@shuttle.technology/authorization 0.0.0-stage → 0.1.0

package/dist/modeC.d.ts

@@ -0,0 +1,131 @@
+import { type PairedRequestGrant } from "./requestGrant.ts";
+export { canonicalJSON, canonicalJSONBytes, sha256HexLower, MaxCanonicalDepth, type CanonicalValue, } from "./canonicalize.ts";
+export { MaxRequestGrantLifetimeSeconds, MaxRequestGrantRecipients, RequestGrantStore, assertGrantMatches, buildRequestGrantEnrollment, enrollRequestGrant, generateRequestSigningKey, jwkThumbprint, parseRequestGrantResult, parseRequestGrantResultEnvelope, type PairedRequestGrant, type RequestGrantBinding, type RequestGrantBounds, type RequestGrantEnrollment, type RequestGrantEnrollmentCreate, type RequestGrantEnrollmentHost, type RequestGrantResult, type RequestPublicJwk, type RequestSigningKey, } from "./requestGrant.ts";
+/** ModeCProofVersion, Audience, Type and Kind are the closed proof constants of source §2.5. */
+export declare const ModeCProofVersion = "1.0";
+export declare const ModeCProofAudience = "authorization-api:mode-c";
+export declare const ModeCProofType = "auth-user-request+jws";
+export declare const ModeCProofKind = "wallet.send";
+/** ModeCProofPayloadMembers is the exact member count of the signed payload. */
+export declare const ModeCProofPayloadMembers = 17;
+/** MaxModeCProofLifetimeSeconds bounds exp-iat. No grace extends it. */
+export declare const MaxModeCProofLifetimeSeconds = 60;
+/** ModeCJtiBytes is the 256-bit jti entropy that is also the Idempotency-Key. */
+export declare const ModeCJtiBytes = 32;
+/**
+ * MediatedTransferIntent is everything the user chooses. The owner, wallet and
+ * network are never caller-supplied: they come from the grant binding, so a
+ * backend cannot redirect the transfer by naming another wallet.
+ */
+export interface MediatedTransferIntent {
+    readonly recipient: string;
+    readonly amountRaw: string;
+    readonly maxFeeRaw: string;
+}
+/** MediatedTransferDisplay is the exact typed intent that must be rendered before signing. */
+export interface MediatedTransferDisplay {
+    readonly kind: "wallet.send";
+    readonly ownerId: string;
+    readonly walletId: string;
+    readonly network: string;
+    readonly asset: "native";
+    readonly recipient: string;
+    readonly amountRaw: string;
+    readonly maxFeeRaw: string;
+}
+/** MediatedOperationCreate is the closed mediated OperationCreate of source §2.2. */
+export interface MediatedOperationCreate {
+    readonly kind: "wallet.send";
+    readonly owner_type: "account";
+    readonly owner_id: string;
+    readonly wallet_id: string;
+    readonly payload: {
+        readonly network: string;
+        readonly asset: "native";
+        readonly recipient: string;
+        readonly amount_raw: string;
+        readonly max_fee_raw: string;
+    };
+}
+/** PreparedMediatedTransfer is one displayed intent and the exact body it will sign. */
+export interface PreparedMediatedTransfer {
+    readonly display: MediatedTransferDisplay;
+    readonly operation: MediatedOperationCreate;
+}
+/**
+ * SignedMediatedRequest is everything the caller hands to its own customer
+ * backend. `idempotencyKey` is the payload `jti` itself, so no other request
+ * identity can be bound to this proof.
+ */
+export interface SignedMediatedRequest {
+    readonly display: MediatedTransferDisplay;
+    readonly operation: MediatedOperationCreate;
+    readonly userProof: string;
+    readonly idempotencyKey: string;
+    readonly jti: string;
+    readonly requestHash: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+/**
+ * prepareMediatedTransfer derives the displayed intent and the exact closed
+ * OperationCreate from the paired grant. It refuses locally before any request
+ * or signature: a recipient outside the frozen allowlist, a noncanonical or
+ * over-ceiling quantity and a zero amount all stop here.
+ */
+export declare function prepareMediatedTransfer(paired: PairedRequestGrant, intent: MediatedTransferIntent): PreparedMediatedTransfer;
+/**
+ * canonicalMediatedRequest is the RFC 8785 serialization the request hash
+ * covers. It is produced from the SDK's own closed body, never from transport
+ * bytes.
