@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -2,7 +2,7 @@ import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domain
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
+import { isLinkSessionTerminalFailureV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
 import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { parseActiveWalletSessionV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
@@ -16,6 +16,8 @@ import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
+import { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse } from "./deviceLinkingResponses.js";
+import { linkedDeviceBootstrapFailure } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { parseLinkedDeviceRequestProofV1 } from "../../../../core/deviceLinking/requestProof.js";
 //#region src/router/transport/fetch/routes/deviceLinking.ts
 const DEVICE_LINKING_BASE = "/wallet/device-linking/v1/sessions";
@@ -52,6 +54,11 @@ async function handleDeviceLinking(ctx) {
 			default: return assertNever(action);
 		}
 	} catch (error) {
+		const bootstrapFailure = linkedDeviceBootstrapFailure(error);
+		if (bootstrapFailure) return sessionResultResponse({
+			outcome: bootstrapFailure,
+			message: "Linked-device bootstrap authority failed"
+		});
 		if (error instanceof DeviceLinkingInputError) return invalidInputResponse(error.message);
 		return json({
 			ok: false,
@@ -63,7 +70,7 @@ async function handleDeviceLinking(ctx) {
 async function handleCreate(ctx, service, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const bodyDigestB64u = await requestBodyDigest(ctx.request);
-	const rawBody = await readJsonBody(ctx.request);
+	const rawBody = await readJson(ctx.request);
 	const body = parseBoundary(() => parseCreateRequest(rawBody));
 	const keyDigest = await computeDevicePublicKeyDigestB64u(body.payload.devicePublicKeyB64u);
 	const proof = parseBoundary(() => parseRequestProofHeader(ctx.request));
@@ -140,7 +147,7 @@ async function handleApproval(ctx, service, rawLinkSessionId, nowMs) {
 		});
 		if (!session) return notFoundResponse();
 		const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
-		if (ownerMismatch) return ownerMismatch;
+		if (ownerMismatch) return authDeniedResponse(ownerMismatch);
 		if (authentication.owner.walletId !== approval.walletId) return authDeniedResponse({
 			kind: "denied",
 			code: "unauthorized",
@@ -224,6 +231,7 @@ async function handleCredential(ctx, service, rawLinkSessionId, nowMs) {
 async function handleSourceContributionPreparation(ctx, service, rawLinkSessionId, nowMs) {
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	if (ctx.method !== "GET") return methodNotAllowedResponse();
 	const preparation = owner.session.sourceContributionPreparation;
 	if (!preparation) return new Response(null, { status: 204 });
@@ -274,10 +282,6 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
-/**
-* A precommit failure's reason is a single token. The installer's message
-* keeps its words, joined, so the session still says what failed.
-*/
 function precommitFailureReasonV1(message) {
 	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
 	return token.length > 0 ? token : "authority_commit_failed";
@@ -286,6 +290,7 @@ async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, n
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const router = service.sourceContributionRouter;
 	if (!router) return notSupportedResponse("Ed25519 source-preserving linking is not configured");
 	const preparation = requireEd25519SourceContributionPreparation(owner.session);
@@ -358,8 +363,6 @@ async function handleEmailOtpBaseFactor(ctx, service, rawLinkSessionId, nowMs) {
 	const authenticated = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state !== "claimed" || session.qrPayload.targetFactor.kind !== "email_otp" || !session.claimTranscript) return invalidStateResponse(session);
 	const walletId = session.claimTranscript.value.walletId;
 	const request = parseBoundary(() => parseLinkedDeviceEmailOtpBaseFactorRequestV1(authenticated.body));
@@ -387,8 +390,6 @@ async function handleOwnerCancel(ctx, service, rawLinkSessionId, nowMs) {
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	parseBoundary(() => parseOwnerCancelRequest(authenticated.body));
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state === "cancelled") return sessionProjectionResponse(session, "replayed");
 	return sessionResultResponse(await service.sessionService.cancelSessionV1({
 		linkSessionId,
@@ -436,6 +437,7 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	if (ctx.method === "GET") {
 		const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 		if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+		if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer ? json(transfer.recipient, { status: 200 }) : new Response(null, { status: 204 });
 	}
@@ -443,8 +445,14 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 	if (authenticated.kind === "denied") return authDeniedResponse(authenticated);
