@getpara/shared 1.24.0 → 1.26.0

package/dist/cjs/index.js

@@ -38,6 +38,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.transactionTypes = void 0;
 __exportStar(require("./types/index.js"), exports);
+__exportStar(require("./types/permissions.js"), exports);
+__exportStar(require("./schemas/permissionsV2.js"), exports);
 __exportStar(require("./utils/index.js"), exports);
 const transactionTypes = __importStar(require("./types/transaction.js"));
 exports.transactionTypes = transactionTypes;

package/dist/cjs/schemas/permissionsV2.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.permissionsV2ValidationErrorSchema = exports.permissionsV2DelegationConsentDiscoveryResponseSchema = exports.permissionsV2DelegationConsentRequestSchema = exports.permissionsV2DelegationConsentViewSchema = exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema = exports.permissionsV2DelegationConsentApiStatusSchema = exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissionsV2PartnerPolicyCandidateSchema = exports.permissionsV2PolicyRuleSchema = exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema = exports.permissionsV2PartnerAuthoredPolicySelectorSchema = exports.permissionsV2ConditionSchema = exports.policyAuthoringJsonObjectSchema = exports.policyAuthoringJsonValueSchema = exports.policyAuthoringJsonPrimitiveSchema = exports.permissionsV2SigningRequestTypeSchema = exports.permissionsV2SigningRequestRouteSchema = exports.permissionsV2SigningWalletTypeSchema = exports.permissionsV2AggregateOperatorSchema = exports.permissionsV2CompareOperatorSchema = exports.permissionsV2PolicyEffectSchema = exports.permissionsV2PolicyModeSchema = exports.permissionsV2PolicyLayerSchema = exports.permissionsV2SigningRequestTypes = exports.policyAuthoringSigningRequestRoutes = exports.policyAuthoringSigningWalletTypes = void 0;
+const zod_1 = require("zod");
+exports.policyAuthoringSigningWalletTypes = ['EVM'];
+exports.policyAuthoringSigningRequestRoutes = [
+    'evm.sign_transaction',
+    'evm.sign_raw',
+    'evm.sign_typed_data',
+    'evm.sign_authorization',
+    'evm.sign_message',
+    'smart_account.user_operation',
+];
+exports.permissionsV2SigningRequestTypes = [
+    'evm_transaction',
+    'evm_message',
+    'evm_raw',
+    'evm_typed_data',
+    'evm_authorization',
+    'smart_account_user_operation',
+];
+const nonEmptyStringSchema = zod_1.z.string().min(1);
+const uniqueNonEmptyStringsSchema = zod_1.z
+    .array(nonEmptyStringSchema)
+    .min(1)
+    .refine((values) => new Set(values).size === values.length, 'values must be unique');
+exports.permissionsV2PolicyLayerSchema = zod_1.z.enum(['para', 'partner']);
+exports.permissionsV2PolicyModeSchema = zod_1.z.enum(['guardrail', 'delegation']);
+exports.permissionsV2PolicyEffectSchema = zod_1.z.enum(['allow', 'deny', 'require_approval']);
+exports.permissionsV2CompareOperatorSchema = zod_1.z.enum(['eq', 'ne', 'lt', 'lte', 'gt', 'gte', 'in']);
+exports.permissionsV2AggregateOperatorSchema = zod_1.z.enum(['lt', 'lte', 'gt', 'gte']);
+exports.permissionsV2SigningWalletTypeSchema = zod_1.z.enum(exports.policyAuthoringSigningWalletTypes);
+exports.permissionsV2SigningRequestRouteSchema = zod_1.z.enum(exports.policyAuthoringSigningRequestRoutes);
+exports.permissionsV2SigningRequestTypeSchema = zod_1.z.enum(exports.permissionsV2SigningRequestTypes);
+exports.policyAuthoringJsonPrimitiveSchema = zod_1.z.union([
+    zod_1.z.string(),
+    zod_1.z.number(),
+    zod_1.z.boolean(),
+    zod_1.z.null(),
+]);
+exports.policyAuthoringJsonValueSchema = zod_1.z.lazy(() => zod_1.z.union([
+    exports.policyAuthoringJsonPrimitiveSchema,
+    zod_1.z.array(exports.policyAuthoringJsonValueSchema),
+    zod_1.z.record(exports.policyAuthoringJsonValueSchema),
+]));
+exports.policyAuthoringJsonObjectSchema = zod_1.z.record(exports.policyAuthoringJsonValueSchema);
+exports.permissionsV2ConditionSchema = zod_1.z.lazy(() => zod_1.z.discriminatedUnion('kind', [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('compare'),
+        fact: nonEmptyStringSchema,
+        op: exports.permissionsV2CompareOperatorSchema,
+        value: exports.policyAuthoringJsonValueSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('aggregate'),
+        fact: nonEmptyStringSchema,
+        op: exports.permissionsV2AggregateOperatorSchema,
+        value: nonEmptyStringSchema,
+        window: nonEmptyStringSchema,
+        asset: nonEmptyStringSchema.optional(),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('all'),
