog(e,t,o,n){const r=["reblog",{account:e,author:t,permlink:o}];return this.customJson([],[e],"follow",JSON.stringify(r),n)}follow(e,t,o){const n=["follow",{follower:e,following:t,what:["blog"]}];return this.customJson([],[e],"follow",JSON.stringify(n),o)}unfollow(e,t,o){const n=["follow",{follower:e,following:t,what:[]}];return this.customJson([],[e],"follow",JSON.stringify(n),o)}ignore(e,t,o){const n=["follow",{follower:e,following:t,what:["ignore"]}];return this.customJson([],[e],"follow",JSON.stringify(n),o)}claimRewardBalance(e,t,o,n,r){const s={account:e,reward_hive:t,reward_hbd:o,reward_vests:n};return this.broadcast([["claim_reward_balance",s]],r)}async revokeToken(e){return await this.send("oauth2/token/revoke","POST",{token:this.accessToken},e),this.removeAccessToken()}updateUserMetadata(e={},t){return console.warn('The function "updateUserMetadata" is deprecated.'),this.send("me","PUT",{user_metadata:e},t)}async send(e,t,o,n){const r=`${this.apiURL}/api/${e}`;if(!n)return this.makeRequest(r,t,o);try{return n(null,await this.makeRequest(r,t,o))}catch(e){return n(e,null)}}broadcast(e,t){return this.send("broadcast","POST",{operations:e},t)}async makeRequest(e,t,o,n=!0){if("function"!=typeof globalThis.fetch)throw new Error("hivesigner: fetch is not available. Node.js 18+ or a modern browser is required. If you are in an older environment, provide a global fetch polyfill.");const r=await globalThis.fetch(e,{method:t,headers:Object.assign({Accept:"application/json, text/plain, */*","Content-Type":"application/json"},n?{Authorization:this.accessToken}:{}),body:JSON.stringify(o)}),s=await r.json();if(200!==r.status||s.error)throw s;return s}}},944(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.API_URL=void 0,t.API_URL="https://hivesigner.com"},69(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.BASE_URL=void 0,t.BASE_URL="https://hivesigner.com"},290(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.BETA_URL=void 0,t.BETA_URL="https://hivesigner.com"},629(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(944),t),r(o(69),t),r(o(290),t)},261(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(7),t)},7(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.Initialize=void 0;const n=o(469);t.Initialize=function(e){return console.warn('The function "Initialize" is deprecated, please use the class "Client" instead.'),new n.Client(e)}},440(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(469),t),r(o(49),t),r(o(261),t),r(o(295),t);const s=o(469),i=o(261),a=o(49),c=o(295);t.default={Client:s.Client,Initialize:i.Initialize,sendTransaction:a.sendTransaction,sendOperations:a.sendOperations,sendOperation:a.sendOperation,sign:a.sign,createPkcePair:c.createPkcePair,pkceChallengeFor:c.pkceChallengeFor}},49(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(893),t),r(o(640),t),r(o(243),t),r(o(887),t)},640(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sendOperation=void 0;const n=o(629),r=o(536),s=o(779);t.sendOperation=function(e,t,o){const i=(0,r.encodeOp)(e,t).replace("hive://",`${n.BETA_URL}/`);return o&&(0,s.isBrowser)()?window.open(i,"_blank").focus():i}},243(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sendOperations=void 0;const n=o(536),r=o(779),s=o(629);t.sendOperations=function(e,t,o){const i=(0,n.encodeOps)(e,t).replace("hive://",`${s.BETA_URL}/`);return o&&(0,r.isBrowser)()?window.open(i,"_blank").focus():i}},887(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sendTransaction=void 0;const n=o(536),r=o(629),s=o(779);t.sendTransaction=function(e,t,o){const i=(0,n.encodeTx)(e,t).replace("hive://",`${r.BETA_URL}/`);return o&&(0,s.isBrowser)()?window.open(i,"_blank").focus():i}},893(e,t,o){Object.defineProperty(t,"__esModule",{value:!0}),t.sign=void 0;const n=o(629);t.sign=function(e,t,o){if(console.warn('The function "sign" is deprecated.'),"string"!