@parity/product-sdk-auth 0.0.0-dev.312.0

package/src/allocations.ts

@@ -0,0 +1,107 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * RFC-0010 `host_request_resource_allocation` helpers for auth consumers.
+ *
+ * The wire call, and the resource / outcome types, live in
+ * `@parity/product-sdk-terminal` (derived from `UserSession` so they can't
+ * drift from the host codec). This module delegates the wire call to terminal's
+ * `sendResourceAllocation` — the cache-free primitive — and layers on the
+ * auth-consumer conveniences (`DEFAULT_RESOURCES`, `summarizeOutcomes`) plus a
+ * `productId`-based signature so headless callers don't need a `TerminalAdapter`.
+ *
+ * The mobile app handles `hostRequestResourceAllocation` in
+ * `AllowanceHostCalls.kt` and routes the user through an approval UI.
+ */
+
+import type { UserSession } from "@parity/product-sdk-terminal";
+import {
+    type AllocatableResource,
+    type ApAllocationOutcome,
+    type OnExistingAllowancePolicy,
+    sendResourceAllocation,
+} from "@parity/product-sdk-terminal";
+
+export type { AllocatableResource, OnExistingAllowancePolicy } from "@parity/product-sdk-terminal";
+
+/**
+ * Outcome of one allocation. Re-exported from terminal's wire-derived type
+ * under the name auth consumers already use. We don't read the inner
+ * `Allocated` payload (allowance slot keys, derivation secrets) — the host
+ * stores them and uses them transparently on subsequent calls. We just need
+ * the tag to know whether the allocation succeeded.
+ */
+export type AllocationOutcome = ApAllocationOutcome;
+
+/** Tag-only view, handy for downstream code that doesn't care about payloads. */
+export type ResourceTag = AllocatableResource["tag"];
+
+/**
+ * Default mobile-granted resource set for a CLI product account: write access
+ * to the statement store + Bulletin, plus PGAS sponsoring for the default
+ * (index 0) product account.
+ */
+export const DEFAULT_RESOURCES: AllocatableResource[] = [
+    { tag: "BulletInAllowance", value: undefined },
+    { tag: "StatementStoreAllowance", value: undefined },
+    // derivation index 0 = the default product account.
+    { tag: "SmartContractAllowance", value: 0 },
+];
+
+/**
+ * Send a `host_request_resource_allocation` request over the user's active
+ * session. The host (mobile wallet) prompts the user to approve and returns
+ * one outcome per requested resource in order.
+ *
+ * Throws on transport-level failures (Statement Store unreachable, encryption
+ * error, etc.). Per-resource refusals are reported as `Rejected`/`NotAvailable`
+ * outcomes — callers inspect the array to decide whether to proceed.
+ */
+export async function requestResourceAllocation(
+    session: UserSession,
+    productId: string,
+    resources: AllocatableResource[] = DEFAULT_RESOURCES,
+    onExisting: OnExistingAllowancePolicy = "Ignore",
+): Promise<AllocationOutcome[]> {
+    return sendResourceAllocation(session, productId, resources, onExisting);
+}
+
+export interface AllocationSummary {
+    granted: AllocatableResource[];
+    rejected: AllocatableResource[];
+    unavailable: AllocatableResource[];
+}
+
+/**
+ * Bucket allocation outcomes by tag. Order-sensitive: `outcomes[i]` maps to
+ * `resources[i]`. Outcomes without a matching resource are silently dropped.
