@seams/wallet-server 0.5.0

package/dist/esm/wasm/shamir3pass_runtime/pkg/shamir3pass_runtime.js

@@ -0,0 +1,393 @@
+//#region ../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime.js
+function init_shamir3pass_runtime() {
+	wasm.init_shamir3pass_runtime();
+}
+/**
+* @param {number} handle
+* @param {string} ciphertext_b64u
+* @returns {string}
+*/
+function shamir3pass_add_lock(handle, ciphertext_b64u) {
+	let deferred3_0;
+	let deferred3_1;
+	try {
+		_assertNum(handle);
+		const ptr0 = passStringToWasm0(ciphertext_b64u, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+		const len0 = WASM_VECTOR_LEN;
+		const ret = wasm.shamir3pass_add_lock(handle, ptr0, len0);
+		var ptr2 = ret[0];
+		var len2 = ret[1];
+		if (ret[3]) {
+			ptr2 = 0;
+			len2 = 0;
+			throw takeFromExternrefTable0(ret[2]);
+		}
+		deferred3_0 = ptr2;
+		deferred3_1 = len2;
+		return getStringFromWasm0(ptr2, len2);
+	} finally {
+		wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+	}
+}
+/**
+* @param {string} group_id
+* @param {Uint8Array} root_secret
+* @param {Uint8Array} context
+* @returns {number}
+*/
+function shamir3pass_derive_lock_key_handle(group_id, root_secret, context) {
+	const ptr0 = passStringToWasm0(group_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+	const len0 = WASM_VECTOR_LEN;
+	const ptr1 = passArray8ToWasm0(root_secret, wasm.__wbindgen_malloc);
+	const len1 = WASM_VECTOR_LEN;
+	const ptr2 = passArray8ToWasm0(context, wasm.__wbindgen_malloc);
+	const len2 = WASM_VECTOR_LEN;
+	const ret = wasm.shamir3pass_derive_lock_key_handle(ptr0, len0, ptr1, len1, ptr2, len2);
+	if (ret[2]) throw takeFromExternrefTable0(ret[1]);
+	return ret[0] >>> 0;
+}
+/**
+* @param {number} handle
+* @returns {boolean}
+*/
+function shamir3pass_destroy_lock_key_handle(handle) {
+	_assertNum(handle);
+	return wasm.shamir3pass_destroy_lock_key_handle(handle) !== 0;
+}
+/**
+* @param {number} handle
+* @param {string} ciphertext_b64u
+* @returns {string}
+*/
+function shamir3pass_remove_lock(handle, ciphertext_b64u) {
+	let deferred3_0;
+	let deferred3_1;
+	try {
+		_assertNum(handle);
+		const ptr0 = passStringToWasm0(ciphertext_b64u, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+		const len0 = WASM_VECTOR_LEN;
+		const ret = wasm.shamir3pass_remove_lock(handle, ptr0, len0);
+		var ptr2 = ret[0];
+		var len2 = ret[1];
+		if (ret[3]) {
+			ptr2 = 0;
+			len2 = 0;
+			throw takeFromExternrefTable0(ret[2]);
+		}
+		deferred3_0 = ptr2;
+		deferred3_1 = len2;
+		return getStringFromWasm0(ptr2, len2);
+	} finally {
+		wasm.__wbindgen_free(deferred3_0, deferred3_1, 1);
+	}
+}
+function __wbg_get_imports() {
+	const import0 = {
+		__proto__: null,
+		__wbg___wbindgen_is_function_d633e708baf0d146: function(arg0) {
+			const ret = typeof arg0 === "function";
+			_assertBoolean(ret);
+			return ret;
+		},
+		__wbg___wbindgen_is_object_4b3de556756ee8a8: function(arg0) {
+			const val = arg0;
+			const ret = typeof val === "object" && val !== null;
+			_assertBoolean(ret);
+			return ret;
+		},
+		__wbg___wbindgen_is_string_7debe47dc1e045c2: function(arg0) {
+			const ret = typeof arg0 === "string";
+			_assertBoolean(ret);
+			return ret;
+		},
+		__wbg___wbindgen_is_undefined_c18285b9fc34cb7d: function(arg0) {
+			const ret = arg0 === void 0;
+			_assertBoolean(ret);
+			return ret;
+		},
+		__wbg___wbindgen_throw_39bc967c0e5a9b58: function(arg0, arg1) {
+			throw new Error(getStringFromWasm0(arg0, arg1));
+		},
+		__wbg_call_08ad0d89caa7cb79: function() {
+			return handleError(function(arg0, arg1, arg2) {
+				return arg0.call(arg1, arg2);
+			}, arguments);
+		},