+ */
+export declare function canonicalMediatedRequest(operation: MediatedOperationCreate): string;
+/** mediatedRequestHash is the lowercase hex SHA-256 of the canonical request bytes. */
+export declare function mediatedRequestHash(crypto: Crypto, operation: MediatedOperationCreate): Promise<string>;
+/**
+ * modeCProtectedHeader is the closed protected header of source §2.5 in its
+ * exact member order. The header is not canonicalized: `alg`, `typ` and `kid`
+ * are emitted in that order with no whitespace, which is the byte sequence the
+ * server's golden vector pins.
+ */
+export declare function modeCProtectedHeader(requestGrantId: string): string;
+/**
+ * ModeCServerClock carries the authenticated server time of source §2.5. It is
+ * seeded from the grant result's `server_time` and refreshed only from a
+ * current authenticated `/v1/me` response; it installs no local clock override
+ * and no tolerance.
+ */
+export declare class ModeCServerClock {
+    #private;
+    constructor(serverTimeSeconds: number, localNowMs: number);
+    /** adopt accepts one authenticated integer NumericDate reading. */
+    adopt(serverTimeSeconds: number, localNowMs: number): void;
+    /** nowSeconds projects the adopted server reading onto the current local instant. */
+    nowSeconds(localNowMs: number): number;
+}
+/** ModeCSigningRequest is the closed input of `signMediatedRequest`. */
+export interface ModeCSigningRequest {
+    readonly grant: PairedRequestGrant;
+    readonly prepared: PreparedMediatedTransfer;
+    readonly crypto: Crypto;
+    readonly serverNowSeconds: number;
+}
+/**
+ * signMediatedRequest produces the compact ES256 proof over the exact
+ * displayed intent.
+ *
+ * The order is fixed so that every refusal happens before the signing key is
+ * touched: the closed input is checked, the displayed intent is independently
+ * rederived from the grant and compared, the grant window is checked, and only
+ * then are the digest, the 256-bit jti and the signature produced. A caller
+ * that hands this function a string, a blob or any backend-supplied payload is
+ * refused with `opaque_signing_input_refused` and no crypto call occurs.
+ */
+export declare function signMediatedRequest(request: ModeCSigningRequest): Promise<SignedMediatedRequest>;
+/**
+ * assertDisplayedIntent is the display-to-intent consistency check of source
+ * §1.4. The operation is rederived from the grant binding and the displayed
+ * recipient, amount and fee, so a display field changed after preparation and
+ * an operation field changed after display are both refused before signing.
+ */
+export declare function assertDisplayedIntent(grant: PairedRequestGrant, prepared: PreparedMediatedTransfer): void;

package/dist/modeC.js

@@ -0,0 +1,248 @@
+// Mode C typed transfer intent and compact ES256 request proof (source §1.4,
+// §2.2, §2.5).
+//
+// This module owns exactly two client responsibilities: display the typed
+// native wallet.send intent, and sign the canonical bytes of that displayed
+// intent with the enrolled non-extractable key. It performs no HTTP and it
+// exports no forward, approve, refuse or backend-signing helper: forwarding and
+// refusal belong to the customer backend, and operation status and result reads
+// use the generic helpers in `client.ts` (source §1.4, AUTH-009-A05).
+//
+// Every locally detectable fault is refused before any crypto call, so an
+// arbitrary or backend-supplied blob never reaches the signing key.
