@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/SeamsWeb/operations/devices/linkDeviceFlowSupport.js

@@ -1,143 +0,0 @@
-import { parseLinkDeviceSessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildFullOwnerDelegatedWalletAuthorityV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { WALLET_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
-import { LinkDeviceEventPhase } from "../../../core/types/sdkSentEvents.js";
-import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-import { assertNeverLinkSessionStateV1 } from "../../../shared-ts/src/device-linking/contracts.js";
-import { buildQrLinkedDeviceSessionPayloadV5 } from "../../../shared-ts/src/device-linking/parsers.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
-import { DeviceLinkingError, DeviceLinkingErrorCode, normalizeLinkedDeviceTargetEmailAddressV1 } from "../../../core/types/linkDevice.js";
-import { nextLinkedDevicePollingDelayMsV1 } from "./deviceLinkingHttpTransport.js";
-//#region src/SeamsWeb/operations/devices/linkDeviceFlowSupport.ts
-function linkedDeviceWalletAuthenticationState(walletSession, registration) {
-	switch (registration.targetFactor.kind) {
-		case "verified_passkey_target_v1": return {
-			kind: "authenticated",
-			walletId: walletSession.walletId,
-			authMethod: WALLET_AUTH_METHODS.passkey
-		};
-		case "verified_email_otp_target_v1": return {
-			kind: "authenticated",
-			walletId: walletSession.walletId,
-			authMethod: WALLET_AUTH_METHODS.emailOtp
-		};
-		default: return registration.targetFactor;
-	}
-}
-function createLinkSessionId() {
-	const parsed = parseLinkDeviceSessionId(secureRandomId("link-session", 32));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function createFlowId() {
-	return secureRandomId("link-flow", 16);
-}
-function notifyError(callback, error) {
-	try {
-		callback?.(error);
-	} catch {}
-}
-function logDevice2LinkingStageV1(input) {
-	console.info("[Device2Linking]", {
-		flowId: input.flowId,
-		linkSessionId: input.linkSessionId,
-		stage: input.stage,
-		...input.details
-	});
-}
-function logDevice2LinkingFailureV1(input) {
-	console.error("[Device2Linking] failed", {
-		flowId: input.flowId,
-		linkSessionId: input.linkSessionId,
-		state: input.state,
-		error: errorMessage(input.error)
-	});
-}
-function resolveSessionStateRetry(resolve, attempt) {
-	setTimeout(resolve, nextLinkedDevicePollingDelayMsV1(250, attempt));
-}
-async function waitForSessionStateRetry(attempt) {
-	await new Promise((resolve) => resolveSessionStateRetry(resolve, attempt));
-}
-function phaseForState(state) {
-	switch (state.state) {
-		case "displaying_qr":
-		case "expired":
-		case "cancelled": return LinkDeviceEventPhase.STEP_01_QR_PREPARE_STARTED;
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning":
-		case "authority_pending_local_install":
-		case "active": return LinkDeviceEventPhase.STEP_02_QR_SCAN_STARTED;
-		case "failed_before_commit": return LinkDeviceEventPhase.FAILED;
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function errorForFailure(error, phase) {
-	if (error instanceof DeviceLinkingError) return error;
-	return new DeviceLinkingError(errorMessage(error) || "Device linking failed", DeviceLinkingErrorCode.REGISTRATION_FAILED, phase);
-}
-/**
-* These failures happen after the server has committed the linked authority.
-* The original delivery is intentionally abandoned; exact-method unlock uses
-* the durable local installation to obtain a successor Wallet Session.
