neozip-blockchain 0.7.2 → 1.0.2

package/dist/token-service/TokenServiceFunding.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * NeoZip Token Service funding API client.
+ *
+ * The Token Service can disburse small native-gas grants to the user's primary
+ * linked Data Wallet so on-chain operations (tokenization, timestamping) can pay
+ * for gas. The recipient is server-authoritative — a client may only request a
+ * grant, never redirect it.
+ *
+ *   GET  /funding/policy?chainId=<id>   (no auth)
+ *   GET  /funding/status?chainId=<id>   (Bearer)
+ *   POST /funding/request               (Bearer, optional Idempotency-Key)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FundingUnavailableError = void 0;
+exports.getFundingPolicy = getFundingPolicy;
+exports.getFundingStatus = getFundingStatus;
+exports.requestFundingGrant = requestFundingGrant;
+const http_1 = require("./http");
+/** Thrown when the Token Service does not expose the funding endpoints (older deployment). */
+class FundingUnavailableError extends Error {
+    constructor(message = 'Token Service does not support funding') {
+        super(message);
+        this.name = 'FundingUnavailableError';
+    }
+}
+exports.FundingUnavailableError = FundingUnavailableError;
+/**
+ * Fetch the public funding policy for a chain (grant size, cooldown, low-balance
+ * threshold). No authentication required.
+ *
+ * @throws {FundingUnavailableError} when the endpoint returns 404.
+ * @throws {Error} on other failures or a malformed response.
+ */
+async function getFundingPolicy(baseUrl, chainId) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    let res;
+    try {
+        res = await fetch(`${url}/funding/policy?chainId=${encodeURIComponent(String(chainId))}`, {
+            method: 'GET',
+        });
+    }
+    catch (err) {
+        throw new Error((0, http_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new FundingUnavailableError();
+    }
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `Funding policy lookup failed (HTTP ${res.status})`));
+    }
+    const policy = parsed.policy;
+    if (!policy) {
+        throw new Error('Funding policy response missing policy');
+    }
+    return {
+        chainId: typeof parsed.chainId === 'number' ? parsed.chainId : chainId,
+        network: typeof parsed.network === 'string' ? parsed.network : '',
+        policy,
+    };
+}
+/**
+ * Fetch the caller's funding status for a chain (recipient address, eligibility,
+ * recent grants). Requires a Bearer access token.
+ *
+ * @throws {FundingUnavailableError} when the endpoint returns 404.
+ * @throws {Error} on other failures (including 401/403) or a malformed response.
+ */
+async function getFundingStatus(baseUrl, accessToken, chainId) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    let res;
+    try {
+        res = await fetch(`${url}/funding/status?chainId=${encodeURIComponent(String(chainId))}`, {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+    }
+    catch (err) {
+        throw new Error((0, http_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new FundingUnavailableError();
+    }
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `Funding status lookup failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    return {
+        chainId: typeof parsed.chainId === 'number' ? parsed.chainId : chainId,
+        recipientAddress: typeof parsed.recipientAddress === 'string' ? parsed.recipientAddress : null,
+        enabled: parsed.enabled === true,
+        requiresPayment: parsed.requiresPayment === true,
+        lastGrantAt: typeof parsed.lastGrantAt === 'string' ? parsed.lastGrantAt : null,
+        nextEligibleAt: typeof parsed.nextEligibleAt === 'string' ? parsed.nextEligibleAt : null,
+        recentGrants: Array.isArray(parsed.recentGrants)
+            ? parsed.recentGrants
+            : [],
+    };
+}
+/**
+ * Request a native-gas grant to the caller's primary Data Wallet. Requires a
+ * Bearer access token; an optional `idempotencyKey` makes retries safe.
+ *
+ * Returns the parsed result (which may itself report `success: false` with an
+ * `errorCode` such as a cooldown).
+ *
+ * @throws {FundingUnavailableError} when the endpoint returns 404.
+ * @throws {Error} when the response is non-JSON (e.g. auth failures).
+ */
+async function requestFundingGrant(baseUrl, accessToken, chainId, idempotencyKey) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        'content-type': 'application/json',
+    };
+    if (idempotencyKey) {
+        headers['Idempotency-Key'] = idempotencyKey;
+    }
+    let res;
+    try {
+        res = await fetch(`${url}/funding/request`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ chainId }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, http_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new FundingUnavailableError();
+    }
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!parsed) {
+        // Auth failures and other non-JSON responses.
