@shuttle.technology/authorization 0.0.0-stage → 0.2.0

package/dist/deviceShares.js

@@ -0,0 +1,204 @@
+// The device shares this SDK keeps (owner decision of 28 October 2026): for
+// each wallet whose device key the SDK made, at creation or at a recovery, the
+// non-extractable device key and the wallet's device share sealed to it, in
+// the origin's storage. A browser that holds no usable share of a wallet,
+// after a change of domain, cleared site data, another browser or device, or
+// a recovery on another device that replaced its share, recovers it with one
+// passkey confirmation (deviceRecovery.ts) and then sends as before. The
+// provider names the device key of the wallet's latest creation or recovery;
+// a kept share sealed to another key is stale. The tabs of one browser take
+// turns under one Web Lock per wallet, so two of them never recover the same
+// wallet at once. The plaintext share never leaves resealDeviceShare.
+import { ClientFlowError } from "./auth.js";
+import { generateDeviceKey } from "./deviceKey.js";
+import { resealDeviceShare } from "./deviceShare.js";
+const unavailable = () => new ClientFlowError("device_share_unavailable");
+const DATABASE = "streams-authorization-device-shares";
+const STORE = "shares";
+function pending(record) {
+    return record !== undefined && record.deviceShare === undefined && typeof record.pendingOperationId === "string" && typeof record.executeKey === "string" && typeof record.publicKeyHex === "string";
+}
+function usable(record) {
+    return record !== undefined && record.pendingOperationId === undefined && record.deviceShare !== null && typeof record.deviceShare === "object";
+}
+/** A usable share is current when the provider names no device key, or names the one it is sealed to. */
+function current(record, serverKey) {
+    return usable(record) && (serverKey === undefined || record.publicKeyHex === serverKey);
+}
+/**
+ * indexedDBDeviceShareStore keeps the records in the origin's IndexedDB, under
+ * namespace (one per client configuration), so the tabs of this origin share
+ * them and the key handles stay non-extractable.
+ */
+export function indexedDBDeviceShareStore(namespace, factory = globalThis.indexedDB) {
+    if (!factory || typeof factory.open !== "function")
+        throw unavailable();
+    const key = (walletId) => `${namespace}|${walletId}`;
+    const run = (mode, work) => new Promise((resolve, reject) => {
+        const opened = factory.open(DATABASE, 1);
+        opened.onupgradeneeded = () => { opened.result.createObjectStore(STORE); };
+        opened.onerror = () => reject(unavailable());
+        opened.onsuccess = () => {
+            const database = opened.result;
+            try {
+                const transaction = database.transaction(STORE, mode);
+                const request = work(transaction.objectStore(STORE));
+                transaction.oncomplete = () => { database.close(); resolve(request.result); };
+                transaction.onerror = transaction.onabort = () => { database.close(); reject(unavailable()); };
+            }
+            catch {
+                database.close();
+                reject(unavailable());
+            }
+        };
+    });
+    return {
+        async load(walletId) {
+            const value = await run("readonly", (store) => store.get(key(walletId)));
+            if (value === undefined)
+                return undefined;
+            const record = value;
+            if (record.walletId !== walletId || !(record.privateKey instanceof CryptoKey) || (!usable(record) && !pending(record)))
+                throw unavailable();
+            return record;
+        },
+        async save(record) {
+            const kept = { walletId: record.walletId, privateKey: record.privateKey };
+            if (record.publicKeyHex !== undefined)
+                kept.publicKeyHex = record.publicKeyHex;
+            if (record.deviceShare !== undefined)
+                kept.deviceShare = { ...record.deviceShare };
+            if (record.pendingOperationId !== undefined)
+                Object.assign(kept, { pendingOperationId: record.pendingOperationId, executeKey: record.executeKey });
+            if (record.pendingLinkedWalletId !== undefined)
+                kept.pendingLinkedWalletId = record.pendingLinkedWalletId;
+            await run("readwrite", (store) => store.put(kept, key(record.walletId)));
+        },
+    };
+}
+/** The store a web client keeps its shares in when the app supplies none: the origin's IndexedDB, where there is one. */
+export function defaultDeviceShareStore(channel, namespace) {
+    if (channel !== "web" || typeof globalThis.indexedDB?.open !== "function")
+        return undefined;
+    return indexedDBDeviceShareStore(namespace);
+}
+/**
+ * DeviceShareKeeper is one client's keeper: the store, the lock its tabs take
+ * turns under, the device keys of the creations it made, and the recovery the
+ * client runs and resumes (deviceRecovery.ts).
