@seams/wallet-server 0.5.0

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -0,0 +1,228 @@
+import { parseMpcMaterialActivationRef, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
+import { json, readJson } from "../../../framework/http.js";
+import { walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
+import { validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs } from "../../../auth/commonRouterUtils.js";
+//#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
+const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
+function parsePreflightRequest(raw) {
+	if (!isPlainObject(raw)) throw new Error("owner execution-lane preflight body is required");
+	const fields = Object.keys(raw).sort();
+	if (fields.length !== 2 || fields[0] !== "curve" || fields[1] !== "expectedMaterialActivation") throw new Error("owner execution-lane preflight body fields are invalid");
+	if (raw.curve !== "ed25519" && raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
+	const materialActivation = parseMpcMaterialActivationRef(raw.expectedMaterialActivation);
+	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
+	return {
+		curve: raw.curve,
+		expectedMaterialActivation: materialActivation.value
+	};
+}
+function serializeMaterialActivation(value) {
+	return {
+		kind: value.kind,
+		activationId: value.activationId,
+		capability: value.capability,
+		materialOwner: value.materialOwner,
+		keyBinding: value.keyBinding,
+		lifecycleBinding: value.lifecycleBinding,
+		signingWorker: value.signingWorker
+	};
+}
+function serializeWalletKeyLifecycle(value) {
+	switch (value.state) {
+		case "active": return {
+			state: value.state,
+			activatedAtMs: value.activatedAtMs
+		};
+		case "retired": return {
+			state: value.state,
+			retiredAtMs: value.retiredAtMs
+		};
+		case "compromised": return {
+			state: value.state,
+			compromisedAtMs: value.compromisedAtMs
+		};
+		default: return value;
+	}
+}
+function serializeWalletKey(value) {
+	switch (value.keyFamily) {
+		case "ed25519": return {
+			kind: value.kind,
+			keyFamily: value.keyFamily,
+			walletId: value.walletId,
+			walletKeyId: value.walletKeyId,
+			walletKeyVersion: value.walletKeyVersion,
+			nearEd25519SigningKeyId: value.nearEd25519SigningKeyId,
+			keyCreationSignerSlot: value.keyCreationSignerSlot,
+			registeredPublicKeyB64u: value.registeredPublicKeyB64u,
+			lifecycle: serializeWalletKeyLifecycle(value.lifecycle)
+		};
+		case "ecdsa_secp256k1": return {
+			kind: value.kind,
+			keyFamily: value.keyFamily,
+			walletId: value.walletId,
+			walletKeyId: value.walletKeyId,
+			walletKeyVersion: value.walletKeyVersion,
+			evmFamilySigningKeySlotId: value.evmFamilySigningKeySlotId,
+			thresholdPublicKey33B64u: value.thresholdPublicKey33B64u,
+			evmAddress: value.evmAddress,
+			lifecycle: serializeWalletKeyLifecycle(value.lifecycle)
+		};
+		default: return value;
+	}
+}
+function serializeSigningLaneLifecycle(value) {
+	switch (value.state) {
+		case "provisioning": return {
+			state: value.state,
+			revocationEpoch: value.revocationEpoch,
+			startedAtMs: value.startedAtMs
+		};
+		case "pending_receipt": return {
+			state: value.state,
+			revocationEpoch: value.revocationEpoch,
+			startedAtMs: value.startedAtMs,
+			deliveryDigestB64u: value.deliveryDigestB64u
+		};
+		case "active": return {
+			state: value.state,
+			revocationEpoch: value.revocationEpoch,
+			activatedAtMs: value.activatedAtMs,
+			activationReceiptDigestB64u: value.activationReceiptDigestB64u
+		};
+		case "revoked": return {
+			state: value.state,
+			revocationEpoch: value.revocationEpoch,
+			revokedAtMs: value.revokedAtMs,
+			revokeReason: value.revokeReason
+		};
+		default: return value;
+	}
+}
+function serializeOwnerContinuity(value) {
+	return {
+		kind: value.kind,
+		signerId: value.signerId,
+		participantIds: value.participantIds,
+		signingWorkerId: value.signingWorkerId,
+		custodyKeyManifestDigestB64u: value.custodyKeyManifestDigestB64u,
+		sourceIdentityDigestB64u: value.sourceIdentityDigestB64u
+	};
+}
+function serializeProjection(value) {
