@seams/wallet-server 0.5.0

package/dist/esm/authorization/domain.js

@@ -0,0 +1,434 @@
+import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
+import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
+import "../shared-ts/src/utils/encoders.js";
+import { parseActiveWalletSessionV1 } from "../shared-ts/src/device-linking/parsers.js";
+import "../shared-ts/src/device-linking/index.js";
+//#region src/authorization/domain.ts
+function buildExactWalletSessionQuotaProjectionV1(fields) {
+	requireNonnegativeInteger(fields.remainingUses, "Wallet Session quota remaining uses");
+	requirePositiveTime(fields.expiresAtMs, "Wallet Session quota expiry");
+	if (fields.lifecycle === "exhausted" !== (fields.remainingUses === 0)) throw new Error("Wallet Session quota lifecycle disagrees with its remaining uses");
+	return {
+		kind: "exact_wallet_session_quota_projection_v1",
+		lifecycle: fields.lifecycle,
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletSessionId: fields.walletSessionId,
+		quotaId: fields.quotaId,
+		remainingUses: fields.remainingUses,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+/**
+* Every capability subject must resolve through the authoritative active
+* authority that the authorization names. A signing or export subject resolves
+* only when its key family is activated and names the same material the
+* authority currently holds; an administration subject resolves only when it
+* names that same authority. Anything else is a capability the caller can no
+* longer exercise, not a corrupt row.
+*/
+function exactWalletSessionCapabilitySubjectsResolveAuthority(input) {
+	return input.session.capabilitySubjects.every((subject) => {
+		switch (subject.kind) {
+			case "sign":
+			case "export_keys": {
+				const activation = subject.keyFamily === "ed25519" ? input.signerActivations.ed25519 : input.signerActivations.ecdsa;
+				return activation !== void 0 && mpcMaterialActivationRefsEqual(activation.materialActivation, subject.materialActivation);
+			}
+			case "link_devices":
+			case "revoke_devices": return subject.authorityId === input.session.authorityId;
+			default: return false;
+		}
+	});
+}
+/**
+* The digest-free authorization projection published to the browser. It carries
+* the exact wallet, authority, method, capability, and lifetime identity a
+* reader needs to reconcile its own record, and never the credential digest.
+*/
+function projectExactWalletSessionAuthorizationV1(session) {
+	const capabilitySubjects = session.capabilitySubjects.map((subject) => {
+		switch (subject.kind) {
+			case "sign":
+			case "export_keys": return {
+				kind: subject.kind,
+				keyFamily: subject.keyFamily,
+				materialActivation: subject.materialActivation
+			};
+			case "link_devices":
+			case "revoke_devices": return { kind: subject.kind };
+			default: throw new Error("Issued linked-device Wallet Session subject is invalid");
+		}
+	});
+	const first = capabilitySubjects[0];
+	if (!first) throw new Error("Issued linked-device Wallet Session has no subjects");
+	return parseActiveWalletSessionV1({
+		kind: "active_wallet_session_v1",
+		walletId: session.walletId,
+		authorityId: session.authorityId,
+		authMethodId: session.walletAuthMethodId,
+		authorizationId: session.authorizationId,
+		quotaId: session.quotaId,
+		authorityDigestB64u: session.authorityDigestB64u,
+		authorityRevocationEpoch: session.authorityRevocationEpoch,
+		capabilitySubjects: [first, ...capabilitySubjects.slice(1)],
+		issuedAtMs: session.createdAtMs,
+		expiresAtMs: session.expiresAtMs
+	});
+}
+function projectActiveWalletSession(issued) {
+	if (issued.quota.quotaId !== issued.session.quotaId) throw new Error("Issued Wallet Session quota does not belong to its authorization");
+	return projectExactWalletSessionAuthorizationV1(issued.session);
+}
+function buildPersistedActiveWalletSessionAuthorizationV2(fields) {
+	if (fields.session.tenantId !== fields.quota.tenantId || fields.session.principalId !== fields.quota.principalId || fields.session.walletSessionId !== fields.quota.walletSessionId || fields.session.quotaId !== fields.quota.quotaId || fields.session.expiresAtMs !== fields.quota.expiresAtMs) throw new Error("V2 persisted active authorization and quota must have one exact identity");
