@polyester/sdk 0.0.0

package/dist/services/auth/account-signer-auth.js

@@ -0,0 +1,337 @@
+import { AuthenticationError, ConfigurationError } from "../../shared/errors.js";
+import { AuthService } from "./auth.js";
+import { AuthSessionStore } from "./session.js";
+import { assertAccountSigner, resolveAccountSigner } from "../../account-signer/types.js";
+import { EventEmitter } from "../../utils/event-emitter.js";
+import { getJwtTimeToExpiry, isJwtValid } from "../../utils/jwt.js";
+import { createAuthTokenStorageSetOptions } from "./token-storage.js";
+//#region src/services/auth/account-signer-auth.ts
+/**
+* Coordinates wallet/account-signer authentication, session storage, subaccount selection, and session refresh.
+*/
+var AccountSignerAuthService = class extends AuthService {
+	events = new EventEmitter();
+	#accountSignerConfig;
+	#accountSigner = null;
+	#accountIdentity = null;
+	#isAuthenticated = false;
+	#mainAccountId = null;
+	#activeAccountId = null;
+	#subaccounts;
+	#walletProvider = void 0;
+	#loginMethod = null;
+	#environmentFingerprint;
+	#tokenStorage;
+	#sessionStore;
+	#realtime;
+	constructor({ transports, accountSignerConfig, environment, subaccounts, realtime, tokenStorage, sessionStore }) {
+		super(transports, realtime);
+		this.#accountSignerConfig = accountSignerConfig;
+		this.#environmentFingerprint = environment.fingerprint;
+		this.#subaccounts = subaccounts;
+		this.#tokenStorage = tokenStorage;
+		this.#realtime = realtime;
+		this.#sessionStore = sessionStore ?? new AuthSessionStore({ environmentFingerprint: environment.fingerprint });
+	}
+	/**
+	* Attaches the subaccounts service used when creating a subaccount during authenticated flows.
+	*/
+	setSubaccountsService(subaccounts) {
+		this.#subaccounts = subaccounts;
+	}
+	/**
+	* Sets the account signer used to sign login and account-switch challenges.
+	*/
+	setAccountSigner(accountSigner) {
+		if (accountSigner) this.#assertAccountSignerEnvironment(accountSigner);
+		this.#accountSigner = accountSigner;
+		this.#accountIdentity = accountSigner ? this.#identityFromSigner(accountSigner) : null;
+		this.#notifyStateChange();
+	}
+	/**
+	* Returns the active account signer, throwing if one has not been configured.
+	*/
+	getAccountSigner() {
+		return this.#accountSigner;
+	}
+	/**
+	* Signs a short-lived login nonce with the configured account signer, exchanges it for a session token, and stores the hydrated account/subaccount session state.
+	*/
+	async login(options) {
+		return this.#login(options);
+	}
+	async #login(options, previousActiveAccount) {
+		const { provider, loginMethod } = options;
+		const accountSigner = await this.#resolveAccountSigner();
+		if (!accountSigner) throw new ConfigurationError("No account signer configured. Call setAccountSigner() or pass accountSigner in config.");
+		const smartAccountAddress = accountSigner.accountAddress;
+		const ownerAddress = accountSigner.ownerAddress ?? accountSigner.accountAddress;
+		const { nonce } = await this.requestLoginNonce(smartAccountAddress);
+		const message = `Polyester Login\n\nNonce: ${nonce}`;
+		const signature = await accountSigner.signMessage(message);
+		const response = await this.loginWithWallet({
+			smartAccountAddress,
+			nonce,
+			signature,
+			primaryWalletAddress: ownerAddress,
+			walletProvider: provider
+		});
+		const environmentSession = this.#getEnvironmentSession();
+		const resolvedLoginMethod = loginMethod ?? this.#loginMethod ?? environmentSession?.loginMethod ?? (provider === "metamask" ? "metamask" : null);
+		const tokenOptions = createAuthTokenStorageSetOptions(response.accessToken);
+		const activeAccount = previousActiveAccount?.mainAccountId === response.accountId ? previousActiveAccount : void 0;
+		this.#sessionStore.commitLogin({
+			accessToken: response.accessToken,
+			tokenOptions,
+			provider,
+			loginMethod: resolvedLoginMethod,
+			primaryWallet: ownerAddress,
+			smartAccount: smartAccountAddress,
+			accountId: response.accountId,
+			activeAccount,
+			username: response.username ?? void 0
+		}, this.#tokenStorage);
+		this.#isAuthenticated = true;
+		this.#mainAccountId = response.accountId;
+		this.#activeAccountId = activeAccount?.accountId ?? response.accountId;
+		this.#walletProvider = provider;
+		this.#loginMethod = resolvedLoginMethod;
+		this.#accountIdentity = this.#identityFromSigner(accountSigner);
+		this.#notifyStateChange();
+		this.events.emit("authenticated", {
+			accountId: response.accountId,
+			username: response.username
+		});
+		const expiresAt = response.expiresAt ? /* @__PURE__ */ new Date(Number(response.expiresAt.seconds) * 1e3 + (response.expiresAt.nanos ?? 0) / 1e6) : /* @__PURE__ */ new Date();
+		return {
+			accountId: response.accountId,
+			username: response.username,
+			expiresAt
+		};
+	}
+	/**
+	* Builds auth state from a session token and optional active account override.
+	*/
+	hydrateAuthState(state) {
+		const existingToken = this.#getEnvironmentBoundToken();
+		if (!existingToken || !isJwtValid(existingToken)) return;
+		const existingSession = this.#getEnvironmentSession();
+		this.#walletProvider = existingSession?.provider ?? this.#walletProvider;
+		this.#loginMethod = existingSession?.loginMethod ?? this.#loginMethod;
+		this.#isAuthenticated = true;
+		this.#mainAccountId = state.mainAccountId;
+		this.#activeAccountId = state.activeAccountId ?? state.mainAccountId;
+		this.#accountIdentity = state.smartAccountAddress ? {
+			accountAddress: state.smartAccountAddress,
+			ownerAddress: state.ownerAddress
+		} : null;
+		this.#notifyStateChange();
+	}
+	/**
+	* Loads the stored token, validates that it still belongs to this environment, and restores auth state when possible.
+	*/
+	async restoreSession() {
+		const existingToken = this.#getEnvironmentBoundToken();
+		if (!existingToken || !isJwtValid(existingToken)) {
+			this.#clearExpiredSessionState();
+			return null;
+		}
+		try {
+			const me = await this.me();
+			this.#isAuthenticated = true;
+			this.#mainAccountId = me.accountId;
+			const existingSession = this.#getEnvironmentSession();
+			this.#walletProvider = existingSession?.provider ?? this.#walletProvider;
+			this.#loginMethod = existingSession?.loginMethod ?? this.#loginMethod;
+			if (!this.#activeAccountId) this.#activeAccountId = existingSession?.activeAccount?.accountId ?? me.accountId;
+			if (!this.#accountSigner) {
+				this.#accountSigner = await resolveAccountSigner(this.#accountSignerConfig);
+				if (this.#accountSigner) {
+					this.#assertAccountSignerEnvironment(this.#accountSigner);
+					this.#accountIdentity = this.#identityFromSigner(this.#accountSigner);
+				}
+			}
+			if (this.#accountSigner?.accountAddress) {
+				const session = this.#sessionStore.ensureSession({
+					provider: this.#walletProvider ? this.#walletProvider : "other",
+					loginMethod: this.#loginMethod ?? (this.#walletProvider === "metamask" ? "metamask" : null),
+					primaryWallet: this.#accountSigner.ownerAddress ?? this.#accountSigner.accountAddress,
+					smartAccount: this.#accountSigner.accountAddress,
+					accountId: me.accountId,
+					username: me.username ?? void 0
+				}, { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds });
+				this.#walletProvider = session.provider;
+				this.#loginMethod = session.loginMethod ?? this.#loginMethod;
+			}
+			this.#notifyStateChange();
+			return {
+				accountId: me.accountId,
+				username: me.username
+			};
+		} catch {
+			this.#clearExpiredSessionState();
+			return null;
+		}
+	}
+	/**
+	* Clears stored auth state and removes the persisted auth token.
+	*/
+	async logout() {
+		this.#realtime.disconnectPrivate();
+		this.#tokenStorage.clear();
+		this.#isAuthenticated = false;
+		this.#mainAccountId = null;
+		this.#activeAccountId = null;
+		this.#loginMethod = null;
+		this.#accountIdentity = null;
+		this.#sessionStore.clear();
+		this.#notifyStateChange();
+		this.events.emit("loggedOut", void 0);
+	}
+	#clearExpiredSessionState() {
+		const shouldEmitLoggedOut = this.#isAuthenticated;
+		this.#realtime.disconnectPrivate();
+		this.#tokenStorage.clear();
+		this.#sessionStore.clear();
+		this.#isAuthenticated = false;
+		this.#mainAccountId = null;
+		this.#activeAccountId = null;
+		this.#loginMethod = null;
+		this.#accountIdentity = null;
+		this.#notifyStateChange();
+		if (shouldEmitLoggedOut) this.events.emit("loggedOut", void 0);
+	}
+	/**
+	* Returns the remaining lifetime of the stored session token in milliseconds.
+	*/
+	getSessionTimeToExpiry() {
+		const token = this.#getEnvironmentBoundToken();
+		if (!token) return 0;
+		return getJwtTimeToExpiry(token);
+	}
+	/**
+	* Refreshes the active account-signer session and updates persisted auth state.
+	*/
+	async refreshSession(params) {
+		if (!this.#isAuthenticated) throw new AuthenticationError("Must be authenticated to refresh session");
+		const currentSession = this.#getEnvironmentSession();
+		return this.#login({
+			provider: this.#resolveRefreshProvider(params?.provider),
+			loginMethod: params?.loginMethod ?? this.#loginMethod
+		}, currentSession?.activeAccount);
+	}
+	/**
+	* Switches the active account/subaccount by signing the required account switch flow.
+	*/
+	switchAccount(accountId, options) {
+		if (!this.#isAuthenticated || !this.#mainAccountId) throw new AuthenticationError("Must be authenticated to switch accounts");
+		this.#activeAccountId = accountId;
+		const isMain = accountId === this.#mainAccountId;
+		this.#sessionStore.setActiveAccount({
+			accountId,
+			isMain,
+			smartAccountAddress: options?.smartAccountAddress,
+			label: options?.label
+		}, { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds });
+		this.#notifyStateChange();
+		return {
+			accountId,
+			isMain
+		};
+	}
+	/** Keeps the display-session identity current for the next server render. */
+	syncSessionUsername(username) {
+		this.#sessionStore.setUsername(username, { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds });
+	}
+	/**
+	* Creates a subaccount for the authenticated account and makes it available to the session state.
+	*/
+	async createSubaccount(params) {
+		if (!this.#isAuthenticated) throw new AuthenticationError("Must be authenticated to create subaccounts");
+		if (!this.#subaccounts) throw new ConfigurationError("SubaccountsService not configured. Pass it to constructor or call setSubaccountsService().");
+		const { accountSigner, label = "", walletProvider = "wallet" } = params;
+		this.#assertAccountSignerEnvironment(accountSigner);
+		const { nonce } = await this.requestLoginNonce(accountSigner.accountAddress);
+		const message = `Polyester Login\n\nNonce: ${nonce}`;
+		const signature = await accountSigner.signMessage(message);
+		const primaryWalletAddress = this.#accountSigner?.ownerAddress ?? accountSigner.ownerAddress ?? this.#accountSigner?.accountAddress ?? "";
+		const response = await this.#subaccounts.create({
+			label,
+			smartAccountAddress: accountSigner.accountAddress,
+			nonce,
+			signature,
+			primaryWalletAddress,
+			walletProvider
+		});
+		return {
+			subaccountId: response.subaccountId,
+			smartAccountSaltNonce: response.smartAccountSaltNonce,
+			revision: response.revision
+		};
+	}
+	/**
+	* Returns the current account-signer auth state snapshot.
+	*/
+	getState() {
+		const accountIdentity = this.#accountSigner ?? this.#accountIdentity;
+		return {
+			isAuthenticated: this.#isAuthenticated,
+			accountAddress: accountIdentity?.accountAddress ?? null,
+			ownerAddress: accountIdentity?.ownerAddress ?? null,
+			mainAccountId: this.#mainAccountId,
+			activeAccount: this.#activeAccountId && this.#mainAccountId ? {
+				accountId: this.#activeAccountId,
+				isMain: this.#activeAccountId === this.#mainAccountId,
+				mainAccountId: this.#mainAccountId,
+				smartAccountAddress: accountIdentity?.accountAddress
+			} : null
+		};
+	}
+	async #resolveAccountSigner() {
+		if (this.#accountSigner) {
+			this.#assertAccountSignerEnvironment(this.#accountSigner);
+			return this.#accountSigner;
+		}
+		const resolved = await resolveAccountSigner(this.#accountSignerConfig);
+		if (resolved) {
+			this.#assertAccountSignerEnvironment(resolved);
+			this.#accountSigner = resolved;
+			this.#accountIdentity = this.#identityFromSigner(resolved);
+		}
+		return this.#accountSigner;
+	}
+	#notifyStateChange() {
+		this.events.emit("stateChange", this.getState());
+	}
+	#getEnvironmentBoundToken() {
+		return this.#sessionStore.getEnvironmentBoundToken(this.#tokenStorage);
+	}
+	#getCurrentTokenStorageOptions() {
+		const token = this.#tokenStorage.get();
+		if (!token) return {
+			expiresAt: null,
+			maxAgeSeconds: null
+		};
+		return createAuthTokenStorageSetOptions(token);
+	}
+	#resolveRefreshProvider(provider) {
+		return provider ?? this.#walletProvider ?? this.#getEnvironmentSession()?.provider ?? "other";
+	}
+	#assertAccountSignerEnvironment(accountSigner) {
+		assertAccountSigner(accountSigner);
+		if (accountSigner.environmentFingerprint !== this.#environmentFingerprint) throw new ConfigurationError("Account signer environment does not match client environment.");
+	}
+	#identityFromSigner(accountSigner) {
+		return {
+			accountAddress: accountSigner.accountAddress,
+			ownerAddress: accountSigner.ownerAddress
+		};
+	}
+	#getEnvironmentSession() {
+		return this.#sessionStore.get();
+	}
+};
+//#endregion
+export { AccountSignerAuthService };
+
+//# sourceMappingURL=account-signer-auth.js.map