+	const lane = value.lane;
+	switch (lane.laneKind) {
+		case "owner_passkey":
+		case "owner_email_otp": return {
+			kind: value.kind,
+			walletKey: serializeWalletKey(value.walletKey),
+			lane: {
+				kind: lane.kind,
+				walletId: lane.walletId,
+				walletKeyId: lane.walletKeyId,
+				laneId: lane.laneId,
+				laneKind: lane.laneKind,
+				laneShareEpoch: lane.laneShareEpoch,
+				participantBindingDigestB64u: lane.participantBindingDigestB64u,
+				walletAuthMethodId: lane.walletAuthMethodId,
+				ownerParticipantContinuity: serializeOwnerContinuity(lane.ownerParticipantContinuity),
+				lifecycle: serializeSigningLaneLifecycle(lane.lifecycle)
+			},
+			materialActivation: serializeMaterialActivation(value.materialActivation),
+			verifiedActivationReceiptDigestB64u: value.verifiedActivationReceiptDigestB64u
+		};
+		default: return assertNever(lane);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unexpected owner execution-lane value: ${String(value)}`);
+}
+function validationFailure(input) {
+	const status = input.code === "sessions_disabled" ? 501 : walletSessionFailureStatus(input.code);
+	return json({
+		ok: false,
+		code: input.code,
+		message: input.message
+	}, { status });
+}
+async function handleOwnerWalletExecutionLanePreflight(ctx) {
+	if (ctx.method !== "POST" || ctx.pathname !== "/wallet/execution-lane/owner") return null;
+	let request;
+	try {
+		request = parsePreflightRequest(await readJson(ctx.request));
+	} catch (error) {
+		return json({
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : "owner execution-lane preflight body is invalid"
+		}, { status: 400 });
+	}
+	const headers = Object.fromEntries(ctx.request.headers.entries());
+	let walletIdRaw;
+	let authorization;
+	if (request.curve === "ed25519") {
+		const validated = await validateRouterAbEd25519WalletSessionInputs({
+			headers,
+			authorizationSessions: ctx.service.authorizationSessions,
+			operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
+		});
+		if (!validated.ok) return validationFailure(validated);
+		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
+		authorization = {
+			kind: "wallet_auth_method",
+			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
+		};
+	} else {
+		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+			headers,
+			authorizationSessions: ctx.service.authorizationSessions,
+			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
+		});
+		if (!validated.ok) return validationFailure(validated);
+		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
+		authorization = {
+			kind: "wallet_auth_method",
+			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
+		};
+	}
+	const walletId = parseWalletId(walletIdRaw);
+	if (!walletId.ok) return validationFailure({
+		code: WALLET_SESSION_FAILURE_CODES.invalid,
+		message: "Wallet Session wallet identity is invalid"
+	});
+	let resolved;
+	try {
+		resolved = await ctx.service.walletRegistration.resolveActiveOwnerWalletExecutionLane({
+			walletId: walletId.value,
+			expectedMaterialActivation: request.expectedMaterialActivation,
+			authorization
+		});
+	} catch {
+		return json({
+			ok: false,
+			code: "internal",
+			message: "Owner wallet execution-lane preflight failed"
+		}, { status: 500 });
+	}
+	if (resolved.kind === "refused") return json({
+		ok: false,
+		code: "wallet_execution_lane_refused",
+		reason: resolved.reason
+	}, { status: 403 });
+	if (resolved.projection.walletKey.keyFamily !== request.curve) return json({
+		ok: false,
+		code: "wallet_execution_lane_refused",
+		reason: "key_family_mismatch"
+	}, { status: 403 });
+	return json({
+		ok: true,
+		projection: serializeProjection(resolved.projection)
+	}, { status: 200 });
+}
+//#endregion
+export { OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH, handleOwnerWalletExecutionLanePreflight };
+
+//# sourceMappingURL=walletExecutionLanePreflight.js.map

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -0,0 +1,73 @@
+import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
+import { readJson } from "../../../framework/http.js";
