@shuttle.technology/authorization 0.0.0-stage → 0.2.0

package/dist/walletCreateGrant.js

@@ -0,0 +1,89 @@
+// A wallet's creation that opens the wallet to a service in the same passkey
+// confirmation (owner decision of 28 October 2026): the read grant
+// service_grant.set would give, named beside the wallet. The person confirms
+// once, on a page that names the service and what it may see; the provider
+// sets the grant when the creation's result is read. A grant that cannot be
+// set leaves the wallet as it is, and the result says why: the app then asks
+// for the grant alone (createServiceGrant), with its own passkey confirmation.
+import { ClientFlowError, opaqueId, record } from "./auth.js";
+import { isAuthorizationErrorCode } from "./errors.js";
+import { printableReference, serviceScopes } from "./slice4.js";
+import { lowerUUID } from "./walletDisplayParts.js";
+const order = ["wallet:read", "operation:read", "streams:read"];
+/** validWalletCreateGrant reads the wire member as the provider takes it: one of its services, one to three scopes, an optional printable reference. */
+export function validWalletCreateGrant(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const grant = value;
+    const members = Object.keys(grant);
+    return members.every((member) => member === "service_principal_id" || member === "scopes" || member === "external_ref") &&
+        opaqueId(grant.service_principal_id) && serviceScopes(grant.scopes) && grant.scopes.length >= 1 && (grant.external_ref === undefined || printableReference(grant.external_ref));
+}
+function grantWire(input) {
+    let declared;
+    try {
+        declared = record(input, ["servicePrincipalId", "scopes"], ["externalRef"]);
+    }
+    catch {
+        throw new ClientFlowError("invalid_operation_create");
+    }
+    // The scopes go in the provider's order, so a repeat of the request is the same request.
+    const raw = declared.scopes;
+    const scopes = serviceScopes(raw) ? order.filter((scope) => raw.includes(scope)) : raw;
+    const wire = { service_principal_id: declared.servicePrincipalId, scopes: scopes };
+    if (declared.externalRef !== undefined)
+        wire.external_ref = declared.externalRef;
+    if (!validWalletCreateGrant(wire))
+        throw new ClientFlowError("invalid_operation_create");
+    return wire;
+}
+/** walletCreateBody is the closed wallet.create body of createWallet(): the device key the creation seals the share to, and the grant when one is asked for. */
+export function walletCreateBody(ownerId, input, sdkKey) {
+    if (input === null || typeof input !== "object")
+        throw new ClientFlowError("invalid_operation_create");
+    const create = { kind: "wallet.create", owner_type: "account", owner_id: ownerId, payload: { network: input.network, recipient_public_key: sdkKey ?? input.recipientPublicKey } };
+    if (input.grant !== undefined)
+        create.grant = grantWire(input.grant);
+    return create;
+}
+function sameGrant(shown, asked) {
+    if (shown === undefined || asked === undefined)
+        return shown === asked;
+    return shown.servicePrincipalId === asked.service_principal_id && shown.scopes.join(" ") === asked.scopes.join(" ") && shown.externalRef === asked.external_ref;
+}
+/** createdAsAsked refuses an admitted creation whose display names another grant than the one asked for, or one where none was. */
+export function createdAsAsked(operation, create) {
+    const display = operation.display;
+    if (operation.kind !== "wallet.create" || display.kind !== "wallet.create")
+        throw new ClientFlowError("invalid_server_response");
+    if (!("materialPurged" in display) && !sameGrant(display.grant, create.grant))
+        throw new ClientFlowError("invalid_server_response");
+    return operation;
+}
+/** parseWalletCreateGrant reads the grant a creation's display names. */
+export function parseWalletCreateGrant(value) {
+    if (!validWalletCreateGrant(value) || order.filter((scope) => value.scopes.includes(scope)).join(" ") !== value.scopes.join(" "))
+        throw new ClientFlowError("invalid_server_response");
+    const grant = { servicePrincipalId: value.service_principal_id, scopes: [...value.scopes] };
+    if (value.external_ref !== undefined)
+        grant.externalRef = value.external_ref;
+    return grant;
+}
+/** parseWalletCreateGrantOutcome reads the grant member of a creation's result: a code exactly for not_set, an operation for every grant that was set. */
+export function parseWalletCreateGrantOutcome(value) {
+    const outcome = record(value, ["state"], ["operation_id", "linked_wallet_id", "code"]);
+    const state = outcome.state;
+    if ((state !== "succeeded" && state !== "pending_target_fence" && state !== "not_set") || (outcome.operation_id !== undefined && !lowerUUID(outcome.operation_id)) ||
+        (outcome.linked_wallet_id !== undefined && !lowerUUID(outcome.linked_wallet_id)) || (state === "not_set") !== (outcome.code !== undefined) ||
+        (outcome.code !== undefined && !isAuthorizationErrorCode(outcome.code)) || (state !== "not_set" && outcome.operation_id === undefined)) {
+        throw new ClientFlowError("invalid_server_response");
+    }
+    const parsed = { state };
+    if (outcome.operation_id !== undefined)
+        parsed.operationId = outcome.operation_id;
+    if (outcome.linked_wallet_id !== undefined)
+        parsed.linkedWalletId = outcome.linked_wallet_id;
+    if (outcome.code !== undefined)
+        parsed.code = outcome.code;
+    return parsed;
+}