=typeof e||"object"!=typeof t||null===t)return{error:"invalid_request",error_description:"Request has an invalid format"};let r=`${n.BASE_URL}/sign/${e}?`;return r+=Object.keys(t).map(e=>`${e}=${encodeURIComponent(t[e])}`).join("&"),r+=o?`&redirect_uri=${encodeURIComponent(o)}`:"",r}},295(e,t){function o(){const e=globalThis.crypto;if(!e||!e.subtle||"function"!=typeof e.getRandomValues)throw new Error("hivesigner: Web Crypto is not available. Node.js 20+ or a modern browser is required for PKCE.");return e}function n(e){let t="";return e.forEach(e=>{t+=String.fromCharCode(e)}),("function"==typeof btoa?btoa(t):Buffer.from(t,"binary").toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function r(e){const t=await o().subtle.digest("SHA-256",(new TextEncoder).encode(e));return n(new Uint8Array(t))}Object.defineProperty(t,"__esModule",{value:!0}),t.createPkcePair=t.pkceChallengeFor=void 0,t.pkceChallengeFor=r,t.createPkcePair=async function(){const e=n(o().getRandomValues(new Uint8Array(32)));return{codeVerifier:e,codeChallenge:await r(e)}}},779(e,t,o){var n=this&&this.__createBinding||(Object.create?function(e,t,o,n){void 0===n&&(n=o);var r=Object.getOwnPropertyDescriptor(t,o);r&&!("get"in r?!t.__esModule:r.writable||r.configurable)||(r={enumerable:!0,get:function(){return t[o]}}),Object.defineProperty(e,n,r)}:function(e,t,o,n){void 0===n&&(n=o),e[n]=t[o]}),r=this&&this.__exportStar||function(e,t){for(var o in e)"default"===o||Object.prototype.hasOwnProperty.call(t,o)||n(t,e,o)};Object.defineProperty(t,"__esModule",{value:!0}),r(o(790),t)},790(e,t){Object.defineProperty(t,"__esModule",{value:!0}),t.isBrowser=void 0,t.isBrowser=function(){return"undefined"!=typeof window&&!!window}},160(e,t,o){var n=o(63),r=o(992),s=/^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/,i=/[\n\r\t]/g,a=/^[A-Za-z][A-Za-z0-9+-.]*:\/\//,c=/:\d+$/,l=/^([a-z][a-z0-9.+-]*:)?(\/\/)?([\\/]+)?([\S\s]*)/i,u=/^[a-zA-Z]:/;function p(e){return(e||"").toString().replace(s,"")}var d=[["#","hash"],["?","query"],function(e,t){return g(t.protocol)?e.replace(/\\/g,"/"):e},["/","pathname"],["@","auth",1],[NaN,"host",void 0,1,1],[/:(\d*)$/,"port",void 0,1],[NaN,"hostname",void 0,1,1]],h={hash:1,query:1};function f(e){var t,n=("undefined"!=typeof window?window:void 0!==o.g?o.g:"undefined"!=typeof self?self:{}).location||{},r={},s=typeof(e=e||n);if("blob:"===e.protocol)r=new v(unescape(e.pathname),{});else if("string"===s)for(t in r=new v(e,{}),h)delete r[t];else if("object"===s){for(t in e)t in h||(r[t]=e[t]);void 0===r.slashes&&(r.slashes=a.test(e.href))}return r}function g(e){return"file:"===e||"ftp:"===e||"http:"===e||"https:"===e||"ws:"===e||"wss:"===e}function b(e,t){e=(e=p(e)).replace(i,""),t=t||{};var o,n=l.exec(e),r=n[1]?n[1].toLowerCase():"",s=!!n[2],a=!!n[3],c=0;return s?a?(o=n[2]+n[3]+n[4],c=n[2].length+n[3].length):(o=n[2]+n[4],c=n[2].length):a?(o=n[3]+n[4],c=n[3].length):o=n[4],"file:"===r?c>=2&&(o=o.slice(2)):g(r)?o=n[4]:r?s&&(o=o.slice(2)):c>=2&&g(t.protocol)&&(o=n[4]),{protocol:r,slashes:s||g(r),slashesCount:c,rest:o}}function v(e,t,o){if(e=(e=p(e)).replace(i,""),!(this instanceof v))return new v(e,t,o);var s,a,c,l,h,_,m=d.slice(),w=typeof t,y=this,O=0;for("object"!==w&&"string"!==w&&(o=t,t=null),o&&"function"!=typeof o&&(o=r.parse),s=!