 	if (authenticated.kind === "not_found") return notFoundResponse();
+	if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 	const recipient = parseBoundary(() => parseLinkedDeviceEd25519ExportRootRecipientV1(authenticated.body));
 	if (recipient.linkSessionId !== authenticated.linkSessionId) return invalidInputResponse("link session id does not match route");
+	const session = authenticated.session;
+	const preparation = await readTargetPreparation(service, session, requireApproval(session), { access: "replay_only" }, nowMs);
+	if (preparation.kind === "conflict") return invalidStateResponse(session);
+	const facts = preparation.ed25519ExportRoot;
+	if (!facts || recipient.walletId !== preparation.walletId || recipient.enrollmentId !== preparation.enrollmentId || recipient.deviceId !== preparation.deviceId || recipient.targetFactor.kind !== preparation.targetFactor.kind || recipient.walletKeyId !== facts.walletKeyId || recipient.revocationEpoch !== facts.revocationEpoch || recipient.applicationBindingDigestB64u !== facts.applicationBindingDigestB64u || recipient.registeredPublicKeyB64u !== facts.registeredPublicKeyB64u) return invalidInputResponse("export-root recipient does not match target preparation");
 	return exportRootWriteResponse(await port.registerRecipientV1({ recipient }));
 }
 async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
@@ -455,12 +463,14 @@ async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
 		const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 		if (authenticated.kind === "denied") return authDeniedResponse(authenticated);
 		if (authenticated.kind === "not_found") return notFoundResponse();
+		if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer?.state === "sealed" ? json(transfer.package, { status: 200 }) : new Response(null, { status: 204 });
 	}
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const submission = parseBoundary(() => parseLinkedDeviceEd25519ExportRootSubmissionV1(owner.body));
 	if (submission.linkSessionId !== sessionId) return invalidInputResponse("link session id does not match route");
 	return exportRootWriteResponse(await port.submitPackageV1({
@@ -472,7 +482,7 @@ async function handleReceipt(ctx, service, rawLinkSessionId, nowMs) {
 	if (!service.installationReceipt) return notSupportedResponse("Installation receipt is not configured");
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const linkSessionId = parseSessionId(rawLinkSessionId);
-	const rawBody = await readJsonBody(ctx.request.clone());
+	const rawBody = await readJson(ctx.request.clone());
 	if (isFinalActivationAcknowledgement(rawBody)) {
 		const acknowledgement = parseBoundary(() => parseLocalAuthorityActivationFinalAckV1(rawBody));
 		if (acknowledgement.linkSessionId !== linkSessionId) return invalidInputResponse("activation acknowledgement session does not match the route");
@@ -658,6 +668,8 @@ async function authenticateOwnerForSession(ctx, service, linkSessionId, nowMs) {
 	});
 	if (!session) return { kind: "not_found" };
 	validateOwnerRequestBinding(authentication.binding, ctx, bodyDigestB64u, nowMs);
+	const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
+	if (ownerMismatch) return ownerMismatch;
 	return {
 		kind: "authorized",
 		body: authentication.body,
@@ -862,69 +874,6 @@ async function authenticateTargetPasskeyOriginV1(ctx, routeId) {
 		expectedOrigin
 	};
 }
-function projectLinkSessionStateV1(state) {
-	switch (state.state) {
-		case "displaying_qr": return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return {
-			state: state.state,
-			deviceId: state.deviceId
-		};
-		case "authority_pending_local_install": return {
-			state: "authority_pending_local_install",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			packageSetDigestB64u: state.packageSetDigestB64u
-		};
-		case "active": return {
-			state: "active",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			activatedAtMs: state.activatedAtMs
-		};
-		case "failed_before_commit": return {
-			state: "failed_before_commit",
-			error: state.error
-		};
-		case "cancelled": return {
-			state: "cancelled",
-			cancelledAtMs: state.cancelledAtMs
-		};
-		case "expired": return {
-			state: "expired",
-			expiredAtMs: state.expiredAtMs
-		};
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function projectSession(record) {
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: record.linkSessionId,
-		qrPayload: record.qrPayload,
-		revision: record.revision,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs,
-		state: projectLinkSessionStateV1(record.state)
-	};
-}
-function sessionProjectionResponse(record, outcome) {
-	return json({
-		ok: true,
-		outcome,
-		session: projectSession(record)
-	}, { status: 200 });
-}
-function targetCredentialResultResponse(record, outcome, targetCredential) {
-	return json({
-		ok: true,
-		outcome,
-		targetCredential,
-		session: projectSession(record)
