@shuttle.technology/authorization 0.0.0-stage → 0.2.0

package/dist/mobile.d.ts

@@ -0,0 +1,64 @@
+export interface MobileSecureStorage {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export interface MobileAssociationInput {
+    redirectUri: string;
+    applicationIdentifier: string;
+}
+export interface MobileAssociationVerification {
+    source: "os_verified_https_association";
+    redirectUri: string;
+    applicationIdentifier: string;
+}
+/**
+ * Host/native trust boundary. Implementations must ask the operating system to
+ * verify the configured HTTPS app/universal-link association. On iOS, where no
+ * API reports that verification, the system makes it when an authentication
+ * session with an HTTPS callback starts, and refuses to start one for an app
+ * the domain does not name; a bridge whose openSystemBrowser opens exactly
+ * that session answers for it. This result is a port contract, not
+ * cryptographic proof produced by this TypeScript package.
+ */
+export interface MobileBrowserBridge {
+    verifyAssociatedRedirect(input: MobileAssociationInput): Promise<MobileAssociationVerification | null>;
+    /**
+     * Opens the URL in the system browser's authentication session
+     * (ASWebAuthenticationSession on iOS, a Custom Tab on Android), never an
+     * embedded web view, and resolves with the URL that session ended on: the
+     * registered app link the provider redirected back to. It resolves with
+     * nothing when no app link came back, for example when the person closed
+     * the browser. A sign-in needs that URL; the other hosted flows take it
+     * from the host through their `complete…` method.
+     */
+    openSystemBrowser(url: string): Promise<string | void> | string | void;
+}
+/**
+ * verifyMobileAssociation asks the host to have the operating system verify
+ * the app link of the exact configured redirect for the configured app, and
+ * accepts only the exact answer for both. It runs when the client is
+ * initialized and again before every sign-in opens the system browser.
+ */
+export declare function verifyMobileAssociation(bridge: MobileBrowserBridge, redirectUri: string, applicationIdentifier: string): Promise<void>;
+/** mobileBridgeComplete checks that the host supplied every mobile port. */
+export declare function mobileBridgeComplete(bridge: MobileBrowserBridge | undefined, storage: MobileSecureStorage | undefined): bridge is MobileBrowserBridge;
+/** mobileApplicationIdentifier is a bundle or package identifier as configuration names it. */
+export declare function mobileApplicationIdentifier(value: unknown): value is string;
+/**
+ * mobileSignInReturn reads what the system browser handed back from a hosted
+ * sign-in: the exact registered redirect with the one-use code and this
+ * sign-in's own state, and nothing else. No app link back, a redirect of
+ * another sign-in or an attempt's redirect is refused before any exchange.
+ */
+export declare function mobileSignInReturn(returned: string | void, redirectUri: string, state: string): {
+    code: string;
+    state: string;
+};
+/**
+ * mobileRefreshKey names the refresh token of one public client in the secure
+ * storage. Its parts are opaque identifiers, which hold no dot, so the key is
+ * unambiguous, and it uses only letters, digits, dots, hyphens and
+ * underscores, which every platform keystore takes as a key.
+ */
+export declare function mobileRefreshKey(tenantId: string, applicationId: string, environmentId: string, clientId: string): string;

package/dist/mobile.js

@@ -0,0 +1,69 @@
+// The mobile host boundary: the ports a native host supplies (the system
+// browser with its verified app link, and the OS secure storage that holds the
+// refresh token), the check of the app link the host reports, and the return
+// of a sign-in from the system browser's authentication session.
+//
+// A mobile app sends no browser Origin. The provider binds its sign-in to the
+// exact registered redirect, an HTTPS app link (iOS universal link, Android
+// app link) on one of the client's registered origins, and to the state and
+// the S256 verifier this client keeps in memory. The browser comes back to the
+// app with the one-use code and the state alone; the access token stays in
+// memory and the refresh token goes only to `MobileSecureStorage`.
+import { ClientFlowError } from "./auth.js";
+import { handoffCallback } from "./redirects.js";
+/**
+ * verifyMobileAssociation asks the host to have the operating system verify
+ * the app link of the exact configured redirect for the configured app, and
+ * accepts only the exact answer for both. It runs when the client is
+ * initialized and again before every sign-in opens the system browser.