(a=b(e||"",t=f(t))).protocol&&!a.slashes,y.slashes=a.slashes||s&&t.slashes,y.protocol=a.protocol||t.protocol||"",e=a.rest,("file:"===a.protocol&&(2!==a.slashesCount||u.test(e))||!a.slashes&&(a.protocol||a.slashesCount<2||!g(y.protocol)))&&(m[3]=[/(.*)/,"pathname"]);O<m.length;O++)"function"!=typeof(l=m[O])?(c=l[0],_=l[1],c!=c?y[_]=e:"string"==typeof c?~(h="@"===c?e.lastIndexOf(c):e.indexOf(c))&&("number"==typeof l[2]?(y[_]=e.slice(0,h),e=e.slice(h+l[2])):(y[_]=e.slice(h),e=e.slice(0,h))):(h=c.exec(e))&&(y[_]=h[1],e=e.slice(0,h.index)),y[_]=y[_]||s&&l[3]&&t[_]||"",l[4]&&(y[_]=y[_].toLowerCase())):e=l(e,y);o&&(y.query=o(y.query)),s&&t.slashes&&"/"!==y.pathname.charAt(0)&&(""!==y.pathname||""!==t.pathname)&&(y.pathname=function(e,t){if(""===e)return t;for(var o=(t||"/").split("/").slice(0,-1).concat(e.split("/")),n=o.length,r=o[n-1],s=!1,i=0;n--;)"."===o[n]?o.splice(n,1):".."===o[n]?(o.splice(n,1),i++):i&&(0===n&&(s=!0),o.splice(n,1),i--);return s&&o.unshift(""),"."!==r&&".."!==r||o.push(""),o.join("/")}(y.pathname,t.pathname)),"/"!==y.pathname.charAt(0)&&g(y.protocol)&&(y.pathname="/"+y.pathname),n(y.port,y.protocol)||(y.host=y.hostname,y.port=""),y.username=y.password="",y.auth&&(~(h=y.auth.indexOf(":"))?(y.username=y.auth.slice(0,h),y.username=encodeURIComponent(decodeURIComponent(y.username)),y.password=y.auth.slice(h+1),y.password=encodeURIComponent(decodeURIComponent(y.password))):y.username=encodeURIComponent(decodeURIComponent(y.auth)),y.auth=y.password?y.username+":"+y.password:y.username),y.origin="file:"!==y.protocol&&g(y.protocol)&&y.host?y.protocol+"//"+y.host:"null",y.href=y.toString()}v.prototype={set:function(e,t,o){var s=this;switch(e){case"query":"string"==typeof t&&t.length&&(t=(o||r.parse)(t)),s[e]=t;break;case"port":s[e]=t,n(t,s.protocol)?t&&(s.host=s.hostname+":"+t):(s.host=s.hostname,s[e]="");break;case"hostname":s[e]=t,s.port&&(t+=":"+s.port),s.host=t;break;case"host":s[e]=t,c.test(t)?(t=t.split(":"),s.port=t.pop(),s.hostname=t.join(":")):(s.hostname=t,s.port="");break;case"protocol":s.protocol=t.toLowerCase(),s.slashes=!o;break;case"pathname":case"hash":if(t){var i="pathname"===e?"/":"#";s[e]=t.charAt(0)!==i?i+t:t}else s[e]=t;break;case"username":case"password":s[e]=encodeURIComponent(t);break;case"auth":var a=t.indexOf(":");~a?(s.username=t.slice(0,a),s.username=encodeURIComponent(decodeURIComponent(s.username)),s.password=t.slice(a+1),s.password=encodeURIComponent(decodeURIComponent(s.password))):s.username=encodeURIComponent(decodeURIComponent(t))}for(var l=0;l<d.length;l++){var u=d[l];u[4]&&(s[u[1]]=s[u[1]].toLowerCase())}return s.auth=s.password?s.username+":"+s.password:s.username,s.origin="file:"!==s.protocol&&g(s.protocol)&&s.host?s.protocol+"//"+s.host:"null",s.href=s.toString(),s},toString:function(e){e&&"function"==typeof e||(e=r.stringify);var t,o=this,n=o.host,s=o.protocol;s&&":"!==s.charAt(s.length-1)&&(s+=":");var i=s+(o.protocol&&o.slashes||g(o.protocol)?"//":"");return o.username?(i+=o.username,o.password&&(i+=":"+o.password),i+="@"):o.password?(i+=":"+o.password,i+="@"):"file:"!==o.protocol&&g(o.protocol)&&!n&&"/"!==o.pathname&&(i+="@"),(":"===n[n.length-1]||c.test(o.hostname)&&!o.port)&&(n+=":"),i+=n+o.pathname,(t="object"==typeof o.query?e(o.query):o.query)&&(i+="?"!==t.charAt(0)?"?"+t:t),o.hash&&(i+=o.hash),i}},v.extractProtocol=b,v.location=f,v.trimLeft=p,v.qs=r,e.exports=v}},t={};function o(n){var r=t[n];if(void 0!==r)return r.exports;var s=t[n]={exports:{}};return e[n].call(s.exports,s,s.exports,o),s.exports}o.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}();var n=o(440);hivesigner=n})();