+ */
+export function summarizeOutcomes(
+    outcomes: AllocationOutcome[],
+    resources: AllocatableResource[],
+): AllocationSummary {
+    const granted: AllocatableResource[] = [];
+    const rejected: AllocatableResource[] = [];
+    const unavailable: AllocatableResource[] = [];
+    outcomes.forEach((outcome, i) => {
+        const resource = resources[i];
+        if (!resource) return;
+        if (outcome.tag === "Allocated") granted.push(resource);
+        else if (outcome.tag === "Rejected") rejected.push(resource);
+        else unavailable.push(resource);
+    });
+    return { granted, rejected, unavailable };
+}

package/src/auth.test.ts

@@ -0,0 +1,49 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { describe, expect, test } from "vitest";
+import { createAuthClient } from "./auth.js";
+import type { AuthConfig } from "./types.js";
+
+const config: AuthConfig = {
+    dappId: "test-app",
+    productId: "test.dot",
+    derivationIndex: 0,
+    peopleEndpoints: ["wss://example.com/people"],
+};
+
+describe("createAuthClient", () => {
+    test("returns the bound auth surface (all functions)", () => {
+        const client = createAuthClient(config);
+        for (const fn of [
+            "connect",
+            "waitForLogin",
+            "getSessionSigner",
+            "findSession",
+            "waitForLogout",
+            "requestAllocation",
+            "clearLocalAppStorage",
+        ] as const) {
+            expect(typeof client[fn]).toBe("function");
+        }
+    });
+
+    test("clearLocalAppStorage returns (no throw) when the dir does not exist", async () => {
+        const client = createAuthClient(config);
+        await expect(
+            client.clearLocalAppStorage("/nonexistent/dir/should-not-exist-xyz"),
+        ).resolves.toBeUndefined();
+    });
+});

package/src/auth.ts

@@ -0,0 +1,486 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * QR login flow — pure business logic, no UI. Lifted from playground-cli
+ * `src/utils/auth.ts` (issue #411); the env-specific config playground imported
+ * from its `config.ts` is now injected via `createAuthClient(config)`.
+ *
+ * Flow:
+ *   1. `connect()` — starts adapter + auth, returns existing address OR QR code
+ *   2. Print QR code to stdout (if needed) — before any UI mounts
+ *   3. `waitForLogin()` — awaits the already-running auth to complete
+ *   4. `getSessionSigner()` — gets a working signer for tx signing (separate adapter)
+ *   5. `requestAllocation()` — RFC-0010 resource allocation (needed before a fresh session can sign)
+ *   6. `findSession()` / `waitForLogout()` — sign out flow, mirror image of connect/waitForLogin
+ */
+
+import type { Dirent } from "node:fs";
+import { readdir, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { deriveH160, ss58Encode } from "@parity/product-sdk-address";
+import {
+    createTerminalAdapter,
+    waitForSessions,
+    renderQrCode,
+    type TerminalAdapter,
+    type PairingStatus,
+    type UserSession,
+} from "@parity/product-sdk-terminal";
+import type { PolkadotSigner } from "polkadot-api";
+import {
+    createSessionSigner,
+    deriveProductPublicKey,
+    sessionRootPublicKey,
+} from "./sessionSigner.js";
+import {
+    requestResourceAllocation,
+    DEFAULT_RESOURCES,
+    type AllocatableResource,
+    type AllocationOutcome,
+    type OnExistingAllowancePolicy,
+} from "./allocations.js";
+import type { AuthConfig } from "./types.js";
+
+/** How long we wait for the statement store to publish the pairing QR. */
+const QR_TIMEOUT_MS = 60_000;
+
+/**
+ * The three addresses we surface from a paired session.
+ *
+ * - `rootAddress` — SS58 of `session.rootAccountId`, the `rootUserAccountId`
+ *   the mobile app sent over the SSO handshake (bare-mnemonic sr25519 root on
+ *   current mobile builds). Keyed by `Resources.Consumers` on the People
+ *   parachain, so it's the right input for `lookupUsername` from
+ *   `@parity/product-sdk-individuality`, which reads that account's usernames.
+ * - `productAddress` — SS58 of the product account derived via
+ *   `product/{productId}/{index}` from `rootAccountId`. This is what actually
+ *   signs on-chain transactions from the CLI.