package/dist/walletDisplayParts.d.ts

@@ -0,0 +1,17 @@
+import type { ResultRecipient } from "./slice4.ts";
+export type DisplayCommon = {
+    ownerId: string;
+    requesterId: string;
+    resultRecipient: ResultRecipient;
+    walletId?: string;
+};
+export declare const walletRecipient: RegExp;
+export declare function displayCommon(display: Record<string, unknown>): DisplayCommon;
+export declare function summaryOf(value: unknown): {
+    preparedSummary?: string;
+};
+export declare function rawQuantity(value: unknown, positive: boolean): value is string;
+export declare function bindingRevision(value: unknown): value is string;
+export declare function lowerUUID(value: unknown): value is string;
+/** lowerHexBytes accepts 1..1024 bytes of lowercase hexadecimal. */
+export declare function lowerHexBytes(value: unknown): value is string;

package/dist/walletDisplayParts.js

@@ -0,0 +1,47 @@
+// Parts every safe display of a wallet operation is read with: the identity
+// members each display carries, and the closed value forms shared by the
+// displays of own wallets and of linked wallets.
+import { ClientFlowError, canonicalDecimal, opaqueId, record } from "./auth.js";
+/** maxUint256 bounds every raw quantity as source §2.4 requires. */
+const maxUint256 = (1n << 256n) - 1n;
+export const walletRecipient = /^[\x21-\x7e]{1,256}$/;
+export function displayCommon(display) {
+    if (!opaqueId(display.owner_id) || !opaqueId(display.requester_id) || (display.wallet_id !== undefined && !opaqueId(display.wallet_id))) {
+        throw new ClientFlowError("invalid_server_response");
+    }
+    const common = { ownerId: display.owner_id, requesterId: display.requester_id, resultRecipient: resultRecipientOf(display.result_recipient) };
+    if (display.wallet_id !== undefined)
+        common.walletId = display.wallet_id;
+    return common;
+}
+function resultRecipientOf(value) {
+    const recipient = record(value, ["type", "id"]);
+    if (recipient.type !== "account" && recipient.type !== "service")
+        throw new ClientFlowError("invalid_server_response");
+    if (!opaqueId(recipient.id))
+        throw new ClientFlowError("invalid_server_response");
+    return { type: recipient.type, id: recipient.id };
+}
+export function summaryOf(value) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== "string" || value.length === 0)
+        throw new ClientFlowError("invalid_server_response");
+    return { preparedSummary: value };
+}
+export function rawQuantity(value, positive) {
+    if (!canonicalDecimal(value))
+        return false;
+    const quantity = BigInt(value);
+    return quantity <= maxUint256 && (!positive || quantity > 0n);
+}
+export function bindingRevision(value) {
+    return canonicalDecimal(value) && value !== "0" && value.length <= 16 && BigInt(value) <= BigInt(Number.MAX_SAFE_INTEGER);
+}
+export function lowerUUID(value) {
+    return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(value);
+}
+/** lowerHexBytes accepts 1..1024 bytes of lowercase hexadecimal. */
+export function lowerHexBytes(value) {
+    return typeof value === "string" && value.length >= 2 && value.length <= 2048 && value.length % 2 === 0 && /^[0-9a-f]+$/.test(value);
+}