+		__wbg_crypto_38df2bab126b63dc: function() {
+			return logError(function(arg0) {
+				return arg0.crypto;
+			}, arguments);
+		},
+		__wbg_getRandomValues_c44a50d8cfdaebeb: function() {
+			return handleError(function(arg0, arg1) {
+				arg0.getRandomValues(arg1);
+			}, arguments);
+		},
+		__wbg_length_5855c1f289dfffc1: function() {
+			return logError(function(arg0) {
+				const ret = arg0.length;
+				_assertNum(ret);
+				return ret;
+			}, arguments);
+		},
+		__wbg_msCrypto_bd5a034af96bcba6: function() {
+			return logError(function(arg0) {
+				return arg0.msCrypto;
+			}, arguments);
+		},
+		__wbg_new_with_length_c8449d782396d344: function() {
+			return logError(function(arg0) {
+				return new Uint8Array(arg0 >>> 0);
+			}, arguments);
+		},
+		__wbg_node_84ea875411254db1: function() {
+			return logError(function(arg0) {
+				return arg0.node;
+			}, arguments);
+		},
+		__wbg_process_44c7a14e11e9f69e: function() {
+			return logError(function(arg0) {
+				return arg0.process;
+			}, arguments);
+		},
+		__wbg_prototypesetcall_f034d444741426c3: function() {
+			return logError(function(arg0, arg1, arg2) {
+				Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
+			}, arguments);
+		},
+		__wbg_randomFillSync_6c25eac9869eb53c: function() {
+			return handleError(function(arg0, arg1) {
+				arg0.randomFillSync(arg1);
+			}, arguments);
+		},
+		__wbg_require_b4edbdcf3e2a1ef0: function() {
+			return handleError(function() {
+				return module.require;
+			}, arguments);
+		},
+		__wbg_static_accessor_GLOBAL_THIS_14325d8cca34bb77: function() {
+			return logError(function() {
+				const ret = typeof globalThis === "undefined" ? null : globalThis;
+				return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
+			}, arguments);
+		},
+		__wbg_static_accessor_GLOBAL_f3a1e69f9c5a7e8e: function() {
+			return logError(function() {
+				const ret = typeof global === "undefined" ? null : global;
+				return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
+			}, arguments);
+		},
+		__wbg_static_accessor_SELF_50cdb5b517789aca: function() {
+			return logError(function() {
+				const ret = typeof self === "undefined" ? null : self;
+				return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
+			}, arguments);
+		},
+		__wbg_static_accessor_WINDOW_d6c4126e4c244380: function() {
+			return logError(function() {
+				const ret = typeof window === "undefined" ? null : window;
+				return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
+			}, arguments);
+		},
+		__wbg_subarray_7ad5f01d4a9c1c4d: function() {
+			return logError(function(arg0, arg1, arg2) {
+				return arg0.subarray(arg1 >>> 0, arg2 >>> 0);
+			}, arguments);
+		},
+		__wbg_versions_276b2795b1c6a219: function() {
+			return logError(function(arg0) {
+				return arg0.versions;
+			}, arguments);
+		},
+		__wbindgen_cast_0000000000000001: function() {
+			return logError(function(arg0, arg1) {
+				return getArrayU8FromWasm0(arg0, arg1);
+			}, arguments);
+		},
+		__wbindgen_cast_0000000000000002: function() {
+			return logError(function(arg0, arg1) {
+				return getStringFromWasm0(arg0, arg1);
+			}, arguments);
+		},
+		__wbindgen_init_externref_table: function() {
+			const table = wasm.__wbindgen_externrefs;
+			const offset = table.grow(4);
+			table.set(0, void 0);
+			table.set(offset + 0, void 0);
+			table.set(offset + 1, null);
+			table.set(offset + 2, true);
+			table.set(offset + 3, false);
+		}
+	};
+	return {
+		__proto__: null,
+		"./shamir3pass_runtime_bg.js": import0
+	};
+}
+function addToExternrefTable0(obj) {
+	const idx = wasm.__externref_table_alloc();
+	wasm.__wbindgen_externrefs.set(idx, obj);