+        of: zod_1.z.array(exports.permissionsV2ConditionSchema).min(1),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('any'),
+        of: zod_1.z.array(exports.permissionsV2ConditionSchema).min(1),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal('not'),
+        of: exports.permissionsV2ConditionSchema,
+    })
+        .strict(),
+]));
+exports.permissionsV2PartnerAuthoredPolicySelectorSchema = zod_1.z
+    .object({
+    walletId: nonEmptyStringSchema.optional(),
+    chainId: zod_1.z.union([nonEmptyStringSchema, uniqueNonEmptyStringsSchema]).optional(),
+    walletType: exports.permissionsV2SigningWalletTypeSchema.optional(),
+    requestRoute: exports.permissionsV2SigningRequestRouteSchema.optional(),
+    requestType: exports.permissionsV2SigningRequestTypeSchema.optional(),
+})
+    .strict();
+exports.permissionsV2PolicyMetadataSchema = zod_1.z
+    .object({
+    label: zod_1.z.string().optional(),
+    productMode: exports.permissionsV2PolicyModeSchema.optional(),
+    description: zod_1.z.string().optional(),
+    annotations: exports.policyAuthoringJsonObjectSchema.optional(),
+})
+    .strict();
+exports.permissionsV2PartnerPolicyMetadataSchema = exports.permissionsV2PolicyMetadataSchema.extend({
+    productMode: exports.permissionsV2PolicyModeSchema,
+});
+exports.permissionsV2PolicyRuleSchema = zod_1.z
+    .object({
+    id: nonEmptyStringSchema,
+    effect: exports.permissionsV2PolicyEffectSchema,
+    when: exports.permissionsV2ConditionSchema,
+})
+    .strict();
+const partnerPolicyCandidateFields = {
+    id: nonEmptyStringSchema,
+    schemaVersion: zod_1.z.literal('permissions.policy.v1'),
+    version: nonEmptyStringSchema,
+    selector: exports.permissionsV2PartnerAuthoredPolicySelectorSchema,
+    rules: zod_1.z.array(exports.permissionsV2PolicyRuleSchema).min(1),
+    metadata: exports.permissionsV2PolicyMetadataSchema.optional(),
+};
+exports.permissionsV2PartnerPolicyCandidateSchema = zod_1.z.object(partnerPolicyCandidateFields).strict();
+exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema = exports.permissionsV2PartnerPolicyCandidateSchema.extend({
+    metadata: exports.permissionsV2PartnerPolicyMetadataSchema,
+});
+exports.permissionsV2DelegationPolicyDefinitionSchema = exports.permissionsV2PartnerAuthoredPolicyDefinitionSchema.extend({
+    layer: zod_1.z.literal('partner'),
+    selector: exports.permissionsV2PartnerAuthoredPolicySelectorSchema.extend({
+        partnerId: nonEmptyStringSchema,
+        appId: nonEmptyStringSchema,
+    }),
+    metadata: exports.permissionsV2PartnerPolicyMetadataSchema.extend({
+        productMode: zod_1.z.literal('delegation'),
+    }),
+});
+exports.permissionsV2DelegationConsentApiStatusSchema = zod_1.z.enum([
+    'pending',
+    'standing',
+    'manual_review',
+    'revoked',
+    'expired',
+]);
+exports.permissionsV2DelegationConsentMutationSchema = zod_1.z
+    .object({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    walletId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    expiresAt: zod_1.z.string().datetime().optional(),
+})
+    .strict();
+exports.permissionsV2DelegationConsentStandingMutationSchema = exports.permissionsV2DelegationConsentMutationSchema
+    .extend({
+    pendingTransactionId: nonEmptyStringSchema,
+})
+    .strict();
+exports.permissionsV2DelegationConsentViewSchema = zod_1.z
+    .object({
+    status: exports.permissionsV2DelegationConsentApiStatusSchema,
+    userId: nonEmptyStringSchema,
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    walletId: nonEmptyStringSchema,
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    grantedAt: zod_1.z.string().datetime().optional(),
+    expiresAt: zod_1.z.string().datetime().optional(),
+    revokedAt: zod_1.z.string().datetime().optional(),
+})
+    .strict();
+exports.permissionsV2DelegationConsentRequestSchema = zod_1.z
+    .object({
+    policy: exports.permissionsV2DelegationPolicyDefinitionSchema,
+    consent: exports.permissionsV2DelegationConsentViewSchema,
+})
+    .strict();
+exports.permissionsV2DelegationConsentDiscoveryResponseSchema = zod_1.z
+    .object({
+    requests: zod_1.z.array(exports.permissionsV2DelegationConsentRequestSchema),
+})
+    .strict();
+exports.permissionsV2ValidationErrorSchema = zod_1.z
+    .object({
+    code: zod_1.z.string(),
+    path: zod_1.z.string(),
+    message: zod_1.z.string(),
+})
+    .strict();