+import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
+import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
+import { routerApiWalletRegistrationRouteService } from "../../../framework/authServicePort.js";
+//#region src/router/transport/fetch/routes/walletRegistration.ts
+const ROUTE_IDS = [
+	"wallet_registration_setup",
+	"wallet_registration_respond",
+	"wallet_registration_activate",
+	"wallet_registration_near_provisioning",
+	"wallet_add_signer_intent",
+	"wallet_add_signer_start",
+	"wallet_add_signer_ecdsa_derivation_respond",
+	"wallet_add_signer_ecdsa_activation",
+	"wallet_add_signer_finalize",
+	"wallet_add_auth_method_intent",
+	"wallet_add_auth_method_email_otp_challenge",
+	"wallet_add_auth_method_start",
+	"wallet_add_auth_method_finalize",
+	"wallet_revoke_auth_method",
+	"wallet_ecdsa_key_facts_inventory",
+	"wallet_near_implicit_account_fund"
+];
+function readPathParam(route, pathname, name) {
+	const routeSegments = route.path.split("/").filter(Boolean);
+	const pathSegments = pathname.split("/").filter(Boolean);
+	const index = routeSegments.indexOf(`:${name}`);
+	if (index < 0) return void 0;
+	const segment = pathSegments[index];
+	return segment ? decodeURIComponent(segment) : void 0;
+}
+function resolveWalletRegistrationRoute(ctx) {
+	for (const routeId of ROUTE_IDS) {
+		const route = findRouteDefinitionById(ctx.routeDefinitions, routeId);
+		if (!route) throw new Error(`Missing route definition for ${routeId}`);
+		if (matchesRouteDefinitionRequest(route, ctx.method, ctx.pathname)) return route;
+	}
+	return null;
+}
+async function handleWalletRegistration(ctx) {
+	const route = resolveWalletRegistrationRoute(ctx);
+	if (!route) return null;
+	const common = {
+		body: await readJson(ctx.request),
+		headers: Object.fromEntries(ctx.request.headers.entries()),
+		hostedWalletOrigins: ctx.opts.hostedWalletOrigins ?? [],
+		logger: ctx.logger,
+		origin: String(ctx.request.headers.get("origin") || ctx.request.headers.get("Origin") || "").trim() || void 0,
+		pathParams: {
+			walletId: readPathParam(route, ctx.pathname, "walletId"),
+			walletAuthMethodId: readPathParam(route, ctx.pathname, "walletAuthMethodId")
+		},
+		route,
+		services: {
+			walletRegistration: routerApiWalletRegistrationRouteService(ctx.service),
+			authorizationSessions: ctx.service.authorizationSessions,
+			apiKeyAuth: ctx.opts.apiKeyAuth,
+			orgProjectEnv: ctx.opts.orgProjectEnv,
+			routerAbPublicKeyset: ctx.opts.routerAbPublicKeyset,
+			session: ctx.opts.session,
+			publishableKeyAuth: ctx.opts.publishableKeyAuth,
+			walletProjection: ctx.opts.walletProjection
+		},
+		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0
+	};
+	return toFetchRouteResponse(route.id === "wallet_registration_setup" ? await handleRouterApiWalletRegistrationSetup(common) : route.id === "wallet_registration_respond" ? await handleRouterApiWalletRegistrationRespond(common) : route.id === "wallet_registration_activate" ? await handleRouterApiWalletRegistrationActivate(common) : route.id === "wallet_registration_near_provisioning" ? await handleRouterApiWalletRegistrationNearProvisioning(common) : route.id === "wallet_add_signer_intent" ? await handleRouterApiWalletAddSignerIntent(common) : route.id === "wallet_add_signer_start" ? await handleRouterApiWalletAddSignerStart(common) : route.id === "wallet_add_signer_ecdsa_derivation_respond" ? await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common) : route.id === "wallet_add_signer_ecdsa_activation" ? await handleRouterApiWalletAddSignerEcdsaActivation(common) : route.id === "wallet_add_signer_finalize" ? await handleRouterApiWalletAddSignerFinalize(common) : route.id === "wallet_add_auth_method_intent" ? await handleRouterApiWalletAddAuthMethodIntent(common) : route.id === "wallet_add_auth_method_email_otp_challenge" ? await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common) : route.id === "wallet_add_auth_method_start" ? await handleRouterApiWalletAddAuthMethodStart(common) : route.id === "wallet_add_auth_method_finalize" ? await handleRouterApiWalletAddAuthMethodFinalize(common) : route.id === "wallet_revoke_auth_method" ? await handleRouterApiWalletRevokeAuthMethod(common) : route.id === "wallet_ecdsa_key_facts_inventory" ? await handleRouterApiWalletEcdsaKeyFactsInventory(common) : await handleRouterApiWalletNearImplicitAccountFund(common));