+ * - `productH160` — the same product pubkey as a 20-byte EVM address (Revive /
+ *   contracts view). Derived from the SAME pubkey as `productAddress`.
+ */
+export interface SessionAddresses {
+    rootAddress: string;
+    productAddress: string;
+    productH160: `0x${string}`;
+}
+
+export type ConnectResult =
+    | { kind: "existing"; address: string; addresses: SessionAddresses }
+    | { kind: "qr"; qrCode: string; login: LoginHandle };
+
+export type LoginStatus =
+    | { step: "waiting" }
+    | { step: "paired" }
+    | { step: "pending"; stage: string }
+    | { step: "success"; address: string; addresses: SessionAddresses }
+    | { step: "error"; message: string };
+
+export interface LoginHandle {
+    adapter: TerminalAdapter;
+    /** The authenticate() promise — already running since connect(). */
+    authPromise: ReturnType<TerminalAdapter["sso"]["authenticate"]>;
+}
+
+/**
+ * A session signer bundle — the signer plus an explicit `destroy()` that tears
+ * down the long-lived adapter the signer depends on. Callers MUST invoke
+ * `destroy()` once done — the WebSocket keeps the event loop alive.
+ */
+export interface SessionHandle {
+    address: string;
+    addresses: SessionAddresses;
+    signer: PolkadotSigner;
+    userSession: UserSession;
+    destroy(): void;
+}
+
+export type LogoutStatus =
+    | { step: "disconnecting"; address: string }
+    | { step: "success"; address: string }
+    | { step: "partial"; address: string; reason: string }
+    | { step: "error"; message: string };
+
+export interface LogoutHandle {
+    adapter: TerminalAdapter;
+    address: string;
+    session: UserSession;
+}
+
+/** The product-bound auth surface returned by `createAuthClient`. */
+export interface AuthClient {
+    connect(): Promise<ConnectResult>;
+    waitForLogin(
+        handle: LoginHandle,
+        onStatus: (status: LoginStatus) => void,
+    ): Promise<string | null>;
+    getSessionSigner(): Promise<SessionHandle | null>;
+    findSession(): Promise<LogoutHandle | null>;
+    waitForLogout(handle: LogoutHandle, onStatus: (status: LogoutStatus) => void): Promise<void>;
+    requestAllocation(
+        session: UserSession,
+        resources?: AllocatableResource[],
+        onExisting?: OnExistingAllowancePolicy,
+    ): Promise<AllocationOutcome[]>;
+    clearLocalAppStorage(dir?: string): Promise<void>;
+}
+
+/**
+ * Build an auth client bound to a product's `AuthConfig`. All adapter creation,
+ * address derivation, and session-storage scoping read from `config`, so the
+ * same code serves any product.
+ */
+export function createAuthClient(config: AuthConfig): AuthClient {
+    const ref = { productId: config.productId, derivationIndex: config.derivationIndex };
+
+    function createAdapter(): TerminalAdapter {
+        return createTerminalAdapter({
+            appId: config.dappId,
+            endpoints: config.peopleEndpoints,
+        });
+    }
+
+    /**
+     * Compute the three display addresses from a paired session. Shares
+     * `deriveProductPublicKey` with `createSessionSigner` so the signing key and
+     * the display SS58/H160 are computed by exactly one function.
+     */
+    function deriveSessionAddresses(session: UserSession): SessionAddresses {
+        const rootBytes = sessionRootPublicKey(session);
+        const productPubkey = deriveProductPublicKey(session, ref);
+        return {
+            rootAddress: ss58Encode(rootBytes),
+            productAddress: ss58Encode(productPubkey),
+            productH160: deriveH160(productPubkey),
+        };
+    }
+
+    function createSigner(session: UserSession): PolkadotSigner {
+        return createSessionSigner(session, ref);
+    }
+
+    function sessionRemoteAddress(session: UserSession): string | null {
+        const raw = (session as { remoteAccount?: { accountId?: Uint8Array } }).remoteAccount
+            ?.accountId;
+        const accountId = raw ? new Uint8Array(raw) : new Uint8Array();
+        return accountId.length === 32 ? ss58Encode(accountId) : null;
+    }
+
+    function sessionLogoutAddress(session: UserSession): string {
+        try {
+            return deriveSessionAddresses(session).productAddress;
+        } catch {
+            return sessionRemoteAddress(session) ?? "(stored session)";
+        }
+    }
+
+    /**
+     * Connect to the statement store and resolve the login state. Returns
+     * immediately if an existing session is found (address only). Otherwise
+     * kicks off authenticate(), waits for the QR payload, and returns the QR
+     * code + a handle to await the auth result.