package/dist/cjs/types/assets.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OnRampMethod = exports.OnRampPurchaseStatus = exports.OnRampPurchaseType = exports.ON_RAMP_ASSETS = exports.OnRampAsset = exports.ON_RAMP_PROVIDERS = exports.OnRampProvider = void 0;
+exports.OnRampMethod = exports.OnRampPurchaseStatus = exports.OnRampPurchaseType = exports.ON_RAMP_ASSETS = exports.OnRampAsset = exports.PROVIDER_PAYMENT_METHODS = exports.ON_RAMP_PAYMENT_METHODS = exports.ON_RAMP_PROVIDERS = exports.OnRampProvider = void 0;
 /** @deprecated use `OnRampProvider` string union instead */
 var OnRampProvider;
 (function (OnRampProvider) {
@@ -9,8 +9,24 @@ var OnRampProvider;
     OnRampProvider["MOONPAY"] = "MOONPAY";
     OnRampProvider["CDP"] = "CDP";
     OnRampProvider["MERCURYO"] = "MERCURYO";
+    OnRampProvider["BRALE"] = "BRALE";
 })(OnRampProvider || (exports.OnRampProvider = OnRampProvider = {}));
-exports.ON_RAMP_PROVIDERS = ['RAMP', 'STRIPE', 'MOONPAY', 'CDP', 'MERCURYO'];
+exports.ON_RAMP_PROVIDERS = ['RAMP', 'STRIPE', 'MOONPAY', 'CDP', 'MERCURYO', 'BRALE'];
+// Payment flows a provider can offer for an implementation in the request's region. Drives which
+// call-to-action the AddFunds modal renders. WIDGET = the hosted redirect flow (provider selection +
+// Continue) that every widget provider supports; APPLE_PAY / CARD / BANK are headless flows enabled
+// per integration.
+exports.ON_RAMP_PAYMENT_METHODS = ['APPLE_PAY', 'CARD', 'BANK', 'WIDGET'];
+// Provider -> the payment flows it can offer, independent of geo. The catalog resolver intersects this
+// with per-region provider availability so a provider only appears (with its methods) where it's buyable.
+exports.PROVIDER_PAYMENT_METHODS = {
+    RAMP: ['WIDGET'],
+    STRIPE: ['WIDGET'],
+    MOONPAY: ['WIDGET', 'CARD'],
+    CDP: ['WIDGET', 'APPLE_PAY'],
+    MERCURYO: ['WIDGET', 'APPLE_PAY'],
+    BRALE: ['BANK'],
+};
 /** @deprecated use `TOnRampAsset` string union instead */
 var OnRampAsset;
 (function (OnRampAsset) {