-*/
-function classifyLinkedDeviceDeliveryFailureV1(error) {
-	const message = errorMessage(error).toLowerCase();
-	if (message.includes("device-linking key handle is unknown or discarded") || message.includes("recipient handle lost")) return "recipient_private_handle_lost";
-	if (message.includes("linked-device wallet session credential delivery is expired")) return "sealed_delivery_expired";
-	return null;
-}
-function linkedDeviceDeliveryRecoveryMessageV1(reason) {
-	switch (reason) {
-		case "recipient_private_handle_lost":
-		case "sealed_delivery_expired": return "The linked device is ready. Return to sign in and unlock the new method to finish setup.";
-		default: return reason;
-	}
-}
-var LinkDeviceFlowSupersededError = class extends Error {
-	constructor() {
-		super("Device-link flow was cancelled or reset");
-		this.name = "LinkDeviceFlowSupersededError";
-	}
-};
-async function generateQrCodeDataUrlV1(payload) {
-	let qrcode;
-	try {
-		qrcode = await import("qrcode");
-	} catch {
-		throw new DeviceLinkingError("Device-link QR generation requires the optional qrcode package", DeviceLinkingErrorCode.UNSUPPORTED, "generation");
-	}
-	return await qrcode.toDataURL(payload, {
-		errorCorrectionLevel: "M",
-		margin: 2
-	});
-}
-function buildDevice2QrSessionPayloadV1(input) {
-	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
-	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
-		linkSessionId: input.linkSessionId,
-		linkPublicKeyB64u: input.linkPublicKeyB64u,
-		devicePublicKeyB64u: input.devicePublicKeyB64u,
-		requestedPermission,
-		targetFactor: { kind: "email_otp" },
-		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-	return buildQrLinkedDeviceSessionPayloadV5({
-		linkSessionId: input.linkSessionId,
-		linkPublicKeyB64u: input.linkPublicKeyB64u,
-		devicePublicKeyB64u: input.devicePublicKeyB64u,
-		requestedPermission,
-		targetFactor: { kind: "passkey_prf" },
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-}
-//#endregion
-export { LinkDeviceFlowSupersededError, buildDevice2QrSessionPayloadV1, classifyLinkedDeviceDeliveryFailureV1, createFlowId, createLinkSessionId, errorForFailure, generateQrCodeDataUrlV1, linkedDeviceDeliveryRecoveryMessageV1, linkedDeviceWalletAuthenticationState, logDevice2LinkingFailureV1, logDevice2LinkingStageV1, notifyError, phaseForState, waitForSessionStateRetry };
-
-//# sourceMappingURL=linkDeviceFlowSupport.js.map

package/dist/esm/SeamsWeb/operations/devices/linkDeviceTargetActivation.js

@@ -1,119 +0,0 @@
-import { parsePasskeyEnvelopeId } from "../../../shared-ts/src/utils/domainIds.js";
-import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-//#region src/SeamsWeb/operations/devices/linkDeviceTargetActivation.ts
-function isPasskeyTargetPreparation(preparation) {
-	return preparation.targetFactor.kind === "passkey_prf";
-}
-function isEmailOtpTargetPreparation(preparation) {
-	return preparation.targetFactor.kind === "email_otp";
-}
-function emailOtpTargetActivationBaseContextV1(context) {
-	return {
-		event: context.event,
-		state: context.state,
-		runEpoch: context.runEpoch,
-		deviceId: context.deviceId,
-		preparation: context.preparation,
-		ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
-		exportRoot: context.exportRoot
-	};
-}
-function requireCompletedEmailOtpTargetActivationStateV1(state) {
-	if (state.kind !== "completed" || !state.factorSecret || typeof state.providerUserId !== "string") throw new Error("linked-device Email OTP factor runtime is unavailable");
-	return {
-		kind: "completed",
-		runEpoch: state.runEpoch,
-		enrollment: state.enrollment,
-		factorSecret: state.factorSecret,
-		providerUserId: state.providerUserId
-	};
-}
-function assertNeverEmailOtpTargetActivationState(value) {
-	throw new Error(`Unknown Email OTP target activation state: ${String(value)}`);
-}
-function assertNeverTargetCredentialActivationState(value) {
-	throw new Error(`Unknown target credential activation state: ${String(value)}`);
-}
-function resolvePostLinkActivationV1(input) {
-	switch (input.targetFactor.kind) {
-		case "verified_passkey_target_v1": {
-			const activation = input.targetCredentialActivationState;
-			if (activation.kind !== "factor_ready" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
-			return {
-				factor: {
-					kind: "passkey",
-					walletId: input.walletId
-				},
-				factorSecret32: activation.factorSecret