+     */
+    async function connect(): Promise<ConnectResult> {
+        const adapter = createAdapter();
+
+        const sessions = await waitForSessions(adapter);
+        if (sessions.length > 0) {
+            // The pairing adapter isn't handed back on the existing-session path
+            // (ConnectResult.existing carries no handle), so tear it down before
+            // returning — including if deriveSessionAddresses throws on a stale
+            // session — or its WebSocket leaks for the process lifetime.
+            try {
+                const addresses = deriveSessionAddresses(sessions[0]);
+                return { kind: "existing", address: addresses.productAddress, addresses };
+            } finally {
+                adapter.destroy().catch(() => {});
+            }
+        }
+
+        // Start authenticate — this triggers the pairing flow and QR emission.
+        const authPromise = adapter.sso.authenticate();
+
+        // Captured so the loser of the race can be cancelled: if the QR payload
+        // wins, an un-cleared setTimeout stays armed and keeps the Node event
+        // loop alive, hanging the CLI for up to QR_TIMEOUT_MS after login.
+        let timeoutHandle: ReturnType<typeof setTimeout> | undefined;
+        try {
+            const qrCode = await Promise.race([
+                new Promise<string>((resolve) => {
+                    let done = false;
+                    // biome-ignore lint/style/useConst: self-referential — the callback calls unsub() to unsubscribe itself, so it can't be const.
+                    let unsub: (() => void) | undefined;
+                    unsub = adapter.sso.pairingStatus.subscribe(async (status: PairingStatus) => {
+                        if (status.step === "pairing" && !done) {
+                            done = true;
+                            unsub?.();
+                            resolve(await renderQrCode(status.payload));
+                        }
+                    });
+                }),
+                new Promise<never>((_, reject) => {
+                    timeoutHandle = setTimeout(
+                        () =>
+                            reject(
+                                new Error(
+                                    `Login service did not respond within ${Math.round(
+                                        QR_TIMEOUT_MS / 1000,
+                                    )}s — try again`,
+                                ),
+                            ),
+                        QR_TIMEOUT_MS,
+                    );
+                }),
+            ]);
+
+            return { kind: "qr", qrCode, login: { adapter, authPromise } };
+        } catch (err) {
+            // Release the WebSocket so we don't leak on the error path. `.catch()`
+            // swallows the post-destroy `DestroyedError` that polkadot-api's
+            // raw-client surfaces when a pending chainHead unsubscribe races the
+            // WS close.
+            adapter.destroy().catch(() => {});
+            throw err;
+        } finally {
+            // Clear the timeout regardless of which promise won — on the QR-win
+            // path this disarms the still-pending timer; on the timeout/error
+            // path it's a harmless no-op.
+            clearTimeout(timeoutHandle);
+        }
+    }
+
+    /**
+     * Wait for the already-running login to complete. Call after the QR code is
+     * displayed. Reports status via callback. Returns the SS58 address on
+     * success, or null on failure.