package/dist/services/auth/account-signer-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-signer-auth.js","names":["#accountSignerConfig","#environmentFingerprint","#subaccounts","#tokenStorage","#realtime","#sessionStore","#assertAccountSignerEnvironment","#accountSigner","#accountIdentity","#identityFromSigner","#notifyStateChange","#login","#resolveAccountSigner","#getEnvironmentSession","#loginMethod","#isAuthenticated","#mainAccountId","#activeAccountId","#walletProvider","#getEnvironmentBoundToken","#clearExpiredSessionState","#getCurrentTokenStorageOptions","#resolveRefreshProvider"],"sources":["../../../src/services/auth/account-signer-auth.ts"],"sourcesContent":["import { AuthService, type AuthServiceTransports } from \"./auth.js\";\nimport { AuthenticationError, ConfigurationError } from \"../../shared/errors.js\";\nimport { AuthSessionStore } from \"./session.js\";\nimport type { AccountSigner, AccountSignerConfig, HexAddress } from \"../../account-signer/types.js\";\nimport { assertAccountSigner, resolveAccountSigner } from \"../../account-signer/types.js\";\nimport { EventEmitter } from \"../../utils/event-emitter.js\";\nimport { isJwtValid, getJwtTimeToExpiry } from \"../../utils/jwt.js\";\nimport type { SubaccountsService } from \"../subaccounts/index.js\";\nimport type {\n    AuthState,\n    AuthHydrationData,\n    AuthLoginMethod,\n    SessionData,\n    ActiveAccountInfo,\n} from \"./session.types.js\";\nimport type { PolyesterRealtime } from \"../../realtime/index.js\";\nimport type { PolyesterEnvironment } from \"../../environment.js\";\nimport {\n    createAuthTokenStorageSetOptions,\n    type AuthTokenStorage,\n    type AuthTokenStorageSetOptions,\n} from \"./token-storage.js\";\n\nexport interface AccountSignerAuthEvents {\n    authenticated: { accountId: string; username: string };\n    loggedOut: void;\n    error: { code: string; message: string };\n    servicesReady: void;\n    stateChange: AuthState;\n}\n\nexport interface LoginResult {\n    accountId: string;\n    username: string;\n    expiresAt: Date;\n}\n\nexport interface LoginOptions {\n    /**\n     * The wallet provider to use for login.\n     */\n    provider: \"metamask\" | \"turnkey\" | \"other\";\n    loginMethod?: AuthLoginMethod | null;\n}\n\nexport interface CreateSubaccountParams {\n    /** The account signer for the new subaccount (caller derives this, e.g. via Turnkey saltNonce) */\n    accountSigner: AccountSigner;\n    /** Optional human-readable label for this subaccount */\n    label?: string;\n    /** Wallet provider hint (e.g. \"turnkey\", \"metamask\"). Defaults to \"wallet\" */\n    walletProvider?: string;\n}\n\nexport interface CreateSubaccountResult {\n    subaccountId: string;\n    smartAccountSaltNonce: number;\n    revision: string;\n}\n\ninterface AccountIdentity {\n    accountAddress: HexAddress;\n    ownerAddress?: HexAddress;\n}\n\n/**\n * Coordinates wallet/account-signer authentication, session storage, subaccount selection, and session refresh.\n */\nexport class AccountSignerAuthService extends AuthService {\n    readonly events = new EventEmitter<AccountSignerAuthEvents>();\n\n    #accountSignerConfig: AccountSignerConfig | undefined;\n    #accountSigner: AccountSigner | null = null;\n    #accountIdentity: AccountIdentity | null = null;\n    #isAuthenticated = false;\n    #mainAccountId: string | null = null;\n    #activeAccountId: string | null = null;\n    #subaccounts: SubaccountsService;\n    #walletProvider: \"metamask\" | \"turnkey\" | \"other\" | undefined = undefined;\n    #loginMethod: AuthLoginMethod | null = null;\n    #environmentFingerprint: string;\n    #tokenStorage: AuthTokenStorage;\n    #sessionStore: AuthSessionStore;\n    #realtime: PolyesterRealtime;\n\n    constructor({\n        transports,\n        accountSignerConfig,\n        environment,\n        subaccounts,\n        realtime,\n        tokenStorage,\n        sessionStore,\n    }: {\n        transports: AuthServiceTransports;\n        accountSignerConfig?: AccountSignerConfig;\n        environment: PolyesterEnvironment;\n        subaccounts: SubaccountsService;\n        realtime: PolyesterRealtime;\n        tokenStorage: AuthTokenStorage;\n        sessionStore?: AuthSessionStore;\n    }) {\n        super(transports, realtime);\n\n        this.#accountSignerConfig = accountSignerConfig;\n        this.#environmentFingerprint = environment.fingerprint;\n        this.#subaccounts = subaccounts;\n        this.#tokenStorage = tokenStorage;\n        this.#realtime = realtime;\n        this.#sessionStore =\n            sessionStore ??\n            new AuthSessionStore({\n                environmentFingerprint: environment.fingerprint,\n            });\n    }\n\n    /**\n     * Attaches the subaccounts service used when creating a subaccount during authenticated flows.\n     */\n    setSubaccountsService(subaccounts: SubaccountsService): void {\n        this.#subaccounts = subaccounts;\n    }\n\n    /**\n     * Sets the account signer used to sign login and account-switch challenges.\n     */\n    setAccountSigner(accountSigner: AccountSigner | null): void {\n        if (accountSigner) this.#assertAccountSignerEnvironment(accountSigner);\n        this.#accountSigner = accountSigner;\n        this.#accountIdentity = accountSigner ? this.#identityFromSigner(accountSigner) : null;\n        this.#notifyStateChange();\n    }\n\n    /**\n     * Returns the active account signer, throwing if one has not been configured.\n     */\n    getAccountSigner(): AccountSigner | null {\n        return this.#accountSigner;\n    }\n\n    /**\n     * Signs a short-lived login nonce with the configured account signer, exchanges it for a session token, and stores the hydrated account/subaccount session state.\n     */\n    async login(options: LoginOptions): Promise<LoginResult> {\n        return this.#login(options);\n    }\n\n    async #login(\n        options: LoginOptions,\n        previousActiveAccount?: ActiveAccountInfo,\n    ): Promise<LoginResult> {\n        const { provider, loginMethod } = options;\n\n        const accountSigner = await this.#resolveAccountSigner();\n\n        if (!accountSigner) {\n            throw new ConfigurationError(\n                \"No account signer configured. Call setAccountSigner() or pass accountSigner in config.\",\n            );\n        }\n\n        const smartAccountAddress = accountSigner.accountAddress;\n        const ownerAddress = accountSigner.ownerAddress ?? accountSigner.accountAddress;\n\n        const { nonce } = await this.requestLoginNonce(smartAccountAddress);\n\n        const message = `Polyester Login\\n\\nNonce: ${nonce}`;\n        const signature = await accountSigner.signMessage(message);\n\n        const response = await this.loginWithWallet({\n            smartAccountAddress,\n            nonce,\n            signature,\n            primaryWalletAddress: ownerAddress,\n            walletProvider: provider,\n        });\n\n        const environmentSession = this.