-			};
-		}
-		case "verified_email_otp_target_v1": {
-			const activation = requireCompletedEmailOtpTargetActivationStateV1(input.emailOtpTargetActivationState);
-			if (activation.runEpoch !== input.runEpoch) throw new Error("linked-device Email OTP factor runtime is unavailable");
-			return {
-				factor: {
-					kind: "email_otp",
-					walletId: input.walletId,
-					walletAuthMethodId: input.walletAuthMethodId,
-					emailHashHex: input.targetFactor.authMethod.emailHashHex,
-					providerIdentity: {
-						provider: emailOtpProviderForLinkedEnrollment(activation.enrollment),
-						providerSubjectId: activation.providerUserId
-					}
-				},
-				factorSecret32: activation.factorSecret
-			};
-		}
-		default: return assertNeverVerifiedTargetFactor(input.targetFactor);
-	}
-}
-function assertNeverVerifiedTargetFactor(value) {
-	throw new Error(`Unknown verified target factor kind: ${String(value)}`);
-}
-function zeroizeLiveBytes(value) {
-	if (value.byteLength > 0) value.fill(0);
-}
-function emailOtpProviderForLinkedEnrollment(enrollment) {
-	return enrollment.kind === "existing_enrollment" ? "google" : "email";
-}
-function requireTargetRpIdV1(preparation) {
-	return preparation.passkeyCreationOptions.rpId;
-}
-function requireEmailOtpTargetPreparationV1(preparation) {
-	if (!isEmailOtpTargetPreparation(preparation)) throw new Error("linked-device Email OTP preparation is unavailable");
-	return preparation;
-}
-function createExportRootEnvelopeIdV1() {
-	const parsed = parsePasskeyEnvelopeId(secureRandomId("linked-device-ed25519-export-root-envelope", 24, "export-root envelope ids"));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function createEmailOtpFactorSecretV1() {
-	return crypto.getRandomValues(new Uint8Array(32));
-}
-async function prepareNewEmailOtpEnrollmentMaterialV1(input) {
-	const disposableSecret = input.factorSecret.slice();
-	try {
-		const material = await input.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({
-			relayUrl: String(input.context.configs.network.relayer.url || "").trim(),
-			walletId: input.walletId,
-			userId: input.targetEmail,
-			clientSecret32: disposableSecret
-		});
-		if (material.emailOtpSessionHandle.kind !== "not_requested") throw new Error("Strict linked-device Email OTP enrollment received obsolete ECDSA material");
-		return {
-			enrollmentId: material.enrollmentId,
-			enrollment: material.emailOtpEnrollment
-		};
-	} finally {
-		zeroizeLiveBytes(disposableSecret);
-	}
-}
-function requireNewEmailOtpEnrollmentMaterialV1(value) {
-	if (!value) throw new Error("new linked-device Email OTP enrollment material is unavailable");
-	return value;
-}
-//#endregion
-export { assertNeverEmailOtpTargetActivationState, assertNeverTargetCredentialActivationState, createEmailOtpFactorSecretV1, createExportRootEnvelopeIdV1, emailOtpTargetActivationBaseContextV1, isEmailOtpTargetPreparation, isPasskeyTargetPreparation, prepareNewEmailOtpEnrollmentMaterialV1, requireCompletedEmailOtpTargetActivationStateV1, requireEmailOtpTargetPreparationV1, requireNewEmailOtpEnrollmentMaterialV1, requireTargetRpIdV1, resolvePostLinkActivationV1, zeroizeLiveBytes };
-
-//# sourceMappingURL=linkDeviceTargetActivation.js.map

package/dist/esm/SeamsWeb/operations/devices/walletHostComposition.js

@@ -1,130 +0,0 @@
-import { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 } from "../../../shared-ts/src/device-linking/deviceManagement.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { createDeviceLinkingFlowPortsV1 } from "./deviceLinkingComposition.js";
-import { WalletHostOwnerRequestTransportError } from "./walletHostOwnerAuthority.js";
-//#region src/SeamsWeb/operations/devices/walletHostComposition.ts
-const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
-const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
-var OwnerWalletSessionReauthRequiredError = class extends Error {
-	constructor() {
-		super("The owner Wallet Session must be renewed");
-		this.code = OWNER_WALLET_SESSION_REAUTH_REQUIRED;
-		this.name = "OwnerWalletSessionReauthRequiredError";
-	}
-};
-function createWalletHostCompositionV1(args) {
-	const deviceLinkingPorts = createDeviceLinkingFlowPortsV1(args);
-	return {
-		linkedDeviceManagement: createWalletHostLinkedDeviceManagementPortV1({ request: args.managementRequest }),
-		deviceLinkingPorts,
-		dispose: deviceLinkingPorts.dispose
-	};