+import { ClientFlowError, base64url, canonicalDecimal, integer } from "./auth.js";
+import { canonicalJSON, canonicalJSONBytes, sha256HexLower } from "./canonicalize.js";
+import {} from "./requestGrant.js";
+export { canonicalJSON, canonicalJSONBytes, sha256HexLower, MaxCanonicalDepth, } from "./canonicalize.js";
+export { MaxRequestGrantLifetimeSeconds, MaxRequestGrantRecipients, RequestGrantStore, assertGrantMatches, buildRequestGrantEnrollment, enrollRequestGrant, generateRequestSigningKey, jwkThumbprint, parseRequestGrantResult, parseRequestGrantResultEnvelope, } from "./requestGrant.js";
+/** ModeCProofVersion, Audience, Type and Kind are the closed proof constants of source §2.5. */
+export const ModeCProofVersion = "1.0";
+export const ModeCProofAudience = "authorization-api:mode-c";
+export const ModeCProofType = "auth-user-request+jws";
+export const ModeCProofKind = "wallet.send";
+/** ModeCProofPayloadMembers is the exact member count of the signed payload. */
+export const ModeCProofPayloadMembers = 17;
+/** MaxModeCProofLifetimeSeconds bounds exp-iat. No grace extends it. */
+export const MaxModeCProofLifetimeSeconds = 60;
+/** ModeCJtiBytes is the 256-bit jti entropy that is also the Idempotency-Key. */
+export const ModeCJtiBytes = 32;
+const maxUint256 = (1n << 256n) - 1n;
+const printableRecipient = /^[\x21-\x7e]{1,256}$/;
+/**
+ * prepareMediatedTransfer derives the displayed intent and the exact closed
+ * OperationCreate from the paired grant. It refuses locally before any request
+ * or signature: a recipient outside the frozen allowlist, a noncanonical or
+ * over-ceiling quantity and a zero amount all stop here.
+ */
+export function prepareMediatedTransfer(paired, intent) {
+    const declared = closed(intent, ["recipient", "amountRaw", "maxFeeRaw"]);
+    const recipient = declared.recipient;
+    const amountRaw = declared.amountRaw;
+    const maxFeeRaw = declared.maxFeeRaw;
+    if (typeof recipient !== "string" || !printableRecipient.test(recipient) || !paired.grant.bounds.recipientAllowlist.includes(recipient)) {
+        throw new ClientFlowError("invalid_transfer_intent");
+    }
+    if (!rawQuantity(amountRaw, true) || !rawQuantity(maxFeeRaw, false) ||
+        BigInt(amountRaw) > BigInt(paired.grant.bounds.maxAmountRaw) || BigInt(maxFeeRaw) > BigInt(paired.grant.bounds.maxFeeRaw)) {
+        throw new ClientFlowError("invalid_transfer_intent");
+    }
+    const binding = paired.grant.binding;
+    const network = paired.grant.bounds.network;
+    return Object.freeze({
+        display: Object.freeze({
+            kind: "wallet.send", ownerId: binding.accountId, walletId: binding.walletId, network,
+            asset: "native", recipient, amountRaw, maxFeeRaw,
+        }),
+        operation: Object.freeze({
+            kind: "wallet.send", owner_type: "account", owner_id: binding.accountId, wallet_id: binding.walletId,
+            payload: Object.freeze({ network, asset: "native", recipient, amount_raw: amountRaw, max_fee_raw: maxFeeRaw }),
+        }),
+    });
+}
+/**
+ * canonicalMediatedRequest is the RFC 8785 serialization the request hash
+ * covers. It is produced from the SDK's own closed body, never from transport
+ * bytes.
+ */
+export function canonicalMediatedRequest(operation) {
+    const closedOperation = closed(operation, ["kind", "owner_type", "owner_id", "wallet_id", "payload"]);
+    const payload = closed(closedOperation.payload, ["network", "asset", "recipient", "amount_raw", "max_fee_raw"]);
+    if (closedOperation.kind !== ModeCProofKind || closedOperation.owner_type !== "account" || payload.asset !== "native") {
+        throw new ClientFlowError("invalid_transfer_intent");
+    }
+    return canonicalJSON({
+        kind: closedOperation.kind,
+        owner_type: closedOperation.owner_type,
+        owner_id: closedOperation.owner_id,
+        wallet_id: closedOperation.wallet_id,
+        payload: {
+            network: payload.network,
+            asset: payload.asset,
+            recipient: payload.recipient,
+            amount_raw: payload.amount_raw,
+            max_fee_raw: payload.max_fee_raw,
+        },
+    });
+}
+/** mediatedRequestHash is the lowercase hex SHA-256 of the canonical request bytes. */
+export function mediatedRequestHash(crypto, operation) {
+    return sha256HexLower(crypto, new TextEncoder().encode(canonicalMediatedRequest(operation)));
+}
+/**
+ * modeCProtectedHeader is the closed protected header of source §2.5 in its
+ * exact member order. The header is not canonicalized: `alg`, `typ` and `kid`
+ * are emitted in that order with no whitespace, which is the byte sequence the
+ * server's golden vector pins.