+	return idx;
+}
+function _assertBoolean(n) {
+	if (typeof n !== "boolean") throw new Error(`expected a boolean argument, found ${typeof n}`);
+}
+function _assertNum(n) {
+	if (typeof n !== "number") throw new Error(`expected a number argument, found ${typeof n}`);
+}
+function getArrayU8FromWasm0(ptr, len) {
+	ptr = ptr >>> 0;
+	return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+function getStringFromWasm0(ptr, len) {
+	ptr = ptr >>> 0;
+	return decodeText(ptr, len);
+}
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+	if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+	return cachedUint8ArrayMemory0;
+}
+function handleError(f, args) {
+	try {
+		return f.apply(this, args);
+	} catch (e) {
+		const idx = addToExternrefTable0(e);
+		wasm.__wbindgen_exn_store(idx);
+	}
+}
+function isLikeNone(x) {
+	return x === void 0 || x === null;
+}
+function logError(f, args) {
+	try {
+		return f.apply(this, args);
+	} catch (e) {
+		let error = function() {
+			try {
+				return e instanceof Error ? `${e.message}\n\nStack:\n${e.stack}` : e.toString();
+			} catch (_) {
+				return "<failed to stringify thrown value>";
+			}
+		}();
+		console.error("wasm-bindgen: imported JS function that was not marked as `catch` threw an error:", error);
+		throw e;
+	}
+}
+function passArray8ToWasm0(arg, malloc) {
+	const ptr = malloc(arg.length * 1, 1) >>> 0;
+	getUint8ArrayMemory0().set(arg, ptr / 1);
+	WASM_VECTOR_LEN = arg.length;
+	return ptr;
+}
+function passStringToWasm0(arg, malloc, realloc) {
+	if (typeof arg !== "string") throw new Error(`expected a string argument, found ${typeof arg}`);
+	if (realloc === void 0) {
+		const buf = cachedTextEncoder.encode(arg);
+		const ptr = malloc(buf.length, 1) >>> 0;
+		getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+		WASM_VECTOR_LEN = buf.length;
+		return ptr;
+	}
+	let len = arg.length;
+	let ptr = malloc(len, 1) >>> 0;
+	const mem = getUint8ArrayMemory0();
+	let offset = 0;
+	for (; offset < len; offset++) {
+		const code = arg.charCodeAt(offset);
+		if (code > 127) break;
+		mem[ptr + offset] = code;
+	}
+	if (offset !== len) {
+		if (offset !== 0) arg = arg.slice(offset);
+		ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+		const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+		const ret = cachedTextEncoder.encodeInto(arg, view);
+		if (ret.read !== arg.length) throw new Error("failed to pass whole string");
+		offset += ret.written;
+		ptr = realloc(ptr, len, offset, 1) >>> 0;
+	}
+	WASM_VECTOR_LEN = offset;
+	return ptr;
+}
+function takeFromExternrefTable0(idx) {
+	const value = wasm.__wbindgen_externrefs.get(idx);
+	wasm.__externref_table_dealloc(idx);
+	return value;
+}
+let cachedTextDecoder = new TextDecoder("utf-8", {
+	ignoreBOM: true,
+	fatal: true
+});
+cachedTextDecoder.decode();
+const MAX_SAFARI_DECODE_BYTES = 2146435072;
+let numBytesDecoded = 0;
+function decodeText(ptr, len) {
+	numBytesDecoded += len;
+	if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+		cachedTextDecoder = new TextDecoder("utf-8", {
+			ignoreBOM: true,
+			fatal: true
+		});
+		cachedTextDecoder.decode();
+		numBytesDecoded = len;
+	}
+	return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+const cachedTextEncoder = new TextEncoder();
+if (!("encodeInto" in cachedTextEncoder)) cachedTextEncoder.encodeInto = function(arg, view) {
+	const buf = cachedTextEncoder.encode(arg);
+	view.set(buf);
+	return {
+		read: arg.length,
+		written: buf.length
+	};
+};
+let WASM_VECTOR_LEN = 0, wasm;
+function __wbg_finalize_init(instance, module) {
+	wasm = instance.exports;
+	cachedUint8ArrayMemory0 = null;