-}
-function createWalletHostLinkedDeviceManagementPortV1(args) {
-	return {
-		listLinkedDevices: async ({ walletId, limit, cursor }) => {
-			const request = parseLinkedDeviceListRequestV1({
-				kind: "linked_device_list_request_v1",
-				walletId,
-				limit,
-				cursor
-			});
-			const path = `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}?walletId=${encodeURIComponent(String(request.walletId))}&limit=${encodeURIComponent(String(request.limit))}&cursor=${encodeURIComponent(request.cursor ?? "")}`;
-			const response = await args.request.request({
-				method: "GET",
-				canonicalPath: path,
-				walletId: request.walletId
-			});
-			assertManagementSuccess(response, "list linked devices");
-			return parseLinkedDeviceListResponseV1(response.body);
-		},
-		revokeLinkedDevice: async ({ walletId, walletAuthMethodId, requestedAtMs, sourceProof }) => {
-			const request = parseLinkedDeviceRevokeRequestV1({
-				kind: "linked_device_revoke_request_v1",
-				walletId,
-				walletAuthMethodId,
-				requestedAtMs
-			});
-			const send = async () => await args.request.request({
-				method: "POST",
-				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
-				body: {
-					...request,
-					sourceProof
-				},
-				walletId
-			});
-			let response;
-			try {
-				response = await send();
-			} catch (error) {
-				if (!(error instanceof WalletHostOwnerRequestTransportError)) throw error;
-				if (error.code !== "network_error") throw error;
-				response = await send();
-			}
-			return parseManagementRevokeResult(response);
-		}
-	};
-}
-function parseManagementRevokeResult(response) {
-	if (response.status === 404) return parseLinkedDeviceRevokeResultV1({ kind: "not_found" });
-	if (response.status === 409) return parseLinkedDeviceRevokeResultV1({ kind: "conflict" });
-	if (response.status === 401 || response.status === 403) return parseLinkedDeviceRevokeResultV1({ kind: "unauthorized" });
-	assertManagementSuccess(response, "revoke linked device");
-	return parseLinkedDeviceRevokeResponseV1(response.body);
-}
-function assertManagementSuccess(response, operation) {
-	if (response.status < 200 || response.status >= 300) {
-		if (response.status === 401 && isManagementUnauthorizedFailureRecordV1(response.body)) throw new OwnerWalletSessionReauthRequiredError();
-		const detail = managementFailureDetail(response.body);
-		throw new Error(detail ? `linked-device ${operation} failed with HTTP ${response.status}: ${detail}` : `linked-device ${operation} failed with HTTP ${response.status}`);
-	}
-}
-function managementFailureDetail(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (isManagementFailureWithMessageRecordV1(raw)) return raw.message;
-	if (isManagementUnauthorizedFailureRecordV1(raw)) return raw.message;
-	return null;
-}
-function parseLinkedDeviceListResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device list response must be an object");
-	if (!isLinkedDeviceListResponseRecordV1(raw)) throw new Error("linked-device list response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device list response is not successful");
-	return parseLinkedDeviceListResultV1({
-		devices: raw.devices,
-		ownerDevices: raw.ownerDevices,
-		nextCursor: raw.nextCursor
-	});
-}
-function isLinkedDeviceListResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "devices|nextCursor|ok|ownerDevices";
-}
-function parseLinkedDeviceRevokeResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device revoke response must be an object");
-	if (!isLinkedDeviceRevokeResponseRecordV1(raw)) throw new Error("linked-device revoke response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device revoke response is not successful");
-	return parseLinkedDeviceRevokeResultV1({
-		kind: raw.kind,
-		walletAuthMethodId: raw.walletAuthMethodId,
-		authorityId: raw.authorityId,
-		revocationEpoch: raw.revocationEpoch
-	});
-}
-function isLinkedDeviceRevokeResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "authorityId|kind|ok|revocationEpoch|walletAuthMethodId";
-}
-function isManagementFailureWithMessageRecordV1(value) {
-	if (Object.keys(value).sort().join("|") !== "kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("message" in value)) return false;
-	return value.ok === false && (value.kind === "invalid_input" || value.kind === "internal") && typeof value.message === "string" && value.message.trim().length > 0;
-}