+	parseDigestB64u(fields.primaryOperationCredentialDigestB64u);
+	return {
+		kind: "persisted_active_wallet_session_authorization_v2",
+		session: fields.session,
+		quota: fields.quota,
+		primaryOperationCredentialDigestB64u: fields.primaryOperationCredentialDigestB64u
+	};
+}
+function appendWalletSessionSignerSubjects(subjects, kind, signerActivations) {
+	if (signerActivations.keyFamilies.length === 1 && signerActivations.keyFamilies[0] === "ed25519") {
+		if (!signerActivations.ed25519) throw new Error("Ed25519 signer activation is missing");
+		subjects.push({
+			kind,
+			keyFamily: "ed25519",
+			materialActivation: signerActivations.ed25519.materialActivation
+		});
+		return;
+	}
+	if (signerActivations.keyFamilies.length === 1 && signerActivations.keyFamilies[0] === "ecdsa_secp256k1") {
+		if (!signerActivations.ecdsa) throw new Error("ECDSA signer activation is missing");
+		subjects.push({
+			kind,
+			keyFamily: "ecdsa_secp256k1",
+			materialActivation: signerActivations.ecdsa.materialActivation
+		});
+		return;
+	}
+	if (!signerActivations.ed25519 || !signerActivations.ecdsa) throw new Error("both-family signer activations are incomplete");
+	subjects.push({
+		kind,
+		keyFamily: "ed25519",
+		materialActivation: signerActivations.ed25519.materialActivation
+	}, {
+		kind,
+		keyFamily: "ecdsa_secp256k1",
+		materialActivation: signerActivations.ecdsa.materialActivation
+	});
+}
+function buildWalletSessionCapabilitySubjectsV1(authority) {
+	const subjects = [];
+	if (authority.permissions.includes("sign")) appendWalletSessionSignerSubjects(subjects, "sign", authority.signerActivations);
+	if (authority.permissions.includes("export_keys")) appendWalletSessionSignerSubjects(subjects, "export_keys", authority.signerActivations);
+	if (authority.permissions.includes("link_devices")) subjects.push({
+		kind: "link_devices",
+		authorityId: authority.authorityId
+	});
+	if (authority.permissions.includes("revoke_devices")) subjects.push({
+		kind: "revoke_devices",
+		authorityId: authority.authorityId
+	});
+	const [firstSubject, ...remainingSubjects] = subjects;
+	if (!firstSubject) throw new Error("active wallet authority must produce capability subjects");
+	return [firstSubject, ...remainingSubjects];
+}
+function buildWalletSessionAuthorizationV2(fields) {
+	requireNonnegativeInteger(fields.authorityRevocationEpoch, "Wallet Session authority revocation epoch");
+	parseDigestB64u(fields.authorityDigestB64u);
+	if (fields.capabilitySubjects.length === 0) throw new Error("Wallet Session capability subjects are required");
+	requireOrderedTimes(fields.createdAtMs, fields.expiresAtMs, "Wallet Session authorization");
+	const identityValues = [
+		String(fields.authorizationId),
+		String(fields.walletSessionId),
+		String(fields.quotaId)
+	];
+	if (new Set(identityValues).size !== identityValues.length) throw new Error("Wallet Session authorization identities must be pairwise distinct");
+	return {
+		kind: "wallet_session_authorization_v2",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletId: fields.walletId,
+		authorityId: fields.authorityId,
+		walletAuthMethodId: fields.walletAuthMethodId,
+		authorityDigestB64u: fields.authorityDigestB64u,
+		authorityRevocationEpoch: fields.authorityRevocationEpoch,
+		mintId: fields.mintId,
+		authorizationId: fields.authorizationId,
+		walletSessionId: fields.walletSessionId,
+		quotaId: fields.quotaId,
+		capabilitySubjects: fields.capabilitySubjects,
+		createdAtMs: fields.createdAtMs,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function walletSessionCapabilitySubjectsV1Equal(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) {
+		const leftSubject = left[index];
+		const rightSubject = right[index];
+		if (!leftSubject || !rightSubject || leftSubject.kind !== rightSubject.kind) return false;
+		switch (leftSubject.kind) {
+			case "sign":
+			case "export_keys": break;
+			case "link_devices":
+			case "revoke_devices":
+				if (rightSubject.kind !== leftSubject.kind || leftSubject.authorityId !== rightSubject.authorityId) return false;
+				break;
+		}
+		if (leftSubject.kind === "sign" || leftSubject.kind === "export_keys") {