+	wasm.__wbindgen_start();
+	return wasm;
+}
+async function __wbg_load(module, imports) {
+	if (typeof Response === "function" && module instanceof Response) {
+		if (typeof WebAssembly.instantiateStreaming === "function") try {
+			return await WebAssembly.instantiateStreaming(module, imports);
+		} catch (e) {
+			if (module.ok && expectedResponseType(module.type) && module.headers.get("Content-Type") !== "application/wasm") console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
+			else throw e;
+		}
+		const bytes = await module.arrayBuffer();
+		return await WebAssembly.instantiate(bytes, imports);
+	} else {
+		const instance = await WebAssembly.instantiate(module, imports);
+		if (instance instanceof WebAssembly.Instance) return {
+			instance,
+			module
+		};
+		else return instance;
+	}
+	function expectedResponseType(type) {
+		switch (type) {
+			case "basic":
+			case "cors":
+			case "default": return true;
+		}
+		return false;
+	}
+}
+async function __wbg_init(module_or_path) {
+	if (wasm !== void 0) return wasm;
+	if (module_or_path !== void 0) if (Object.getPrototypeOf(module_or_path) === Object.prototype) ({module_or_path} = module_or_path);
+	else console.warn("using deprecated parameters for the initialization function; pass a single object instead");
+	if (module_or_path === void 0) module_or_path = new URL("shamir3pass_runtime_bg.wasm", import.meta.url);
+	const imports = __wbg_get_imports();
+	if (typeof module_or_path === "string" || typeof Request === "function" && module_or_path instanceof Request || typeof URL === "function" && module_or_path instanceof URL) module_or_path = fetch(module_or_path);
+	const { instance, module } = await __wbg_load(await module_or_path, imports);
+	return __wbg_finalize_init(instance, module);
+}
+//#endregion
+export { __wbg_init, init_shamir3pass_runtime, shamir3pass_add_lock, shamir3pass_derive_lock_key_handle, shamir3pass_destroy_lock_key_handle, shamir3pass_remove_lock };
+
+//# sourceMappingURL=shamir3pass_runtime.js.map

package/dist/esm/wasm/signer.js

@@ -0,0 +1,2 @@
+import wasm_signer_worker_bg_default from "./near_signer/pkg/wasm_signer_worker_bg.wasm";
+export { wasm_signer_worker_bg_default as default };

package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts

@@ -0,0 +1,147 @@
+import type { DomainId } from '../utils/domainIds';
+export type AuthorizationParseError = {
+    readonly code: 'missing' | 'invalid';
+    readonly message: string;
+};
+export type AuthorizationParseResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: AuthorizationParseError;
+};
+export declare const CAPABILITY_KINDS: {
+    readonly vaultAccess: "vault_access";
+    readonly nearEd25519MpcSigning: "near_ed25519_mpc_signing";
+    readonly evmEcdsaMpcSigning: "evm_ecdsa_mpc_signing";
+};
+export type CapabilityKind = (typeof CAPABILITY_KINDS)[keyof typeof CAPABILITY_KINDS];
+export declare const VAULT_OPERATION_KINDS: {
+    readonly proxyUse: "vault.proxy_use";
+    readonly reveal: "vault.reveal";
+};
+export type VaultOperationKind = (typeof VAULT_OPERATION_KINDS)[keyof typeof VAULT_OPERATION_KINDS];
+export declare const NEAR_ED25519_MPC_OPERATION_KINDS: {
+    readonly signTransaction: "near.sign_transaction";
+    readonly signDelegateAction: "near.sign_delegate_action";
+    readonly signNep413Message: "near.sign_nep413_message";
+    readonly exportKey: "near.export_key";
+};
+export type NearEd25519MpcOperationKind = (typeof NEAR_ED25519_MPC_OPERATION_KINDS)[keyof typeof NEAR_ED25519_MPC_OPERATION_KINDS];
+export declare const EVM_ECDSA_MPC_OPERATION_KINDS: {