+        throw new Error((0, http_1.genericAuthErrorMessage)(res.status) ?? `Funding request failed (HTTP ${res.status})`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=TokenServiceFunding.js.map

package/dist/token-service/TokenServiceFunding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenServiceFunding.js","sourceRoot":"","sources":["../../src/token-service/TokenServiceFunding.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAyEH,4CA6BC;AASD,4CAsCC;AAYD,kDAmCC;AAlMD,iCAMgB;AAkDhB,8FAA8F;AAC9F,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,GAAG,wCAAwC;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,2BAA2B,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;YACxF,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,IAAA,mCAA4B,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,sCAAsC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAmC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACtE,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACjE,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,WAAmB,EACnB,OAAe;IAEf,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,2BAA2B,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;YACxF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,IAAA,mCAA4B,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,IAAA,mBAAY,EAAC,MAAM,EAAE,sCAAsC,GAAG,CAAC,MAAM,GAAG,EAAE;YACxE,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACtE,gBAAgB,EACd,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC9E,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI;QAChC,eAAe,EAAE,MAAM,CAAC,eAAe,KAAK,IAAI;QAChD,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAC/E,cAAc,EAAE,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACxF,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAE,MAAM,CAAC,YAAsC;YAChD,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,WAAmB,EACnB,OAAe,EACf,cAAuB;IAEvB,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,WAAW,EAAE;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;IAC9C,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,kBAAkB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,IAAA,mCAA4B,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,8CAA8C;QAC9C,MAAM,IAAI,KAAK,CACb,IAAA,8BAAuB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gCAAgC,GAAG,CAAC,MAAM,GAAG,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,MAAyC,CAAC;AACnD,CAAC"}

package/dist/token-service/TokenServiceIdentity.d.ts

@@ -0,0 +1,96 @@
+/**
+ * NeoZip Token Service identity HTTP client.
+ *
+ * Stateless functions for linking an EVM data wallet to an account and managing
+ * its encrypted identity key:
+ *
+ *   GET  /crypto/coordinator-config                              (no auth)
+ *   POST /identity/wallets/challenge                             (no auth)
+ *   POST /identity/wallets/ensure                                (no auth)
+ *   POST /identity/users/me/wallets/:id/attach/challenge         (Bearer)
+ *   POST /identity/users/me/wallets/:id/attach/complete          (Bearer)
+ *   GET  /identity/wallets/:id/identity-key                      (Bearer)
+ *   POST /identity/wallets/:id/identity-key/init/challenge       (Bearer)
+ *   POST /identity/wallets/:id/identity-key/init/complete        (Bearer)
+ *
+ * These functions only speak HTTP; message signing with the wallet's private key
+ * is the responsibility of the calling application (CLI/Desktop), which composes
+ * the challenge/complete pairs around a local signer.
+ */
+/** Default ECIES suite advertised when registering an identity key. */
+export declare const DEFAULT_RECIPIENT_SUITE = "ecies-x25519-aes256gcm";
+/**
+ * Wrapped (encrypted) EVM private key bundle sent to the Token Service when
+ * registering an identity key. The wrap parameters describe how the X25519
+ * private key is sealed to the EOA so the server stores ciphertext only.
+ */
+export interface WrapBundle {
+    wrappedPrivateKeyB64: string;
+    wrapFormatVersion: number;
+    wrapKdfInfo: string;
+    wrapKdfSaltB64: string;
+    wrapAead: string;
+    wrapIvB64: string;
+    wrapAadB64: string;
+}
+/** Identity-key registration payload: a wrap bundle plus the X25519 public key. */
+export interface IdentityKeyBundleBody extends WrapBundle {
+    x25519PublicKeyB64: string;
+    recipientSuites?: string[];
+}
+/** Thrown when an identity key already exists for a wallet (HTTP 409). */
+export declare class IdentityKeyConflictError extends Error {
+    constructor(message: string);
+}
+/** Probe whether the Token Service exposes wallet-identity coordination. */
+export declare function fetchCoordinatorConfig(baseUrl: string): Promise<boolean>;
+/** Request a challenge proving control of `evmAddress` (no auth). */
+export declare function requestWalletEnsureChallenge(baseUrl: string, evmAddress: string): Promise<{
+    challengeId: string;
+    message: string;
+    evmAddress: string;
+}>;
+/** Ensure a wallet record exists for the signed challenge (no auth). */