#getEnvironmentSession();\n        const resolvedLoginMethod =\n            loginMethod ??\n            this.#loginMethod ??\n            environmentSession?.loginMethod ??\n            (provider === \"metamask\" ? \"metamask\" : null);\n\n        const tokenOptions = createAuthTokenStorageSetOptions(response.accessToken);\n        const activeAccount =\n            previousActiveAccount?.mainAccountId === response.accountId\n                ? previousActiveAccount\n                : undefined;\n        this.#sessionStore.commitLogin(\n            {\n                accessToken: response.accessToken,\n                tokenOptions,\n                provider,\n                loginMethod: resolvedLoginMethod,\n                primaryWallet: ownerAddress,\n                smartAccount: smartAccountAddress,\n                accountId: response.accountId,\n                activeAccount,\n                username: response.username ?? undefined,\n            },\n            this.#tokenStorage,\n        );\n        this.#isAuthenticated = true;\n        this.#mainAccountId = response.accountId;\n        this.#activeAccountId = activeAccount?.accountId ?? response.accountId;\n        this.#walletProvider = provider;\n        this.#loginMethod = resolvedLoginMethod;\n        this.#accountIdentity = this.#identityFromSigner(accountSigner);\n\n        this.#notifyStateChange();\n\n        this.events.emit(\"authenticated\", {\n            accountId: response.accountId,\n            username: response.username,\n        });\n\n        const expiresAt = response.expiresAt\n            ? new Date(\n                  Number(response.expiresAt.seconds) * 1000 +\n                      (response.expiresAt.nanos ?? 0) / 1_000_000,\n              )\n            : new Date();\n\n        return {\n            accountId: response.accountId,\n            username: response.username,\n            expiresAt,\n        };\n    }\n\n    /**\n     * Builds auth state from a session token and optional active account override.\n     */\n    hydrateAuthState(state: AuthHydrationData): void {\n        const existingToken = this.#getEnvironmentBoundToken();\n        if (!existingToken || !isJwtValid(existingToken)) return;\n\n        const existingSession = this.#getEnvironmentSession();\n        this.#walletProvider = existingSession?.provider ?? this.#walletProvider;\n        this.#loginMethod = existingSession?.loginMethod ?? this.#loginMethod;\n\n        this.#isAuthenticated = true;\n        this.#mainAccountId = state.mainAccountId;\n        this.#activeAccountId = state.activeAccountId ?? state.mainAccountId;\n        this.#accountIdentity = state.smartAccountAddress\n            ? {\n                  accountAddress: state.smartAccountAddress,\n                  ownerAddress: state.ownerAddress,\n              }\n            : null;\n\n        this.#notifyStateChange();\n    }\n\n    /**\n     * Loads the stored token, validates that it still belongs to this environment, and restores auth state when possible.\n     */\n    async restoreSession(): Promise<{ accountId: string; username: string } | null> {\n        const existingToken = this.#getEnvironmentBoundToken();\n\n        if (!existingToken || !isJwtValid(existingToken)) {\n            this.#clearExpiredSessionState();\n            return null;\n        }\n\n        try {\n            const me = await this.me();\n            this.#isAuthenticated = true;\n            this.#mainAccountId = me.accountId;\n\n            // preserve active account if already set (e.g. via hydration), otherwise use main\n            const existingSession = this.#getEnvironmentSession();\n            this.#walletProvider = existingSession?.provider ?? this.#walletProvider;\n            this.#loginMethod = existingSession?.loginMethod ?? this.#loginMethod;\n            if (!this.#activeAccountId) {\n                this.#activeAccountId = existingSession?.activeAccount?.accountId ?? me.accountId;\n            }\n\n            // use existing account signer if set, otherwise try to resolve from config\n            if (!this.#accountSigner) {\n                this.#accountSigner = await resolveAccountSigner(this.#accountSignerConfig);\n                if (this.#accountSigner) {\n                    this.#assertAccountSignerEnvironment(this.#accountSigner);\n                    this.#accountIdentity = this.#identityFromSigner(this.#accountSigner);\n                }\n            }\n\n            // keep the display session available for SSR hydration\n            if (this.#accountSigner?.accountAddress) {\n                const session = this.#sessionStore.ensureSession(\n                    {\n                        provider: this.#walletProvider ? this.#walletProvider : \"other\",\n                        loginMethod:\n                            this.#loginMethod ??\n                            (this.#walletProvider === \"metamask\" ? \"metamask\" : null),\n                        primaryWallet:\n                            this.#accountSigner.ownerAddress ?? this.#accountSigner.accountAddress,\n                        smartAccount: this.#accountSigner.accountAddress,\n                        accountId: me.accountId,\n                        username: me.username ?? undefined,\n                    },\n                    { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds },\n                );\n                this.#walletProvider = session.provider;\n                this.#loginMethod = session.loginMethod ?? this.#loginMethod;\n            }\n\n            this.#notifyStateChange();\n            return { accountId: me.accountId, username: me.username };\n        } catch {\n            this.#clearExpiredSessionState();\n            return null;\n        }\n    }\n\n    /**\n     * Clears stored auth state and removes the persisted auth token.\n     */\n    async logout(): Promise<void> {\n        this.#realtime.disconnectPrivate();\n        this.#tokenStorage.clear();\n        this.#isAuthenticated = false;\n        this.#mainAccountId = null;\n        this.#activeAccountId = null;\n        this.#loginMethod = null;\n        this.#accountIdentity = null;\n\n        this.#sessionStore.clear();\n\n        this.#notifyStateChange();\n        this.events.emit(\"loggedOut\", undefined);\n    }\n\n    #clearExpiredSessionState(): void {\n        const shouldEmitLoggedOut = this.#isAuthenticated;\n        this.#realtime.disconnectPrivate();\n        this.#tokenStorage.clear();\n        this.#sessionStore.clear();\n        this.#isAuthenticated = false;\n        this.