+    readonly signTransaction: "evm.sign_transaction";
+    readonly exportKey: "evm.export_key";
+};
+export type EvmEcdsaMpcOperationKind = (typeof EVM_ECDSA_MPC_OPERATION_KINDS)[keyof typeof EVM_ECDSA_MPC_OPERATION_KINDS];
+export type CapabilityOperationKind = VaultOperationKind | NearEd25519MpcOperationKind | EvmEcdsaMpcOperationKind;
+export type CapabilityOperationKindByCapability = {
+    readonly vault_access: VaultOperationKind;
+    readonly near_ed25519_mpc_signing: NearEd25519MpcOperationKind;
+    readonly evm_ecdsa_mpc_signing: EvmEcdsaMpcOperationKind;
+};
+export type CapabilityOperationRef = {
+    [K in CapabilityKind]: {
+        readonly capabilityKind: K;
+        readonly operationKind: CapabilityOperationKindByCapability[K];
+    };
+}[CapabilityKind];
+export declare const AUTH_FACTOR_KINDS: {
+    readonly passkey: "passkey";
+    readonly emailOtp: "email_otp";
+};
+export type AuthFactorKind = (typeof AUTH_FACTOR_KINDS)[keyof typeof AUTH_FACTOR_KINDS];
+export declare const AUTHORIZATION_EVIDENCE_KINDS: {
+    readonly seamsSession: "seams_session";
+    readonly passkeyAssertion: "passkey_assertion";
+    readonly emailOtp: "email_otp";
+};
+export type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
+export type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;
+export type AuthorizationEvidenceKind = SessionAuthorizationEvidenceKind | InteractiveAuthorizationEvidenceKind;
+export type AuthorizationEvidenceRequirement = {
+    readonly mode: 'all' | 'any';
+    readonly evidenceKinds: readonly [AuthorizationEvidenceKind, ...AuthorizationEvidenceKind[]];
+};
+export type TenantId = DomainId<'TenantId'>;
+export type PrincipalId = DomainId<'PrincipalId'>;
+export type EcdsaAuthorizationSessionId = DomainId<'EcdsaAuthorizationSessionId'>;
+export type SeamsSession = DomainId<'SeamsSession'>;
+export type HostedWalletSessionExchangeCodeId = DomainId<'HostedWalletSessionExchangeCodeId'>;
+export type SessionClientId = DomainId<'SessionClientId'>;
+export type DeviceId = DomainId<'DeviceId'>;
+export type AuthFactorId = DomainId<'AuthFactorId'>;
+export type CapabilityId = DomainId<'CapabilityId'>;
+export type CapabilityBindingId = DomainId<'CapabilityBindingId'>;
+export type CapabilityOperationId = DomainId<'CapabilityOperationId'>;
+export type WalletSessionAuthorizationId = DomainId<'WalletSessionAuthorizationId'>;
+export declare const AUTHORIZATION_GRANT_KINDS: {
+    readonly walletSession: "wallet_session_authorization";
+};
+export type AuthorizationGrantKind = (typeof AUTHORIZATION_GRANT_KINDS)[keyof typeof AUTHORIZATION_GRANT_KINDS];
+export type WalletSessionAuthorizationRef = {
+    readonly kind: 'wallet_session_authorization';
+    readonly authorizationId: WalletSessionAuthorizationId;
+};
+/** Each authorization grant carries exactly one Wallet Session authorization identity. */
+export type AuthorizationGrantRef = WalletSessionAuthorizationRef;
+export type AuthorizedOperationId = DomainId<'AuthorizedOperationId'>;
+export type WalletSessionId = DomainId<'WalletSessionId'>;
+export type MpcWalletSigningQuotaId = DomainId<'MpcWalletSigningQuotaId'>;
+export type WalletSessionMintId = DomainId<'WalletSessionMintId'>;
+export type AuthorizationEvidenceId = DomainId<'AuthorizationEvidenceId'>;
+export type AuthorizationEvidenceSetId = DomainId<'AuthorizationEvidenceSetId'>;
+export type GrantChallengeId = DomainId<'GrantChallengeId'>;
+export type PolicyId = DomainId<'PolicyId'>;
+export type AuthorizationAuditEventId = DomainId<'AuthorizationAuditEventId'>;
+export type VaultId = DomainId<'VaultId'>;
+export type VaultItemId = DomainId<'VaultItemId'>;