+export declare function completeWalletEnsure(baseUrl: string, input: {
+    evmAddress: string;
+    challengeId: string;
+    evmSignature: string;
+}): Promise<{
+    walletId: number;
+    evmAddress: string;
+}>;
+/** Request a challenge to attach a wallet to the authenticated account (Bearer). */
+export declare function requestWalletAttachChallenge(baseUrl: string, accessToken: string, walletId: number): Promise<{
+    challengeId: string;
+    message: string;
+    walletId: number;
+    evmAddress: string;
+}>;
+/** Complete a wallet attach with a signature, linking it as primary (Bearer). */
+export declare function completeWalletAttach(baseUrl: string, accessToken: string, walletId: number, input: {
+    challengeId: string;
+    evmSignature: string;
+}): Promise<{
+    linkId: number;
+}>;
+/** Fetch the identity-key bundle for a wallet, or `{ found: false }` (Bearer). */
+export declare function getIdentityKeyBundle(baseUrl: string, accessToken: string, walletId: number): Promise<{
+    found: false;
+} | {
+    found: true;
+    identityKeyId: number;
+    x25519PublicKey: string;
+}>;
+/** Request a challenge to register an identity key for a wallet (Bearer). */
+export declare function requestIdentityKeyInitChallenge(baseUrl: string, accessToken: string, walletId: number, bundle: IdentityKeyBundleBody): Promise<{
+    challengeId: string;
+    message: string;
+    evmAddress: string;
+    wrappedSha256Hex: string;
+}>;
+/** Complete identity-key registration with a signature (Bearer). */
+export declare function completeIdentityKeyInit(baseUrl: string, accessToken: string, walletId: number, bundle: IdentityKeyBundleBody, challengeId: string, evmSignature: string): Promise<{
+    identityKeyId: number;
+    x25519PublicKey: string;
+}>;
+//# sourceMappingURL=TokenServiceIdentity.d.ts.map

package/dist/token-service/TokenServiceIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenServiceIdentity.d.ts","sourceRoot":"","sources":["../../src/token-service/TokenServiceIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAuBD,4EAA4E;AAC5E,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ9E;AAED,qEAAqE;AACrE,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBvE;AAED,wEAAwE;AACxE,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvE,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBnD;AAED,oFAAoF;AACpF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBzF;AAED,iFAAiF;AACjF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B7B;AAED,kFAAkF;AAClF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB7F;AAED,6EAA6E;AAC7E,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC,CAwBD;AAED,oEAAoE;AACpE,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAkC7D"}

package/dist/token-service/TokenServiceIdentity.js

@@ -0,0 +1,240 @@
+"use strict";
+/**
+ * NeoZip Token Service identity HTTP client.
+ *
+ * Stateless functions for linking an EVM data wallet to an account and managing
+ * its encrypted identity key:
+ *
+ *   GET  /crypto/coordinator-config                              (no auth)
+ *   POST /identity/wallets/challenge                             (no auth)
+ *   POST /identity/wallets/ensure                                (no auth)
+ *   POST /identity/users/me/wallets/:id/attach/challenge         (Bearer)
+ *   POST /identity/users/me/wallets/:id/attach/complete          (Bearer)
+ *   GET  /identity/wallets/:id/identity-key                      (Bearer)
+ *   POST /identity/wallets/:id/identity-key/init/challenge       (Bearer)
+ *   POST /identity/wallets/:id/identity-key/init/complete        (Bearer)
+ *
+ * These functions only speak HTTP; message signing with the wallet's private key
+ * is the responsibility of the calling application (CLI/Desktop), which composes
+ * the challenge/complete pairs around a local signer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityKeyConflictError = exports.DEFAULT_RECIPIENT_SUITE = void 0;
+exports.fetchCoordinatorConfig = fetchCoordinatorConfig;
+exports.requestWalletEnsureChallenge = requestWalletEnsureChallenge;
+exports.completeWalletEnsure = completeWalletEnsure;
+exports.requestWalletAttachChallenge = requestWalletAttachChallenge;
+exports.completeWalletAttach = completeWalletAttach;
+exports.getIdentityKeyBundle = getIdentityKeyBundle;
+exports.requestIdentityKeyInitChallenge = requestIdentityKeyInitChallenge;
+exports.completeIdentityKeyInit = completeIdentityKeyInit;
+const ethers_1 = require("ethers");
+const http_1 = require("./http");
+/** Default ECIES suite advertised when registering an identity key. */
+exports.DEFAULT_RECIPIENT_SUITE = 'ecies-x25519-aes256gcm';
+/** Thrown when an identity key already exists for a wallet (HTTP 409). */
+class IdentityKeyConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityKeyConflictError';
+    }
+}
+exports.IdentityKeyConflictError = IdentityKeyConflictError;
+function challengeBody(bundle) {
+    return {
+        x25519PublicKeyB64: bundle.x25519PublicKeyB64,