package/dist/walletEvents.d.ts

@@ -0,0 +1,43 @@
+/** MaxWalletEventPayloadLength bounds the body text one activity event releases whole. */
+export declare const MaxWalletEventPayloadLength = 131072;
+export type WalletEventKind = "deposit" | "withdrawal" | "activity";
+export type WalletEventStatus = "completed" | "finalized" | "reverted";
+/** WalletEvent is one wallet event 3.0. */
+export interface WalletEvent {
+    readonly contractVersion: "3.0";
+    /** Unique per subject and revision. */
+    readonly eventId: string;
+    /**
+     * The event's own place in the stream of events: an opaque text no two
+     * events share. A stream of wallet events is continued after it.
+     */
+    readonly cursor: string;
+    readonly kind: WalletEventKind;
+    readonly status: WalletEventStatus;
+    /** Native decimal revision, from "1"; it is never converted to a JavaScript number. */
+    readonly revision: string;
+    /** What the revisions are about: one transfer in, one transfer out, or one activity. */
+    readonly subjectId: string;
+    readonly registrationId: string;
+    readonly networkId: string;
+    /** The tracked address. */
+    readonly address: string;
+    /** Present for a deposit and a withdrawal, and for an activity that names an asset. */
+    readonly asset?: string;
+    /** Canonical unsigned decimal string in minimal units. Present for a deposit and a withdrawal. */
+    readonly rawAmount?: string;
+    readonly counterparty?: string;
+    /** Present for an activity: its kind as Streams names it. */
+    readonly activityType?: string;
+    readonly sourceReference: string;
+    readonly observedAt: string;
+    /** Present for reverted, when Streams names a reason. */
+    readonly invalidationReason?: string;
+    /** The body of an expanded activity as its canonical JSON text, and the same read as an object. */
+    readonly payloadJson?: string;
+    readonly payload?: Readonly<Record<string, unknown>>;
+    /** Present instead of payloadJson when the body is too large for this read. */
+    readonly payloadOmittedBytes?: number;
+}
+/** parseWalletEvent parses one wallet event 3.0, closed. */
+export declare function parseWalletEvent(value: unknown): WalletEvent;

package/dist/walletEvents.js

@@ -0,0 +1,97 @@
+// The wallet event 3.0: one shape for everything a client hears about a
+// tracked wallet.
+//
+//   kind     "deposit" (value came in), "withdrawal" (value went out),
+//            "activity" (anything else)
+//   status   "completed" (it is in a block), "finalized" (the block is final),
+//            "reverted" (the block was replaced)
+//   revision "1" for the first status of a subject, "2" for the next
+//
+// Every subject is told at least twice, completed and then finalized, on
+// every network. Where a block is final as soon as it exists the two arrive
+// together; on Ethereum finalized follows completed after thirteen to
+// nineteen minutes. A client that acts on a transfer once it is in a block
+// waits for completed and may ignore what follows.
+//
+// The parser is closed, like every parser of this package: a member that is
+// missing, unknown or owned by another kind refuses the event.
+import { ClientFlowError, integer, opaqueId, record, rfc3339UTC } from "./auth.js";
+/** MaxWalletEventPayloadLength bounds the body text one activity event releases whole. */
+export const MaxWalletEventPayloadLength = 131072;
+const kinds = ["deposit", "withdrawal", "activity"];
+const statuses = ["completed", "finalized", "reverted"];
+const decimalPattern = /^[1-9][0-9]{0,255}$/;
+const revisionPattern = /^[1-9][0-9]{0,19}$/;
+const cursorPattern = /^[1-9][0-9]{0,18}\.[1-9]$/;
+const optional = ["asset", "raw_amount", "counterparty", "activity_type", "invalidation_reason", "payload_json", "payload_omitted_bytes"];