+ */
+export async function verifyMobileAssociation(bridge, redirectUri, applicationIdentifier) {
+    let verification;
+    try {
+        verification = await bridge.verifyAssociatedRedirect({ redirectUri, applicationIdentifier });
+    }
+    catch {
+        throw new ClientFlowError("mobile_association_unverified");
+    }
+    if (!exactMobileAssociation(verification, redirectUri, applicationIdentifier))
+        throw new ClientFlowError("mobile_association_unverified");
+}
+/** mobileBridgeComplete checks that the host supplied every mobile port. */
+export function mobileBridgeComplete(bridge, storage) {
+    return Boolean(storage) && Boolean(bridge) && typeof bridge?.verifyAssociatedRedirect === "function" && typeof bridge?.openSystemBrowser === "function";
+}
+/** mobileApplicationIdentifier is a bundle or package identifier as configuration names it. */
+export function mobileApplicationIdentifier(value) {
+    return typeof value === "string" && /^[A-Za-z0-9._-]{1,255}$/.test(value);
+}
+/**
+ * mobileSignInReturn reads what the system browser handed back from a hosted
+ * sign-in: the exact registered redirect with the one-use code and this
+ * sign-in's own state, and nothing else. No app link back, a redirect of
+ * another sign-in or an attempt's redirect is refused before any exchange.
+ */
+export function mobileSignInReturn(returned, redirectUri, state) {
+    if (typeof returned !== "string")
+        throw new ClientFlowError("mobile_redirect_unavailable");
+    const callback = handoffCallback(returned, redirectUri);
+    if (callback.attemptId !== undefined)
+        throw new ClientFlowError("invalid_callback");
+    if (callback.state !== state)
+        throw new ClientFlowError("state_mismatch");
+    return { code: callback.code, state: callback.state };
+}
+/**
+ * mobileRefreshKey names the refresh token of one public client in the secure
+ * storage. Its parts are opaque identifiers, which hold no dot, so the key is
+ * unambiguous, and it uses only letters, digits, dots, hyphens and
+ * underscores, which every platform keystore takes as a key.
+ */
+export function mobileRefreshKey(tenantId, applicationId, environmentId, clientId) {
+    return ["authorization", tenantId, applicationId, environmentId, clientId, "refresh"].join(".");
+}
+function exactMobileAssociation(value, redirectUri, applicationIdentifier) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const result = value;
+    return Object.keys(result).length === 3 && result.source === "os_verified_https_association" && result.redirectUri === redirectUri && result.applicationIdentifier === applicationIdentifier;
+}

package/dist/modeC.d.ts

@@ -0,0 +1,131 @@
+import { type PairedRequestGrant } from "./requestGrant.ts";
+export { canonicalJSON, canonicalJSONBytes, sha256HexLower, MaxCanonicalDepth, type CanonicalValue, } from "./canonicalize.ts";
+export { MaxRequestGrantLifetimeSeconds, MaxRequestGrantRecipients, RequestGrantStore, assertGrantMatches, buildRequestGrantEnrollment, enrollRequestGrant, generateRequestSigningKey, jwkThumbprint, parseRequestGrantResult, parseRequestGrantResultEnvelope, type PairedRequestGrant, type RequestGrantBinding, type RequestGrantBounds, type RequestGrantEnrollment, type RequestGrantEnrollmentCreate, type RequestGrantEnrollmentHost, type RequestGrantResult, type RequestPublicJwk, type RequestSigningKey, } from "./requestGrant.ts";
+/** ModeCProofVersion, Audience, Type and Kind are the closed proof constants of source §2.5. */
+export declare const ModeCProofVersion = "1.0";
+export declare const ModeCProofAudience = "authorization-api:mode-c";
+export declare const ModeCProofType = "auth-user-request+jws";
+export declare const ModeCProofKind = "wallet.send";
+/** ModeCProofPayloadMembers is the exact member count of the signed payload. */
+export declare const ModeCProofPayloadMembers = 17;
+/** MaxModeCProofLifetimeSeconds bounds exp-iat. No grace extends it. */
+export declare const MaxModeCProofLifetimeSeconds = 60;
+/** ModeCJtiBytes is the 256-bit jti entropy that is also the Idempotency-Key. */
+export declare const ModeCJtiBytes = 32;
+/**
+ * MediatedTransferIntent is everything the user chooses. The owner, wallet and
+ * network are never caller-supplied: they come from the grant binding, so a
+ * backend cannot redirect the transfer by naming another wallet.