+ */
+export class DeviceShareKeeper {
+    #store;
+    #crypto;
+    #lock;
+    #lockPrefix;
+    #recover;
+    #resume;
+    /** Device keys of creations, by the creation's idempotency key, so a repeat sends the same request. */
+    #creationKeys = new Map();
+    /** The creation's device key, by operation, until its result is kept. */
+    #creations = new Map();
+    /** Recoveries under way in this client, by wallet. */
+    #flights = new Map();
+    constructor(input) {
+        this.#store = input.store;
+        this.#crypto = input.crypto;
+        this.#lock = input.lock;
+        this.#lockPrefix = input.lockPrefix;
+        this.#recover = input.recover;
+        this.#resume = input.resume;
+    }
+    #required() {
+        if (!this.#store)
+            throw unavailable();
+        return this.#store;
+    }
+    /** The device key a creation without the app's own key is sealed to; the same one for every call with the same idempotency key, also at once. */
+    creationKey(idempotencyKey) {
+        this.#required();
+        let made = this.#creationKeys.get(idempotencyKey);
+        if (!made) {
+            made = generateDeviceKey(this.#crypto.subtle);
+            this.#creationKeys.set(idempotencyKey, made);
+            made.catch(() => this.#creationKeys.delete(idempotencyKey));
+        }
+        return made;
+    }
+    /** holdCreation remembers which device key the admitted creation's share will be sealed to. */
+    holdCreation(operationId, device) { this.#creations.set(operationId, device); }
+    /**
+     * keepCreated keeps the share of a creation this keeper made the key for,
+     * once its result is read, under the wallet's lock. It never replaces a
+     * record of the wallet: one kept already is the creation's own, read before,
+     * or a later recovery's, pending or done, which a late read of the
+     * creation's result must not undo.
+     */
+    async keepCreated(operationId, result) {
+        const device = this.#creations.get(operationId);
+        if (!device || result.kind !== "wallet_created" || !result.wallet || !result.deviceShare)
+            return;
+        const store = this.#required(), walletId = result.wallet.walletId, deviceShare = result.deviceShare;
+        await this.#lock(this.#lockName(walletId), async () => {
+            if ((await store.load(walletId)) === undefined)
+                await store.save({ walletId, privateKey: device.privateKey, publicKeyHex: device.publicKeyHex, deviceShare });
+        });
+        this.#creations.delete(operationId);
+    }
+    #lockName(walletId) { return `${this.#lockPrefix}:device-recovery:${walletId}`; }
+    async has(wallet, serverKey) {
+        const record = await this.#required().load(wallet.externalWalletId);
+        return usable(record) && current(record, await serverKey());
+    }
+    ensure(wallet, serverKey, options = {}) {
+        const store = this.#required();
+        const walletId = wallet.externalWalletId;
+        const force = options.force === true;
+        const running = force ? undefined : this.#flights.get(walletId);
+        if (running)
+            return running;
+        const flight = (async () => {
+            if (!force && current(await store.load(walletId), await serverKey()))
+                return false;
+            // Under the tabs' lock the store and the provider's key are read again:
+            // a tab that waited finds the share the other one recovered, or the
+            // recovery it left pending, and recovers nothing new.