package/lib/index.d.ts

@@ -1,9 +1,11 @@
 export * from './client';
 export * from './methods';
 export * from './factories';
+export * from './pkce';
 import { Client } from './client';
 import { Initialize } from './factories';
 import { sendTransaction, sendOperations, sendOperation, sign } from './methods';
+import { createPkcePair, pkceChallengeFor } from './pkce';
 declare const _default: {
     Client: typeof Client;
     Initialize: typeof Initialize;
@@ -11,5 +13,7 @@ declare const _default: {
     sendOperations: typeof sendOperations;
     sendOperation: typeof sendOperation;
     sign: typeof sign;
+    createPkcePair: typeof createPkcePair;
+    pkceChallengeFor: typeof pkceChallengeFor;
 };
 export default _default;

package/lib/index.js

@@ -51,7 +51,12 @@ class Client {
         this.scope = scope;
         return this;
     }
-    getLoginURL(state, account) {
+    /**
+     * The authorize URL. Pass `options.codeChallenge` (from createPkcePair) to
+     * protect a code flow sign-in with PKCE, which a native app needs for a
+     * custom scheme callback such as `myapp://callback`.
+     */
+    getLoginURL(state, account, options = {}) {
         const redirectUri = encodeURIComponent(this.callbackURL);
         let loginURL = `${BASE_URL}/oauth2/authorize?client_id=${this.app}&redirect_uri=${redirectUri}`;
         if (this.responseType === 'code') {
@@ -66,14 +71,35 @@ class Client {
         if (account) {
             loginURL += `&account=${encodeURIComponent(account)}`;
         }
+        // PKCE protects a code: the token flow has none, and Hivesigner ignores it there.
+        if (options.codeChallenge && this.responseType === 'code') {
+            loginURL += `&code_challenge=${encodeURIComponent(options.codeChallenge)}&code_challenge_method=S256`;
+        }
         return loginURL;
     }
     login(options) {
         if (isBrowser()) {
             // @ts-ignore
-            window.location = this.getLoginURL(options.state);
+            window.location = this.getLoginURL(options.state, undefined, { codeChallenge: options.codeChallenge });
         }
     }
+    /**
+     * Exchange a code for tokens at /api/oauth2/token. With PKCE send the
+     * verifier; a native app sends no secret and gets no refresh token. A
+     * server may pass its client secret as well.
+     *
+     * Sent WITHOUT the Authorization header: the API reads that header before
+     * the body, so a token this client already holds would be read instead of
+     * the code.
+     */
+    async exchangeCode(code, codeVerifier, clientSecret) {
+        const body = { code };
+        if (codeVerifier)
+            body.code_verifier = codeVerifier;
+        if (clientSecret)
+            body.client_secret = clientSecret;
+        return (await this.makeRequest(`${this.apiURL}/api/oauth2/token`, 'POST', body, false));
+    }
     me(cb) {
         return this.send('me', 'POST', {}, cb);
     }
@@ -170,18 +196,14 @@ class Client {
     broadcast(operations, cb) {