-function isManagementUnauthorizedFailureRecordV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	if (Object.keys(value).sort().join("|") !== "code|kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("code" in value) || !("message" in value)) return false;
-	return value.ok === false && value.kind === "unauthorized" && typeof value.code === "string" && typeof value.message === "string" && value.message.trim().length > 0;
-}
-//#endregion
-export { createWalletHostCompositionV1 };
-
-//# sourceMappingURL=walletHostComposition.js.map

package/dist/esm/SeamsWeb/operations/devices/walletHostOwnerAuthority.js

@@ -1,191 +0,0 @@
-import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { hasDelegatedWalletPermissionV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { awaitNearProvisioningInFlight } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
-import { parseExactAdministeredSignerManifestV1 } from "../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
-import { parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1 } from "../../../shared-ts/src/device-linking/parsers.js";
-import { WalletSessionAuthorizationUpgradeRequiredError } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { DeviceLinkingError, DeviceLinkingErrorCode } from "../../../core/types/linkDevice.js";
-//#region src/SeamsWeb/operations/devices/walletHostOwnerAuthority.ts
-const OWNER_AUTHORIZATION_PATH = "/wallet/device-linking/v1/owner-authorization";
-/** An owner request that received no answer: the network failed, or it timed out. */
-var WalletHostOwnerRequestTransportError = class extends Error {
-	constructor(code, message) {
-		super(`Owner Router request failed: ${message}`);
-		this.code = code;
-		this.name = "WalletHostOwnerRequestTransportError";
-	}
-};
-function createWalletHostOwnerAuthoritiesV1(input) {
-	const context = normalizeContext(input);
-	return {
-		ownerAuthorization: { authenticateOwnerForLinkingV1: async (request) => await authorizeOwnerForLinkingV1(context, request) },
-		ownerRequest: { requestOwnerV1: async (request) => await requestAsAuthorizedOwnerV1(context, request) },
-		managementRequest: { request: async (request) => await requestManagementAsOwnerV1(context, request) }
-	};
-}
-function normalizeContext(input) {
-	const baseUrl = String(input.relayerUrl || "").trim().replace(/\/+$/, "");
-	if (!baseUrl) throw new Error("Wallet-host device linking requires a Router URL");
-	return {
-		...input,
-		baseUrl
-	};
-}
-/**
-* The fail-closed preflight, exact result `wallet_unlock_required`.
-*
-* The locked and missing-session arms run before any network I/O. The
-* export-root arm runs after the stateless owner-authorization read, because
-* whether Ed25519 export access is needed comes from the server-derived
-* source signer manifest - but still before the QR claim and everything after
-* it: the flow creates no claim, approval, credential, recipient package, or
-* authenticator prompt. Unlocking is the user's explicit act on the wallet
-* surface — never a side effect of scanning a QR.
-*/
-function walletUnlockRequiredV1() {
-	return new DeviceLinkingError("wallet_unlock_required", DeviceLinkingErrorCode.WALLET_UNLOCK_REQUIRED, "authorization");
-}
-async function authorizeOwnerForLinkingV1(context, input) {
-	const state = context.readWalletAuthenticationState();
-	if (state.kind !== "authenticated") throw walletUnlockRequiredV1();
-	await awaitNearProvisioningInFlight(state.walletId);
-	const session = await requireActiveWalletSessionForSelectedMethodV1(context, state.walletId);
-	const response = await requestWithExactSessionV1(context, session, {
-		method: "POST",
-		canonicalPath: OWNER_AUTHORIZATION_PATH,
-		body: parseLinkedDeviceOwnerAuthorizationRequestV1({
-			payload: input.payload,
-			requestedAtMs: input.requestedAtMs
-		})
-	});
-	if (response.status < 200 || response.status >= 300) throw new Error(ownerRequestFailureMessage(response));
-	const parsed = parseOwnerAuthorizationResponseV1(response.body, session);
-	const exportRootRequired = hasDelegatedWalletPermissionV1(input.payload.requestedPermission, "export_keys") && parsed.sourceSignerManifest.keyFamilies.some((family) => family === "ed25519");
-	const ed25519ExportRootCapability = exportRootRequired ? context.readUnlockedEd25519ExportRootCapabilityV1(state.walletId) : void 0;