+			if (rightSubject.kind !== leftSubject.kind || leftSubject.keyFamily !== rightSubject.keyFamily || !mpcMaterialActivationRefsEqual(leftSubject.materialActivation, rightSubject.materialActivation)) return false;
+		}
+	}
+	return true;
+}
+function walletSessionAuthorizationV2RecordsEqual(left, right) {
+	return left.kind === right.kind && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.authorityDigestB64u === right.authorityDigestB64u && left.authorityRevocationEpoch === right.authorityRevocationEpoch && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId && walletSessionCapabilitySubjectsV1Equal(left.capabilitySubjects, right.capabilitySubjects) && left.createdAtMs === right.createdAtMs && left.expiresAtMs === right.expiresAtMs;
+}
+function parseMpcMaterialActivationRefRequired(value) {
+	const parsed = parseMpcMaterialActivationRef(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthorityIdRequired(value) {
+	const parsed = parseWalletAuthorityId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthMethodIdRequired(value) {
+	const parsed = parseWalletAuthMethodId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletSessionCapabilitySubject(value) {
+	if (!isWalletSessionCapabilitySubjectRecordV1(value) || typeof value.kind !== "string") throw new Error("Wallet Session capability subject must be an object");
+	switch (value.kind) {
+		case "sign":
+		case "export_keys":
+			if (Object.keys(value).sort().join("|") !== "keyFamily|kind|materialActivation") throw new Error("Wallet Session signer capability subject contains unexpected fields");
+			if (value.keyFamily !== "ed25519" && value.keyFamily !== "ecdsa_secp256k1") throw new Error("Wallet Session signer capability subject key family is invalid");
+			return {
+				kind: value.kind,
+				keyFamily: value.keyFamily,
+				materialActivation: parseMpcMaterialActivationRefRequired(value.materialActivation)
+			};
+		case "link_devices":
+		case "revoke_devices":
+			if (Object.keys(value).sort().join("|") !== "authorityId|kind") throw new Error("Wallet Session administration capability subject contains unexpected fields");
+			return {
+				kind: value.kind,
+				authorityId: parseWalletAuthorityIdRequired(value.authorityId)
+			};
+		default: throw new Error("Wallet Session capability subject kind is unsupported");
+	}
+}
+function isWalletSessionCapabilitySubjectRecordV1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseWalletSessionCapabilitySubjects(value) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error("Wallet Session capability subjects must be non-empty");
+	const subjects = [];
+	for (const subject of value) subjects.push(parseWalletSessionCapabilitySubject(subject));
+	const [firstSubject, ...remainingSubjects] = subjects;
+	if (!firstSubject) throw new Error("Wallet Session capability subjects must be non-empty");
+	return [firstSubject, ...remainingSubjects];
+}
+function parseWalletSessionAuthorizationV2(value) {
+	if (!isWalletSessionAuthorizationRecordV2(value)) throw new Error("Wallet Session authorization V2 contains unexpected fields");
+	if (value.kind !== "wallet_session_authorization_v2") throw new Error("Wallet Session authorization V2 kind is invalid");
+	const tenantId = parseTenantIdRequired(value.tenantId);
+	const principalId = parsePrincipalIdRequired(value.principalId);
+	const walletId = parseWalletIdRequired(value.walletId);
+	const authorityId = parseWalletAuthorityIdRequired(value.authorityId);
+	const walletAuthMethodId = parseWalletAuthMethodIdRequired(value.walletAuthMethodId);
+	const authorityDigestB64u = parseDigestB64u(value.authorityDigestB64u);
+	const mintIdResult = parseWalletSessionMintId(value.mintId);
+	if (!mintIdResult.ok) throw new Error(mintIdResult.error.message);
+	const authorizationIdResult = parseWalletSessionAuthorizationId(value.authorizationId);
+	if (!authorizationIdResult.ok) throw new Error(authorizationIdResult.error.message);
+	const walletSessionId = parseWalletSessionIdRequired(value.walletSessionId);
+	const quotaId = parseMpcWalletSigningQuotaIdRequired(value.quotaId);
+	return buildWalletSessionAuthorizationV2({
+		tenantId,
+		principalId,
+		walletId,
+		authorityId,
+		walletAuthMethodId,
+		authorityDigestB64u,