+ */
+export interface MediatedTransferIntent {
+    readonly recipient: string;
+    readonly amountRaw: string;
+    readonly maxFeeRaw: string;
+}
+/** MediatedTransferDisplay is the exact typed intent that must be rendered before signing. */
+export interface MediatedTransferDisplay {
+    readonly kind: "wallet.send";
+    readonly ownerId: string;
+    readonly walletId: string;
+    readonly network: string;
+    readonly asset: "native";
+    readonly recipient: string;
+    readonly amountRaw: string;
+    readonly maxFeeRaw: string;
+}
+/** MediatedOperationCreate is the closed mediated OperationCreate of source §2.2. */
+export interface MediatedOperationCreate {
+    readonly kind: "wallet.send";
+    readonly owner_type: "account";
+    readonly owner_id: string;
+    readonly wallet_id: string;
+    readonly payload: {
+        readonly network: string;
+        readonly asset: "native";
+        readonly recipient: string;
+        readonly amount_raw: string;
+        readonly max_fee_raw: string;
+    };
+}
+/** PreparedMediatedTransfer is one displayed intent and the exact body it will sign. */
+export interface PreparedMediatedTransfer {
+    readonly display: MediatedTransferDisplay;
+    readonly operation: MediatedOperationCreate;
+}
+/**
+ * SignedMediatedRequest is everything the caller hands to its own customer
+ * backend. `idempotencyKey` is the payload `jti` itself, so no other request
+ * identity can be bound to this proof.
+ */
+export interface SignedMediatedRequest {
+    readonly display: MediatedTransferDisplay;
+    readonly operation: MediatedOperationCreate;
+    readonly userProof: string;
+    readonly idempotencyKey: string;
+    readonly jti: string;
+    readonly requestHash: string;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+/**
+ * prepareMediatedTransfer derives the displayed intent and the exact closed
+ * OperationCreate from the paired grant. It refuses locally before any request
+ * or signature: a recipient outside the frozen allowlist, a noncanonical or
+ * over-ceiling quantity and a zero amount all stop here.
+ */
+export declare function prepareMediatedTransfer(paired: PairedRequestGrant, intent: MediatedTransferIntent): PreparedMediatedTransfer;
+/**
+ * canonicalMediatedRequest is the RFC 8785 serialization the request hash
+ * covers. It is produced from the SDK's own closed body, never from transport
+ * bytes.
+ */
+export declare function canonicalMediatedRequest(operation: MediatedOperationCreate): string;
+/** mediatedRequestHash is the lowercase hex SHA-256 of the canonical request bytes. */
+export declare function mediatedRequestHash(crypto: Crypto, operation: MediatedOperationCreate): Promise<string>;
+/**
+ * modeCProtectedHeader is the closed protected header of source §2.5 in its
+ * exact member order. The header is not canonicalized: `alg`, `typ` and `kid`
+ * are emitted in that order with no whitespace, which is the byte sequence the
+ * server's golden vector pins.
+ */
+export declare function modeCProtectedHeader(requestGrantId: string): string;
+/**
+ * ModeCServerClock carries the authenticated server time of source §2.5. It is
+ * seeded from the grant result's `server_time` and refreshed only from a
+ * current authenticated `/v1/me` response; it installs no local clock override
+ * and no tolerance.
+ */
+export declare class ModeCServerClock {
+    #private;
+    constructor(serverTimeSeconds: number, localNowMs: number);
+    /** adopt accepts one authenticated integer NumericDate reading. */
+    adopt(serverTimeSeconds: number, localNowMs: number): void;
+    /** nowSeconds projects the adopted server reading onto the current local instant. */
+    nowSeconds(localNowMs: number): number;
+}
+/** ModeCSigningRequest is the closed input of `signMediatedRequest`. */
+export interface ModeCSigningRequest {
+    readonly grant: PairedRequestGrant;
+    readonly prepared: PreparedMediatedTransfer;
+    readonly crypto: Crypto;
+    readonly serverNowSeconds: number;
+}
+/**
+ * signMediatedRequest produces the compact ES256 proof over the exact
+ * displayed intent.
+ *
+ * The order is fixed so that every refusal happens before the signing key is
+ * touched: the closed input is checked, the displayed intent is independently
+ * rederived from the grant and compared, the grant window is checked, and only
+ * then are the digest, the 256-bit jti and the signature produced. A caller
+ * that hands this function a string, a blob or any backend-supplied payload is
+ * refused with `opaque_signing_input_refused` and no crypto call occurs.
+ */
+export declare function signMediatedRequest(request: ModeCSigningRequest): Promise<SignedMediatedRequest>;
+/**
+ * assertDisplayedIntent is the display-to-intent consistency check of source
+ * §1.4. The operation is rederived from the grant binding and the displayed
+ * recipient, amount and fee, so a display field changed after preparation and
+ * an operation field changed after display are both refused before signing.