-	if (exportRootRequired && (!ed25519ExportRootCapability || ed25519ExportRootCapability.walletId !== String(state.walletId) || ed25519ExportRootCapability.walletSessionId !== String(session.operationCredential.walletSessionId) || ed25519ExportRootCapability.expiresAtMs <= Date.now())) throw walletUnlockRequiredV1();
-	if (exportRootRequired) {
-		if (!ed25519ExportRootCapability) throw walletUnlockRequiredV1();
-		return {
-			...parsed,
-			exportRootRequirement: "required",
-			ed25519ExportRootCapability
-		};
-	}
-	return {
-		...parsed,
-		exportRootRequirement: "not_required"
-	};
-}
-async function requestAsAuthorizedOwnerV1(context, input) {
-	if (input.authentication.source.kind !== "wallet_session") throw new Error("Wallet-host device linking requires a reusable owner Wallet Session");
-	const state = context.readWalletAuthenticationState();
-	if (state.kind !== "authenticated") throw walletUnlockRequiredV1();
-	const session = await requireActiveWalletSessionForSelectedMethodV1(context, state.walletId);
-	if (input.authentication.source.walletSessionId !== session.operationCredential.walletSessionId || input.authentication.source.authorizationId !== session.record.authorizationId) throw new Error("Owner Wallet Session identity changed after authorization");
-	return await requestWithExactSessionV1(context, session, input);
-}
-async function requestManagementAsOwnerV1(context, input) {
-	return await requestWithExactSessionV1(context, await requireActiveWalletSessionForSelectedMethodV1(context, input.walletId), input);
-}
-async function requireActiveWalletSessionForSelectedMethodV1(context, walletId) {
-	const selected = await context.resolveSelectedWalletAuthority(walletId);
-	if (selected.kind !== "resolved") throw walletUnlockRequiredV1();
-	const { selection, authMethod, authority } = selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== walletId || authMethod.walletAuthorityId !== authority.authorityId || authMethod.status !== "active" || authority.walletId !== walletId || authority.state !== "active") throw walletUnlockRequiredV1();
-	const read = await context.walletSessions.readExactWithOperationCredential({
-		walletId,
-		authorityId: authority.authorityId,
-		authMethodId: authMethod.walletAuthMethodId
-	});
-	switch (read.kind) {
-		case "found": break;
-		case "missing": throw walletUnlockRequiredV1();
-		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError("Stored owner Wallet Session requires a newer client");
-		default: throw new Error("Unsupported owner Wallet Session read result");
-	}
-	if (read.record.authorityDigestB64u !== authority.authorityDigestB64u || read.record.authorityRevocationEpoch !== authority.revocationEpoch || read.record.expiresAtMs <= Date.now()) throw walletUnlockRequiredV1();
-	return read;
-}
-async function requestWithExactSessionV1(context, session, input) {
-	return await requestWithCredentialV1(context, session.operationCredential.token, input);
-}
-async function requestWithCredentialV1(context, walletSessionToken, input) {
-	const response = await context.http.request({
-		method: input.method,
-		url: `${context.baseUrl}${input.canonicalPath}`,
-		headers: { authorization: `Bearer ${walletSessionToken}` },
-		...input.body === void 0 ? {} : { body: input.body }
-	});
-	if (!response.ok) throw new WalletHostOwnerRequestTransportError(response.code, response.message);
-	return response.value;
-}
-function parseOwnerAuthorizationResponseV1(raw, session) {
-	const record = parseWalletHostOwnerAuthorizationResponseRecordV1(raw);
-	const authenticationRecord = parseWalletHostOwnerAuthorizationAuthenticationRecordV1(record.authentication);
-	if (authenticationRecord.kind !== "link_session_authenticated_request_v1") throw new Error("Owner authorization authentication kind is invalid");
-	const source = parseLinkedDeviceOwnerAuthorizationSourceV1(authenticationRecord.source);
-	const ownerAuthorization = parseLinkedDeviceOwnerAuthorizationSourceV1(record.ownerAuthorization);
-	assertWalletSessionSourceMatchesExactSession(source, session);
-	assertSameOwnerAuthorization(source, ownerAuthorization);
-	const authentication = {
-		kind: "link_session_authenticated_request_v1",
-		source,
-		proofDigestB64u: parseDigestB64u(authenticationRecord.proofDigestB64u)
-	};
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok || walletId.value !== session.record.walletId) throw new Error("Owner authorization wallet identity changed");