+        wrappedPrivateKeyB64: bundle.wrappedPrivateKeyB64,
+        wrapFormatVersion: bundle.wrapFormatVersion,
+        wrapKdfInfo: bundle.wrapKdfInfo,
+        wrapKdfSaltB64: bundle.wrapKdfSaltB64,
+        wrapAead: bundle.wrapAead,
+        wrapIvB64: bundle.wrapIvB64,
+        wrapAadB64: bundle.wrapAadB64,
+        recipientSuites: bundle.recipientSuites ?? [exports.DEFAULT_RECIPIENT_SUITE],
+    };
+}
+function authHeaders(accessToken) {
+    return {
+        Authorization: `Bearer ${accessToken}`,
+        'content-type': 'application/json',
+    };
+}
+/** Probe whether the Token Service exposes wallet-identity coordination. */
+async function fetchCoordinatorConfig(baseUrl) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    try {
+        const res = await fetch(`${url}/crypto/coordinator-config`, { method: 'GET' });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/** Request a challenge proving control of `evmAddress` (no auth). */
+async function requestWalletEnsureChallenge(baseUrl, evmAddress) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const checksummed = (0, ethers_1.getAddress)(evmAddress.trim());
+    const res = await fetch(`${url}/identity/wallets/challenge`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ evmAddress: checksummed }),
+    });
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `Wallet challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = (0, http_1.pickString)(parsed, 'challengeId');
+    const message = (0, http_1.pickString)(parsed, 'message');
+    const addr = (0, http_1.pickString)(parsed, 'evmAddress');
+    if (!challengeId || !message || !addr) {
+        throw new Error('Wallet challenge response missing fields');
+    }
+    return { challengeId, message, evmAddress: addr };
+}
+/** Ensure a wallet record exists for the signed challenge (no auth). */
+async function completeWalletEnsure(baseUrl, input) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const checksummed = (0, ethers_1.getAddress)(input.evmAddress.trim());
+    const res = await fetch(`${url}/identity/wallets/ensure`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            evmAddress: checksummed,
+            challengeId: input.challengeId,
+            evmSignature: input.evmSignature,
+        }),
+    });
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `Wallet ensure failed (HTTP ${res.status})`));
+    }
+    const walletId = typeof parsed.walletId === 'number' ? parsed.walletId : Number(parsed.walletId);
+    const addr = (0, http_1.pickString)(parsed, 'evmAddress');
+    if (!Number.isFinite(walletId) || !addr) {
+        throw new Error('Wallet ensure response missing walletId');
+    }
+    return { walletId, evmAddress: addr };
+}
+/** Request a challenge to attach a wallet to the authenticated account (Bearer). */
+async function requestWalletAttachChallenge(baseUrl, accessToken, walletId) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const res = await fetch(`${url}/identity/users/me/wallets/${walletId}/attach/challenge`, { method: 'POST', headers: authHeaders(accessToken) });
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `Attach challenge failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const challengeId = (0, http_1.pickString)(parsed, 'challengeId');
+    const message = (0, http_1.pickString)(parsed, 'message');
+    const wid = typeof parsed.walletId === 'number' ? parsed.walletId : Number(parsed.walletId);
+    const addr = (0, http_1.pickString)(parsed, 'evmAddress');
+    if (!challengeId || !message || !Number.isFinite(wid) || !addr) {
+        throw new Error('Attach challenge response missing fields');
+    }
+    return { challengeId, message, walletId: wid, evmAddress: addr };
+}
+/** Complete a wallet attach with a signature, linking it as primary (Bearer). */
+async function completeWalletAttach(baseUrl, accessToken, walletId, input) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const res = await fetch(`${url}/identity/users/me/wallets/${walletId}/attach/complete`, {
+        method: 'POST',
+        headers: authHeaders(accessToken),
+        body: JSON.stringify({
+            challengeId: input.challengeId,
+            evmSignature: input.evmSignature,
+            setPrimary: true,
+        }),
+    });
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `Attach complete failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const linkId = typeof parsed.linkId === 'number' ? parsed.linkId : Number(parsed.linkId);
+    if (!Number.isFinite(linkId)) {
+        throw new Error('Attach complete response missing linkId');
+    }
+    return { linkId };
+}
+/** Fetch the identity-key bundle for a wallet, or `{ found: false }` (Bearer). */
+async function getIdentityKeyBundle(baseUrl, accessToken, walletId) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key`, {
+        method: 'GET',
+        headers: authHeaders(accessToken),
+    });
+    if (res.status === 404)