+ */
+export declare function assertDisplayedIntent(grant: PairedRequestGrant, prepared: PreparedMediatedTransfer): void;

package/dist/modeC.js

@@ -0,0 +1,248 @@
+// Mode C typed transfer intent and compact ES256 request proof (source §1.4,
+// §2.2, §2.5).
+//
+// This module owns exactly two client responsibilities: display the typed
+// native wallet.send intent, and sign the canonical bytes of that displayed
+// intent with the enrolled non-extractable key. It performs no HTTP and it
+// exports no forward, approve, refuse or backend-signing helper: forwarding and
+// refusal belong to the customer backend, and operation status and result reads
+// use the generic helpers in `client.ts` (source §1.4, AUTH-009-A05).
+//
+// Every locally detectable fault is refused before any crypto call, so an
+// arbitrary or backend-supplied blob never reaches the signing key.
+import { ClientFlowError, base64url, canonicalDecimal, integer } from "./auth.js";
+import { canonicalJSON, canonicalJSONBytes, sha256HexLower } from "./canonicalize.js";
+import {} from "./requestGrant.js";
+export { canonicalJSON, canonicalJSONBytes, sha256HexLower, MaxCanonicalDepth, } from "./canonicalize.js";
+export { MaxRequestGrantLifetimeSeconds, MaxRequestGrantRecipients, RequestGrantStore, assertGrantMatches, buildRequestGrantEnrollment, enrollRequestGrant, generateRequestSigningKey, jwkThumbprint, parseRequestGrantResult, parseRequestGrantResultEnvelope, } from "./requestGrant.js";
+/** ModeCProofVersion, Audience, Type and Kind are the closed proof constants of source §2.5. */
+export const ModeCProofVersion = "1.0";
+export const ModeCProofAudience = "authorization-api:mode-c";
+export const ModeCProofType = "auth-user-request+jws";
+export const ModeCProofKind = "wallet.send";
+/** ModeCProofPayloadMembers is the exact member count of the signed payload. */
+export const ModeCProofPayloadMembers = 17;
+/** MaxModeCProofLifetimeSeconds bounds exp-iat. No grace extends it. */
+export const MaxModeCProofLifetimeSeconds = 60;
+/** ModeCJtiBytes is the 256-bit jti entropy that is also the Idempotency-Key. */
+export const ModeCJtiBytes = 32;
+const maxUint256 = (1n << 256n) - 1n;
+const printableRecipient = /^[\x21-\x7e]{1,256}$/;
+/**
+ * prepareMediatedTransfer derives the displayed intent and the exact closed
+ * OperationCreate from the paired grant. It refuses locally before any request
+ * or signature: a recipient outside the frozen allowlist, a noncanonical or
+ * over-ceiling quantity and a zero amount all stop here.
+ */
+export function prepareMediatedTransfer(paired, intent) {
+    const declared = closed(intent, ["recipient", "amountRaw", "maxFeeRaw"]);
+    const recipient = declared.recipient;
+    const amountRaw = declared.amountRaw;
+    const maxFeeRaw = declared.maxFeeRaw;
+    if (typeof recipient !== "string" || !printableRecipient.test(recipient) || !paired.grant.bounds.recipientAllowlist.includes(recipient)) {
+        throw new ClientFlowError("invalid_transfer_intent");
+    }
+    if (!rawQuantity(amountRaw, true) || !rawQuantity(maxFeeRaw, false) ||
+        BigInt(amountRaw) > BigInt(paired.grant.bounds.maxAmountRaw) || BigInt(maxFeeRaw) > BigInt(paired.grant.bounds.maxFeeRaw)) {
+        throw new ClientFlowError("invalid_transfer_intent");
+    }
+    const binding = paired.grant.binding;
+    const network = paired.grant.bounds.network;
+    return Object.freeze({
+        display: Object.freeze({
+            kind: "wallet.send", ownerId: binding.accountId, walletId: binding.walletId, network,
+            asset: "native", recipient, amountRaw, maxFeeRaw,
+        }),
+        operation: Object.freeze({
+            kind: "wallet.send", owner_type: "account", owner_id: binding.accountId, wallet_id: binding.walletId,
+            payload: Object.freeze({ network, asset: "native", recipient, amount_raw: amountRaw, max_fee_raw: maxFeeRaw }),
+        }),
+    });
+}
+/**
+ * canonicalMediatedRequest is the RFC 8785 serialization the request hash
+ * covers. It is produced from the SDK's own closed body, never from transport
+ * bytes.