package/dist/cjs/types/auth.js

@@ -57,6 +57,10 @@ exports.OAUTH_METHODS = [
     'FARCASTER',
     'TELEGRAM',
     'CUSTOM_OIDC',
+    // A partner-configured OAuth2 provider Para ships no first-party adapter for (e.g. Spotify). The specific
+    // connection rides on the flow's providerConfigHandle; the generic OAuth2 client uses the connection's
+    // stored endpoints. (ENG-7008)
+    'CUSTOM_OAUTH',
 ];
 exports.LINKED_ACCOUNT_TYPES = [
     'EMAIL',

package/dist/cjs/types/headlessOnRamp.js

@@ -0,0 +1,9 @@
+"use strict";
+// Headless on-ramp types, shared between the server and the web-sdk client so request/response shapes
+// aren't duplicated across the server and the user-management-client.
+//
+// Each headless (native Apple Pay / Platform SDK) provider has its own router and route per action —
+// POST /users/:userId/onramp/<provider>/<action> — with its param/result types defined below. CDP
+// (Coinbase) is the only provider defined + wired today; Mercuryo and MoonPay add their types here when
+// they land on their own branches.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/index.js

@@ -16,14 +16,17 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./assets.js"), exports);
 __exportStar(require("./auth.js"), exports);
+__exportStar(require("./headlessOnRamp.js"), exports);
 __exportStar(require("./authFactor.js"), exports);
 __exportStar(require("./authState.js"), exports);
 __exportStar(require("./modal.js"), exports);
 __exportStar(require("./otp.js"), exports);
 __exportStar(require("./params.js"), exports);
 __exportStar(require("./partner.js"), exports);
+__exportStar(require("./sdkCapabilities.js"), exports);
 __exportStar(require("./partnerAppConfig.js"), exports);
 __exportStar(require("./pending-transaction.js"), exports);
+__exportStar(require("./permissions.js"), exports);
 __exportStar(require("./signing.js"), exports);
 __exportStar(require("./theme.js"), exports);
 __exportStar(require("./transaction.js"), exports);

package/dist/cjs/types/permissions.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/sdkCapabilities.js