+ */
+export function modeCProtectedHeader(requestGrantId) {
+    return `{"alg":"ES256","typ":${JSON.stringify(ModeCProofType)},"kid":${JSON.stringify(requestGrantId)}}`;
+}
+/**
+ * ModeCServerClock carries the authenticated server time of source §2.5. It is
+ * seeded from the grant result's `server_time` and refreshed only from a
+ * current authenticated `/v1/me` response; it installs no local clock override
+ * and no tolerance.
+ */
+export class ModeCServerClock {
+    #serverTime;
+    #observedMs;
+    constructor(serverTimeSeconds, localNowMs) {
+        this.#serverTime = 0;
+        this.#observedMs = 0;
+        this.adopt(serverTimeSeconds, localNowMs);
+    }
+    /** adopt accepts one authenticated integer NumericDate reading. */
+    adopt(serverTimeSeconds, localNowMs) {
+        if (!integer(serverTimeSeconds) || serverTimeSeconds <= 0 || !Number.isFinite(localNowMs))
+            throw new ClientFlowError("invalid_server_time");
+        this.#serverTime = serverTimeSeconds;
+        this.#observedMs = localNowMs;
+    }
+    /** nowSeconds projects the adopted server reading onto the current local instant. */
+    nowSeconds(localNowMs) {
+        if (!Number.isFinite(localNowMs))
+            throw new ClientFlowError("invalid_server_time");
+        const elapsed = Math.floor((localNowMs - this.#observedMs) / 1_000);
+        const now = this.#serverTime + elapsed;
+        if (!integer(now) || now <= 0)
+            throw new ClientFlowError("invalid_server_time");
+        return now;
+    }
+}
+/**
+ * signMediatedRequest produces the compact ES256 proof over the exact
+ * displayed intent.
+ *
+ * The order is fixed so that every refusal happens before the signing key is
+ * touched: the closed input is checked, the displayed intent is independently
+ * rederived from the grant and compared, the grant window is checked, and only
+ * then are the digest, the 256-bit jti and the signature produced. A caller
+ * that hands this function a string, a blob or any backend-supplied payload is
+ * refused with `opaque_signing_input_refused` and no crypto call occurs.
+ */
+export async function signMediatedRequest(request) {
+    const input = closed(request, ["grant", "prepared", "crypto", "serverNowSeconds"]);
+    const grant = input.grant;
+    const prepared = input.prepared;
+    const crypto = input.crypto;
+    const serverNowSeconds = input.serverNowSeconds;
+    if (!grant?.grant || !grant.key?.privateKey || !prepared?.display || !prepared.operation)
+        throw new ClientFlowError("opaque_signing_input_refused");
+    if (!crypto?.subtle || typeof crypto.subtle.sign !== "function" || typeof crypto.subtle.digest !== "function" || typeof crypto.getRandomValues !== "function") {
+        throw new ClientFlowError("runtime_capability_unavailable");
+    }
+    assertDisplayedIntent(grant, prepared);
+    if (!integer(serverNowSeconds) || serverNowSeconds <= 0 || serverNowSeconds >= grant.grant.expiresAt) {
+        throw new ClientFlowError("request_grant_reenrollment_required");
+    }
+    const issuedAt = serverNowSeconds;
+    const expiresAt = Math.min(issuedAt + MaxModeCProofLifetimeSeconds, grant.grant.expiresAt);
+    if (expiresAt <= issuedAt || expiresAt - issuedAt > MaxModeCProofLifetimeSeconds)
+        throw new ClientFlowError("request_grant_reenrollment_required");
+    const requestHash = await mediatedRequestHash(crypto, prepared.operation);
+    const jti = base64url(crypto.getRandomValues(new Uint8Array(ModeCJtiBytes)));
+    const binding = grant.grant.binding;
+    const payload = canonicalJSONBytes({
+        version: ModeCProofVersion,
+        aud: ModeCProofAudience,
+        tenant_id: binding.tenantId,
+        application_id: binding.applicationId,
+        environment_id: binding.environmentId,
+        client_id: binding.clientId,
+        account_id: binding.accountId,
+        session_id: binding.sessionId,
+        service_principal_id: binding.servicePrincipalId,
+        wallet_id: binding.walletId,
+        wallet_generation: binding.walletGeneration,
+        mapping_version: binding.mappingVersion,
+        kind: ModeCProofKind,
+        request_hash: requestHash,
+        jti,
+        iat: issuedAt,
+        exp: expiresAt,
+    });
+    const header = new TextEncoder().encode(modeCProtectedHeader(grant.grant.requestGrantId));
+    const signingInput = `${base64url(header)}.${base64url(payload)}`;
+    const signature = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: { name: "SHA-256" } }, grant.key.privateKey, new TextEncoder().encode(signingInput)));
+    // WebCrypto ECDSA already emits the 64-byte R||S encoding JWS requires; a
+    // runtime that returns DER or another length is refused, never reshaped.