         return this.send('broadcast', 'POST', { operations }, cb);
     }
-    async makeRequest(url, method, body) {
+    async makeRequest(url, method, body, withToken = true) {
         if (typeof globalThis.fetch !== 'function') {
             throw new Error('hivesigner: fetch is not available. Node.js 18+ or a modern browser is required. ' +
                 'If you are in an older environment, provide a global fetch polyfill.');
         }
         const response = await globalThis.fetch(url, {
             method,
-            headers: {
-                Accept: 'application/json, text/plain, */*',
-                'Content-Type': 'application/json',
-                Authorization: this.accessToken,
-            },
+            headers: Object.assign({ Accept: 'application/json, text/plain, */*', 'Content-Type': 'application/json' }, (withToken ? { Authorization: this.accessToken } : {})),
             body: JSON.stringify(body),
         });
         const json = await response.json();
@@ -243,18 +265,54 @@ function Initialize(config) {
     return new Client(config);
 }
 
+/**
+ * PKCE (RFC 7636) for apps that cannot keep a client secret: a native app makes
+ * a fresh verifier for every sign-in, sends only its S256 challenge to the
+ * authorize page, and proves it holds the verifier when it exchanges the code.
+ * See https://hivesigner.com/docs/pkce
+ */
+function subtleCrypto() {
+    const c = globalThis.crypto;
+    if (!c || !c.subtle || typeof c.getRandomValues !== 'function') {
+        throw new Error('hivesigner: Web Crypto is not available. Node.js 20+ or a modern browser is required for PKCE.');
+    }
+    return c;
+}
+function base64url(bytes) {
+    let binary = '';
+    bytes.forEach((b) => {
+        binary += String.fromCharCode(b);
+    });
+    const b64 = typeof btoa === 'function' ? btoa(binary) : Buffer.from(binary, 'binary').toString('base64');
+    return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** BASE64URL(SHA256(verifier)), the S256 challenge of a verifier. */
+async function pkceChallengeFor(codeVerifier) {
+    const digest = await subtleCrypto().subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier));
+    return base64url(new Uint8Array(digest));
+}
+/** A new verifier (32 random bytes, 43 characters) and its S256 challenge. */
+async function createPkcePair() {
+    const codeVerifier = base64url(subtleCrypto().getRandomValues(new Uint8Array(32)));
+    return { codeVerifier, codeChallenge: await pkceChallengeFor(codeVerifier) };
+}
+
 var index = {
     Client,
     Initialize,
     sendTransaction,
     sendOperations,
     sendOperation,
-    sign
+    sign,
+    createPkcePair,
+    pkceChallengeFor
 };
 
 exports.Client = Client;
 exports.Initialize = Initialize;
+exports.createPkcePair = createPkcePair;
 exports["default"] = index;
+exports.pkceChallengeFor = pkceChallengeFor;
 exports.sendOperation = sendOperation;
 exports.sendOperations = sendOperations;
 exports.sendTransaction = sendTransaction;