+     */
+    async function waitForLogin(
+        { adapter, authPromise }: LoginHandle,
+        onStatus: (status: LoginStatus) => void,
+    ): Promise<string | null> {
+        onStatus({ step: "waiting" });
+
+        const unsubPairing = adapter.sso.pairingStatus.subscribe((status: PairingStatus) => {
+            if (status.step === "finished") {
+                onStatus({ step: "paired" });
+            } else if (status.step === "pending") {
+                onStatus({ step: "pending", stage: status.stage });
+            } else if (status.step === "pairingError") {
+                onStatus({ step: "error", message: status.message });
+            }
+        });
+
+        let authenticated = false;
+        let address: string | null = null;
+        try {
+            const result = await authPromise;
+            result.match(
+                (session) => {
+                    if (session) {
+                        authenticated = true;
+                    } else {
+                        // Ok channel but no session — pairing resolved without
+                        // producing a session. Surface it rather than returning
+                        // null with no status, which would hang the caller.
+                        onStatus({
+                            step: "error",
+                            message: "Login did not produce a session",
+                        });
+                    }
+                },
+                (error) => {
+                    onStatus({ step: "error", message: error.message });
+                },
+            );
+            if (authenticated) {
+                const sessions = await waitForSessions(adapter, 3000);
+                if (sessions.length > 0) {
+                    const addresses = deriveSessionAddresses(sessions[0]);
+                    address = addresses.productAddress;
+                    onStatus({ step: "success", address, addresses });
+                } else {
+                    onStatus({
+                        step: "error",
+                        message: "Login succeeded but the local session was not available",
+                    });
+                }
+            }
+        } finally {
+            unsubPairing();
+            // The pairing adapter isn't needed after login — getSessionSigner()
+            // builds its own — so tear it down to release the WebSocket.
+            adapter.destroy().catch(() => {});
+        }
+
+        return address;
+    }
+
+    /**
+     * Get a working signer from a persisted session. The returned handle owns a
+     * terminal adapter that stays alive while the signer is in use (signing goes
+     * through the adapter's WebSocket). Call `destroy()` when done. Returns null
+     * if no session exists.
+     */
+    async function getSessionSigner(): Promise<SessionHandle | null> {
+        const adapter = createAdapter();
+
+        const sessions = await waitForSessions(adapter, 3000);
+        if (sessions.length === 0) {
+            adapter.destroy().catch(() => {});
+            return null;
+        }
+
+        const session = sessions[0];
+        // createSigner / deriveSessionAddresses derive the product key and can
+        // throw on a stale session (missing rootAccountId). Destroy the adapter
+        // on that path — the handle that owns `destroy` is never returned, so
+        // without this the WebSocket leaks.
+        let signer: PolkadotSigner;
+        let addresses: SessionAddresses;
+        try {
+            signer = createSigner(session);
+            addresses = deriveSessionAddresses(session);
+        } catch (err) {
+            adapter.destroy().catch(() => {});
+            throw err;
+        }
+
+        let destroyed = false;
+        const destroy = () => {
+            if (destroyed) return;
+            destroyed = true;
+            adapter.destroy().catch(() => {});
+        };
+
+        return {
+            address: addresses.productAddress,
+            addresses,
+            signer,
+            userSession: session,
+            destroy,
+        };
+    }
+
+    /**
+     * RFC-0010 resource allocation over the user's active session — grants the
+     * statement-store / Bulletin / smart-contract allowances the product account
+     * needs before it can sign. The mobile wallet prompts the user to approve.
+     */
+    async function requestAllocation(
+        session: UserSession,
+        resources: AllocatableResource[] = DEFAULT_RESOURCES,
+        onExisting: OnExistingAllowancePolicy = "Ignore",
+    ): Promise<AllocationOutcome[]> {
+        return requestResourceAllocation(session, config.productId, resources, onExisting);
+    }
+
+    /**
+     * Look up the currently paired session, if any. Returns a handle ready for
+     * `waitForLogout()`, or null when no session is signed in (adapter destroyed
+     * on the null path).