#mainAccountId = null;\n        this.#activeAccountId = null;\n        this.#loginMethod = null;\n        this.#accountIdentity = null;\n        this.#notifyStateChange();\n        if (shouldEmitLoggedOut) {\n            this.events.emit(\"loggedOut\", undefined);\n        }\n    }\n\n    /**\n     * Returns the remaining lifetime of the stored session token in milliseconds.\n     */\n    getSessionTimeToExpiry(): number {\n        const token = this.#getEnvironmentBoundToken();\n        if (!token) return 0;\n        return getJwtTimeToExpiry(token);\n    }\n\n    /**\n     * Refreshes the active account-signer session and updates persisted auth state.\n     */\n    async refreshSession(params?: {\n        provider?: \"metamask\" | \"turnkey\" | \"other\";\n        loginMethod?: AuthLoginMethod | null;\n    }): Promise<LoginResult> {\n        if (!this.#isAuthenticated) {\n            throw new AuthenticationError(\"Must be authenticated to refresh session\");\n        }\n\n        const currentSession = this.#getEnvironmentSession();\n        return this.#login(\n            {\n                provider: this.#resolveRefreshProvider(params?.provider),\n                loginMethod: params?.loginMethod ?? this.#loginMethod,\n            },\n            currentSession?.activeAccount,\n        );\n    }\n\n    /**\n     * Switches the active account/subaccount by signing the required account switch flow.\n     */\n    switchAccount(\n        accountId: string,\n        options?: { smartAccountAddress?: string; label?: string },\n    ): { accountId: string; isMain: boolean } {\n        if (!this.#isAuthenticated || !this.#mainAccountId) {\n            throw new AuthenticationError(\"Must be authenticated to switch accounts\");\n        }\n\n        this.#activeAccountId = accountId;\n        const isMain = accountId === this.#mainAccountId;\n\n        this.#sessionStore.setActiveAccount(\n            {\n                accountId,\n                isMain,\n                smartAccountAddress: options?.smartAccountAddress,\n                label: options?.label,\n            },\n            { maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds },\n        );\n        this.#notifyStateChange();\n\n        return { accountId, isMain };\n    }\n\n    /** Keeps the display-session identity current for the next server render. */\n    syncSessionUsername(username: string | null): void {\n        this.#sessionStore.setUsername(username, {\n            maxAgeSeconds: this.#getCurrentTokenStorageOptions().maxAgeSeconds,\n        });\n    }\n\n    /**\n     * Creates a subaccount for the authenticated account and makes it available to the session state.\n     */\n    async createSubaccount(params: CreateSubaccountParams): Promise<CreateSubaccountResult> {\n        if (!this.#isAuthenticated) {\n            throw new AuthenticationError(\"Must be authenticated to create subaccounts\");\n        }\n\n        if (!this.#subaccounts) {\n            throw new ConfigurationError(\n                \"SubaccountsService not configured. Pass it to constructor or call setSubaccountsService().\",\n            );\n        }\n\n        const { accountSigner, label = \"\", walletProvider = \"wallet\" } = params;\n        this.#assertAccountSignerEnvironment(accountSigner);\n\n        // request nonce for the subaccount's smart account address\n        const { nonce } = await this.requestLoginNonce(accountSigner.accountAddress);\n\n        // sign canonical login message with the subaccount account signer\n        const message = `Polyester Login\\n\\nNonce: ${nonce}`;\n        const signature = await accountSigner.signMessage(message);\n\n        // use main account signer's owner address for primary wallet reference\n        const primaryWalletAddress =\n            this.#accountSigner?.ownerAddress ??\n            accountSigner.ownerAddress ??\n            this.#accountSigner?.accountAddress ??\n            \"\";\n\n        const response = await this.#subaccounts.create({\n            label,\n            smartAccountAddress: accountSigner.accountAddress,\n            nonce,\n            signature,\n            primaryWalletAddress,\n            walletProvider,\n        });\n\n        return {\n            subaccountId: response.subaccountId,\n            smartAccountSaltNonce: response.smartAccountSaltNonce,\n            revision: response.revision,\n        };\n    }\n\n    /**\n     * Returns the current account-signer auth state snapshot.\n     */\n    getState(): AuthState {\n        const accountIdentity = this.#accountSigner ?? this.#accountIdentity;\n\n        return {\n            isAuthenticated: this.#isAuthenticated,\n            accountAddress: accountIdentity?.accountAddress ?? null,\n            ownerAddress: accountIdentity?.ownerAddress ?? null,\n            mainAccountId: this.#mainAccountId,\n            activeAccount:\n                this.#activeAccountId && this.#mainAccountId\n                    ? {\n                          accountId: this.#activeAccountId,\n                          isMain: this.#activeAccountId === this.#mainAccountId,\n                          mainAccountId: this.#mainAccountId,\n                          smartAccountAddress: accountIdentity?.accountAddress,\n                      }\n                    : null,\n        };\n    }\n\n    async #resolveAccountSigner(): Promise<AccountSigner | null> {\n        if (this.#accountSigner) {\n            this.#assertAccountSignerEnvironment(this.#accountSigner);\n            return this.#accountSigner;\n        }\n\n        const resolved = await resolveAccountSigner(this.#accountSignerConfig);\n        if (resolved) {\n            this.#assertAccountSignerEnvironment(resolved);\n            this.#accountSigner = resolved;\n            this.#accountIdentity = this.#identityFromSigner(resolved);\n        }\n        return this.#accountSigner;\n    }\n\n    #notifyStateChange(): void {\n        this.events.emit(\"stateChange\", this.getState());\n    }\n\n    #getEnvironmentBoundToken(): string | null {\n        return this.#sessionStore.getEnvironmentBoundToken(this.#tokenStorage);\n    }\n\n    #getCurrentTokenStorageOptions(): AuthTokenStorageSetOptions {\n        const token = this.#tokenStorage.get();\n        if (!token) return { expiresAt: null, maxAgeSeconds: null };\n        return createAuthTokenStorageSetOptions(token);\n    }\n\n    #resolveRefreshProvider(\n        provider?: \"metamask\" | \"turnkey\" | \"other\",\n    ): \"metamask\" | \"turnkey\" | \"other\" {\n        return (\n            provider ?? this.#walletProvider ?? this.#getEnvironmentSession()?.provider ?? \"other\"\n        );\n    }\n\n    #assertAccountSignerEnvironment(accountSigner: AccountSigner): void {\n        assertAccountSigner(accountSigner);\n        if (accountSigner.environmentFingerprint !