+export type CapabilityOperationResultStorageRef = DomainId<'CapabilityOperationResultStorageRef'>;
+export declare function isCapabilityKind(value: unknown): value is CapabilityKind;
+export declare function isAuthorizationEvidenceKind(value: unknown): value is AuthorizationEvidenceKind;
+export declare function buildVaultOperationRef<TOperationKind extends VaultOperationKind>(operationKind: TOperationKind): Extract<CapabilityOperationRef, {
+    readonly capabilityKind: 'vault_access';
+}> & {
+    readonly operationKind: TOperationKind;
+};
+export declare function buildNearEd25519MpcOperationRef<TOperationKind extends NearEd25519MpcOperationKind>(operationKind: TOperationKind): Extract<CapabilityOperationRef, {
+    readonly capabilityKind: 'near_ed25519_mpc_signing';
+}> & {
+    readonly operationKind: TOperationKind;
+};
+export declare function buildEvmEcdsaMpcOperationRef<TOperationKind extends EvmEcdsaMpcOperationKind>(operationKind: TOperationKind): Extract<CapabilityOperationRef, {
+    readonly capabilityKind: 'evm_ecdsa_mpc_signing';
+}> & {
+    readonly operationKind: TOperationKind;
+};
+export declare function parseCapabilityOperationRef(value: unknown): AuthorizationParseResult<CapabilityOperationRef>;
+export declare function buildAuthorizationEvidenceRequirement(input: {
+    readonly mode: AuthorizationEvidenceRequirement['mode'];
+    readonly evidenceKinds: readonly [AuthorizationEvidenceKind, ...AuthorizationEvidenceKind[]];
+}): AuthorizationEvidenceRequirement;
+export declare function parseTenantId(value: unknown): AuthorizationParseResult<TenantId>;
+export declare function parsePrincipalId(value: unknown): AuthorizationParseResult<PrincipalId>;
+export declare function parseEcdsaAuthorizationSessionId(value: unknown): AuthorizationParseResult<EcdsaAuthorizationSessionId>;
+export declare function parseSeamsSession(value: unknown): AuthorizationParseResult<SeamsSession>;
+export declare function parseHostedWalletSessionExchangeCodeId(value: unknown): AuthorizationParseResult<HostedWalletSessionExchangeCodeId>;
+export declare function parseSessionClientId(value: unknown): AuthorizationParseResult<SessionClientId>;
+export declare function parseDeviceId(value: unknown): AuthorizationParseResult<DeviceId>;
+export declare function parseAuthFactorId(value: unknown): AuthorizationParseResult<AuthFactorId>;
+export declare function parseCapabilityId(value: unknown): AuthorizationParseResult<CapabilityId>;
+export declare function parseCapabilityBindingId(value: unknown): AuthorizationParseResult<CapabilityBindingId>;
+export declare function parseCapabilityOperationId(value: unknown): AuthorizationParseResult<CapabilityOperationId>;
+export declare function parseAuthorizationGrantRef(value: unknown): AuthorizationParseResult<AuthorizationGrantRef>;
+export declare function buildAuthorizationGrantRef(authorizationId: WalletSessionAuthorizationId): WalletSessionAuthorizationRef;
+export declare function parseWalletSessionAuthorizationId(value: unknown): AuthorizationParseResult<WalletSessionAuthorizationId>;
+export declare function parseAuthorizedOperationId(value: unknown): AuthorizationParseResult<AuthorizedOperationId>;
+export declare function parseWalletSessionId(value: unknown): AuthorizationParseResult<WalletSessionId>;
+export declare function parseMpcWalletSigningQuotaId(value: unknown): AuthorizationParseResult<MpcWalletSigningQuotaId>;
+export declare function parseWalletSessionMintId(value: unknown): AuthorizationParseResult<WalletSessionMintId>;
+export declare function parseAuthorizationEvidenceId(value: unknown): AuthorizationParseResult<AuthorizationEvidenceId>;