-	}, { status: 200 });
-}
 function claimResultResponse(result) {
 	if (result.outcome !== "applied" && result.outcome !== "replayed") return sessionResultResponse(result);
 	const claim = result.record.claimTranscript?.value;
@@ -953,6 +902,16 @@ function approvalResultResponse(result) {
 }
 function sessionResultResponse(result) {
 	switch (result.outcome) {
+		case "home_conflict": return json({
+			ok: false,
+			code: "wallet_home_conflict",
+			message: result.message
+		}, { status: 409 });
+		case "home_unavailable": return json({
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: result.message
+		}, { status: 503 });
 		case "applied":
 		case "replayed": return sessionProjectionResponse(result.record, result.outcome);
 		case "conflict": return json({
@@ -993,49 +952,19 @@ function sessionResultResponse(result) {
 		default: return assertNever(result);
 	}
 }
-function invalidStateResponse(record) {
-	return json({
-		ok: false,
-		outcome: "invalid_state",
-		state: record.state.state,
-		session: projectSession(record)
-	}, { status: 409 });
-}
-function exportRootWriteResponse(result) {
-	return result.outcome === "conflict" ? json({
-		ok: false,
-		code: result.reason ?? "conflict",
-		message: "export-root relay conflict"
-	}, { status: 409 }) : json({
-		ok: true,
-		outcome: result.outcome
-	}, { status: 200 });
-}
 function ownerSessionResponse(context) {
 	return context.kind === "denied" ? authDeniedResponse(context) : notFoundResponse();
 }
-/**
-* The one owner-to-session binding, shared by every owner route on a claimed
-* session. It runs before any state is disclosed: an authenticated owner of a
-* DIFFERENT wallet must get the same denial for every state, not a projection
-* or an invalid-state body. An unclaimed session has no wallet to bind to yet,
-* so the caller's state checks answer instead.
-*/
 function requireOwnerMatchesClaimedWallet(owner, session) {
 	const claimWalletId = session.claimTranscript?.value.walletId;
 	if (claimWalletId === void 0) return null;
 	if (owner.walletId === claimWalletId) return null;
-	return authDeniedResponse({
+	return {
 		kind: "denied",
 		code: "unauthorized",
 		message: "owner session does not match link wallet"
-	});
+	};
 }
-/**
-* Approval-time revalidation of the selected Email OTP base method. The same
-* eligibility question the dedicated base-factor route answers, asked once
-* more with the id the approval names, so the two paths cannot drift.
-*/
 async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	const provider = service.emailOtpTargetFactor;
 	if (!provider) return notSupportedResponse("Email OTP linking is not configured");
@@ -1054,43 +983,6 @@ async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	});
 	return null;
 }
-function authDeniedResponse(result) {
-	return json({
-		ok: false,
-		outcome: "unauthorized",
-		code: result.code,
-		message: result.message
-	}, { status: result.code === "expired" ? 410 : 401 });
-}
-function invalidInputResponse(message) {
-	return json({
-		ok: false,
-		outcome: "invalid_input",
-		code: "invalid_input",
-		message
-	}, { status: 400 });
-}
-function notSupportedResponse(message = "Device linking is not configured") {
-	return json({
-		ok: false,
-		code: "not_supported",
-		message
-	}, { status: 501 });
-}
-function notFoundResponse() {
-	return json({
-		ok: false,
-		code: "not_found",
-		message: "Linked-device session not found"
-	}, { status: 404 });
-}
-function methodNotAllowedResponse() {
-	return json({
-		ok: false,
-		code: "method_not_allowed",
-		message: "Method is not allowed"
-	}, { status: 405 });
-}
 function parseCreateRequest(raw) {
 	const record = requireRecord(raw, "device-linking create request");
 	requireExactKeys(record, ["kind", "payload"]);
@@ -1155,9 +1047,6 @@ function parseB64uBytes(raw, field) {
 	if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is not canonical base64url`);
 	return bytes;
 }
-async function readJsonBody(request) {
-	return await readJson(request);
-}
 function parseBoundary(parse) {
 	try {
 		return parse();

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -4,9 +4,9 @@ import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/autho
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
 /**
@@ -61,11 +61,7 @@ async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
 async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 	if (ctx.pathname !== "/wallet/device-linking/v1/owner-authorization") return null;
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
-	if (!service) return json({
-		ok: false,
-		code: "not_supported",
-		message: "Linked-device owner authorization is not configured"
-	}, { status: 501 });
+	if (!service) return jsonFailure(501, "not_supported", "Linked-device owner authorization is not configured");
 	const nowV1 = Date.now;
 	let body;
 	let rawBody;
@@ -75,11 +71,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 		rawBody = await readJson(ctx.request.clone());