+            return this.#lock(this.#lockName(walletId), async () => {
+                let record = await store.load(walletId);
+                let resumed = false;
+                if (pending(record)) {
+                    record = await this.#resume(wallet, record, options);
+                    if (record) {
+                        await store.save(record);
+                        resumed = true;
+                    }
+                }
+                // A share kept, or resumed just now, is used only while the provider
+                // names its key: a recovery on another device since replaced it.
+                if ((resumed || !force) && current(record, await serverKey()))
+                    return resumed;
+                // One recovery, and one more when another device recovered meanwhile;
+                // then the call gives up rather than chase the other device.
+                for (let attempt = resumed ? 1 : 0; attempt < 2; attempt++) {
+                    const recovered = await this.#recover(wallet, options, (kept) => store.save(kept));
+                    if (recovered.walletId !== walletId)
+                        throw new ClientFlowError("invalid_server_response");
+                    await store.save(recovered);
+                    if (current(recovered, await serverKey()))
+                        return true;
+                }
+                throw new ClientFlowError("device_recovery_failed");
+            });
+        })();
+        if (!force) {
+            this.#flights.set(walletId, flight);
+            void flight.then(() => this.#flights.delete(walletId), () => this.#flights.delete(walletId));
+        }
+        return flight;
+    }
+    async sealedFor(wallet, transportPublicKey) {
+        const record = await this.#required().load(wallet.externalWalletId);
+        if (!usable(record))
+            throw unavailable();
+        return resealDeviceShare(record.privateKey, record.deviceShare, transportPublicKey, this.#crypto);
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,280 @@
+/**
+ * The provider's error codes: every code of the ErrorCode enum of the
+ * committed OpenAPI document, each with the HTTP status, `retryable` and
+ * `next_action` it is always answered with. An answer that disagrees with this
+ * table is refused as `invalid_error_response`, so a code an application
+ * switches on is always one of these.
+ */
+import type { NextAction } from "./auth.ts";
+export interface AuthorizationErrorContract {
+    readonly status: number;
+    readonly retryable: boolean;
+    readonly nextAction: NextAction;
+}
+declare const contracts: {
+    readonly INVALID_REQUEST: {
+        readonly status: 400;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly REGISTRATION_SCOPE_SELECTION_REQUIRED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly CURSOR_INVALID: {
+        readonly status: 400;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly UNSUPPORTED_VERSION: {
+        readonly status: 400;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly UNAUTHORIZED: {
+        readonly status: 401;
+        readonly retryable: false;
+        readonly nextAction: "reauthenticate";
+    };
+    readonly SCOPE_DENIED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly ORIGIN_NOT_ALLOWED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly LIMIT_PER_TRANSFER_EXCEEDED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly LIMIT_DAILY_EXCEEDED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly RECIPIENT_NOT_ALLOWED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly CONFIRMATION_METHOD_UNAVAILABLE: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "use_passkey";
+    };
+    readonly USER_PROOF_REQUIRED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "sign_user_request";
+    };
+    readonly USER_PROOF_INVALID: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "sign_user_request";
+    };
+    readonly REQUEST_GRANT_INVALID: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "use_passkey";
+    };
+    readonly DEBIT_PERMISSION_INVALID: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly NOT_FOUND: {
+        readonly status: 404;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly IDENTITY_NOT_REGISTERED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "start_signup";
+    };
+    readonly IDENTITY_ALREADY_REGISTERED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "start_login";
+    };