+export declare function parseAuthorizationEvidenceSetId(value: unknown): AuthorizationParseResult<AuthorizationEvidenceSetId>;
+export declare function parseGrantChallengeId(value: unknown): AuthorizationParseResult<GrantChallengeId>;
+export declare function parsePolicyId(value: unknown): AuthorizationParseResult<PolicyId>;
+export declare function parseAuthorizationAuditEventId(value: unknown): AuthorizationParseResult<AuthorizationAuditEventId>;
+export declare function parseVaultId(value: unknown): AuthorizationParseResult<VaultId>;
+export declare function parseVaultItemId(value: unknown): AuthorizationParseResult<VaultItemId>;
+export declare function parseCapabilityOperationResultStorageRef(value: unknown): AuthorizationParseResult<CapabilityOperationResultStorageRef>;
+//# sourceMappingURL=capabilityKinds.d.ts.map

package/dist/types/shared-ts/src/authorization/capabilityKinds.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capabilityKinds.typecheck.d.ts.map

package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts

@@ -0,0 +1,44 @@
+import type { AuthorizationParseResult } from './capabilityKinds';
+export type DelegatedWalletPermissionV1 = 'sign' | 'export_keys' | 'link_devices' | 'revoke_devices';
+export declare const FULL_OWNER_PERMISSIONS: readonly ["export_keys", "link_devices", "revoke_devices", "sign"];
+export declare const SIGNING_ONLY_PERMISSIONS: readonly ["sign"];
+type CanonicalPermissionTuple = readonly [
+    DelegatedWalletPermissionV1,
+    ...DelegatedWalletPermissionV1[]
+];
+declare const canonicalPermissionSetBrand: unique symbol;
+declare class CanonicalDelegatedWalletPermissionSetProof extends Array<DelegatedWalletPermissionV1> {
+    readonly [canonicalPermissionSetBrand]: true;
+    private constructor();
+    static create(permissions: CanonicalPermissionTuple): CanonicalDelegatedWalletPermissionSetProof;
+    static get [Symbol.species](): ArrayConstructor;
+}
+/** A canonical permission set can only be obtained from a boundary parser or builder. */
+export type CanonicalDelegatedWalletPermissionSetV1 = CanonicalDelegatedWalletPermissionSetProof;
+export type DelegatedWalletAuthorityV1 = {
+    readonly kind: 'delegated_wallet_authority_v1';
+    readonly permissions: CanonicalDelegatedWalletPermissionSetV1;
+};
+export declare function isDelegatedWalletPermissionV1(value: unknown): value is DelegatedWalletPermissionV1;
+export declare function parseDelegatedWalletPermissionSetV1(raw: unknown): AuthorizationParseResult<CanonicalDelegatedWalletPermissionSetV1>;
+export declare function buildDelegatedWalletAuthorityV1(input: {
+    readonly permissions: CanonicalDelegatedWalletPermissionSetV1;
+}): DelegatedWalletAuthorityV1;
+export declare function parseDelegatedWalletAuthorityV1(raw: unknown): AuthorizationParseResult<DelegatedWalletAuthorityV1>;
+export declare function buildFullOwnerPermissionsV1(): CanonicalDelegatedWalletPermissionSetV1;
+export declare function buildSigningOnlyPermissionsV1(): CanonicalDelegatedWalletPermissionSetV1;
+export declare function buildFullOwnerDelegatedWalletAuthorityV1(): DelegatedWalletAuthorityV1;
+export declare function buildSigningOnlyDelegatedWalletAuthorityV1(): DelegatedWalletAuthorityV1;
+export declare function hasDelegatedWalletPermissionV1(authority: DelegatedWalletAuthorityV1, permission: DelegatedWalletPermissionV1): boolean;
+export declare function delegatedWalletPermissionNamesV1(authority: DelegatedWalletAuthorityV1): readonly DelegatedWalletPermissionV1[];
+export declare function sameDelegatedWalletAuthorityV1(left: DelegatedWalletAuthorityV1, right: DelegatedWalletAuthorityV1): boolean;