+}
+//#endregion
+export { handleWalletRegistration };
+
+//# sourceMappingURL=walletRegistration.js.map

package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js

@@ -0,0 +1,43 @@
+import { json } from "../../../framework/http.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+//#region src/router/transport/fetch/routes/webauthnAuthenticators.ts
+async function handleWebAuthnAuthenticators(ctx) {
+	if (ctx.method !== "GET") return null;
+	if (ctx.pathname !== "/webauthn/authenticators") return null;
+	try {
+		const token = extractBearerCredential(ctx.request.headers);
+		if (!token) return json({
+			ok: false,
+			code: "unauthorized",
+			message: "No valid Wallet Session"
+		}, { status: 401 });
+		const nowMs = Date.now();
+		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: ctx.service.authorizationSessions.tenantId,
+			token,
+			nowMs
+		});
+		if (!exact) return json({
+			ok: false,
+			code: "unauthorized",
+			message: "No valid Wallet Session"
+		}, { status: 401 });
+		const rpIdFromQuery = String(ctx.url.searchParams.get("rpId") || ctx.url.searchParams.get("rp_id") || "").trim();
+		const result = await ctx.service.webAuthn.listWebAuthnAuthenticatorsForUser({
+			userId: String(exact.authorization.session.walletId),
+			...rpIdFromQuery ? { rpId: rpIdFromQuery } : {}
+		});
+		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
+		return json(result, { status: 200 });
+	} catch (e) {
+		return json({
+			ok: false,
+			code: "internal",
+			message: e?.message || "Internal error"
+		}, { status: 500 });
+	}
+}
+//#endregion
+export { handleWebAuthnAuthenticators };
+
+//# sourceMappingURL=webauthnAuthenticators.js.map

package/dist/esm/router/transport/fetch/routes/wellKnown.js

@@ -0,0 +1,48 @@
+import "../../../../shared-ts/src/utils/routerAbPublicKeyset.js";
+import { json } from "../../../framework/http.js";
+import { normalizeRorHost, resolveWellKnownSigningSessionSealCapabilities, sanitizeRorOrigins } from "../../../framework/ror/normalize.js";
+import { resolveRorRpId } from "../../../framework/ror/provider.js";
+//#region src/router/transport/fetch/routes/wellKnown.ts
+async function handleWellKnown(ctx) {
+	if (ctx.method !== "GET") return null;
+	if (ctx.pathname === "/.well-known/router-ab/keyset" || ctx.pathname === `/.well-known/router-ab/keyset/` || ctx.pathname === "/router-ab/keyset" || ctx.pathname === `/router-ab/keyset/`) {
+		const keyset = ctx.opts.routerAbPublicKeyset;
+		if (!keyset) return json({
+			ok: false,
+			code: "router_ab_public_keyset_not_configured",
+			message: "Router A/B public keyset is not configured"
+		}, {
+			status: 404,
+			headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
+		});
+		return json(keyset, {
+			status: 200,
+			headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
+		});
+	}
+	if (ctx.pathname !== "/.well-known/webauthn" && ctx.pathname !== "/.well-known/webauthn/") return null;
+	let origins = [];
+	const signingSessionSeal = resolveWellKnownSigningSessionSealCapabilities(ctx.opts.signingSessionSeal);
+	try {
+		const host = normalizeRorHost(ctx.request.headers.get("x-forwarded-host") || ctx.request.headers.get("host") || ctx.url.hostname);
+		const rpId = resolveRorRpId({
+			ror: ctx.opts.ror,
+			host: host || void 0
+		});
+		origins = rpId && ctx.opts.ror ? sanitizeRorOrigins(await ctx.opts.ror.provider.getAllowedOrigins({
+			rpId,
+			...host ? { host } : {}
+		})) : [];
+	} catch {}
+	return json({
+		origins,
+		capabilities: { signingSessionSeal }
+	}, {
+		status: 200,
+		headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
+	});
+}
+//#endregion
+export { handleWellKnown };
+
+//# sourceMappingURL=wellKnown.js.map

package/dist/esm/shared-ts/src/authorization/capabilityKinds.js

@@ -0,0 +1,224 @@
+import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