+/** parseWalletEvent parses one wallet event 3.0, closed. */
+export function parseWalletEvent(value) {
+    const event = record(value, [
+        "contract_version", "event_id", "cursor", "kind", "status", "revision", "subject_id",
+        "registration_id", "network_id", "address", "source_reference", "observed_at",
+    ], optional);
+    const has = (member) => Object.prototype.hasOwnProperty.call(event, member);
+    const transfer = event.kind === "deposit" || event.kind === "withdrawal";
+    if (event.contract_version !== "3.0" || !text(event.event_id, 512) || !matches(cursorPattern, event.cursor) ||
+        typeof event.kind !== "string" || !kinds.includes(event.kind) ||
+        typeof event.status !== "string" || !statuses.includes(event.status) ||
+        !matches(revisionPattern, event.revision) || (event.status === "completed") !== (event.revision === "1") ||
+        !text(event.subject_id, 256) || !opaqueId(event.registration_id) || !text(event.network_id, 256) ||
+        !text(event.address, 256) || !text(event.source_reference, 512) || !rfc3339UTC(event.observed_at) ||
+        // A transfer names its asset and its amount and nothing an activity owns.
+        (transfer && (!text(event.asset, 512) || !matches(decimalPattern, event.raw_amount) || has("activity_type") ||
+            has("payload_json") || has("payload_omitted_bytes"))) ||
+        (!transfer && (!text(event.activity_type, 128) || (has("asset") && !text(event.asset, 512)) ||
+            (has("raw_amount") && !matches(decimalPattern, event.raw_amount)) ||
+            (has("payload_json") && has("payload_omitted_bytes")))) ||
+        (has("counterparty") && !text(event.counterparty, 512)) ||
+        (has("invalidation_reason") && (event.status !== "reverted" || !text(event.invalidation_reason, 128))) ||
+        (has("payload_omitted_bytes") && !(integer(event.payload_omitted_bytes) && event.payload_omitted_bytes >= 1))) {
+        throw new ClientFlowError("invalid_server_response");
+    }
+    const parsed = {
+        contractVersion: "3.0", eventId: event.event_id, cursor: event.cursor, kind: event.kind, status: event.status,
+        revision: event.revision, subjectId: event.subject_id, registrationId: event.registration_id,
+        networkId: event.network_id, address: event.address, sourceReference: event.source_reference,
+        observedAt: event.observed_at,
+    };
+    if (has("asset"))
+        parsed.asset = event.asset;
+    if (has("raw_amount"))
+        parsed.rawAmount = event.raw_amount;
+    if (has("counterparty"))
+        parsed.counterparty = event.counterparty;
+    if (has("activity_type"))
+        parsed.activityType = event.activity_type;
+    if (has("invalidation_reason"))
+        parsed.invalidationReason = event.invalidation_reason;
+    if (has("payload_json")) {
+        parsed.payload = payloadObject(event.payload_json);
+        parsed.payloadJson = event.payload_json;
+    }
+    if (has("payload_omitted_bytes"))
+        parsed.payloadOmittedBytes = event.payload_omitted_bytes;
+    return Object.freeze(parsed);
+}
+/** Only the JSON text of an object within the bound is a body; anything else refuses the event. */
+function payloadObject(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > MaxWalletEventPayloadLength) {
+        throw new ClientFlowError("invalid_server_response");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new ClientFlowError("invalid_server_response");
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new ClientFlowError("invalid_server_response");
+    return Object.freeze(parsed);
+}
+function text(value, maximum) {
+    return typeof value === "string" && value.length >= 1 && value.length <= maximum;
+}
+function matches(pattern, value) {
+    return typeof value === "string" && pattern.test(value);
+}