+     */
+    async function findSession(): Promise<LogoutHandle | null> {
+        const adapter = createAdapter();
+        const sessions = await waitForSessions(adapter, 3000);
+        if (sessions.length === 0) {
+            try {
+                await adapter.destroy();
+            } catch {
+                // best-effort
+            }
+            return null;
+        }
+        const session = sessions[0];
+        const address = sessionLogoutAddress(session);
+        return { adapter, address, session };
+    }
+
+    /**
+     * Disconnect the given session. Sends a `Disconnected` statement so the
+     * paired mobile app drops its side, then clears the local `${dappId}_*`
+     * files. Always releases the adapter before returning.
+     */
+    async function waitForLogout(
+        handle: LogoutHandle,
+        onStatus: (status: LogoutStatus) => void,
+    ): Promise<void> {
+        const { adapter, address, session } = handle;
+
+        try {
+            onStatus({ step: "disconnecting", address });
+            const result = await adapter.sessions.disconnect(session);
+            if (result.isOk()) {
+                await clearLocalAppStorage();
+                onStatus({ step: "success", address });
+                return;
+            }
+            const reason = result.error.message || "remote unreachable";
+            await clearLocalAppStorage();
+            onStatus({ step: "partial", address, reason });
+        } catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            try {
+                await clearLocalAppStorage();
+                onStatus({ step: "partial", address, reason });
+            } catch (cleanupErr) {
+                const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+                onStatus({ step: "error", message: msg });
+            }
+        } finally {
+            try {
+                await adapter.destroy();
+            } catch {
+                // best-effort
+            }
+        }
+    }
+
+    /**
+     * Best-effort removal of this app's persisted state under `~/.polkadot-apps/`.
+     * Scoped by `${dappId}_` prefix so files belonging to other polkadot apps
+     * sharing the directory are left alone. Errors are swallowed.
+     */
+    async function clearLocalAppStorage(
+        dir: string = join(homedir(), ".polkadot-apps"),
+    ): Promise<void> {
+        let entries: Dirent[];
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        } catch {
+            return;
+        }
+        const prefix = `${config.dappId}_`;
+        await Promise.all(
+            entries
+                .filter((entry) => entry.isFile() && entry.name.startsWith(prefix))
+                .map((entry) =>
+                    unlink(join(dir, entry.name)).catch(() => {
+                        // best-effort
+                    }),
+                ),
+        );
+    }
+
+    return {
+        connect,
+        waitForLogin,
+        getSessionSigner,
+        findSession,
+        waitForLogout,
+        requestAllocation,
+        clearLocalAppStorage,
+    };
+}

package/src/index.ts

@@ -0,0 +1,55 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * @parity/product-sdk-auth — QR/mobile sign-in + session signing for Polkadot
+ * product CLIs. Runtime-agnostic core (no terminal UI). UI helpers (QR render,
+ * status formatters) live under the `./ui` entrypoint so headless consumers
+ * don't pull terminal-rendering.
+ */
+
+export { createAuthClient } from "./auth.js";
+export type {
+    AuthClient,
+    SessionAddresses,
+    ConnectResult,
+    LoginStatus,
+    LoginHandle,
+    SessionHandle,
+    LogoutStatus,
+    LogoutHandle,
+} from "./auth.js";
+
+export {
+    createSessionSigner,
+    deriveProductPublicKey,
+    sessionRootPublicKey,
+    INCOMPLETE_SESSION_MESSAGE,
+} from "./sessionSigner.js";
+export type { ProductAccountRef } from "./sessionSigner.js";
+
+export { resolveSigner, SignerNotAvailableError, parseDevAccountName } from "./signer.js";
+export type { ResolvedSigner, SignerSource, SignerOptions } from "./signer.js";
+
+export { requestResourceAllocation, summarizeOutcomes, DEFAULT_RESOURCES } from "./allocations.js";
+export type {
+    AllocatableResource,
+    AllocationOutcome,
+    AllocationSummary,
+    OnExistingAllowancePolicy,
+    ResourceTag,
+} from "./allocations.js";
+
+export type { AuthConfig } from "./types.js";