 		body = parseLinkedDeviceOwnerAuthorizationRequestV1(rawBody);
 	} catch (error) {
-		return json({
-			ok: false,
-			code: "invalid_body",
-			message: error instanceof Error ? error.message : "Owner authorization body is invalid"
-		}, { status: 400 });
+		return jsonFailure(400, "invalid_body", error instanceof Error ? error.message : "Owner authorization body is invalid");
 	}
 	const validated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
 		request: ctx.request,
@@ -99,11 +91,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 			owner: validated.owner
 		}), { status: 200 });
 	} catch (error) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error)
-		}, { status: 500 });
+		return jsonFailure(500, "internal", error instanceof Error ? error.message : String(error));
 	}
 }
 async function validateOwnerWalletSessionV1(input) {
@@ -267,12 +255,8 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	const status = value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401;
-	return json({
-		ok: false,
-		code: value.code,
-		message: value.message
-	}, { status });
+	if (value.code === "unavailable") return jsonFailure(503, value.code, value.message);
+	return jsonFailure(value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 export { LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, authenticateDeviceLinkingOwnerWalletSessionRequestV1, createDeviceLinkingOwnerRequestAuthenticatorV1, handleDeviceLinkingOwnerAuthorization };

package/dist/esm/router/transport/fetch/routes/deviceLinkingResponses.js

@@ -0,0 +1,130 @@
+import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
+import { json } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/deviceLinkingResponses.ts
+function projectLinkSessionStateV1(state) {
+	switch (state.state) {
+		case "displaying_qr": return { state: "displaying_qr" };
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return {
+			state: state.state,
+			deviceId: state.deviceId
+		};
+		case "authority_pending_local_install": return {
+			state: "authority_pending_local_install",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			packageSetDigestB64u: state.packageSetDigestB64u
+		};
+		case "active": return {
+			state: "active",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			activatedAtMs: state.activatedAtMs
+		};
+		case "failed_before_commit": return {
+			state: "failed_before_commit",
+			error: state.error
+		};
+		case "cancelled": return {
+			state: "cancelled",
+			cancelledAtMs: state.cancelledAtMs
+		};
+		case "expired": return {
+			state: "expired",
+			expiredAtMs: state.expiredAtMs
+		};
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function projectSession(record) {
+	return {
+		kind: "linked_device_session_projection_v1",
+		linkSessionId: record.linkSessionId,
+		qrPayload: record.qrPayload,
+		revision: record.revision,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs,
+		state: projectLinkSessionStateV1(record.state)
+	};
+}
+function invalidStateResponse(record) {
+	return json({
+		ok: false,
+		outcome: "invalid_state",
+		state: record.state.state,
+		session: projectSession(record)
+	}, { status: 409 });
+}
+function sessionProjectionResponse(record, outcome) {
+	return json({
+		ok: true,
+		outcome,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function targetCredentialResultResponse(record, outcome, targetCredential) {
+	return json({
+		ok: true,
+		outcome,
+		targetCredential,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function exportRootWriteResponse(result) {
+	return result.outcome === "conflict" ? json({
+		ok: false,
+		code: result.reason ?? "conflict",
+		message: "export-root relay conflict"
+	}, { status: 409 }) : json({
+		ok: true,
+		outcome: result.outcome
+	}, { status: 200 });
+}
+function invalidInputResponse(message) {
+	return json({
+		ok: false,
+		outcome: "invalid_input",
+		code: "invalid_input",
+		message
+	}, { status: 400 });
+}
+function notSupportedResponse(message = "Device linking is not configured") {
+	return json({
+		ok: false,
+		code: "not_supported",
+		message
+	}, { status: 501 });
+}
+function notFoundResponse() {
+	return json({
+		ok: false,
+		code: "not_found",
+		message: "Linked-device session not found"
+	}, { status: 404 });
+}
+function methodNotAllowedResponse() {
+	return json({
+		ok: false,
+		code: "method_not_allowed",
+		message: "Method is not allowed"
+	}, { status: 405 });
+}
+function authDeniedResponse(result) {
+	if (result.code === "unavailable") return json({
+		ok: false,
+		code: result.code,
+		message: result.message
+	}, { status: 503 });
+	return json({
+		ok: false,
+		outcome: "unauthorized",
+		code: result.code,
+		message: result.message
+	}, { status: result.code === "expired" ? 410 : 401 });
+}
+//#endregion
+export { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse };
+
+//# sourceMappingURL=deviceLinkingResponses.js.map