package/dist/walletLimits.d.ts

@@ -0,0 +1,65 @@
+export type LimitAsset = 'native' | 'usdt' | 'usdc';
+/** At most this many network and asset pairs, and this many recipients. */
+export declare const MaxLimitCeilings = 24;
+export declare const MaxLimitRecipients = 100;
+/** The ceilings of one asset on one network, in that network's minimal units. An absent ceiling bounds nothing. */
+export interface WalletCeiling {
+    network: string;
+    asset: LimitAsset;
+    perTransferRaw?: string;
+    perDayRaw?: string;
+}
+/** A wallet's limits now. revision "0" is a wallet whose limits were never set; no recipient means any recipient. */
+export interface WalletLimits {
+    requestId: string;
+    walletId: string;
+    revision: string;
+    ceilings: readonly WalletCeiling[];
+    recipients: readonly string[];
+}
+/**
+ * The whole of a wallet's new limits. Empty ceilings and recipients remove every limit. revision is the
+ * revision of the limits they were edited from, as limits() read it: a change made from limits that
+ * changed since (in another tab, say) is refused with VERSION_CONFLICT; read them again and redo it.
+ */
+export interface WalletLimitsInput {
+    ceilings: readonly WalletCeiling[];
+    recipients: readonly string[];
+    revision: string;
+}
+/** What the owner confirms: the wallet's address and its new limits as they will be kept, recipients in the form the network compares them by. */
+export interface WalletLimitsDisplay {
+    kind: 'wallet_limits.set';
+    ownerId: string;
+    requesterId: string;
+    linkedWalletId: string;
+    walletAddress: string;
+    ceilings: readonly WalletCeiling[];
+    recipients: readonly string[];
+    expectedRevision: string;
+}
+/**
+ * The answers to a send the wallet's limits do not allow. Each is 403 and
+ * nothing is sent; the send goes through only after the limits change.
+ * - LIMIT_PER_TRANSFER_EXCEEDED: the amount is over the ceiling of one
+ *   transfer of its asset on its network.
+ * - LIMIT_DAILY_EXCEEDED: with what the wallet's sends of that asset on that
+ *   network moved in the last 24 hours, the send would pass the daily
+ *   ceiling. It is judged when the send is executed.
+ * - RECIPIENT_NOT_ALLOWED: the wallet has a recipient list and the recipient
+ *   is not in it.
+ * The first and the last are answered when the send is created and again
+ * when it is executed, against the limits as they are then; a repeated
+ * create with the same key answers the send it created. A speed-up is
+ * judged by them too and adds nothing to the day, but is refused when the
+ * day already holds more than the daily ceiling; a cancel by none.
+ */
+export declare const WalletLimitRefusals: readonly ['LIMIT_PER_TRANSFER_EXCEEDED', 'LIMIT_DAILY_EXCEEDED', 'RECIPIENT_NOT_ALLOWED'];
+export type WalletLimitRefusal = (typeof WalletLimitRefusals)[number];
+export declare const isWalletLimitRefusal: (code: unknown) => code is WalletLimitRefusal;
+/** The closed body of POST /v1/operations that asks to replace a linked wallet's limits. */
+export declare function walletLimitsCreate(ownerId: string, linkedWalletId: string, input: WalletLimitsInput): Record<string, unknown>;
+/** The answer of GET /v1/linked-wallets/{id}/limits for walletId. */
+export declare function parseWalletLimits(payload: unknown, walletId: string): WalletLimits;
+/** The display of a wallet_limits.set operation. */
+export declare function parseWalletLimitsDisplay(value: unknown): WalletLimitsDisplay;