+    if (signature.length !== 64)
+        throw new ClientFlowError("invalid_request_signature");
+    return Object.freeze({
+        display: prepared.display,
+        operation: prepared.operation,
+        userProof: `${signingInput}.${base64url(signature)}`,
+        idempotencyKey: jti,
+        jti,
+        requestHash,
+        issuedAt,
+        expiresAt,
+    });
+}
+/**
+ * assertDisplayedIntent is the display-to-intent consistency check of source
+ * §1.4. The operation is rederived from the grant binding and the displayed
+ * recipient, amount and fee, so a display field changed after preparation and
+ * an operation field changed after display are both refused before signing.
+ */
+export function assertDisplayedIntent(grant, prepared) {
+    const display = closed(prepared.display, ["kind", "ownerId", "walletId", "network", "asset", "recipient", "amountRaw", "maxFeeRaw"]);
+    let rederived;
+    try {
+        rederived = prepareMediatedTransfer(grant, {
+            recipient: display.recipient,
+            amountRaw: display.amountRaw,
+            maxFeeRaw: display.maxFeeRaw,
+        });
+    }
+    catch {
+        throw new ClientFlowError("display_intent_mismatch");
+    }
+    const sameDisplay = ["kind", "ownerId", "walletId", "network", "asset", "recipient", "amountRaw", "maxFeeRaw"]
+        .every((member) => display[member] === rederived.display[member]);
+    if (!sameDisplay || canonicalMediatedRequest(prepared.operation) !== canonicalMediatedRequest(rederived.operation)) {
+        throw new ClientFlowError("display_intent_mismatch");
+    }
+}
+/**
+ * closed accepts exactly the named members of a plain object. A string, a
+ * binary blob, an array and any extra or missing member are refused, which is
+ * how arbitrary backend-supplied bytes are rejected before crypto.
+ */
+function closed(value, required) {
+    if (value === null || typeof value !== "object" || Array.isArray(value) || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+        throw new ClientFlowError("opaque_signing_input_refused");
+    }
+    const result = value;
+    const allowed = new Set(required);
+    if (required.some((member) => !(member in result)) || Object.keys(result).some((member) => !allowed.has(member))) {
+        throw new ClientFlowError("opaque_signing_input_refused");
+    }
+    return result;
+}
+function rawQuantity(value, positive) {
+    if (!canonicalDecimal(value))
+        return false;
+    const quantity = BigInt(value);
+    return quantity <= maxUint256 && (!positive || quantity > 0n);
+}

package/dist/modeCLinked.d.ts

@@ -0,0 +1,207 @@
+import { type RequestSigningKey } from "./requestGrant.ts";
+import type { DeviceSharePackage } from "./walletOperations.ts";
+export { ModeCServerClock, MaxModeCProofLifetimeSeconds } from "./modeC.ts";
+export { generateRequestSigningKey, type RequestSigningKey } from "./requestGrant.ts";
+/** ModeCLinkedProofVersion is the proof of a transfer from a linked wallet. */
+export declare const ModeCLinkedProofVersion = "2.0";
+/** The assets a linked grant may name. */
+export declare const LinkedModeCAssets: readonly ["native", "usdt", "usdc"];
+export type LinkedModeCAsset = (typeof LinkedModeCAssets)[number];
+export interface LinkedAssetCeiling {
+    readonly asset: LinkedModeCAsset;
+    /** The most one transfer of the asset may move, in its minimal units. */
+    readonly maxAmountRaw: string;
+}
+/** LinkedRequestGrantEnrollment is what the person sets and confirms with the passkey. */
+export interface LinkedRequestGrantEnrollment {
+    readonly ownerId: string;
+    readonly servicePrincipalId: string;
+    readonly linkedWalletId: string;
+    /** The network the transfers are made on: the wallet's own, or for an EVM wallet another EVM network. */
+    readonly network: string;
+    readonly assets: readonly LinkedAssetCeiling[];
+    /** Zero to ten recipients; none means any recipient. */
+    readonly recipientAllowlist: readonly string[];
+    /** The most the network fee may be, in minimal units of the network's own coin. */
+    readonly maxFeeRaw: string;
+}
+/** The closed session.authorize_requests OperationCreate of a linked wallet. */