== this.#environmentFingerprint) {\n            throw new ConfigurationError(\n                \"Account signer environment does not match client environment.\",\n            );\n        }\n    }\n\n    #identityFromSigner(accountSigner: AccountSigner): AccountIdentity {\n        return {\n            accountAddress: accountSigner.accountAddress,\n            ownerAddress: accountSigner.ownerAddress,\n        };\n    }\n\n    #getEnvironmentSession(): SessionData | null {\n        return this.#sessionStore.get();\n    }\n}\n"],"mappings":";;;;;;;;;;;AAoEA,IAAa,2BAAb,cAA8C,YAAY;CACtD,SAAkB,IAAI,aAAsC;CAE5D;CACA,iBAAuC;CACvC,mBAA2C;CAC3C,mBAAmB;CACnB,iBAAgC;CAChC,mBAAkC;CAClC;CACA,kBAAgE,KAAA;CAChE,eAAuC;CACvC;CACA;CACA;CACA;CAEA,YAAY,EACR,YACA,qBACA,aACA,aACA,UACA,cACA,gBASD;EACC,MAAM,YAAY,QAAQ;EAE1B,KAAKA,uBAAuB;EAC5B,KAAKC,0BAA0B,YAAY;EAC3C,KAAKC,eAAe;EACpB,KAAKC,gBAAgB;EACrB,KAAKC,YAAY;EACjB,KAAKC,gBACD,gBACA,IAAI,iBAAiB,EACjB,wBAAwB,YAAY,YACxC,CAAC;CACT;;;;CAKA,sBAAsB,aAAuC;EACzD,KAAKH,eAAe;CACxB;;;;CAKA,iBAAiB,eAA2C;EACxD,IAAI,eAAe,KAAKI,gCAAgC,aAAa;EACrE,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB,gBAAgB,KAAKC,oBAAoB,aAAa,IAAI;EAClF,KAAKC,mBAAmB;CAC5B;;;;CAKA,mBAAyC;EACrC,OAAO,KAAKH;CAChB;;;;CAKA,MAAM,MAAM,SAA6C;EACrD,OAAO,KAAKI,OAAO,OAAO;CAC9B;CAEA,MAAMA,OACF,SACA,uBACoB;EACpB,MAAM,EAAE,UAAU,gBAAgB;EAElC,MAAM,gBAAgB,MAAM,KAAKC,sBAAsB;EAEvD,IAAI,CAAC,eACD,MAAM,IAAI,mBACN,wFACJ;EAGJ,MAAM,sBAAsB,cAAc;EAC1C,MAAM,eAAe,cAAc,gBAAgB,cAAc;EAEjE,MAAM,EAAE,UAAU,MAAM,KAAK,kBAAkB,mBAAmB;EAElE,MAAM,UAAU,6BAA6B;EAC7C,MAAM,YAAY,MAAM,cAAc,YAAY,OAAO;EAEzD,MAAM,WAAW,MAAM,KAAK,gBAAgB;GACxC;GACA;GACA;GACA,sBAAsB;GACtB,gBAAgB;EACpB,CAAC;EAED,MAAM,qBAAqB,KAAKC,uBAAuB;EACvD,MAAM,sBACF,eACA,KAAKC,gBACL,oBAAoB,gBACnB,aAAa,aAAa,aAAa;EAE5C,MAAM,eAAe,iCAAiC,SAAS,WAAW;EAC1E,MAAM,gBACF,uBAAuB,kBAAkB,SAAS,YAC5C,wBACA,KAAA;EACV,KAAKT,cAAc,YACf;GACI,aAAa,SAAS;GACtB;GACA;GACA,aAAa;GACb,eAAe;GACf,cAAc;GACd,WAAW,SAAS;GACpB;GACA,UAAU,SAAS,YAAY,KAAA;EACnC,GACA,KAAKF,aACT;EACA,KAAKY,mBAAmB;EACxB,KAAKC,iBAAiB,SAAS;EAC/B,KAAKC,mBAAmB,eAAe,aAAa,SAAS;EAC7D,KAAKC,kBAAkB;EACvB,KAAKJ,eAAe;EACpB,KAAKN,mBAAmB,KAAKC,oBAAoB,aAAa;EAE9D,KAAKC,mBAAmB;EAExB,KAAK,OAAO,KAAK,iBAAiB;GAC9B,WAAW,SAAS;GACpB,UAAU,SAAS;EACvB,CAAC;EAED,MAAM,YAAY,SAAS,4BACrB,IAAI,KACA,OAAO,SAAS,UAAU,OAAO,IAAI,OAChC,SAAS,UAAU,SAAS,KAAK,GAC1C,oBACA,IAAI,KAAK;EAEf,OAAO;GACH,WAAW,SAAS;GACpB,UAAU,SAAS;GACnB;EACJ;CACJ;;;;CAKA,iBAAiB,OAAgC;EAC7C,MAAM,gBAAgB,KAAKS,0BAA0B;EACrD,IAAI,CAAC,iBAAiB,CAAC,WAAW,aAAa,GAAG;EAElD,MAAM,kBAAkB,KAAKN,uBAAuB;EACpD,KAAKK,kBAAkB,iBAAiB,YAAY,KAAKA;EACzD,KAAKJ,eAAe,iBAAiB,eAAe,KAAKA;EAEzD,KAAKC,mBAAmB;EACxB,KAAKC,iBAAiB,MAAM;EAC5B,KAAKC,mBAAmB,MAAM,mBAAmB,MAAM;EACvD,KAAKT,mBAAmB,MAAM,sBACxB;GACI,gBAAgB,MAAM;GACtB,cAAc,MAAM;EACxB,IACA;EAEN,KAAKE,mBAAmB;CAC5B;;;;CAKA,MAAM,iBAA0E;EAC5E,MAAM,gBAAgB,KAAKS,0BAA0B;EAErD,IAAI,CAAC,iBAAiB,CAAC,WAAW,aAAa,GAAG;GAC9C,KAAKC,0BAA0B;GAC/B,OAAO;EACX;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,KAAK,GAAG;GACzB,KAAKL,mBAAmB;GACxB,KAAKC,iBAAiB,GAAG;GAGzB,MAAM,kBAAkB,KAAKH,uBAAuB;GACpD,KAAKK,kBAAkB,iBAAiB,YAAY,KAAKA;GACzD,KAAKJ,eAAe,iBAAiB,eAAe,KAAKA;GACzD,IAAI,CAAC,KAAKG,kBACN,KAAKA,mBAAmB,iBAAiB,eAAe,aAAa,GAAG;GAI5E,IAAI,CAAC,KAAKV,gBAAgB;IACtB,KAAKA,iBAAiB,MAAM,qBAAqB,KAAKP,oBAAoB;IAC1E,IAAI,KAAKO,gBAAgB;KACrB,KAAKD,gCAAgC,KAAKC,cAAc;KACxD,KAAKC,mBAAmB,KAAKC,oBAAoB,KAAKF,cAAc;IACxE;GACJ;GAGA,IAAI,KAAKA,gBAAgB,gBAAgB;IACrC,MAAM,UAAU,KAAKF,cAAc,cAC/B;KACI,UAAU,KAAKa,kBAAkB,KAAKA,kBAAkB;KACxD,aACI,KAAKJ,iBACJ,KAAKI,oBAAoB,aAAa,aAAa;KACxD,eACI,KAAKX,eAAe,gBAAgB,KAAKA,eAAe;KAC5D,cAAc,KAAKA,eAAe;KAClC,WAAW,GAAG;KACd,UAAU,GAAG,YAAY,KAAA;IAC7B,GACA,EAAE,eAAe,KAAKc,+BAA+B,CAAC,CAAC,cAAc,CACzE;IACA,KAAKH,kBAAkB,QAAQ;IAC/B,KAAKJ,eAAe,QAAQ,eAAe,KAAKA;GACpD;GAEA,KAAKJ,mBAAmB;GACxB,OAAO;IAAE,WAAW,GAAG;IAAW,UAAU,GAAG;GAAS;EAC5D,QAAQ;GACJ,KAAKU,0BAA0B;GAC/B,OAAO;EACX;CACJ;;;;CAKA,MAAM,SAAwB;EAC1B,KAAKhB,UAAU,kBAAkB;EACjC,KAAKD,cAAc,MAAM;EACzB,KAAKY,mBAAmB;EACxB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB;EACxB,KAAKH,eAAe;EACpB,KAAKN,mBAAmB;EAExB,KAAKH,cAAc,MAAM;EAEzB,KAAKK,mBAAmB;EACxB,KAAK,OAAO,KAAK,aAAa,KAAA,CAAS;CAC3C;CAEA,4BAAkC;EAC9B,MAAM,sBAAsB,KAAKK;EACjC,KAAKX,UAAU,kBAAkB;EACjC,KAAKD,cAAc,MAAM;EACzB,KAAKE,cAAc,MAAM;EACzB,KAAKU,mBAAmB;EACxB,KAAKC,iBAAiB;EACtB,KAAKC,mBAAmB;EACxB,KAAKH,eAAe;EACpB,KAAKN,mBAAmB;EACxB,KAAKE,mBAAmB;EACxB,IAAI,qBACA,KAAK,OAAO,KAAK,aAAa,KAAA,CAAS;CAE/C;;;;CAKA,yBAAiC;EAC7B,MAAM,QAAQ,KAAKS,0BAA0B;EAC7C,IAAI,CAAC,OAAO,OAAO;EACnB,OAAO,mBAAmB,KAAK;CACnC;;;;CAKA,MAAM,eAAe,QAGI;EACrB,IAAI,CAAC,KAAKJ,kBACN,MAAM,IAAI,oBAAoB,0CAA0C;EAG5E,MAAM,iBAAiB,KAAKF,uBAAuB;EACnD,OAAO,KAAKF,OACR;GACI,UAAU,KAAKW,wBAAwB,QAAQ,QAAQ;GACvD,aAAa,QAAQ,eAAe,KAAKR;EAC7C,GACA,gBAAgB,aACpB;CACJ;;;;CAKA,cACI,WACA,SACsC;EACtC,IAAI,CAAC,KAAKC,oBAAoB,CAAC,KAAKC,gBAChC,MAAM,IAAI,oBAAoB,0CAA0C;EAG5E,KAAKC,mBAAmB;EACxB,MAAM,SAAS,cAAc,KAAKD;EAElC,KAAKX,cAAc,iBACf;GACI;GACA;GACA,qBAAqB,SAAS;GAC9B,OAAO,SAAS;EACpB,GACA,EAAE,eAAe,KAAKgB,+BAA+B,CAAC,CAAC,cAAc,CACzE;EACA,KAAKX,mBAAmB;EAExB,OAAO;GAAE;GAAW;EAAO;CAC/B;;CAGA,oBAAoB,UAA+B;EAC/C,KAAKL,cAAc,YAAY,UAAU,EACrC,eAAe,KAAKgB,+BAA+B,CAAC,CAAC,cACzD,CAAC;CACL;;;;CAKA,MAAM,iBAAiB,QAAiE;EACpF,IAAI,CAAC,KAAKN,kBACN,MAAM,IAAI,oBAAoB,6CAA6C;EAG/E,IAAI,CAAC,KAAKb,cACN,MAAM,IAAI,mBACN,4FACJ;EAGJ,MAAM,EAAE,eAAe,QAAQ,IAAI,iBAAiB,aAAa;EACjE,KAAKI,gCAAgC,aAAa;EAGlD,MAAM,EAAE,UAAU,MAAM,KAAK,kBAAkB,cAAc,cAAc;EAG3E,MAAM,UAAU,6BAA6B;EAC7C,MAAM,YAAY,MAAM,cAAc,YAAY,OAAO;EAGzD,MAAM,uBACF,KAAKC,gBAAgB,gBACrB,cAAc,gBACd,KAAKA,gBAAgB,kBACrB;EAEJ,MAAM,WAAW,MAAM,KAAKL,aAAa,OAAO;GAC5C;GACA,qBAAqB,cAAc;GACnC;GACA;GACA;GACA;EACJ,CAAC;EAED,OAAO;GACH,cAAc,SAAS;GACvB,uBAAuB,SAAS;GAChC,UAAU,SAAS;EACvB;CACJ;;;;CAKA,WAAsB;EAClB,MAAM,kBAAkB,KAAKK,kBAAkB,KAAKC;EAEpD,OAAO;GACH,iBAAiB,KAAKO;GACtB,gBAAgB,iBAAiB,kBAAkB;GACnD,cAAc,iBAAiB,gBAAgB;GAC/C,eAAe,KAAKC;GACpB,eACI,KAAKC,oBAAoB,KAAKD,iBACxB;IACI,WAAW,KAAKC;IAChB,QAAQ,KAAKA,qBAAqB,KAAKD;IACvC,eAAe,KAAKA;IACpB,qBAAqB,iBAAiB;GAC1C,IACA;EACd;CACJ;CAEA,MAAMJ,wBAAuD;EACzD,IAAI,KAAKL,gBAAgB;GACrB,KAAKD,gCAAgC,KAAKC,cAAc;GACxD,OAAO,KAAKA;EAChB;EAEA,MAAM,WAAW,MAAM,qBAAqB,KAAKP,oBAAoB;EACrE,IAAI,UAAU;GACV,KAAKM,gCAAgC,QAAQ;GAC7C,KAAKC,iBAAiB;GACtB,KAAKC,mBAAmB,KAAKC,oBAAoB,QAAQ;EAC7D;EACA,OAAO,KAAKF;CAChB;CAEA,qBAA2B;EACvB,KAAK,OAAO,KAAK,eAAe,KAAK,SAAS,CAAC;CACnD;CAEA,4BAA2C;EACvC,OAAO,KAAKF,cAAc,yBAAyB,KAAKF,aAAa;CACzE;CAEA,iCAA6D;EACzD,MAAM,QAAQ,KAAKA,cAAc,IAAI;EACrC,IAAI,CAAC,OAAO,OAAO;GAAE,WAAW;GAAM,eAAe;EAAK;EAC1D,OAAO,iCAAiC,KAAK;CACjD;CAEA,wBACI,UACgC;EAChC,OACI,YAAY,KAAKe,mBAAmB,KAAKL,uBAAuB,CAAC,EAAE,YAAY;CAEvF;CAEA,gCAAgC,eAAoC;EAChE,oBAAoB,aAAa;EACjC,IAAI,cAAc,2BAA2B,KAAKZ,yBAC9C,MAAM,IAAI,mBACN,+DACJ;CAER;CAEA,oBAAoB,eAA+C;EAC/D,OAAO;GACH,gBAAgB,cAAc;GAC9B,cAAc,cAAc;EAChC;CACJ;CAEA,yBAA6C;EACzC,OAAO,KAAKI,cAAc,IAAI;CAClC;AACJ"}