+export declare function validateDelegatedWalletAuthorityAttenuationV1(input: {
+    readonly parent: DelegatedWalletAuthorityV1;
+    readonly child: DelegatedWalletAuthorityV1;
+}): AuthorizationParseResult<true>;
+export declare function assertDelegatedWalletAuthorityAttenuationV1(input: {
+    readonly parent: DelegatedWalletAuthorityV1;
+    readonly child: DelegatedWalletAuthorityV1;
+}): void;
+export {};
+//# sourceMappingURL=delegatedAuthority.d.ts.map

package/dist/types/shared-ts/src/authorization/index.d.ts

@@ -0,0 +1,7 @@
+export * from './capabilityKinds';
+export * from './delegatedAuthority';
+export * from './operationFingerprint';
+export * from './walletCustodyOperation';
+export * from './walletAuthority';
+export * from './walletSessionIssuance';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/authorization/operationFingerprint.d.ts

@@ -0,0 +1,39 @@
+import type { DigestB64u } from '../utils/canonicalPrimitives';
+import { type AuthorizationParseResult, type CapabilityId, type CapabilityOperationId, type CapabilityOperationRef, type PrincipalId, type TenantId } from './capabilityKinds';
+declare const capabilityOperationFingerprintDigestBrand: unique symbol;
+export type CapabilityOperationFingerprintDigest = DigestB64u & {
+    readonly [capabilityOperationFingerprintDigestBrand]: true;
+};
+export type OperationDigestSet = {
+    readonly laneDigest: DigestB64u;
+    readonly intentDigest: DigestB64u;
+    readonly displayDigest: DigestB64u;
+};
+type CapabilityOperationEnvelopeFields<TOperation extends CapabilityOperationRef = CapabilityOperationRef> = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly capabilityId: CapabilityId;
+    readonly operationId: CapabilityOperationId;
+    readonly operation: TOperation;
+    readonly digests: OperationDigestSet;
+};
+declare class CapabilityOperationEnvelopeProof<TOperation extends CapabilityOperationRef = CapabilityOperationRef> {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly capabilityId: CapabilityId;
+    readonly operationId: CapabilityOperationId;
+    readonly operation: TOperation;
+    readonly digests: OperationDigestSet;
+    private retainProof;
+    constructor(fields: CapabilityOperationEnvelopeFields<TOperation>);
+}
+export type CapabilityOperationEnvelope<TOperation extends CapabilityOperationRef = CapabilityOperationRef> = CapabilityOperationEnvelopeProof<TOperation>;
+export declare function buildCapabilityOperationEnvelope<TOperation extends CapabilityOperationRef>(fields: CapabilityOperationEnvelopeFields<TOperation>): CapabilityOperationEnvelope<TOperation>;
+export declare function parseCapabilityOperationEnvelope(raw: unknown): AuthorizationParseResult<CapabilityOperationEnvelope>;
+export declare function parseOperationDigestSet(raw: unknown): AuthorizationParseResult<OperationDigestSet>;
+export declare function canonicalCapabilityOperationFingerprintPreimageV1(envelope: CapabilityOperationEnvelope): string;
+export declare function computeCapabilityOperationFingerprintDigest(envelope: CapabilityOperationEnvelope): Promise<CapabilityOperationFingerprintDigest>;
+export declare function parseCapabilityOperationFingerprintDigest(value: unknown): CapabilityOperationFingerprintDigest;
+export declare function parseSigningOperationFingerprintDigest(value: unknown): DigestB64u;
+export {};
+//# sourceMappingURL=operationFingerprint.d.ts.map

package/dist/types/shared-ts/src/authorization/operationFingerprint.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=operationFingerprint.typecheck.d.ts.map