+    readonly IDENTITY_ALREADY_LINKED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly LAST_FACTOR: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly CONFIRMATION_REPLAYED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly CANNOT_CANCEL: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly VERSION_CONFLICT: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "refresh_resource";
+    };
+    readonly AUTHORIZATION_STALE: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "refresh_resource";
+    };
+    readonly IDEMPOTENCY_CONFLICT: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "lookup_operation";
+    };
+    readonly USER_PROOF_REPLAYED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "lookup_operation";
+    };
+    readonly OPERATION_NOT_AUTHORIZED: {
+        readonly status: 409;
+        readonly retryable: false;
+        readonly nextAction: "use_passkey";
+    };
+    readonly RESULT_NOT_READY: {
+        readonly status: 409;
+        readonly retryable: true;
+        readonly nextAction: "wait_for_result";
+    };
+    readonly TRANSFER_IN_FLIGHT: {
+        readonly status: 409;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+    readonly ATTEMPT_EXPIRED: {
+        readonly status: 410;
+        readonly retryable: false;
+        readonly nextAction: "reauthenticate";
+    };
+    readonly OPERATION_EXPIRED: {
+        readonly status: 410;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly RESULT_EXPIRED: {
+        readonly status: 410;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly RESYNC_REQUIRED: {
+        readonly status: 410;
+        readonly retryable: false;
+        readonly nextAction: "resync_streams";
+    };
+    readonly USER_PROOF_EXPIRED: {
+        readonly status: 410;
+        readonly retryable: false;
+        readonly nextAction: "sign_user_request";
+    };
+    readonly CAPABILITY_UNAVAILABLE: {
+        readonly status: 422;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly RECOVERY_UNAVAILABLE: {
+        readonly status: 422;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly PAYLOAD_NOT_SUPPORTED: {
+        readonly status: 422;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly RATE_LIMITED: {
+        readonly status: 429;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+    readonly DEPENDENCY_UNAVAILABLE: {
+        readonly status: 503;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+    readonly NETWORK_FEE_TOO_HIGH: {
+        readonly status: 503;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+    readonly INSUFFICIENT_BALANCE: {
+        readonly status: 422;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly WALLET_POLICY_DENIED: {
+        readonly status: 403;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly TENANT_AUTH_UNAVAILABLE: {
+        readonly status: 503;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+    readonly AUDIT_UNAVAILABLE: {
+        readonly status: 503;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+    readonly ADAPTER_INTEGRITY_CONFLICT: {
+        readonly status: 503;
+        readonly retryable: false;
+        readonly nextAction: "none";
+    };
+    readonly INTERNAL_ERROR: {
+        readonly status: 500;
+        readonly retryable: true;
+        readonly nextAction: "retry_same_request";
+    };
+};
+/** One code of the provider's ErrorCode enum. */
+export type AuthorizationErrorCode = keyof typeof contracts;
+/** Every code, with the status, `retryable` and `nextAction` it is answered with. */
+export declare const AuthorizationErrorContracts: Readonly<Record<AuthorizationErrorCode, AuthorizationErrorContract>>;
+/** Every code of the provider's ErrorCode enum. */
+export declare const AuthorizationErrorCodes: readonly AuthorizationErrorCode[];
+export declare function isAuthorizationErrorCode(value: unknown): value is AuthorizationErrorCode;
+/**
+ * The refusals of a Mode C transfer that the person's app signed and the
+ * service forwarded, besides the answers every request can get. The proof:
+ * `USER_PROOF_REQUIRED`, `USER_PROOF_INVALID`, `USER_PROOF_EXPIRED`, and
+ * `USER_PROOF_REPLAYED` or `IDEMPOTENCY_CONFLICT` for a reused one. The grant:
+ * `REQUEST_GRANT_INVALID` when it is not this service's, has ended or was
+ * enrolled on other bounds. The amount and the recipient, against the grant's
+ * bounds and the wallet's limits: `LIMIT_PER_TRANSFER_EXCEEDED`,
+ * `LIMIT_DAILY_EXCEEDED`, `RECIPIENT_NOT_ALLOWED`. The fee:
+ * `NETWORK_FEE_TOO_HIGH`. The balance, short of the amount and the fee's
+ * ceiling: `INSUFFICIENT_BALANCE`. The wallet system's own signing policy:
+ * `WALLET_POLICY_DENIED`. A refused transfer moved nothing.