+		authorityRevocationEpoch: requireNonnegativeInteger(value.authorityRevocationEpoch, "Wallet Session authority revocation epoch"),
+		mintId: mintIdResult.value,
+		authorizationId: authorizationIdResult.value,
+		walletSessionId,
+		quotaId,
+		capabilitySubjects: parseWalletSessionCapabilitySubjects(value.capabilitySubjects),
+		createdAtMs: requirePositiveTimestamp(value.createdAtMs, "Wallet Session createdAtMs"),
+		expiresAtMs: requirePositiveTimestamp(value.expiresAtMs, "Wallet Session expiresAtMs")
+	});
+}
+function isWalletSessionAuthorizationRecordV2(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join("|") === "authorityDigestB64u|authorityId|authorityRevocationEpoch|authorizationId|capabilitySubjects|createdAtMs|expiresAtMs|kind|mintId|principalId|quotaId|tenantId|walletAuthMethodId|walletId|walletSessionId";
+}
+async function buildAuthorizedOperation(input) {
+	if (input.tenantId !== input.operation.tenantId) throw new Error("authorized operation tenant must match its operation envelope");
+	const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(input.operation);
+	return {
+		...input,
+		kind: "authorized_operation",
+		operationFingerprintDigest,
+		lifecycle: "claimed"
+	};
+}
+const AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES = 64 * 1024;
+const AUTHORIZED_OPERATION_RESULT_DIGEST_DOMAIN_V1 = "seams:authorization:authorized-operation-result:v1";
+function parseAuthorizedOperationReplayResponse(value) {
+	if (!isAuthorizedOperationReplayResponseRecordV1(value)) throw new Error("authorized operation replay response must be an object");
+	const keys = Object.keys(value).sort();
+	if (keys.length !== 3 || keys.join("|") !== "bodyText|contentType|status") throw new Error("authorized operation replay response must contain only status, contentType, and bodyText");
+	const status = value.status;
+	if (typeof status !== "number" || !Number.isSafeInteger(status) || status < 200 || status > 599) throw new Error("authorized operation replay response status must be an HTTP status");
+	const contentType = value.contentType;
+	if (typeof contentType !== "string" || contentType.length === 0 || contentType.trim() !== contentType || contentType.length > 255 || /[\u0000-\u001f\u007f]/.test(contentType)) throw new Error("authorized operation replay response contentType is invalid");
+	const bodyText = value.bodyText;
+	if (typeof bodyText !== "string") throw new Error("authorized operation replay response bodyText must be text");
+	if (new TextEncoder().encode(bodyText).byteLength > 65536) throw new Error("authorized operation replay response bodyText is too large");
+	if (responseStatusHasNoBody(status) && bodyText.length !== 0) throw new Error("authorized operation replay response status cannot carry a body");
+	return {
+		status,
+		contentType,
+		bodyText
+	};
+}
+function authorizedOperationReplayBodyInit(response) {
+	const parsed = parseAuthorizedOperationReplayResponse(response);
+	return responseStatusHasNoBody(parsed.status) ? null : parsed.bodyText;
+}
+function responseStatusHasNoBody(status) {
+	return status === 204 || status === 205 || status === 304;
+}
+function isAuthorizedOperationReplayResponseRecordV1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join("|") === "bodyText|contentType|status";
+}
+async function computeAuthorizedOperationResultDigest(response) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${AUTHORIZED_OPERATION_RESULT_DIGEST_DOMAIN_V1}|${alphabetizeStringify(parseAuthorizedOperationReplayResponse(response))}`)));
+}
+function parseHostedWalletSeamsSessionExchangeCode(value) {
+	return parseAuthorizationDomainId(value, "hostedWalletSessionExchangeCode");
+}
+function parseVerifiedOwnerProofId(value) {
+	return parseAuthorizationDomainId(value, "verifiedOwnerProofId");
+}
+function parseHostedWalletSeamsSessionExchangeNonce(value) {
+	return parseAuthorizationDomainId(value, "hostedWalletSessionExchangeNonce");
+}
+function parseHostedWalletSessionCredentialId(value) {
+	return parseAuthorizationDomainId(value, "hostedWalletSessionCredentialId");
+}
+function parseHostedWalletSessionOperationCredentialV1(raw) {
+	if (!isHostedWalletSessionOperationCredentialRecordV1(raw)) throw new Error("HostedWalletSessionOperationCredentialV1 must be an exact object");