package/dist/services/auth/auth.d.ts

@@ -0,0 +1,91 @@
+import { SessionLevel } from "../../gen/auth/v1/mfa_pb.js";
+import { PolyesterMutationOptions, PolyesterRequestOptions } from "../../shared/request-options.js";
+import { PolyesterRealtime } from "../../realtime/types.js";
+import "../../realtime/index.js";
+import { ProfileService } from "./profile/profile.js";
+import { Transport } from "@connectrpc/connect";
+import * as v from "valibot";
+//#region src/services/auth/auth.d.ts
+declare const LoginWithWalletInputSchema: v.StrictObjectSchema<{
+  readonly smartAccountAddress: v.StringSchema<undefined>;
+  readonly nonce: v.StringSchema<undefined>;
+  readonly signature: v.StringSchema<undefined>;
+  readonly userAgent: v.OptionalSchema<v.StringSchema<undefined>, "">;
+  readonly ip: v.OptionalSchema<v.StringSchema<undefined>, "">;
+  readonly primaryWalletAddress: v.OptionalSchema<v.StringSchema<undefined>, "">;
+  readonly walletProvider: v.OptionalSchema<v.StringSchema<undefined>, "">;
+}, undefined>;
+type LoginWithWalletInput = v.InferInput<typeof LoginWithWalletInputSchema>;
+interface AuthServiceTransports {
+  publicApi: Transport;
+  authApi: Transport;
+}
+declare const MeSchema: v.ObjectSchema<{
+  readonly accountId: v.SchemaWithPipe<readonly [v.BigintSchema<undefined>, v.TransformAction<bigint, string>]>;
+  readonly apiKeyId: v.SchemaWithPipe<readonly [v.OptionalSchema<v.BigintSchema<undefined>, undefined>, v.TransformAction<bigint | undefined, string | undefined>]>;
+  readonly username: v.StringSchema<undefined>;
+  readonly session: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ObjectSchema<{
+    readonly sessionId: v.StringSchema<undefined>;
+    readonly sessionLevel: v.SchemaWithPipe<readonly [v.EnumSchema<typeof SessionLevel, undefined>, v.TransformAction<SessionLevel, "unspecified" | "primaryAuthenticated" | "mfaElevated" | "freshStepUp">]>;
+    readonly authenticationMethods: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, readonly []>;
+    readonly authTime: v.SchemaWithPipe<readonly [v.OptionalSchema<v.ObjectSchema<{
+      readonly seconds: v.BigintSchema<undefined>;
+      readonly nanos: v.OptionalSchema<v.NumberSchema<undefined>, 0>;
+    }, undefined>, undefined>, v.TransformAction<{
+      seconds: bigint;
+      nanos: number;
+    } | undefined, number | undefined>]>;
+  }, undefined>, v.TransformAction<{
+    sessionId: string;
+    sessionLevel: "unspecified" | "primaryAuthenticated" | "mfaElevated" | "freshStepUp";
+    authenticationMethods: string[];
+    authTime?: number | undefined;
+  }, {
+    sessionId: string;
+    sessionLevel: "unspecified" | "primaryAuthenticated" | "mfaElevated" | "freshStepUp";
+    authenticationMethods: string[];
+    authTimeMs: number | undefined;
+  }>]>, undefined>;
+}, undefined>;
+type Me = v.InferOutput<typeof MeSchema>;
+declare const LoginWithWalletResponseSchema: v.ObjectSchema<{
+  readonly accessToken: v.StringSchema<undefined>;
+  readonly expiresAt: v.OptionalSchema<v.ObjectSchema<{
+    readonly seconds: v.BigintSchema<undefined>;
+    readonly nanos: v.OptionalSchema<v.NumberSchema<undefined>, 0>;
+  }, undefined>, undefined>;
+  readonly accountId: v.SchemaWithPipe<readonly [v.BigintSchema<undefined>, v.TransformAction<bigint, string>]>;
+  readonly username: v.StringSchema<undefined>;
+}, undefined>;
+type LoginWithWalletResponse = v.InferOutput<typeof LoginWithWalletResponseSchema>;
+declare const NonceSchema: v.ObjectSchema<{
+  readonly nonce: v.StringSchema<undefined>;
+  readonly expiresAt: v.OptionalSchema<v.ObjectSchema<{
+    readonly seconds: v.BigintSchema<undefined>;
+    readonly nanos: v.OptionalSchema<v.NumberSchema<undefined>, 0>;
+  }, undefined>, undefined>;
+}, undefined>;
+type Nonce = v.InferOutput<typeof NonceSchema>;
+/**
+ * Handles wallet-based authentication, caller introspection, and authenticated profile operations.
+ */
+declare class AuthService {
+  #private;
+  profile: ProfileService;
+  constructor(transports: AuthServiceTransports, realtime: PolyesterRealtime);
+  /**
+   * Returns the authenticated caller's account context, including account ID, optional API key ID, username, and session assurance details from the presented token or API key.
+   */
+  me(options?: PolyesterRequestOptions): Promise<Me>;
+  /**
+   * Requests a short-lived nonce for the given smart-account EVM address; the nonce is single-purpose, replaced by subsequent requests, and expires after about five minutes.
+   */
+  requestLoginNonce(smartAccountAddress: string, options?: PolyesterRequestOptions): Promise<Nonce>;
+  /**
+   * Exchanges a signed login nonce for an authenticated session token and account identity returned by the auth API.
+   */
+  protected loginWithWallet(input: LoginWithWalletInput, options?: PolyesterMutationOptions): Promise<LoginWithWalletResponse>;
+}
+//#endregion
+export { AuthService, AuthServiceTransports, LoginWithWalletInput, LoginWithWalletInputSchema, LoginWithWalletResponse, Me, Nonce };
+//# sourceMappingURL=auth.d.ts.map