+ */
+export declare const ModeCRefusals: readonly ["USER_PROOF_REQUIRED", "USER_PROOF_INVALID", "USER_PROOF_EXPIRED", "USER_PROOF_REPLAYED", "IDEMPOTENCY_CONFLICT", "REQUEST_GRANT_INVALID", "LIMIT_PER_TRANSFER_EXCEEDED", "LIMIT_DAILY_EXCEEDED", "RECIPIENT_NOT_ALLOWED", "NETWORK_FEE_TOO_HIGH", "INSUFFICIENT_BALANCE", "WALLET_POLICY_DENIED"];
+export type ModeCRefusal = (typeof ModeCRefusals)[number];
+export declare const isModeCRefusal: (code: unknown) => code is ModeCRefusal;
+/**
+ * The status of a write that possibly committed: it keeps its code and answers retryable false with
+ * lookup_operation and the operation to look up, at 500 for a code that is 500 and otherwise at 503
+ * (the server's error encoder).
+ */
+export declare const possibleCommitStatus: (code: AuthorizationErrorCode) => number;
+/**
+ * The codes the server names an operation with while keeping their own tuple: its WithOperationID call
+ * sites and the platform-custody result read. Every other operation_id is a possible commit.
+ */
+export declare const operationIdCodes: ReadonlySet<string>;
+export {};

package/dist/errors.js

@@ -0,0 +1,85 @@
+const contracts = {
+    INVALID_REQUEST: { status: 400, retryable: false, nextAction: "none" },
+    REGISTRATION_SCOPE_SELECTION_REQUIRED: { status: 409, retryable: false, nextAction: "none" },
+    CURSOR_INVALID: { status: 400, retryable: false, nextAction: "none" },
+    UNSUPPORTED_VERSION: { status: 400, retryable: false, nextAction: "none" },
+    UNAUTHORIZED: { status: 401, retryable: false, nextAction: "reauthenticate" },
+    SCOPE_DENIED: { status: 403, retryable: false, nextAction: "none" },
+    ORIGIN_NOT_ALLOWED: { status: 403, retryable: false, nextAction: "none" },
+    LIMIT_PER_TRANSFER_EXCEEDED: { status: 403, retryable: false, nextAction: "none" },
+    LIMIT_DAILY_EXCEEDED: { status: 403, retryable: false, nextAction: "none" },
+    RECIPIENT_NOT_ALLOWED: { status: 403, retryable: false, nextAction: "none" },
+    CONFIRMATION_METHOD_UNAVAILABLE: { status: 403, retryable: false, nextAction: "use_passkey" },
+    USER_PROOF_REQUIRED: { status: 403, retryable: false, nextAction: "sign_user_request" },
+    USER_PROOF_INVALID: { status: 403, retryable: false, nextAction: "sign_user_request" },
+    REQUEST_GRANT_INVALID: { status: 403, retryable: false, nextAction: "use_passkey" },
+    DEBIT_PERMISSION_INVALID: { status: 403, retryable: false, nextAction: "none" },
+    NOT_FOUND: { status: 404, retryable: false, nextAction: "none" },
+    IDENTITY_NOT_REGISTERED: { status: 409, retryable: false, nextAction: "start_signup" },
+    IDENTITY_ALREADY_REGISTERED: { status: 409, retryable: false, nextAction: "start_login" },
+    IDENTITY_ALREADY_LINKED: { status: 409, retryable: false, nextAction: "none" },
+    LAST_FACTOR: { status: 409, retryable: false, nextAction: "none" },
+    CONFIRMATION_REPLAYED: { status: 409, retryable: false, nextAction: "none" },
+    CANNOT_CANCEL: { status: 409, retryable: false, nextAction: "none" },
+    VERSION_CONFLICT: { status: 409, retryable: false, nextAction: "refresh_resource" },
+    AUTHORIZATION_STALE: { status: 409, retryable: false, nextAction: "refresh_resource" },