package/dist/walletLimits.js

@@ -0,0 +1,102 @@
+// The limits of a linked wallet (owner decision of 14 October 2026). The
+// account's session reads them; changing them, removing them included, is the
+// wallet_limits.set operation the owner confirms with a passkey on the
+// provider's page, which says the new limits in words; and every send from
+// the wallet obeys them. Amounts are in each asset's minimal units on its own
+// network: a token's decimals differ between networks (USDT has 6 on Ethereum
+// and 18 on BNB Smart Chain), so a ceiling names its network.
+import { ClientFlowError, canonicalDecimal, integer, opaqueId, record } from './auth.js';
+import { fault, network, uuid } from './linkedChecks.js';
+/** At most this many network and asset pairs, and this many recipients. */
+export const MaxLimitCeilings = 24;
+export const MaxLimitRecipients = 100;
+/**
+ * The answers to a send the wallet's limits do not allow. Each is 403 and
+ * nothing is sent; the send goes through only after the limits change.
+ * - LIMIT_PER_TRANSFER_EXCEEDED: the amount is over the ceiling of one
+ *   transfer of its asset on its network.
+ * - LIMIT_DAILY_EXCEEDED: with what the wallet's sends of that asset on that
+ *   network moved in the last 24 hours, the send would pass the daily
+ *   ceiling. It is judged when the send is executed.
+ * - RECIPIENT_NOT_ALLOWED: the wallet has a recipient list and the recipient
+ *   is not in it.
+ * The first and the last are answered when the send is created and again
+ * when it is executed, against the limits as they are then; a repeated
+ * create with the same key answers the send it created. A speed-up is
+ * judged by them too and adds nothing to the day, but is refused when the
+ * day already holds more than the daily ceiling; a cancel by none.
+ */
+export const WalletLimitRefusals = ['LIMIT_PER_TRANSFER_EXCEEDED', 'LIMIT_DAILY_EXCEEDED', 'RECIPIENT_NOT_ALLOWED'];
+export const isWalletLimitRefusal = (code) => WalletLimitRefusals.includes(code);
+/** The closed body of POST /v1/operations that asks to replace a linked wallet's limits. */
+export function walletLimitsCreate(ownerId, linkedWalletId, input) {
+    const invalid = () => { throw new ClientFlowError('invalid_operation_create'); };
+    const closed = (value, required, optional = []) => { try {
+        return record(value, required, optional);
+    }
+    catch {
+        return invalid();
+    } };
+    const declared = closed(input, ['ceilings', 'recipients', 'revision']);
+    if (!opaqueId(ownerId) || !uuid(linkedWalletId) || !Array.isArray(declared.ceilings) || declared.ceilings.length > MaxLimitCeilings || !recipients(declared.recipients) || !revision(declared.revision))
+        invalid();
+    const pairs = new Set();
+    const ceilings = declared.ceilings.map((value) => {
+        const c = closed(value, ['network', 'asset'], ['perTransferRaw', 'perDayRaw']);
+        const pair = `${c.network} ${c.asset}`;
+        if (!network(c.network) || !asset(c.asset) || pairs.has(pair) || (c.perTransferRaw === undefined && c.perDayRaw === undefined) ||
+            (c.perTransferRaw !== undefined && !amount(c.perTransferRaw)) || (c.perDayRaw !== undefined && !amount(c.perDayRaw)))
+            invalid();
+        pairs.add(pair);
+        const out = { network: c.network, asset: c.asset };
+        if (c.perTransferRaw !== undefined)
+            out.per_transfer_raw = c.perTransferRaw;
+        if (c.perDayRaw !== undefined)
+            out.per_day_raw = c.perDayRaw;
+        return out;
+    });
+    return { kind: 'wallet_limits.set', owner_type: 'account', owner_id: ownerId, linked_wallet_id: linkedWalletId, payload: { ceilings, recipients: [...declared.recipients], expected_revision: declared.revision } };
+}
+/** The answer of GET /v1/linked-wallets/{id}/limits for walletId. */
+export function parseWalletLimits(payload, walletId) {
+    const root = record(payload, ['request_id', 'limits']);
+    const l = record(root.limits, ['ceilings', 'recipients', 'revision', 'wallet_id']);
+    if (!opaqueId(root.request_id) || l.wallet_id !== walletId || !canonicalDecimal(l.revision) || !recipients(l.recipients))
+        fault();
+    return Object.freeze({ requestId: root.request_id, walletId, revision: l.revision, ceilings: parseCeilings(l.ceilings), recipients: Object.freeze([...l.recipients]) });
+}
+/** The display of a wallet_limits.set operation. */
+export function parseWalletLimitsDisplay(value) {
+    const d = record(value, ['kind', 'owner_id', 'requester_id', 'linked_wallet_id', 'wallet_address', 'ceilings', 'recipients', 'expected_revision']);
+    if (d.kind !== 'wallet_limits.set' || !opaqueId(d.owner_id) || !opaqueId(d.requester_id) || !uuid(d.linked_wallet_id) || typeof d.wallet_address !== 'string' ||
+        d.wallet_address.length < 1 || d.wallet_address.length > 256 || !recipients(d.recipients) || !revision(d.expected_revision))
+        fault();
+    return Object.freeze({ kind: 'wallet_limits.set', ownerId: d.owner_id, requesterId: d.requester_id, linkedWalletId: d.linked_wallet_id, walletAddress: d.wallet_address,
+        ceilings: parseCeilings(d.ceilings), recipients: Object.freeze([...d.recipients]), expectedRevision: d.expected_revision });
+}
+function parseCeilings(value) {
+    if (!Array.isArray(value) || value.length > MaxLimitCeilings)
+        fault();
+    const pairs = new Set();
+    return Object.freeze(value.map((item) => {
+        const c = record(item, ['network', 'asset'], ['per_transfer_raw', 'per_day_raw', 'decimals']);
+        const pair = `${c.network} ${c.asset}`;
+        if (!network(c.network) || !asset(c.asset) || pairs.has(pair) || (c.per_transfer_raw === undefined && c.per_day_raw === undefined) ||
+            (c.per_transfer_raw !== undefined && !amount(c.per_transfer_raw)) || (c.per_day_raw !== undefined && !amount(c.per_day_raw)) ||
+            (c.decimals !== undefined && (!integer(c.decimals) || c.decimals < 0 || c.decimals > 30)))
+            fault();
+        pairs.add(pair);
+        const out = { network: c.network, asset: c.asset };
+        if (c.per_transfer_raw !== undefined)
+            out.perTransferRaw = c.per_transfer_raw;
+        if (c.per_day_raw !== undefined)
+            out.perDayRaw = c.per_day_raw;
+        return Object.freeze(out);
+    }));
+}
+function asset(v) { return v === 'native' || v === 'usdt' || v === 'usdc'; }
+function amount(v) { return canonicalDecimal(v) && v.length <= 78; }
+function revision(v) { return canonicalDecimal(v) && v.length <= 20; }
+function recipients(v) {
+    return Array.isArray(v) && v.length <= MaxLimitRecipients && new Set(v).size === v.length && v.every((r) => typeof r === 'string' && /^[\x21-\x7e]{1,128}$/.test(r));
+}