+        return { found: false };
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `identity-key GET failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const ik = parsed.identityKey;
+    if (!ik)
+        throw new Error('identity-key response missing identityKey');
+    const identityKeyId = typeof ik.identityKeyId === 'number' ? ik.identityKeyId : Number(ik.identityKeyId);
+    const x25519PublicKey = (0, http_1.pickString)(ik, 'x25519PublicKeyB64', 'x25519PublicKey');
+    if (!Number.isFinite(identityKeyId) || !x25519PublicKey) {
+        throw new Error('identity-key response incomplete');
+    }
+    return { found: true, identityKeyId, x25519PublicKey };
+}
+/** Request a challenge to register an identity key for a wallet (Bearer). */
+async function requestIdentityKeyInitChallenge(baseUrl, accessToken, walletId, bundle) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key/init/challenge`, {
+        method: 'POST',
+        headers: authHeaders(accessToken),
+        body: JSON.stringify(challengeBody(bundle)),
+    });
+    const parsed = await (0, http_1.safeJson)(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `init challenge failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const challengeId = (0, http_1.pickString)(parsed, 'challengeId');
+    const message = (0, http_1.pickString)(parsed, 'message');
+    const evmAddress = (0, http_1.pickString)(parsed, 'evmAddress');
+    const wrappedSha256Hex = (0, http_1.pickString)(parsed, 'wrappedSha256Hex');
+    if (!challengeId || !message || !evmAddress || !wrappedSha256Hex) {
+        throw new Error('init challenge response missing fields');
+    }
+    return { challengeId, message, evmAddress, wrappedSha256Hex };
+}
+/** Complete identity-key registration with a signature (Bearer). */
+async function completeIdentityKeyInit(baseUrl, accessToken, walletId, bundle, challengeId, evmSignature) {
+    const url = (0, http_1.normalizeServerUrl)(baseUrl);
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key/init/complete`, {
+        method: 'POST',
+        headers: authHeaders(accessToken),
+        body: JSON.stringify({
+            ...challengeBody(bundle),
+            challengeId,
+            evmSignature,
+        }),
+    });
+    const parsed = await (0, http_1.safeJson)(res);
+    if (res.status === 409) {
+        throw new IdentityKeyConflictError((0, http_1.extractError)(parsed, 'Identity key already exists for this wallet.'));
+    }
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error((0, http_1.extractError)(parsed, `init complete failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const ik = parsed.identityKey;
+    if (!ik)
+        throw new Error('init complete missing identityKey');
+    const identityKeyId = typeof ik.identityKeyId === 'number' ? ik.identityKeyId : Number(ik.identityKeyId);
+    const x25519PublicKey = (0, http_1.pickString)(ik, 'x25519PublicKeyB64', 'x25519PublicKey');
+    if (!Number.isFinite(identityKeyId) || !x25519PublicKey) {
+        throw new Error('init complete response incomplete');
+    }
+    return { identityKeyId, x25519PublicKey };
+}
+//# sourceMappingURL=TokenServiceIdentity.js.map

package/dist/token-service/TokenServiceIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenServiceIdentity.js","sourceRoot":"","sources":["../../src/token-service/TokenServiceIdentity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAgEH,wDAQC;AAGD,oEAsBC;AAGD,oDA0BC;AAGD,oEAyBC;AAGD,oDA+BC;AAGD,oDA0BC;AAGD,0EAkCC;AAGD,0DAyCC;AAxSD,mCAAoC;AACpC,iCAKgB;AAEhB,uEAAuE;AAC1D,QAAA,uBAAuB,GAAG,wBAAwB,CAAC;AAuBhE,0EAA0E;AAC1E,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,SAAS,aAAa,CAAC,MAA6B;IAClD,OAAO;QACL,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,+BAAuB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB;IACtC,OAAO;QACL,aAAa,EAAE,UAAU,WAAW,EAAE;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,sBAAsB,CAAC,OAAe;IAC1D,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qEAAqE;AAC9D,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,UAAkB;IAElB,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,6BAA6B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,iCAAiC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,KAAwE;IAExE,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,0BAA0B,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GACZ,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,WAAmB,EACnB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,GAAG,8BAA8B,QAAQ,mBAAmB,EAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,CACtD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,iCAAiC,GAAG,CAAC,MAAM,GAAG,EAAE;YACnF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GACP,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACnE,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,WAAmB,EACnB,QAAgB,EAChB,KAAoD;IAEpD,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,GAAG,8BAA8B,QAAQ,kBAAkB,EAC9D;