-	return {
-		authentication,
-		walletId: walletId.value,
-		ownerAuthorization,
-		sourceSignerManifest: parseExactAdministeredSignerManifestV1(record.sourceSignerManifest),
-		expiresAtMs: positiveSafeInteger(record.expiresAtMs, "expiresAtMs")
-	};
-}
-function assertWalletSessionSourceMatchesExactSession(source, session) {
-	if (source.kind !== "wallet_session") throw new Error("Owner authorization did not return a Wallet Session source");
-	if (source.walletSessionId !== session.operationCredential.walletSessionId) throw new Error("Owner authorization Wallet Session id changed");
-	if (source.authorizationId !== session.record.authorizationId) throw new Error("Owner authorization id changed");
-}
-function assertSameOwnerAuthorization(left, right) {
-	if (left.kind !== "wallet_session" || right.kind !== "wallet_session" || left.walletSessionId !== right.walletSessionId || left.authorizationId !== right.authorizationId) throw new Error("Owner authorization source changed");
-}
-function parseWalletHostOwnerAuthorizationResponseRecordV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Owner authorization response must be an object");
-	if (!isWalletHostOwnerAuthorizationResponseRecordV1(raw)) throw new Error("Owner authorization response has unexpected fields");
-	return raw;
-}
-function isWalletHostOwnerAuthorizationResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "authentication|expiresAtMs|ownerAuthorization|sourceSignerManifest|walletId";
-}
-function parseWalletHostOwnerAuthorizationAuthenticationRecordV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Owner authorization response must be an object");
-	if (!isWalletHostOwnerAuthorizationAuthenticationRecordV1(raw)) throw new Error("Owner authorization response has unexpected fields");
-	return raw;
-}
-function isWalletHostOwnerAuthorizationAuthenticationRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "kind|proofDigestB64u|source";
-}
-function ownerRequestFailureMessage(response) {
-	const message = parseOwnerRequestFailureMessage(response.body);
-	if (message) return `Owner authorization failed: ${message}`;
-	return `Owner authorization failed with HTTP ${response.status}`;
-}
-function parseOwnerRequestFailureMessage(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (!isOwnerRequestFailureRecordV1(raw)) return null;
-	if (raw.ok !== false || typeof raw.code !== "string") return null;
-	return typeof raw.message === "string" && raw.message.trim() ? raw.message : null;
-}
-function isOwnerRequestFailureRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "code|message|ok";
-}
-function positiveSafeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return Number(raw);
-}
-//#endregion
-export { WalletHostOwnerRequestTransportError, createWalletHostOwnerAuthoritiesV1 };
-
-//# sourceMappingURL=walletHostOwnerAuthority.js.map

package/dist/esm/SeamsWeb/operations/evm/index.js

@@ -1,35 +0,0 @@
-//#region src/SeamsWeb/operations/evm/index.ts
-function buildEvmWalletRegistrationArgs(args) {
-	if (!args.chainTargets.length) throw new Error("[SeamsWeb][evm] registerEvmWallet requires at least one chain target");
-	if (!args.participantIds.length) throw new Error("[SeamsWeb][evm] registerEvmWallet requires participant ids");
-	if (!args.authMethod) throw new Error("[SeamsWeb][evm] registerEvmWallet requires an explicit authMethod");
-	return {
-		wallet: { kind: "server_allocated" },
-		authMethod: args.authMethod,
-		signerSelection: {
-			kind: "signer_set",
-			signers: [{
-				kind: "evm_family_ecdsa",
-				chainTargets: [...args.chainTargets],
-				participantIds: [...args.participantIds]
-			}]
-		},
-		options: args.options || {}
-	};
-}
-function buildEvmBootstrapArgs(configs, args) {
-	const managedRegistration = configs.registration.mode === "managed" ? configs.registration : null;
-	const runtimeScopeBootstrap = args.runtimeScopeBootstrap || (managedRegistration ? {
-		projectEnvironmentId: managedRegistration.projectEnvironmentId,
-		publishableKey: managedRegistration.publishableKey
-	} : void 0);
-	if (args.chainTarget.kind !== "evm") throw new Error("[SeamsWeb][evm] bootstrapEcdsaSession requires an EVM chainTarget");
-	return {
-		...args,
-		...runtimeScopeBootstrap ? { runtimeScopeBootstrap } : {}
-	};
-}
-//#endregion
-export { buildEvmBootstrapArgs, buildEvmWalletRegistrationArgs };
-
-//# sourceMappingURL=index.js.map