Request builders

Each factory adds a nonce and expiry, canonicalizes dapp.origin, and validates the request before returning it. The factories are exported from @glyph-oss/connect.

import {
  createConnectRequest,
  createScCallRequest,
  createSignMessageRequest,
  createTransferRequest,
  createVerifyMessageRequest,
} from "@glyph-oss/connect";

Shared fields

Every request contains:

interface GlyphDappMeta {
  name?: string;
  origin: string;
  icon?: string;
}

interface GlyphBaseRequest {
  type: GlyphRequestType;
  dapp: GlyphDappMeta;
  nonce: string;
  exp?: number;
}

dapp.origin must be a credential-free, canonical HTTPS origin with no path, query, or fragment. The SDK rejects local, private, reserved, and otherwise non-global host addresses.

Factories accept optional defaults:

interface GlyphRequestDefaults {
  nonce?: string;
  exp?: number;
  ttlSeconds?: number;
}

When omitted, nonce is generated with the platform Web Crypto API and exp is five minutes in the future. An explicit nonce must be 16 to 128 characters. An expiry must be a future Unix timestamp no more than one hour ahead. ttlSeconds must be positive and no more than 3600.

Transfer

const request = createTransferRequest({
  type: "transfer",
  dapp: { name: "Example", origin: "https://example.app" },
  to: recipientIdentity,
  amount: "1000",
  from: optionalSenderIdentity,
  tick_offset: 5,
});

Fields:

Smart-contract call

const request = createScCallRequest({
  type: "sc_call",
  dapp: { origin: "https://example.app" },
  contract_index: 12,
  input_type: 3,
  amount: "0",
  payload: payloadBase64,
  from: optionalSenderIdentity,
  tick_offset: 5,
});

contract_index must be an integer from 0 through 63. input_type must be a non-negative integer. amount is optional and, when present, must be a non-negative integer within the signed 64-bit maximum. payload is an optional string carried to the wallet.

Sign a message

const request = createSignMessageRequest({
  type: "sign_message",
  dapp: { origin: "https://example.app" },
  message: "Sign in to Example",
  from: optionalSenderIdentity,
  data: contextBase64,
});

message is required, must not be empty, and is limited to 2048 Unicode characters. from and data are optional.

This request asks Glyph Wallet to sign after the user approves it. It does not create a browser-side signer. Verify the signed callback envelope in the dApp with k12 and verify from @qubic.org/crypto@1.0.0 before using the returned signature or public key.

Verify a message

const request = createVerifyMessageRequest({
  type: "verify_message",
  dapp: { origin: "https://example.app" },
  message: "Sign in to Example",
  signature: signatureBase64,
  public_key: publicKeyBase64,
  data: contextBase64,
});

message, signature, and public_key are required strings. data is optional. The wallet returns whether the supplied signature is valid in a verified callback result.

The Wallet's verified result is separate from the dApp's cryptographic verification of the callback envelope. Always verify the envelope before trusting this result or any other callback data.

Connect

const request = createConnectRequest({
  type: "connect",
  dapp: { name: "Example", origin: "https://example.app" },
  permissions: ["transfer", "sign_message"],
});

The optional permissions array accepts only the request permissions supported by the v2 type: transfer, sc_call, and sign_message. The wallet returns the approved permissions in the connected result. Do not treat an omitted array as an implicit authorization for every request type.

Validate an existing request

Use validateGlyphRequest() when a request was assembled outside a factory:

import { validateGlyphRequest } from "@glyph-oss/connect";

const validated = validateGlyphRequest(untrustedRequest);

Validation checks the discriminant, nonce, expiry, origin, and request-specific fields. It returns a normalized request or throws an Error. Validate before creating an envelope.