+    IDEMPOTENCY_CONFLICT: { status: 409, retryable: false, nextAction: "lookup_operation" },
+    USER_PROOF_REPLAYED: { status: 409, retryable: false, nextAction: "lookup_operation" },
+    OPERATION_NOT_AUTHORIZED: { status: 409, retryable: false, nextAction: "use_passkey" },
+    RESULT_NOT_READY: { status: 409, retryable: true, nextAction: "wait_for_result" },
+    TRANSFER_IN_FLIGHT: { status: 409, retryable: true, nextAction: "retry_same_request" },
+    ATTEMPT_EXPIRED: { status: 410, retryable: false, nextAction: "reauthenticate" },
+    OPERATION_EXPIRED: { status: 410, retryable: false, nextAction: "none" },
+    RESULT_EXPIRED: { status: 410, retryable: false, nextAction: "none" },
+    RESYNC_REQUIRED: { status: 410, retryable: false, nextAction: "resync_streams" },
+    USER_PROOF_EXPIRED: { status: 410, retryable: false, nextAction: "sign_user_request" },
+    CAPABILITY_UNAVAILABLE: { status: 422, retryable: false, nextAction: "none" },
+    RECOVERY_UNAVAILABLE: { status: 422, retryable: false, nextAction: "none" },
+    PAYLOAD_NOT_SUPPORTED: { status: 422, retryable: false, nextAction: "none" },
+    RATE_LIMITED: { status: 429, retryable: true, nextAction: "retry_same_request" },
+    DEPENDENCY_UNAVAILABLE: { status: 503, retryable: true, nextAction: "retry_same_request" },
+    NETWORK_FEE_TOO_HIGH: { status: 503, retryable: true, nextAction: "retry_same_request" },
+    INSUFFICIENT_BALANCE: { status: 422, retryable: false, nextAction: "none" },
+    WALLET_POLICY_DENIED: { status: 403, retryable: false, nextAction: "none" },
+    TENANT_AUTH_UNAVAILABLE: { status: 503, retryable: true, nextAction: "retry_same_request" },
+    AUDIT_UNAVAILABLE: { status: 503, retryable: true, nextAction: "retry_same_request" },
+    ADAPTER_INTEGRITY_CONFLICT: { status: 503, retryable: false, nextAction: "none" },
+    INTERNAL_ERROR: { status: 500, retryable: true, nextAction: "retry_same_request" },
+};
+/** Every code, with the status, `retryable` and `nextAction` it is answered with. */
+export const AuthorizationErrorContracts = Object.freeze(contracts);
+/** Every code of the provider's ErrorCode enum. */
+export const AuthorizationErrorCodes = Object.freeze(Object.keys(contracts));
+export function isAuthorizationErrorCode(value) {
+    return typeof value === "string" && Object.prototype.hasOwnProperty.call(contracts, value);
+}
+/**
+ * The refusals of a Mode C transfer that the person's app signed and the
+ * service forwarded, besides the answers every request can get. The proof:
+ * `USER_PROOF_REQUIRED`, `USER_PROOF_INVALID`, `USER_PROOF_EXPIRED`, and
+ * `USER_PROOF_REPLAYED` or `IDEMPOTENCY_CONFLICT` for a reused one. The grant:
+ * `REQUEST_GRANT_INVALID` when it is not this service's, has ended or was
+ * enrolled on other bounds. The amount and the recipient, against the grant's
+ * bounds and the wallet's limits: `LIMIT_PER_TRANSFER_EXCEEDED`,
+ * `LIMIT_DAILY_EXCEEDED`, `RECIPIENT_NOT_ALLOWED`. The fee:
+ * `NETWORK_FEE_TOO_HIGH`. The balance, short of the amount and the fee's
+ * ceiling: `INSUFFICIENT_BALANCE`. The wallet system's own signing policy:
+ * `WALLET_POLICY_DENIED`. A refused transfer moved nothing.