package/dist/services/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/services/auth/auth.ts"],"mappings":";;;;;;;;cAaa,4BAA0B,EAAA;;;;;;;;;KAU3B,uBAAuB,EAAE,kBAAkB;UAEtC;EACb,WAAW;EACX,SAAS;;cAGP,UAAQ,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;KAOF,KAAK,EAAE,mBAAmB;cAEhC,+BAA6B,EAAA;;;;;;;;;KAOvB,0BAA0B,EAAE,mBAAmB;cAErD,aAAW,EAAA;;;;;;;KAKL,QAAQ,EAAE,mBAAmB;;;;cAK5B;;EAGT,SAAS;EAEG,YAAA,YAAY,uBAAuB,UAAU;;;;EASnD,GAAG,UAAU,0BAA0B,QAAQ;;;;EAQ/C,kBACF,6BACA,UAAU,0BACX,QAAQ;;;;YAaK,gBACZ,OAAO,sBACP,UAAU,2BACX,QAAQ"}

package/dist/services/auth/auth.js

@@ -0,0 +1,71 @@
+import { AuthService as AuthService$1 } from "../../gen/auth/v1/auth_pb.js";
+import { toConnectCallOptions } from "../../shared/request-options.js";
+import { OptionalPublicIdSchema, PublicIdSchema, TimestampSchema } from "../../shared/schemas.js";
+import { ProfileService } from "./profile/profile.js";
+import { MfaSessionInfoSchema } from "../mfa/mfa.schemas.js";
+import { createClient } from "@connectrpc/connect";
+import * as v from "valibot";
+//#region src/services/auth/auth.ts
+const LoginWithWalletInputSchema = v.strictObject({
+	smartAccountAddress: v.string(),
+	nonce: v.string(),
+	signature: v.string(),
+	userAgent: v.optional(v.string(), ""),
+	ip: v.optional(v.string(), ""),
+	primaryWalletAddress: v.optional(v.string(), ""),
+	walletProvider: v.optional(v.string(), "")
+});
+const MeSchema = v.object({
+	accountId: PublicIdSchema,
+	apiKeyId: OptionalPublicIdSchema,
+	username: v.string(),
+	session: v.optional(MfaSessionInfoSchema)
+});
+const LoginWithWalletResponseSchema = v.object({
+	accessToken: v.string(),
+	expiresAt: v.optional(TimestampSchema),
+	accountId: PublicIdSchema,
+	username: v.string()
+});
+const NonceSchema = v.object({
+	nonce: v.string(),
+	expiresAt: v.optional(TimestampSchema)
+});
+/**
+* Handles wallet-based authentication, caller introspection, and authenticated profile operations.
+*/
+var AuthService = class {
+	#publicClient;
+	#authClient;
+	profile;
+	constructor(transports, realtime) {
+		this.#publicClient = createClient(AuthService$1, transports.publicApi);
+		this.#authClient = createClient(AuthService$1, transports.authApi);
+		this.profile = new ProfileService(transports.authApi, realtime);
+	}
+	/**
+	* Returns the authenticated caller's account context, including account ID, optional API key ID, username, and session assurance details from the presented token or API key.
+	*/
+	async me(options) {
+		const res = await this.#authClient.me({}, toConnectCallOptions(options));
+		return v.parse(MeSchema, res);
+	}
+	/**
+	* Requests a short-lived nonce for the given smart-account EVM address; the nonce is single-purpose, replaced by subsequent requests, and expires after about five minutes.
+	*/
+	async requestLoginNonce(smartAccountAddress, options) {
+		return v.parse(NonceSchema, await this.#publicClient.getNonce({ smartAccountAddress }, toConnectCallOptions(options)));
+	}
+	/**
+	* Exchanges a signed login nonce for an authenticated session token and account identity returned by the auth API.
+	*/
+	async loginWithWallet(input, options) {
+		const validatedInput = v.parse(LoginWithWalletInputSchema, input);
+		const res = await this.#publicClient.loginWithWallet(validatedInput, toConnectCallOptions(options));
+		return v.parse(LoginWithWalletResponseSchema, res);
+	}
+};
+//#endregion
+export { AuthService, LoginWithWalletInputSchema };
+
+//# sourceMappingURL=auth.js.map