+export interface LinkedRequestGrantEnrollmentCreate {
+    readonly kind: "session.authorize_requests";
+    readonly owner_type: "account";
+    readonly owner_id: string;
+    /** Who may read the grant; absent, the account itself. */
+    readonly result_recipient?: {
+        readonly type: "account" | "service";
+        readonly id: string;
+    };
+    readonly payload: {
+        readonly public_jwk: {
+            readonly kty: "EC";
+            readonly crv: "P-256";
+            readonly x: string;
+            readonly y: string;
+        };
+        readonly service_principal_id: string;
+        readonly linked_wallet_id: string;
+        readonly network: string;
+        readonly assets: readonly {
+            readonly asset: LinkedModeCAsset;
+            readonly max_amount_raw: string;
+        }[];
+        readonly recipient_allowlist: readonly string[];
+        readonly max_fee_raw: string;
+    };
+}
+/** The enrollment as the person confirms it, read back with the operation. */
+export interface LinkedEnrollmentDisplay {
+    kind: "session.authorize_requests";
+    ownerId: string;
+    requesterId: string;
+    servicePrincipalId: string;
+    linkedWalletId: string;
+    address: string;
+    network: string;
+    assets: readonly LinkedAssetCeiling[];
+    recipientAllowlist: readonly string[];
+    maxFeeRaw: string;
+    publicKeyThumbprint: string;
+}
+/** The grant the enrollment issued: its identity, binding and bounds. Times are NumericDate seconds. */
+export interface LinkedRequestGrantResult {
+    readonly requestGrantId: string;
+    readonly publicKeyThumbprint: string;
+    readonly serverTime: number;
+    readonly expiresAt: number;
+    readonly binding: {
+        readonly tenantId: string;
+        readonly applicationId: string;
+        readonly environmentId: string;
+        readonly clientId: string;
+        readonly accountId: string;
+        readonly sessionId: string;
+        readonly servicePrincipalId: string;
+        readonly linkedWalletId: string;
+        readonly bindingRevision: string;
+    };
+    readonly bounds: {
+        readonly network: string;
+        readonly recipientAllowlist: readonly string[];
+        readonly assets: readonly LinkedAssetCeiling[];
+        readonly maxFeeRaw: string;
+    };
+}
+/** One linked grant beside the exact key that signs under it. */
+export interface PairedLinkedRequestGrant {
+    readonly grant: LinkedRequestGrantResult;
+    readonly key: RequestSigningKey;
+}
+/**
+ * canonicalAddress is a recipient in the form the network compares addresses
+ * by, as the provider keeps it: an EVM address in lower case, a TON address
+ * raw (workchain:hash in lower-case hex, from the user-friendly form when its
+ * checksum holds), anything else as given. An address that is not well formed
+ * for its network is returned unchanged, as the provider does.
+ */
+export declare function canonicalAddress(network: string, address: string): string;
+/** sameAddress compares two recipients as the network compares addresses. */
+export declare function sameAddress(network: string, a: string, b: string): boolean;
+/** buildLinkedRequestGrantEnrollment checks every bound locally and returns the closed create body. */
+export declare function buildLinkedRequestGrantEnrollment(key: RequestSigningKey, enrollment: LinkedRequestGrantEnrollment): LinkedRequestGrantEnrollmentCreate;
+/** validateLinkedEnrollmentCreate is the client's createOperation check of the body above. */
+export declare function validateLinkedEnrollmentCreate(value: unknown, expectedOwnerId: string): void;
+/** parseLinkedEnrollmentDisplay reads the enrollment display of a linked wallet. */
+export declare function parseLinkedEnrollmentDisplay(value: unknown): LinkedEnrollmentDisplay;
+/** parseLinkedRequestGrantResult accepts exactly the protected result of a linked grant. */
+export declare function parseLinkedRequestGrantResult(payload: unknown): LinkedRequestGrantResult;
+/**
+ * pairLinkedRequestGrant keeps a grant beside the key that enrolled it, and
+ * refuses one that is not this key's grant on these bounds: another key, owner,
+ * service, wallet, network, asset ceiling, fee ceiling or recipient list.