package/lib/pkce.d.ts

@@ -0,0 +1,16 @@
+/**
+ * PKCE (RFC 7636) for apps that cannot keep a client secret: a native app makes
+ * a fresh verifier for every sign-in, sends only its S256 challenge to the
+ * authorize page, and proves it holds the verifier when it exchanges the code.
+ * See https://hivesigner.com/docs/pkce
+ */
+export interface PkcePair {
+    /** Kept by the app until the exchange. Never put it in a URL. */
+    codeVerifier: string;
+    /** Sent as `code_challenge` with `code_challenge_method=S256`. */
+    codeChallenge: string;
+}
+/** BASE64URL(SHA256(verifier)), the S256 challenge of a verifier. */
+export declare function pkceChallengeFor(codeVerifier: string): Promise<string>;
+/** A new verifier (32 random bytes, 43 characters) and its S256 challenge. */
+export declare function createPkcePair(): Promise<PkcePair>;

package/lib/types/index.d.ts

@@ -4,3 +4,4 @@ export * from './callback-function.type';
 export * from './login-options.interface';
 export * from './send-response.type';
 export * from './hive.types';
+export * from './token-response.interface';

package/lib/types/login-options.interface.d.ts

@@ -1,3 +1,5 @@
 export interface LoginOptions {
     state: string;
+    /** From createPkcePair: protects a code flow sign-in with PKCE. */
+    codeChallenge?: string;
 }

package/lib/types/token-response.interface.d.ts

@@ -0,0 +1,8 @@
+/** What /api/oauth2/token answers. `refresh_token` is absent for a PKCE
+    exchange without a client secret. */
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    expires_in: number;
+    username: string;
+}

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "hivesigner",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Hivesigner SDK",
   "main": "./lib/index",
   "types": "./lib/index",
+  "files": [
+    "lib"
+  ],
   "scripts": {
     "build": "rimraf lib && webpack && rollup -c rollup.config.js && tsc --emitDeclarationOnly",
     "test": "npx jest",

package/.claude/settings.local.json

@@ -1,12 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(test:*)",
-      "WebSearch",
-      "Bash(npm test:*)",
-      "Bash(npm run build:*)",
-      "Bash(npx tsc:*)",
-      "Bash(yarn build:*)"
-    ]
-  }
-}

package/.eslintignore

@@ -1,3 +0,0 @@
-node_modules
-dist
-coverage

package/.eslintrc.js

@@ -1,16 +0,0 @@
-module.exports = {
-    parser: '@typescript-eslint/parser', // Specifies the ESLint parser
-    extends: [
-        'plugin:@typescript-eslint/recommended' // Uses the recommended rules from @typescript-eslint/eslint-plugin
-    ],
-    parserOptions: {
-        ecmaVersion: 2018, // Allows for the parsing of modern ECMAScript features
-        sourceType: 'module' // Allows for the use of imports
-    },
-    rules: {
-        // Place to specify ESLint rules. Can be used to overwrite rules specified from the extended configs
-        // e.g. '@typescript-eslint/explicit-function-return-type': 'off',
-        "@typescript-eslint/ban-ts-comment": "off",
-        "@typescript-eslint/no-empty-function": "off"
-    }
-};