package/dist/services/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":["#publicClient","Proto.AuthService","#authClient"],"sources":["../../../src/services/auth/auth.ts"],"sourcesContent":["import { createClient, type Client, type Transport } from \"@connectrpc/connect\";\nimport * as Proto from \"../../gen/auth/v1/auth_pb.js\";\nimport * as v from \"valibot\";\nimport { ProfileService } from \"./profile/profile.js\";\nimport { OptionalPublicIdSchema, PublicIdSchema, TimestampSchema } from \"../../shared/schemas.js\";\nimport {\n    toConnectCallOptions,\n    type PolyesterMutationOptions,\n    type PolyesterRequestOptions,\n} from \"../../shared/request-options.js\";\nimport { MfaSessionInfoSchema } from \"../mfa/mfa.schemas.js\";\nimport type { PolyesterRealtime } from \"../../realtime/index.js\";\n\nexport const LoginWithWalletInputSchema = v.strictObject({\n    smartAccountAddress: v.string(),\n    nonce: v.string(),\n    signature: v.string(),\n    userAgent: v.optional(v.string(), \"\"),\n    ip: v.optional(v.string(), \"\"),\n    primaryWalletAddress: v.optional(v.string(), \"\"),\n    walletProvider: v.optional(v.string(), \"\"),\n});\n\nexport type LoginWithWalletInput = v.InferInput<typeof LoginWithWalletInputSchema>;\n\nexport interface AuthServiceTransports {\n    publicApi: Transport;\n    authApi: Transport;\n}\n\nconst MeSchema = v.object({\n    accountId: PublicIdSchema,\n    apiKeyId: OptionalPublicIdSchema,\n    username: v.string(),\n    session: v.optional(MfaSessionInfoSchema),\n});\n\nexport type Me = v.InferOutput<typeof MeSchema>;\n\nconst LoginWithWalletResponseSchema = v.object({\n    accessToken: v.string(),\n    expiresAt: v.optional(TimestampSchema),\n    accountId: PublicIdSchema,\n    username: v.string(),\n});\n\nexport type LoginWithWalletResponse = v.InferOutput<typeof LoginWithWalletResponseSchema>;\n\nconst NonceSchema = v.object({\n    nonce: v.string(),\n    expiresAt: v.optional(TimestampSchema),\n});\n\nexport type Nonce = v.InferOutput<typeof NonceSchema>;\n\n/**\n * Handles wallet-based authentication, caller introspection, and authenticated profile operations.\n */\nexport class AuthService {\n    #publicClient: Client<typeof Proto.AuthService>;\n    #authClient: Client<typeof Proto.AuthService>;\n    profile: ProfileService;\n\n    constructor(transports: AuthServiceTransports, realtime: PolyesterRealtime) {\n        this.#publicClient = createClient(Proto.AuthService, transports.publicApi);\n        this.#authClient = createClient(Proto.AuthService, transports.authApi);\n        this.profile = new ProfileService(transports.authApi, realtime);\n    }\n\n    /**\n     * Returns the authenticated caller's account context, including account ID, optional API key ID, username, and session assurance details from the presented token or API key.\n     */\n    async me(options?: PolyesterRequestOptions): Promise<Me> {\n        const res = await this.#authClient.me({}, toConnectCallOptions(options));\n        return v.parse(MeSchema, res);\n    }\n\n    /**\n     * Requests a short-lived nonce for the given smart-account EVM address; the nonce is single-purpose, replaced by subsequent requests, and expires after about five minutes.\n     */\n    async requestLoginNonce(\n        smartAccountAddress: string,\n        options?: PolyesterRequestOptions,\n    ): Promise<Nonce> {\n        return v.parse(\n            NonceSchema,\n            await this.#publicClient.getNonce(\n                { smartAccountAddress },\n                toConnectCallOptions(options),\n            ),\n        );\n    }\n\n    /**\n     * Exchanges a signed login nonce for an authenticated session token and account identity returned by the auth API.\n     */\n    protected async loginWithWallet(\n        input: LoginWithWalletInput,\n        options?: PolyesterMutationOptions,\n    ): Promise<LoginWithWalletResponse> {\n        const validatedInput = v.parse(LoginWithWalletInputSchema, input);\n        const res = await this.#publicClient.loginWithWallet(\n            validatedInput,\n            toConnectCallOptions(options),\n        );\n        return v.parse(LoginWithWalletResponseSchema, res);\n    }\n}\n"],"mappings":";;;;;;;;AAaA,MAAa,6BAA6B,EAAE,aAAa;CACrD,qBAAqB,EAAE,OAAO;CAC9B,OAAO,EAAE,OAAO;CAChB,WAAW,EAAE,OAAO;CACpB,WAAW,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CACpC,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CAC7B,sBAAsB,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;CAC/C,gBAAgB,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE;AAC7C,CAAC;AASD,MAAM,WAAW,EAAE,OAAO;CACtB,WAAW;CACX,UAAU;CACV,UAAU,EAAE,OAAO;CACnB,SAAS,EAAE,SAAS,oBAAoB;AAC5C,CAAC;AAID,MAAM,gCAAgC,EAAE,OAAO;CAC3C,aAAa,EAAE,OAAO;CACtB,WAAW,EAAE,SAAS,eAAe;CACrC,WAAW;CACX,UAAU,EAAE,OAAO;AACvB,CAAC;AAID,MAAM,cAAc,EAAE,OAAO;CACzB,OAAO,EAAE,OAAO;CAChB,WAAW,EAAE,SAAS,eAAe;AACzC,CAAC;;;;AAOD,IAAa,cAAb,MAAyB;CACrB;CACA;CACA;CAEA,YAAY,YAAmC,UAA6B;EACxE,KAAKA,gBAAgB,aAAaC,eAAmB,WAAW,SAAS;EACzE,KAAKC,cAAc,aAAaD,eAAmB,WAAW,OAAO;EACrE,KAAK,UAAU,IAAI,eAAe,WAAW,SAAS,QAAQ;CAClE;;;;CAKA,MAAM,GAAG,SAAgD;EACrD,MAAM,MAAM,MAAM,KAAKC,YAAY,GAAG,CAAC,GAAG,qBAAqB,OAAO,CAAC;EACvE,OAAO,EAAE,MAAM,UAAU,GAAG;CAChC;;;;CAKA,MAAM,kBACF,qBACA,SACc;EACd,OAAO,EAAE,MACL,aACA,MAAM,KAAKF,cAAc,SACrB,EAAE,oBAAoB,GACtB,qBAAqB,OAAO,CAChC,CACJ;CACJ;;;;CAKA,MAAgB,gBACZ,OACA,SACgC;EAChC,MAAM,iBAAiB,EAAE,MAAM,4BAA4B,KAAK;EAChE,MAAM,MAAM,MAAM,KAAKA,cAAc,gBACjC,gBACA,qBAAqB,OAAO,CAChC;EACA,OAAO,EAAE,MAAM,+BAA+B,GAAG;CACrD;AACJ"}

package/dist/services/auth/auth.types.d.ts

@@ -0,0 +1,3 @@
+import { LoginWithWalletInput, LoginWithWalletResponse, Me, Nonce } from "./auth.js";
+import { AccountSignerAuthEvents, CreateSubaccountParams, CreateSubaccountResult, LoginOptions, LoginResult } from "./account-signer-auth.js";
+export type { AccountSignerAuthEvents, CreateSubaccountResult as AccountSignerCreateSubaccountResult, CreateSubaccountParams, LoginOptions, LoginResult, LoginWithWalletInput, LoginWithWalletResponse, Me, Nonce };

package/dist/services/auth/cookie-constants.d.ts

@@ -0,0 +1,6 @@
+//#region src/services/auth/cookie-constants.d.ts
+declare const POLYESTER_SESSION_COOKIE_NAME = "polyester_session_3";
+declare const POLYESTER_AUTH_TOKEN_COOKIE_NAME = "polyester_auth_token";
+//#endregion
+export { POLYESTER_AUTH_TOKEN_COOKIE_NAME, POLYESTER_SESSION_COOKIE_NAME };
+//# sourceMappingURL=cookie-constants.d.ts.map

package/dist/services/auth/cookie-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-constants.d.ts","names":[],"sources":["../../../src/services/auth/cookie-constants.ts"],"mappings":";cAGa;cAEA"}

package/dist/services/auth/cookie-constants.js

@@ -0,0 +1,8 @@
+//#region src/services/auth/cookie-constants.ts
+const POLYESTER_SESSION_COOKIE_NAME = "polyester_session_3";
+const POLYESTER_LOGIN_COOKIE_MAX_AGE = 604800;
+const POLYESTER_AUTH_TOKEN_COOKIE_NAME = "polyester_auth_token";
+//#endregion
+export { POLYESTER_AUTH_TOKEN_COOKIE_NAME, POLYESTER_LOGIN_COOKIE_MAX_AGE, POLYESTER_SESSION_COOKIE_NAME };
+
+//# sourceMappingURL=cookie-constants.js.map

package/dist/services/auth/cookie-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-constants.js","names":[],"sources":["../../../src/services/auth/cookie-constants.ts"],"sourcesContent":["// v3: session payload schema added a required environmentFingerprint; bumping\n// the cookie name makes the migration an explicit new cookie instead of a\n// failed parse of the old one (old sessions are simply ignored).\nexport const POLYESTER_SESSION_COOKIE_NAME = \"polyester_session_3\";\nexport const POLYESTER_LOGIN_COOKIE_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\nexport const POLYESTER_AUTH_TOKEN_COOKIE_NAME = \"polyester_auth_token\";\n"],"mappings":";AAGA,MAAa,gCAAgC;AAC7C,MAAa,iCAAiC;AAC9C,MAAa,mCAAmC"}

package/dist/services/auth/profile/profile.d.ts

@@ -0,0 +1,35 @@
+import { PolyesterMutationOptions, PolyesterRequestOptions } from "../../../shared/request-options.js";
+import { PolyesterRealtime } from "../../../realtime/types.js";
+import "../../../realtime/index.js";
+import { BaseSubscribeInput } from "../../../shared/types.js";
+import { AccountIdentity, Profile, UpdateProfileInputSchema, UsernameHistoryEntry } from "./profile.schemas.js";
+import { Transport } from "@connectrpc/connect";
+import * as v from "valibot";
+//#region src/services/auth/profile/profile.d.ts
+interface SubscribeIdentityInput extends BaseSubscribeInput<AccountIdentity> {}
+/**
+ * Manages the authenticated account's public profile and realtime identity updates.
+ */
+declare class ProfileService {
+  #private;
+  constructor(transport: Transport, realtime: PolyesterRealtime);
+  /**
+   * Fetches the caller's public profile, including username eligibility/cooldown, verified social handles, avatar, VIP tier, and account creation timestamp.
+   */
+  get(options?: PolyesterRequestOptions): Promise<Profile>;
+  /**
+   * Updates only the provided mutable profile fields; omitted fields are unchanged, while present empty strings clear optional text fields such as bio, website, Twitter, and avatar URL.
+   */
+  update(input: v.InferInput<typeof UpdateProfileInputSchema>, options?: PolyesterMutationOptions): Promise<Profile>;
+  /**
+   * Returns the caller's recent username changes, newest first, capped at 20 entries.
+   */
+  getUsernameHistory(options?: PolyesterRequestOptions): Promise<UsernameHistoryEntry[]>;
+  /**
+   * Subscribes to public identity updates and emits normalized account identity records with base58 account IDs, username, avatar URL, and root smart-account address.
+   */
+  subscribeIdentity(input: SubscribeIdentityInput): () => void;
+}
+//#endregion
+export { ProfileService };
+//# sourceMappingURL=profile.d.ts.map

package/dist/services/auth/profile/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","names":[],"sources":["../../../../src/services/auth/profile/profile.ts"],"mappings":";;;;;;;;UAqBU,+BAA+B,mBAAmB;;;;cAK/C;;EAIG,YAAA,WAAW,WAAW,UAAU;;;;EAQtC,IAAI,UAAU,0BAA0B,QAAQ;;;;EAShD,OACF,OAAO,EAAE,kBAAkB,2BAC3B,UAAU,2BACX,QAAQ;;;;EAYL,mBAAmB,UAAU,0BAA0B,QAAQ;;;;EAQrE,kBAAkB,OAAO"}