+ */
+export function canonicalMediatedRequest(operation) {
+    const closedOperation = closed(operation, ["kind", "owner_type", "owner_id", "wallet_id", "payload"]);
+    const payload = closed(closedOperation.payload, ["network", "asset", "recipient", "amount_raw", "max_fee_raw"]);
+    if (closedOperation.kind !== ModeCProofKind || closedOperation.owner_type !== "account" || payload.asset !== "native") {
+        throw new ClientFlowError("invalid_transfer_intent");
+    }
+    return canonicalJSON({
+        kind: closedOperation.kind,
+        owner_type: closedOperation.owner_type,
+        owner_id: closedOperation.owner_id,
+        wallet_id: closedOperation.wallet_id,
+        payload: {
+            network: payload.network,
+            asset: payload.asset,
+            recipient: payload.recipient,
+            amount_raw: payload.amount_raw,
+            max_fee_raw: payload.max_fee_raw,
+        },
+    });
+}
+/** mediatedRequestHash is the lowercase hex SHA-256 of the canonical request bytes. */
+export function mediatedRequestHash(crypto, operation) {
+    return sha256HexLower(crypto, new TextEncoder().encode(canonicalMediatedRequest(operation)));
+}
+/**
+ * modeCProtectedHeader is the closed protected header of source §2.5 in its
+ * exact member order. The header is not canonicalized: `alg`, `typ` and `kid`
+ * are emitted in that order with no whitespace, which is the byte sequence the
+ * server's golden vector pins.
+ */
+export function modeCProtectedHeader(requestGrantId) {
+    return `{"alg":"ES256","typ":${JSON.stringify(ModeCProofType)},"kid":${JSON.stringify(requestGrantId)}}`;
+}
+/**
+ * ModeCServerClock carries the authenticated server time of source §2.5. It is
+ * seeded from the grant result's `server_time` and refreshed only from a
+ * current authenticated `/v1/me` response; it installs no local clock override
+ * and no tolerance.
+ */
+export class ModeCServerClock {
+    #serverTime;
+    #observedMs;
+    constructor(serverTimeSeconds, localNowMs) {
+        this.#serverTime = 0;
+        this.#observedMs = 0;
+        this.adopt(serverTimeSeconds, localNowMs);
+    }
+    /** adopt accepts one authenticated integer NumericDate reading. */
+    adopt(serverTimeSeconds, localNowMs) {
+        if (!integer(serverTimeSeconds) || serverTimeSeconds <= 0 || !Number.isFinite(localNowMs))
+            throw new ClientFlowError("invalid_server_time");
+        this.#serverTime = serverTimeSeconds;
+        this.#observedMs = localNowMs;
+    }
+    /** nowSeconds projects the adopted server reading onto the current local instant. */
+    nowSeconds(localNowMs) {
+        if (!Number.isFinite(localNowMs))
+            throw new ClientFlowError("invalid_server_time");
+        const elapsed = Math.floor((localNowMs - this.#observedMs) / 1_000);
+        const now = this.#serverTime + elapsed;
+        if (!integer(now) || now <= 0)
+            throw new ClientFlowError("invalid_server_time");
+        return now;
+    }
+}
+/**
+ * signMediatedRequest produces the compact ES256 proof over the exact
+ * displayed intent.
+ *
+ * The order is fixed so that every refusal happens before the signing key is
+ * touched: the closed input is checked, the displayed intent is independently
+ * rederived from the grant and compared, the grant window is checked, and only
+ * then are the digest, the 256-bit jti and the signature produced. A caller
+ * that hands this function a string, a blob or any backend-supplied payload is
+ * refused with `opaque_signing_input_refused` and no crypto call occurs.