+ */
+export const ModeCRefusals = Object.freeze([
+    "USER_PROOF_REQUIRED", "USER_PROOF_INVALID", "USER_PROOF_EXPIRED", "USER_PROOF_REPLAYED", "IDEMPOTENCY_CONFLICT",
+    "REQUEST_GRANT_INVALID", "LIMIT_PER_TRANSFER_EXCEEDED", "LIMIT_DAILY_EXCEEDED", "RECIPIENT_NOT_ALLOWED", "NETWORK_FEE_TOO_HIGH", "INSUFFICIENT_BALANCE", "WALLET_POLICY_DENIED",
+]);
+export const isModeCRefusal = (code) => ModeCRefusals.includes(code);
+/**
+ * The status of a write that possibly committed: it keeps its code and answers retryable false with
+ * lookup_operation and the operation to look up, at 500 for a code that is 500 and otherwise at 503
+ * (the server's error encoder).
+ */
+export const possibleCommitStatus = (code) => AuthorizationErrorContracts[code].status === 500 ? 500 : 503;
+/**
+ * The codes the server names an operation with while keeping their own tuple: its WithOperationID call
+ * sites and the platform-custody result read. Every other operation_id is a possible commit.
+ */
+export const operationIdCodes = new Set(["AUTHORIZATION_STALE", "USER_PROOF_REQUIRED", "IDEMPOTENCY_CONFLICT", "RESULT_NOT_READY", "OPERATION_EXPIRED", "RESULT_EXPIRED",
+    "INVALID_REQUEST", "CAPABILITY_UNAVAILABLE", "ADAPTER_INTEGRITY_CONFLICT", "DEPENDENCY_UNAVAILABLE"]);

package/dist/linkedChecks.d.ts

@@ -0,0 +1,17 @@
+import type { ResultRecipient } from './slice4.ts';
+export declare function fault(): never;
+export declare function requestID(v: unknown): void;
+export declare function requestUUID(v: unknown): void;
+export declare function token(v: unknown): void;
+export declare function uuid(v: unknown): v is string;
+export declare function safeRevision(v: unknown): v is string;
+export declare function text(v: unknown, max: number): v is string;
+export declare function hex(v: unknown): v is string;
+export declare function b64(v: unknown): v is string;
+export declare function digest(v: unknown): v is string;
+export declare function publicKey(a: unknown, v: unknown): boolean;
+export declare function network(v: unknown): v is string;
+export declare function assets(v: unknown): v is string[];
+export declare function activityTypes(v: unknown): v is string[];
+export declare function recipient(v: unknown): ResultRecipient;
+export declare function https(v: unknown): boolean;

package/dist/linkedChecks.js

@@ -0,0 +1,31 @@
+// The small checks the linked-wallet modules share: identifiers, revisions,
+// networks, assets and the error a request or an answer fails with. They
+// moved out of linkedWallets.ts when that file reached the repository line
+// target.