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,IAAI;SACjB,CAAC;KACH,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,gCAAgC,GAAG,CAAC,MAAM,GAAG,EAAE;YAClF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,WAAmB,EACnB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,qBAAqB,QAAQ,eAAe,EAAE;QAC1E,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,iCAAiC,GAAG,CAAC,MAAM,GAAG,EAAE;YACnF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAkD,CAAC;IACrE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACtE,MAAM,aAAa,GACjB,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,EAAE,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AACzD,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,+BAA+B,CACnD,OAAe,EACf,WAAmB,EACnB,QAAgB,EAChB,MAA6B;IAO7B,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,GAAG,qBAAqB,QAAQ,8BAA8B,EACjE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;KAC5C,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,+BAA+B,GAAG,CAAC,MAAM,GAAG,EAAE;YACjF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,IAAA,iBAAU,EAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AAChE,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,WAAmB,EACnB,QAAgB,EAChB,MAA6B,EAC7B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,GAAG,GAAG,IAAA,yBAAkB,EAAC,OAAO,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,GAAG,qBAAqB,QAAQ,6BAA6B,EAChE;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,aAAa,CAAC,MAAM,CAAC;YACxB,WAAW;YACX,YAAY;SACb,CAAC;KACH,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAQ,EAA0B,GAAG,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAChC,IAAA,mBAAY,EAAC,MAAM,EAAE,8CAA8C,CAAC,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,IAAA,mBAAY,EAAC,MAAM,EAAE,8BAA8B,GAAG,CAAC,MAAM,GAAG,EAAE;YAChF,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAkD,CAAC;IACrE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC9D,MAAM,aAAa,GACjB,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,EAAE,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAC5C,CAAC"}

package/dist/token-service/http.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Shared low-level HTTP utilities for the NeoZip Token Service account, funding,
+ * and identity client modules.
+ *
+ * These helpers are intentionally persistence-free and product-agnostic: they
+ * speak raw HTTP to the Token Service and surface **generic** errors. Higher
+ * layers (CLI / MCP / Desktop) own token storage and may map authentication
+ * failures (401/403) to product-specific recovery guidance.
+ */
+/**
+ * Resolve and normalize a Token Service base URL.
+ *
+ * Resolution follows {@link getTokenServiceUrl} (explicit URL → env → default),
+ * then trailing slashes are stripped so callers can safely append `/path`.
+ */
+export declare function normalizeServerUrl(serverUrl?: string): string;
+/** Parse a JSON body, returning `null` for non-JSON or malformed responses. */
+export declare function safeJson<T>(response: Response): Promise<T | null>;
+/** Return the first non-empty string value among `keys`, else `null`. */
+export declare function pickString(obj: Record<string, unknown>, ...keys: string[]): string | null;
+/**
+ * Generic authentication-failure message for 401/403 responses. Returns `null`
+ * for any other status. Intentionally free of product-specific recovery
+ * commands — application layers should add their own guidance.
+ */
+export declare function genericAuthErrorMessage(status: number): string | null;
+/**
+ * Extract a human-readable error from a parsed JSON body, preferring `error`
+ * then `message`. For 401/403 (when `options.status` is provided) a generic
+ * auth message is returned instead.
+ */
+export declare function extractError(parsed: unknown, fallback: string, options?: {
+    status?: number;
+}): string;
+/**
+ * Derive an access-token expiry (epoch milliseconds) from a verify/login
+ * response body. Supports both absolute `expiresAt` (seconds or ms) and
+ * relative `expiresIn` (seconds). Returns `null` when neither is present.
+ */
+export declare function parseAccessTokenExpiry(parsed: Record<string, unknown>): number | null;
+/**
+ * Turn a thrown `fetch` error into a friendly, actionable message. Network-level
+ * failures point at the unreachable base URL; everything else is passed through.
+ */
+export declare function formatTokenServiceFetchError(baseUrl: string, err: unknown): string;
+//# sourceMappingURL=http.d.ts.map

package/dist/token-service/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/token-service/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,+EAA+E;AAC/E,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAQvE;AAED,yEAAyE;AACzE,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,IAAI,EAAE,MAAM,EAAE,GAChB,MAAM,GAAG,IAAI,CAMf;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CAUR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,GAAG,IAAI,CAUf;AAUD;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAalF"}