@@ -0,0 +1,45 @@
+"use strict";
+// Client → server capability negotiation.
+//
+// The SDK advertises which features THIS build supports via a single request header, and the server gates
+// behavior on the presence of a token rather than on an SDK version number. This keeps a capability coupled
+// to the build that implements it (no cross-repo version guessing) and, unlike a header-per-feature, needs
+// only ONE CORS `allowedHeaders` + `Vary` entry no matter how many capabilities are added.
+//
+// To add a capability: add a token below, send it from the SDK build that implements it
+// (`serializeCapabilities`), and check for it on the server (`parseCapabilities(...).has(...)`).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SdkCapability = exports.SDK_CAPABILITIES_HEADER = void 0;
+exports.serializeCapabilities = serializeCapabilities;
+exports.parseCapabilities = parseCapabilities;
+exports.SDK_CAPABILITIES_HEADER = 'x-para-capabilities';
+var SdkCapability;
+(function (SdkCapability) {
+    // The build ships the on-ramp catalog picker, so it wants the OnRampConfigV2 (DB-reference) config shape
+    // from GET /on-ramp-config instead of the legacy assetInfo config. Checked server-side in onRampConfig.ts.
+    SdkCapability["OnRampCatalog"] = "onramp-catalog";
+    // The build can drive the Coinbase (CDP) headless on-ramp order flow. Advertised by the SDK now, but NOT
+    // yet gated server-side — the CDP order route serves everyone; wire a parseCapabilities(...).has(...) check
+    // here when the flow needs to condition on client support.
+    SdkCapability["CdpHeadless"] = "cdp-headless";
+})(SdkCapability || (exports.SdkCapability = SdkCapability = {}));
+const KNOWN_CAPABILITIES = new Set(Object.values(SdkCapability));
+/** Serialize a build's supported capabilities into the header value (comma-separated tokens). */
+function serializeCapabilities(capabilities) {
+    return [...new Set(capabilities)].join(',');
+}
+/**
+ * Parse the capabilities header into the set of KNOWN capabilities the client advertised. Unknown tokens
+ * (e.g. a newer SDK advertising a capability this server doesn't understand yet) are ignored.
+ */
+function parseCapabilities(header) {
+    const result = new Set();
+    if (!header)
+        return result;
+    for (const raw of header.split(',')) {
+        const token = raw.trim();
+        if (KNOWN_CAPABILITIES.has(token))
+            result.add(token);
+    }
+    return result;
+}

package/dist/esm/index.js

@@ -1,4 +1,6 @@
 export * from './types/index.js';
+export * from './types/permissions.js';
+export * from './schemas/permissionsV2.js';
 export * from './utils/index.js';
 import * as transactionTypes from './types/transaction.js';
 export { transactionTypes };