+import { ClientFlowError, canonicalDecimal, opaqueId, record } from './auth.js';
+import { MaxStreamsActivityTypes } from './streams.js';
+export function fault() { throw new ClientFlowError('invalid_server_response'); }
+export function requestID(v) { if (!opaqueId(v))
+    throw new ClientFlowError('invalid_linked_wallet_request'); }
+export function requestUUID(v) { if (!uuid(v))
+    throw new ClientFlowError('invalid_linked_wallet_request'); }
+export function token(v) { if (!text(v, 8192))
+    throw new ClientFlowError('invalid_linked_wallet_request'); }
+export function uuid(v) { return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(v); }
+export function safeRevision(v) { return canonicalDecimal(v) && v.length <= 16 && v !== '0' && BigInt(v) <= BigInt(Number.MAX_SAFE_INTEGER); }
+export function text(v, max) { return typeof v === 'string' && v.length > 0 && new TextEncoder().encode(v).length <= max && v.trim() === v && !/[\x00-\x1f\x7f]/.test(v); }
+export function hex(v) { return typeof v === 'string' && v.length > 0 && v.length <= 2048 && /^([0-9a-f]{2})+$/.test(v); }
+export function b64(v) { return typeof v === 'string' && /^[A-Za-z0-9_-]+$/.test(v); }
+export function digest(v) { return typeof v === 'string' && /^[0-9a-f]{64}$/.test(v); }
+export function publicKey(a, v) { return typeof v === 'string' && (a === 'ed25519' ? /^[a-f0-9]{64}$/.test(v) : a === 'secp256k1' && /^(02|03)[a-f0-9]{64}$|^04[a-f0-9]{128}$/.test(v)); }
+export function network(v) { return typeof v === 'string' && /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}$/.test(v); }
+export function assets(v) { return Array.isArray(v) && v.length <= 32 && new Set(v).size === v.length && v.every(a => typeof a === 'string' && /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,32}\/[-a-z0-9]{3,8}:[-.%a-zA-Z0-9]{1,128}(\/[-.%a-zA-Z0-9]{1,78})?$/.test(a)); }
+export function activityTypes(v) { return Array.isArray(v) && v.length <= MaxStreamsActivityTypes && new Set(v).size === v.length && v.every(t => typeof t === 'string' && t.length <= 64 && /^[a-z][a-z0-9]*(?:[._][a-z0-9]+)*$/.test(t)); }
+export function recipient(v) { const r = record(v, ['type', 'id']); if (!['account', 'service'].includes(r.type) || !opaqueId(r.id))
+    fault(); return { type: r.type, id: r.id }; }
+export function https(v) { try {
+    return typeof v === 'string' && new URL(v).protocol === 'https:';
+}
+catch {
+    return false;
+} }

package/dist/linkedRecovery.d.ts

@@ -0,0 +1,40 @@
+import { type DisplayCommon } from "./walletDisplayParts.ts";
+import type { LinkedWalletIdentity } from "./linkedSendDisplay.ts";
+import type { DeviceSharePackage } from "./walletOperations.ts";
+/** The create body of a recovery: the account's own linked wallet and the new device key its share is sealed to. */
+export type LinkedRecoverCreate = {
+    owner_type: "account";
+    owner_id: string;
+    kind: "wallet.recover";
+    linked_wallet_id: string;
+    payload: {
+        recipient_public_key: string;
+    };
+};
+/**
+ * LinkedRecoverDisplay is what the person confirms: the wallet by its address
+ * and network, and the device key its share goes to. The summary is there from
+ * the admission on, since the recovery is frozen whole when it is admitted.
+ */
+export type LinkedRecoverDisplay = DisplayCommon & LinkedWalletIdentity & {
+    kind: "wallet.recover";
+    network: string;
+    address: string;
+    recipientPublicKey: string;
+    preparedSummary?: string;
+};
+export declare function linkedRecoverCreate(ownerId: string, linkedWalletId: string, recipientPublicKey: string): LinkedRecoverCreate;
+/** validLinkedRecoverCreate checks the members a recovery adds to the common ones validateUserWalletCreate checked. */
+export declare function validLinkedRecoverCreate(common: Record<string, unknown>): boolean;
+export declare function parseLinkedRecoverDisplay(value: unknown): LinkedRecoverDisplay;
+/** The released result of a recovery: the wallet it is of and its device share, sealed to the new device key. */
+export declare function parseRecoveredShareResult(requestId: unknown, value: unknown, expectedOperationId: string): {
+    requestId: string;
+    result: {
+        operationId: string;
+        kind: "device_share_recovered";
+        receiptId: string;
+        linkedWalletId: string;
+        deviceShare: DeviceSharePackage;
+    };
+};