+ */
+export declare function pairLinkedRequestGrant(key: RequestSigningKey, grant: LinkedRequestGrantResult, enrollment: LinkedRequestGrantEnrollment): PairedLinkedRequestGrant;
+/** What the person chooses for one transfer. A comment is carried on TON only. */
+export interface LinkedTransferIntent {
+    readonly asset: LinkedModeCAsset;
+    readonly recipient: string;
+    readonly amountRaw: string;
+    readonly comment?: string;
+}
+/** The closed OperationCreate a linked transfer's request hash covers. */
+export interface LinkedMediatedOperationCreate {
+    readonly kind: "wallet.send";
+    readonly owner_type: "account";
+    readonly owner_id: string;
+    readonly linked_wallet_id: string;
+    readonly payload: {
+        readonly network: string;
+        readonly asset: LinkedModeCAsset;
+        readonly recipient: string;
+        readonly amount_raw: string;
+        readonly comment?: string;
+    };
+}
+/** The transfer exactly as the app shows it before signing. */
+export interface LinkedTransferDisplay {
+    readonly ownerId: string;
+    readonly linkedWalletId: string;
+    readonly servicePrincipalId: string;
+    readonly network: string;
+    readonly asset: LinkedModeCAsset;
+    readonly recipient: string;
+    readonly amountRaw: string;
+    readonly comment?: string;
+    readonly maxFeeRaw: string;
+}
+export interface PreparedLinkedTransfer {
+    readonly display: LinkedTransferDisplay;
+    readonly operation: LinkedMediatedOperationCreate;
+}
+/**
+ * prepareLinkedMediatedTransfer derives the display and the closed body from
+ * the grant and the person's choice, and refuses before any signature what the
+ * grant does not cover: another asset, an amount over its ceiling, a recipient
+ * off a non-empty list, a comment off TON.
+ */
+export declare function prepareLinkedMediatedTransfer(paired: PairedLinkedRequestGrant, intent: LinkedTransferIntent): PreparedLinkedTransfer;
+/** canonicalLinkedMediatedRequest is the RFC 8785 serialization the request hash covers. */
+export declare function canonicalLinkedMediatedRequest(operation: LinkedMediatedOperationCreate): string;
+/** The device share as the request carries it, snake_case. */
+export interface WireDeviceShare {
+    readonly ciphertext: string;
+    readonly nonce: string;
+    readonly ephemeral_public_key: string;
+    readonly encryption_algorithm: string;
+    readonly encryption_context: string;
+}
+export declare function wireDeviceShare(share: DeviceSharePackage): WireDeviceShare;
+/** deviceShareDigest is the lowercase hex SHA-256 of the RFC 8785 JSON of the share as the request carries it. */
+export declare function deviceShareDigest(crypto: Crypto, share: WireDeviceShare): Promise<string>;
+/** The request the backend forwards, unchanged, with Idempotency-Key = idempotencyKey. */
+export interface LinkedMediatedRequest {
+    readonly operation: LinkedMediatedOperationCreate;
+    readonly user_proof: string;
+    readonly device_share: WireDeviceShare;
+}
+export interface SignedLinkedMediatedRequest {
+    readonly display: LinkedTransferDisplay;
+    readonly request: LinkedMediatedRequest;
+    readonly idempotencyKey: string;
+    readonly requestHash: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+/**
+ * signLinkedMediatedRequest signs the shown transfer and the device share with
+ * the enrolled key as the 2.0 proof. The share is the one sealed to the Wallet
+ * for this transfer (resealDeviceShare); its digest is signed, so the backend
+ * can neither swap it nor change the transfer. The request lives at most 60
+ * seconds and never past the grant.
+ */
+export declare function signLinkedMediatedRequest(input: {
+    grant: PairedLinkedRequestGrant;
+    prepared: PreparedLinkedTransfer;
+    deviceShare: DeviceSharePackage;
+    crypto: Crypto;
+    serverNowSeconds: number;
+}): Promise<SignedLinkedMediatedRequest>;