package/dist/esm/schemas/permissionsV2.js

@@ -0,0 +1,185 @@
+import { z } from 'zod';
+export const policyAuthoringSigningWalletTypes = ['EVM'];
+export const policyAuthoringSigningRequestRoutes = [
+    'evm.sign_transaction',
+    'evm.sign_raw',
+    'evm.sign_typed_data',
+    'evm.sign_authorization',
+    'evm.sign_message',
+    'smart_account.user_operation',
+];
+export const permissionsV2SigningRequestTypes = [
+    'evm_transaction',
+    'evm_message',
+    'evm_raw',
+    'evm_typed_data',
+    'evm_authorization',
+    'smart_account_user_operation',
+];
+const nonEmptyStringSchema = z.string().min(1);
+const uniqueNonEmptyStringsSchema = z
+    .array(nonEmptyStringSchema)
+    .min(1)
+    .refine((values) => new Set(values).size === values.length, 'values must be unique');
+export const permissionsV2PolicyLayerSchema = z.enum(['para', 'partner']);
+export const permissionsV2PolicyModeSchema = z.enum(['guardrail', 'delegation']);
+export const permissionsV2PolicyEffectSchema = z.enum(['allow', 'deny', 'require_approval']);
+export const permissionsV2CompareOperatorSchema = z.enum(['eq', 'ne', 'lt', 'lte', 'gt', 'gte', 'in']);
+export const permissionsV2AggregateOperatorSchema = z.enum(['lt', 'lte', 'gt', 'gte']);
+export const permissionsV2SigningWalletTypeSchema = z.enum(policyAuthoringSigningWalletTypes);
+export const permissionsV2SigningRequestRouteSchema = z.enum(policyAuthoringSigningRequestRoutes);
+export const permissionsV2SigningRequestTypeSchema = z.enum(permissionsV2SigningRequestTypes);
+export const policyAuthoringJsonPrimitiveSchema = z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+]);
+export const policyAuthoringJsonValueSchema = z.lazy(() => z.union([
+    policyAuthoringJsonPrimitiveSchema,
+    z.array(policyAuthoringJsonValueSchema),
+    z.record(policyAuthoringJsonValueSchema),
+]));
+export const policyAuthoringJsonObjectSchema = z.record(policyAuthoringJsonValueSchema);
+export const permissionsV2ConditionSchema = z.lazy(() => z.discriminatedUnion('kind', [
+    z
+        .object({
+        kind: z.literal('compare'),
+        fact: nonEmptyStringSchema,
+        op: permissionsV2CompareOperatorSchema,
+        value: policyAuthoringJsonValueSchema,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal('aggregate'),
+        fact: nonEmptyStringSchema,
+        op: permissionsV2AggregateOperatorSchema,
+        value: nonEmptyStringSchema,
+        window: nonEmptyStringSchema,
+        asset: nonEmptyStringSchema.optional(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal('all'),
+        of: z.array(permissionsV2ConditionSchema).min(1),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal('any'),
+        of: z.array(permissionsV2ConditionSchema).min(1),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal('not'),
+        of: permissionsV2ConditionSchema,
+    })
+        .strict(),
+]));
+export const permissionsV2PartnerAuthoredPolicySelectorSchema = z
+    .object({
+    walletId: nonEmptyStringSchema.optional(),
+    chainId: z.union([nonEmptyStringSchema, uniqueNonEmptyStringsSchema]).optional(),
+    walletType: permissionsV2SigningWalletTypeSchema.optional(),
+    requestRoute: permissionsV2SigningRequestRouteSchema.optional(),
+    requestType: permissionsV2SigningRequestTypeSchema.optional(),
+})
+    .strict();
+export const permissionsV2PolicyMetadataSchema = z
+    .object({
+    label: z.string().optional(),
+    productMode: permissionsV2PolicyModeSchema.optional(),
+    description: z.string().optional(),
+    annotations: policyAuthoringJsonObjectSchema.optional(),
+})
+    .strict();
+export const permissionsV2PartnerPolicyMetadataSchema = permissionsV2PolicyMetadataSchema.extend({
+    productMode: permissionsV2PolicyModeSchema,
+});
+export const permissionsV2PolicyRuleSchema = z
+    .object({
+    id: nonEmptyStringSchema,
+    effect: permissionsV2PolicyEffectSchema,
+    when: permissionsV2ConditionSchema,
+})
+    .strict();
+const partnerPolicyCandidateFields = {
+    id: nonEmptyStringSchema,
+    schemaVersion: z.literal('permissions.policy.v1'),
+    version: nonEmptyStringSchema,
+    selector: permissionsV2PartnerAuthoredPolicySelectorSchema,
+    rules: z.array(permissionsV2PolicyRuleSchema).min(1),
+    metadata: permissionsV2PolicyMetadataSchema.optional(),
+};
+export const permissionsV2PartnerPolicyCandidateSchema = z.object(partnerPolicyCandidateFields).strict();
+export const permissionsV2PartnerAuthoredPolicyDefinitionSchema = permissionsV2PartnerPolicyCandidateSchema.extend({
+    metadata: permissionsV2PartnerPolicyMetadataSchema,
+});
+export const permissionsV2DelegationPolicyDefinitionSchema = permissionsV2PartnerAuthoredPolicyDefinitionSchema.extend({
+    layer: z.literal('partner'),
+    selector: permissionsV2PartnerAuthoredPolicySelectorSchema.extend({
+        partnerId: nonEmptyStringSchema,
+        appId: nonEmptyStringSchema,
+    }),
+    metadata: permissionsV2PartnerPolicyMetadataSchema.extend({
+        productMode: z.literal('delegation'),
+    }),
+});
+export const permissionsV2DelegationConsentApiStatusSchema = z.enum([
+    'pending',
+    'standing',
+    'manual_review',
+    'revoked',
+    'expired',
+]);
+export const permissionsV2DelegationConsentMutationSchema = z
+    .object({
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    walletId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    expiresAt: z.string().datetime().optional(),
+})
+    .strict();
+export const permissionsV2DelegationConsentStandingMutationSchema = permissionsV2DelegationConsentMutationSchema
+    .extend({
+    pendingTransactionId: nonEmptyStringSchema,
+})
+    .strict();
+export const permissionsV2DelegationConsentViewSchema = z
+    .object({
+    status: permissionsV2DelegationConsentApiStatusSchema,
+    userId: nonEmptyStringSchema,
+    partnerId: nonEmptyStringSchema,
+    appId: nonEmptyStringSchema,
+    walletId: nonEmptyStringSchema,
+    policyId: nonEmptyStringSchema,
+    policyVersion: nonEmptyStringSchema,
+    policyHash: nonEmptyStringSchema,
+    grantedAt: z.string().datetime().optional(),
+    expiresAt: z.string().datetime().optional(),
+    revokedAt: z.string().datetime().optional(),
+})
+    .strict();
+export const permissionsV2DelegationConsentRequestSchema = z
+    .object({
+    policy: permissionsV2DelegationPolicyDefinitionSchema,
+    consent: permissionsV2DelegationConsentViewSchema,
+})
+    .strict();
+export const permissionsV2DelegationConsentDiscoveryResponseSchema = z
+    .object({
+    requests: z.array(permissionsV2DelegationConsentRequestSchema),
+})
+    .strict();
+export const permissionsV2ValidationErrorSchema = z
+    .object({
+    code: z.string(),
+    path: z.string(),
+    message: z.string(),
+})
+    .strict();