+//#region ../shared-ts/src/authorization/capabilityKinds.ts
+const CAPABILITY_KINDS = {
+	vaultAccess: "vault_access",
+	nearEd25519MpcSigning: "near_ed25519_mpc_signing",
+	evmEcdsaMpcSigning: "evm_ecdsa_mpc_signing"
+};
+const VAULT_OPERATION_KINDS = {
+	proxyUse: "vault.proxy_use",
+	reveal: "vault.reveal"
+};
+const NEAR_ED25519_MPC_OPERATION_KINDS = {
+	signTransaction: "near.sign_transaction",
+	signDelegateAction: "near.sign_delegate_action",
+	signNep413Message: "near.sign_nep413_message",
+	exportKey: "near.export_key"
+};
+const EVM_ECDSA_MPC_OPERATION_KINDS = {
+	signTransaction: "evm.sign_transaction",
+	exportKey: "evm.export_key"
+};
+const AUTHORIZATION_EVIDENCE_KINDS = {
+	seamsSession: "seams_session",
+	passkeyAssertion: "passkey_assertion",
+	emailOtp: "email_otp"
+};
+const AUTHORIZATION_GRANT_KINDS = { walletSession: "wallet_session_authorization" };
+const CAPABILITY_KIND_VALUES = Object.values(CAPABILITY_KINDS);
+const VAULT_OPERATION_KIND_VALUES = Object.values(VAULT_OPERATION_KINDS);
+const NEAR_ED25519_MPC_OPERATION_KIND_VALUES = Object.values(NEAR_ED25519_MPC_OPERATION_KINDS);
+const EVM_ECDSA_MPC_OPERATION_KIND_VALUES = Object.values(EVM_ECDSA_MPC_OPERATION_KINDS);
+const AUTHORIZATION_EVIDENCE_KIND_VALUES = Object.values(AUTHORIZATION_EVIDENCE_KINDS);
+function isCapabilityKind(value) {
+	return typeof value === "string" && CAPABILITY_KIND_VALUES.includes(value);
+}
+function isAuthorizationEvidenceKind(value) {
+	return typeof value === "string" && AUTHORIZATION_EVIDENCE_KIND_VALUES.includes(value);
+}
+function buildVaultOperationRef(operationKind) {
+	return {
+		capabilityKind: CAPABILITY_KINDS.vaultAccess,
+		operationKind
+	};
+}
+function buildNearEd25519MpcOperationRef(operationKind) {
+	return {
+		capabilityKind: CAPABILITY_KINDS.nearEd25519MpcSigning,
+		operationKind
+	};
+}
+function buildEvmEcdsaMpcOperationRef(operationKind) {
+	return {
+		capabilityKind: CAPABILITY_KINDS.evmEcdsaMpcSigning,
+		operationKind
+	};
+}
+function parseCapabilityOperationRef(value) {
+	if (!isExactOperationRefRecord(value)) return invalidResult("capability operation must contain exact capabilityKind and operationKind");
+	switch (value.capabilityKind) {
+		case CAPABILITY_KINDS.vaultAccess:
+			if (isVaultOperationKind(value.operationKind)) return {
+				ok: true,
+				value: buildVaultOperationRef(value.operationKind)
+			};
+			return invalidResult("vault capability operation is unsupported");
+		case CAPABILITY_KINDS.nearEd25519MpcSigning:
+			if (isNearEd25519MpcOperationKind(value.operationKind)) return {
+				ok: true,
+				value: buildNearEd25519MpcOperationRef(value.operationKind)
+			};
+			return invalidResult("NEAR Ed25519 MPC capability operation is unsupported");
+		case CAPABILITY_KINDS.evmEcdsaMpcSigning:
+			if (isEvmEcdsaMpcOperationKind(value.operationKind)) return {
+				ok: true,
+				value: buildEvmEcdsaMpcOperationRef(value.operationKind)
+			};
+			return invalidResult("EVM ECDSA MPC capability operation is unsupported");
+	}
+	return invalidResult("capability kind is unsupported");
+}
+function buildAuthorizationEvidenceRequirement(input) {
+	const [firstKind, ...remainingKinds] = [...new Set(input.evidenceKinds)].sort();
+	if (!firstKind) throw new Error("authorization evidence requirement must contain at least one evidence kind");
+	return {
+		mode: input.mode,
+		evidenceKinds: [firstKind, ...remainingKinds]
+	};
+}
+function parseTenantId(value) {
+	return parseAuthorizationId(value, "tenantId");
+}
+function parsePrincipalId(value) {
+	return parseAuthorizationId(value, "principalId");
+}
+function parseEcdsaAuthorizationSessionId(value) {
+	return parseAuthorizationId(value, "ecdsaAuthorizationSessionId");
+}
+function parseHostedWalletSessionExchangeCodeId(value) {
+	return parseAuthorizationId(value, "hostedWalletSessionExchangeCodeId");
+}
+function parseDeviceId(value) {
+	return parseAuthorizationId(value, "deviceId");
+}
+function parseAuthFactorId(value) {
+	return parseAuthorizationId(value, "authFactorId");
+}
+function parseCapabilityId(value) {