+	if (raw.kind !== "opaque_hosted_wallet_session_operation_credential_v1") throw new Error("HostedWalletSessionOperationCredentialV1.kind is invalid");
+	const token = parseHostedWalletSessionOperationCredentialToken(raw.token);
+	const walletSessionId = parseWalletSessionId(raw.walletSessionId);
+	if (!walletSessionId.ok) throw new Error(`walletSessionId is invalid: ${walletSessionId.error.message}`);
+	return {
+		kind: raw.kind,
+		token,
+		walletSessionId: walletSessionId.value
+	};
+}
+function isHostedWalletSessionOperationCredentialRecordV1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join("|") === "kind|token|walletSessionId";
+}
+function parsePrimaryWalletSessionOperationCredentialToken(value) {
+	if (typeof value !== "string" || !/^wst_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("primary Wallet Session credential is invalid");
+	return parseAuthorizationDomainId(value, "primaryWalletSessionOperationCredentialToken");
+}
+function parseHostedWalletSessionOperationCredentialToken(value) {
+	if (typeof value !== "string" || !/^wsh_[A-Za-z0-9_-]{43}$/.test(value)) throw new Error("HostedWalletSessionOperationCredentialV1.token is invalid");
+	return parseAuthorizationDomainId(value, "hostedWalletSessionOperationCredentialToken");
+}
+function parseSessionOrigin(value) {
+	if (typeof value !== "string" || value.trim() !== value) throw new Error("session origin must be a canonical HTTP origin");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("session origin must be a canonical HTTP origin");
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.origin !== value || url.pathname !== "/" || url.search || url.hash) throw new Error("session origin must be a canonical HTTP origin");
+	return value;
+}
+function buildActiveWalletSessionQuota(fields) {
+	requirePositiveCount(fields.remainingUses, "Wallet Session quota remaining uses");
+	requirePositiveTime(fields.expiresAtMs, "Wallet Session quota expiry");
+	return {
+		kind: "active_wallet_session_quota",
+		tenantId: fields.tenantId,
+		principalId: fields.principalId,
+		walletSessionId: fields.walletSessionId,
+		quotaId: fields.quotaId,
+		remainingUses: fields.remainingUses,
+		expiresAtMs: fields.expiresAtMs
+	};
+}
+function parseAuthorizationDomainId(value, fieldName) {
+	if (typeof value !== "string" || value.trim() !== value || value.length === 0 || value.length > 512 || /[\s\u0000-\u001f\u007f]/.test(value)) throw new Error(`${fieldName} must be a compact opaque identifier`);
+	return value;
+}
+function parseTenantIdRequired(value) {
+	const parsed = parseTenantId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization tenantId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parsePrincipalIdRequired(value) {
+	const parsed = parsePrincipalId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization principalId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseWalletIdRequired(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization walletId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseWalletSessionIdRequired(value) {
+	const parsed = parseWalletSessionId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization walletSessionId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseMpcWalletSigningQuotaIdRequired(value) {
+	const parsed = parseMpcWalletSigningQuotaId(value);
+	if (!parsed.ok) throw new Error(`linked-device authorization quotaId: ${parsed.error.message}`);
+	return parsed.value;
+}
+function requirePositiveCount(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+}
+function requireNonnegativeInteger(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a nonnegative safe integer`);
+	return value;
+}
+function requirePositiveTimestamp(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function requirePositiveTime(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive timestamp`);
+}
+function requireOrderedTimes(createdAtMs, expiresAtMs, label) {
+	requirePositiveTime(createdAtMs, `${label} creation`);
+	requirePositiveTime(expiresAtMs, `${label} expiry`);
+	if (expiresAtMs <= createdAtMs) throw new Error(`${label} expiry must follow creation`);
+}
+//#endregion
+export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };
+
+//# sourceMappingURL=domain.js.map