package/dist/esm/types/assets.js

@@ -6,8 +6,24 @@ export var OnRampProvider;
     OnRampProvider["MOONPAY"] = "MOONPAY";
     OnRampProvider["CDP"] = "CDP";
     OnRampProvider["MERCURYO"] = "MERCURYO";
+    OnRampProvider["BRALE"] = "BRALE";
 })(OnRampProvider || (OnRampProvider = {}));
-export const ON_RAMP_PROVIDERS = ['RAMP', 'STRIPE', 'MOONPAY', 'CDP', 'MERCURYO'];
+export const ON_RAMP_PROVIDERS = ['RAMP', 'STRIPE', 'MOONPAY', 'CDP', 'MERCURYO', 'BRALE'];
+// Payment flows a provider can offer for an implementation in the request's region. Drives which
+// call-to-action the AddFunds modal renders. WIDGET = the hosted redirect flow (provider selection +
+// Continue) that every widget provider supports; APPLE_PAY / CARD / BANK are headless flows enabled
+// per integration.
+export const ON_RAMP_PAYMENT_METHODS = ['APPLE_PAY', 'CARD', 'BANK', 'WIDGET'];
+// Provider -> the payment flows it can offer, independent of geo. The catalog resolver intersects this
+// with per-region provider availability so a provider only appears (with its methods) where it's buyable.
+export const PROVIDER_PAYMENT_METHODS = {
+    RAMP: ['WIDGET'],
+    STRIPE: ['WIDGET'],
+    MOONPAY: ['WIDGET', 'CARD'],
+    CDP: ['WIDGET', 'APPLE_PAY'],
+    MERCURYO: ['WIDGET', 'APPLE_PAY'],
+    BRALE: ['BANK'],
+};
 /** @deprecated use `TOnRampAsset` string union instead */
 export var OnRampAsset;
 (function (OnRampAsset) {

package/dist/esm/types/auth.js

@@ -54,6 +54,10 @@ export const OAUTH_METHODS = [
     'FARCASTER',
     'TELEGRAM',
     'CUSTOM_OIDC',
+    // A partner-configured OAuth2 provider Para ships no first-party adapter for (e.g. Spotify). The specific
+    // connection rides on the flow's providerConfigHandle; the generic OAuth2 client uses the connection's
+    // stored endpoints. (ENG-7008)
+    'CUSTOM_OAUTH',
 ];
 export const LINKED_ACCOUNT_TYPES = [
     'EMAIL',