package/CLAUDE.md

@@ -1,142 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-HiveSigner SDK is a JavaScript/TypeScript SDK for the Hive blockchain's OAuth2 authentication service (HiveSigner). It enables applications to authenticate users and perform Hive blockchain operations on their behalf. The SDK works in both browser and Node.js environments.
-
-## Build & Development Commands
-
-### Building
-```bash
-npm run build
-```
-This command:
-1. Cleans the `lib/` directory
-2. Runs webpack to create browser bundle (`lib/hivesigner.min.js`)
-3. Runs rollup to create CommonJS module (`lib/index.js`)
-4. Runs TypeScript compiler to emit type declarations (`lib/**/*.d.ts`)
-
-### Testing
-```bash
-npm test
-```
-Runs all tests using Jest with ts-jest preset.
-
-To run a single test file:
-```bash
-npx jest src/path/to/file.spec.ts
-```
-
-### Linting
-```bash
-npm run lint
-```
-Runs ESLint on all TypeScript files in `src/`.
-
-## Architecture
-
-### Core Components
-
-**Client Class (`src/client.ts`)**
-- Main entry point for SDK functionality
-- Handles OAuth2 authentication flow (login, token management)
-- Provides convenience methods for common Hive operations (vote, comment, follow, etc.)
-- Uses method overloading to support both callback and Promise-based APIs
-- All operations ultimately call `broadcast()` or `send()` methods
-
-**Dual API Pattern**
-The SDK supports both callbacks and Promises throughout. Each public method has overloaded signatures:
-```typescript
-public vote(...args): Promise<SendResponse>
-public vote(...args, cb: CallbackFunction): Promise<SendResponse>
-```
-
-### Directory Structure
-
-- `src/client.ts` - Main Client class with all SDK methods
-- `src/methods/` - Standalone utility methods for operations like `sendOperation`, `sendOperations`, `sign`
-- `src/factories/` - Factory functions (mainly deprecated `Initialize` function)
-- `src/types/` - TypeScript interfaces and types
-- `src/consts/` - Constants for API URLs (API_URL, BASE_URL, BETA_URL)
-- `src/utilities/` - Helper utilities like `isBrowser()`
-
-### Key Concepts
-
-**Operation Broadcasting**
-- Most methods construct an operation array and call `this.broadcast(operations, cb)`
-- `broadcast()` sends operations to HiveSigner API's `/api/broadcast` endpoint
-- Operations follow Hive blockchain operation format (from `@hiveio/dhive`)
-
-**Authentication Flow**
-1. App creates Client instance with `app`, `callbackURL`, and `scope`
-2. User redirects to URL from `getLoginURL()` or calls `login()`
-3. HiveSigner redirects back with `access_token` in query params
-4. App sets token via `setAccessToken(accessToken)`
-5. Authenticated calls include token in Authorization header
-
-**URI Encoding for Operations**
-- `sendOperation()` and `sendOperations()` use `hive-uri` package to encode operations as hive:// URIs
-- These URIs are converted to HiveSigner web URLs for browser-based signing
-
-## Build Output
-
-The build produces three main artifacts in `lib/`:
-- `index.js` + `index.d.ts` - CommonJS module with TypeScript declarations
-- `hivesigner.min.js` - Webpack-bundled browser build (UMD format)
-- Directory structure mirrors `src/` for individual module imports
-
-## TypeScript Configuration
-
-- Target: ES5 for broad compatibility
-- Module: CommonJS
-- Declaration files are generated for all modules
-- Test files (`*.spec.ts`) are excluded from compilation
-
-## Dependencies
-
-**Runtime:**
-- `cross-fetch` - Isomorphic fetch for Node.js and browser
-- `hive-uri` - Encoding/decoding Hive operation URIs
-- `@hiveio/dhive` (devDep, used for types) - Hive blockchain library
-
-**Build:**
-- Webpack for browser bundle
-- Rollup for CommonJS build
-- TypeScript for compilation and type checking
-- Jest + ts-jest for testing
-
-## Known Issues & Fixes
-
-### "Illegal invocation" Error with Fetch
-When using the SDK in browser environments, you may encounter:
-```
-TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation
-```
-
-**Cause**: The native browser `fetch` function loses its binding to the `window` object when imported and called through `cross-fetch`.
-
-**Fix Applied**: The fetch function is now explicitly bound at module load time in `src/client.ts`:
-```typescript
-const fetch = crossFetch.bind(typeof globalThis !== 'undefined' ? globalThis : undefined)
-```
-
-This ensures the fetch function maintains proper context in both browser and Node.js environments.
-
-### Webpack Build Error with Node.js 17+
-When building with Node.js 17+, you may encounter:
-```
-Error: error:0308010C:digital envelope routines::unsupported
-```
-
-**Cause**: Webpack 4 uses the MD4 hash algorithm which was removed in OpenSSL 3.0 (used by Node.js 17+).
-
-**Fix Applied**: The build script now uses the legacy OpenSSL provider:
-```bash
-NODE_OPTIONS=--openssl-legacy-provider webpack
-```
-
-**Alternative Solutions**:
-- Use Node.js 16 or earlier
-- Upgrade to Webpack 5 (requires dependency updates)

package/docs/CNAME

@@ -1 +0,0 @@
-demo.hivesigner.com