+ */
+export async function signMediatedRequest(request) {
+    const input = closed(request, ["grant", "prepared", "crypto", "serverNowSeconds"]);
+    const grant = input.grant;
+    const prepared = input.prepared;
+    const crypto = input.crypto;
+    const serverNowSeconds = input.serverNowSeconds;
+    if (!grant?.grant || !grant.key?.privateKey || !prepared?.display || !prepared.operation)
+        throw new ClientFlowError("opaque_signing_input_refused");
+    if (!crypto?.subtle || typeof crypto.subtle.sign !== "function" || typeof crypto.subtle.digest !== "function" || typeof crypto.getRandomValues !== "function") {
+        throw new ClientFlowError("runtime_capability_unavailable");
+    }
+    assertDisplayedIntent(grant, prepared);
+    if (!integer(serverNowSeconds) || serverNowSeconds <= 0 || serverNowSeconds >= grant.grant.expiresAt) {
+        throw new ClientFlowError("request_grant_reenrollment_required");
+    }
+    const issuedAt = serverNowSeconds;
+    const expiresAt = Math.min(issuedAt + MaxModeCProofLifetimeSeconds, grant.grant.expiresAt);
+    if (expiresAt <= issuedAt || expiresAt - issuedAt > MaxModeCProofLifetimeSeconds)
+        throw new ClientFlowError("request_grant_reenrollment_required");
+    const requestHash = await mediatedRequestHash(crypto, prepared.operation);
+    const jti = base64url(crypto.getRandomValues(new Uint8Array(ModeCJtiBytes)));
+    const binding = grant.grant.binding;
+    const payload = canonicalJSONBytes({
+        version: ModeCProofVersion,
+        aud: ModeCProofAudience,
+        tenant_id: binding.tenantId,
+        application_id: binding.applicationId,
+        environment_id: binding.environmentId,
+        client_id: binding.clientId,
+        account_id: binding.accountId,
+        session_id: binding.sessionId,
+        service_principal_id: binding.servicePrincipalId,
+        wallet_id: binding.walletId,
+        wallet_generation: binding.walletGeneration,
+        mapping_version: binding.mappingVersion,
+        kind: ModeCProofKind,
+        request_hash: requestHash,
+        jti,
+        iat: issuedAt,
+        exp: expiresAt,
+    });
+    const header = new TextEncoder().encode(modeCProtectedHeader(grant.grant.requestGrantId));
+    const signingInput = `${base64url(header)}.${base64url(payload)}`;
+    const signature = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: { name: "SHA-256" } }, grant.key.privateKey, new TextEncoder().encode(signingInput)));
+    // WebCrypto ECDSA already emits the 64-byte R||S encoding JWS requires; a
+    // runtime that returns DER or another length is refused, never reshaped.
+    if (signature.length !== 64)
+        throw new ClientFlowError("invalid_request_signature");
+    return Object.freeze({
+        display: prepared.display,
+        operation: prepared.operation,
+        userProof: `${signingInput}.${base64url(signature)}`,
+        idempotencyKey: jti,
+        jti,
+        requestHash,
+        issuedAt,
+        expiresAt,
+    });
+}
+/**
+ * assertDisplayedIntent is the display-to-intent consistency check of source
+ * §1.4. The operation is rederived from the grant binding and the displayed
+ * recipient, amount and fee, so a display field changed after preparation and
+ * an operation field changed after display are both refused before signing.
+ */
+export function assertDisplayedIntent(grant, prepared) {
+    const display = closed(prepared.display, ["kind", "ownerId", "walletId", "network", "asset", "recipient", "amountRaw", "maxFeeRaw"]);
+    let rederived;
+    try {
+        rederived = prepareMediatedTransfer(grant, {
+            recipient: display.recipient,
+            amountRaw: display.amountRaw,
+            maxFeeRaw: display.maxFeeRaw,
+        });
+    }
+    catch {
+        throw new ClientFlowError("display_intent_mismatch");
+    }
+    const sameDisplay = ["kind", "ownerId", "walletId", "network", "asset", "recipient", "amountRaw", "maxFeeRaw"]
+        .every((member) => display[member] === rederived.display[member]);
+    if (!sameDisplay || canonicalMediatedRequest(prepared.operation) !== canonicalMediatedRequest(rederived.operation)) {
+        throw new ClientFlowError("display_intent_mismatch");
+    }
+}
+/**
+ * closed accepts exactly the named members of a plain object. A string, a
+ * binary blob, an array and any extra or missing member are refused, which is
+ * how arbitrary backend-supplied bytes are rejected before crypto.
+ */
+function closed(value, required) {
+    if (value === null || typeof value !== "object" || Array.isArray(value) || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+        throw new ClientFlowError("opaque_signing_input_refused");
+    }
+    const result = value;
+    const allowed = new Set(required);
+    if (required.some((member) => !(member in result)) || Object.keys(result).some((member) => !allowed.has(member))) {
+        throw new ClientFlowError("opaque_signing_input_refused");
+    }
+    return result;
+}
+function rawQuantity(value, positive) {
+    if (!canonicalDecimal(value))
+        return false;
+    const quantity = BigInt(value);
+    return quantity <= maxUint256 && (!positive || quantity > 0n);
+}