package/dist/esm/types/headlessOnRamp.js

@@ -0,0 +1,8 @@
+// Headless on-ramp types, shared between the server and the web-sdk client so request/response shapes
+// aren't duplicated across the server and the user-management-client.
+//
+// Each headless (native Apple Pay / Platform SDK) provider has its own router and route per action —
+// POST /users/:userId/onramp/<provider>/<action> — with its param/result types defined below. CDP
+// (Coinbase) is the only provider defined + wired today; Mercuryo and MoonPay add their types here when
+// they land on their own branches.
+export {};

package/dist/esm/types/index.js

@@ -1,13 +1,16 @@
 export * from './assets.js';
 export * from './auth.js';
+export * from './headlessOnRamp.js';
 export * from './authFactor.js';
 export * from './authState.js';
 export * from './modal.js';
 export * from './otp.js';
 export * from './params.js';
 export * from './partner.js';
+export * from './sdkCapabilities.js';
 export * from './partnerAppConfig.js';
 export * from './pending-transaction.js';
+export * from './permissions.js';
 export * from './signing.js';
 export * from './theme.js';
 export * from './transaction.js';

package/dist/esm/types/permissions.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/sdkCapabilities.js

@@ -0,0 +1,40 @@
+// Client → server capability negotiation.
+//
+// The SDK advertises which features THIS build supports via a single request header, and the server gates
+// behavior on the presence of a token rather than on an SDK version number. This keeps a capability coupled
+// to the build that implements it (no cross-repo version guessing) and, unlike a header-per-feature, needs
+// only ONE CORS `allowedHeaders` + `Vary` entry no matter how many capabilities are added.
+//
+// To add a capability: add a token below, send it from the SDK build that implements it
+// (`serializeCapabilities`), and check for it on the server (`parseCapabilities(...).has(...)`).
+export const SDK_CAPABILITIES_HEADER = 'x-para-capabilities';
+export var SdkCapability;
+(function (SdkCapability) {
+    // The build ships the on-ramp catalog picker, so it wants the OnRampConfigV2 (DB-reference) config shape
+    // from GET /on-ramp-config instead of the legacy assetInfo config. Checked server-side in onRampConfig.ts.
+    SdkCapability["OnRampCatalog"] = "onramp-catalog";
+    // The build can drive the Coinbase (CDP) headless on-ramp order flow. Advertised by the SDK now, but NOT
+    // yet gated server-side — the CDP order route serves everyone; wire a parseCapabilities(...).has(...) check
+    // here when the flow needs to condition on client support.
+    SdkCapability["CdpHeadless"] = "cdp-headless";
+})(SdkCapability || (SdkCapability = {}));
+const KNOWN_CAPABILITIES = new Set(Object.values(SdkCapability));
+/** Serialize a build's supported capabilities into the header value (comma-separated tokens). */
+export function serializeCapabilities(capabilities) {
+    return [...new Set(capabilities)].join(',');
+}
+/**
+ * Parse the capabilities header into the set of KNOWN capabilities the client advertised. Unknown tokens
+ * (e.g. a newer SDK advertising a capability this server doesn't understand yet) are ignored.
+ */
+export function parseCapabilities(header) {
+    const result = new Set();
+    if (!header)
+        return result;
+    for (const raw of header.split(',')) {
+        const token = raw.trim();
+        if (KNOWN_CAPABILITIES.has(token))
+            result.add(token);
+    }
+    return result;
+}

package/dist/types/index.d.ts

@@ -1,4 +1,6 @@
 export * from './types/index.js';
+export * from './types/permissions.js';
+export * from './schemas/permissionsV2.js';
 export * from './utils/index.js';
 import * as transactionTypes from './types/transaction.js';
 export { transactionTypes };

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AAEjC,OAAO,KAAK,gBAAgB,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AAEjC,OAAO,KAAK,gBAAgB,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,CAAC"}