+	return parseAuthorizationId(value, "capabilityId");
+}
+function parseCapabilityOperationId(value) {
+	return parseAuthorizationId(value, "capabilityOperationId");
+}
+function parseAuthorizationGrantRef(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return invalidResult("authorizationGrantRef must be an object");
+	const record = value;
+	const keys = Object.keys(record);
+	if (keys.length !== 2 || !keys.includes("kind") || !keys.includes("authorizationId")) return invalidResult("authorizationGrantRef contains unexpected fields");
+	switch (record.kind) {
+		case AUTHORIZATION_GRANT_KINDS.walletSession: {
+			const authorizationId = parseWalletSessionAuthorizationId(record.authorizationId);
+			if (!authorizationId.ok) return authorizationId;
+			return {
+				ok: true,
+				value: {
+					kind: AUTHORIZATION_GRANT_KINDS.walletSession,
+					authorizationId: authorizationId.value
+				}
+			};
+		}
+		default: return invalidResult("authorizationGrantRef.kind is unsupported");
+	}
+}
+function buildAuthorizationGrantRef(authorizationId) {
+	return {
+		kind: AUTHORIZATION_GRANT_KINDS.walletSession,
+		authorizationId
+	};
+}
+function parseWalletSessionAuthorizationId(value) {
+	return parseAuthorizationId(value, "walletSessionAuthorizationId");
+}
+function parseAuthorizedOperationId(value) {
+	return parseAuthorizationId(value, "authorizedOperationId");
+}
+function parseWalletSessionId(value) {
+	return parseAuthorizationId(value, "walletSessionId");
+}
+function parseMpcWalletSigningQuotaId(value) {
+	return parseAuthorizationId(value, "mpcWalletSigningQuotaId");
+}
+function parseWalletSessionMintId(value) {
+	return parseAuthorizationId(value, "walletSessionMintId");
+}
+function parseAuthorizationEvidenceId(value) {
+	return parseAuthorizationId(value, "authorizationEvidenceId");
+}
+function parseAuthorizationEvidenceSetId(value) {
+	return parseAuthorizationId(value, "authorizationEvidenceSetId");
+}
+function parseAuthorizationAuditEventId(value) {
+	return parseAuthorizationId(value, "authorizationAuditEventId");
+}
+function parseVaultId(value) {
+	return parseAuthorizationId(value, "vaultId");
+}
+function parseVaultItemId(value) {
+	return parseAuthorizationId(value, "vaultItemId");
+}
+function isVaultOperationKind(value) {
+	return typeof value === "string" && VAULT_OPERATION_KIND_VALUES.includes(value);
+}
+function isNearEd25519MpcOperationKind(value) {
+	return typeof value === "string" && NEAR_ED25519_MPC_OPERATION_KIND_VALUES.includes(value);
+}
+function isEvmEcdsaMpcOperationKind(value) {
+	return typeof value === "string" && EVM_ECDSA_MPC_OPERATION_KIND_VALUES.includes(value);
+}
+function isExactOperationRefRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 2 || !keys.includes("capabilityKind") || !keys.includes("operationKind")) return false;
+	return isCapabilityKind(value.capabilityKind);
+}
+function parseAuthorizationId(value, fieldName) {
+	if (typeof value !== "string") return {
+		ok: false,
+		error: {
+			code: value == null ? "missing" : "invalid",
+			message: `${fieldName} must be a nonempty string`
+		}
+	};
+	const normalized = value.trim();
+	if (!normalized) return {
+		ok: false,
+		error: {
+			code: "missing",
+			message: `${fieldName} is required`
+		}
+	};
+	if (normalized.length > 512 || hasWhitespaceOrControlCharacters(normalized)) return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: `${fieldName} must be a compact opaque identifier`
+		}
+	};
+	return {
+		ok: true,
+		value: normalized
+	};
+}
+function invalidResult(message) {
+	return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message
+		}
+	};
+}
+//#endregion
+export { AUTHORIZATION_EVIDENCE_KINDS, AUTHORIZATION_GRANT_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildAuthorizationEvidenceRequirement, buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, isAuthorizationEvidenceKind, isCapabilityKind, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseDeviceId, parseEcdsaAuthorizationSessionId, parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
+
+//# sourceMappingURL=capabilityKinds.js.map