neozip-cli 0.90.0 → 0.95.1

package/dist/src/account/token-service-funding.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FundingUnavailableError = void 0;
+exports.getFundingPolicy = getFundingPolicy;
+exports.getFundingStatus = getFundingStatus;
+exports.requestFundingGrant = requestFundingGrant;
+/**
+ * Token Service funding API client.
+ *
+ * The Token Service can disburse small native-gas grants to the user's primary
+ * linked Data Wallet so on-chain operations (-b tokenization, -ts timestamp,
+ * -ots) can pay for gas. The recipient is server-authoritative — a client may
+ * only request a grant, never redirect it.
+ *
+ *   GET  /funding/policy?chainId=<id>   (no auth)
+ *   GET  /funding/status?chainId=<id>   (Bearer)
+ *   POST /funding/request               (Bearer, optional Idempotency-Key)
+ */
+const recipient_lookup_1 = require("../archive/recipient-lookup");
+const token_service_fetch_1 = require("../util/token-service-fetch");
+const token_auth_1 = require("../connection/token-auth");
+/** Thrown when the Token Service does not expose the funding endpoints (older deployment). */
+class FundingUnavailableError extends Error {
+    constructor(message = "Token Service does not support funding") {
+        super(message);
+        this.name = "FundingUnavailableError";
+    }
+}
+exports.FundingUnavailableError = FundingUnavailableError;
+async function safeJson(response) {
+    const ct = response.headers.get("content-type") || "";
+    if (!ct.includes("json"))
+        return null;
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+function extractError(parsed, fallback, options) {
+    const authHint = options?.status != null
+        ? (0, token_auth_1.tokenServiceAuthErrorMessage)(options.status, options.email)
+        : null;
+    if (authHint)
+        return authHint;
+    if (parsed && typeof parsed === "object") {
+        const p = parsed;
+        if (typeof p.error === "string")
+            return p.error;
+        if (typeof p.message === "string")
+            return p.message;
+    }
+    return fallback;
+}
+function baseUrlFor(baseUrl) {
+    return (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+}
+async function getFundingPolicy(baseUrl, chainId) {
+    const url = baseUrlFor(baseUrl);
+    let res;
+    try {
+        res = await fetch(`${url}/funding/policy?chainId=${encodeURIComponent(String(chainId))}`, {
+            method: "GET",
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new FundingUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Funding policy lookup failed (HTTP ${res.status})`));
+    }
+    const policy = parsed.policy;
+    if (!policy) {
+        throw new Error("Funding policy response missing policy");
+    }
+    return {
+        chainId: typeof parsed.chainId === "number" ? parsed.chainId : chainId,
+        network: typeof parsed.network === "string" ? parsed.network : "",
+        policy,
+    };
+}
+async function getFundingStatus(baseUrl, accessToken, chainId) {
+    const url = baseUrlFor(baseUrl);
+    let res;
+    try {
+        res = await fetch(`${url}/funding/status?chainId=${encodeURIComponent(String(chainId))}`, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new FundingUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Funding status lookup failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    return {
+        chainId: typeof parsed.chainId === "number" ? parsed.chainId : chainId,
+        recipientAddress: typeof parsed.recipientAddress === "string" ? parsed.recipientAddress : null,
+        enabled: parsed.enabled === true,
+        requiresPayment: parsed.requiresPayment === true,
+        lastGrantAt: typeof parsed.lastGrantAt === "string" ? parsed.lastGrantAt : null,
+        nextEligibleAt: typeof parsed.nextEligibleAt === "string" ? parsed.nextEligibleAt : null,
+        recentGrants: Array.isArray(parsed.recentGrants)
+            ? parsed.recentGrants
+            : [],
+    };
+}
+async function requestFundingGrant(baseUrl, accessToken, chainId, idempotencyKey) {
+    const url = baseUrlFor(baseUrl);
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json",
+    };
+    if (idempotencyKey) {
+        headers["Idempotency-Key"] = idempotencyKey;
+    }
+    let res;
+    try {
+        res = await fetch(`${url}/funding/request`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ chainId }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new FundingUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!parsed) {
+        // Auth failures and other non-JSON responses.
+        throw new Error((0, token_auth_1.tokenServiceAuthErrorMessage)(res.status, null) ??
+            `Funding request failed (HTTP ${res.status})`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=token-service-funding.js.map

package/dist/src/account/token-service-identity.js

@@ -0,0 +1,488 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityKeyConflictError = exports.WalletLoginUnavailableError = void 0;
+exports.registerEmailWithDelivery = registerEmailWithDelivery;
+exports.registerEmailApp = registerEmailApp;
+exports.registerEmailCli = registerEmailCli;
+exports.verifyEmailAndExtractToken = verifyEmailAndExtractToken;
+exports.exchangeMagicLinkToken = exchangeMagicLinkToken;
+exports.requestWalletLoginChallenge = requestWalletLoginChallenge;
+exports.walletLogin = walletLogin;
+exports.requestPhoneOtp = requestPhoneOtp;
+exports.verifyPhoneOtp = verifyPhoneOtp;
+exports.fetchCoordinatorConfig = fetchCoordinatorConfig;
+exports.requestWalletEnsureChallenge = requestWalletEnsureChallenge;
+exports.completeWalletEnsure = completeWalletEnsure;
+exports.requestWalletAttachChallenge = requestWalletAttachChallenge;
+exports.completeWalletAttach = completeWalletAttach;
+exports.runWalletEnsureAndAttach = runWalletEnsureAndAttach;
+exports.getIdentityKeyBundle = getIdentityKeyBundle;
+exports.requestIdentityKeyInitChallenge = requestIdentityKeyInitChallenge;
+exports.completeIdentityKeyInit = completeIdentityKeyInit;
+const ethers_1 = require("ethers");
+const recipient_lookup_1 = require("../archive/recipient-lookup");
+const token_service_fetch_1 = require("../util/token-service-fetch");
+const token_auth_1 = require("../connection/token-auth");
+const wallet_evm_1 = require("./wallet-evm");
+const DEFAULT_RECIPIENT_SUITE = "ecies-x25519-aes256gcm";
+function challengeBody(bundle) {
+    return {
+        x25519PublicKeyB64: bundle.x25519PublicKeyB64,
+        wrappedPrivateKeyB64: bundle.wrappedPrivateKeyB64,
+        wrapFormatVersion: bundle.wrapFormatVersion,
+        wrapKdfInfo: bundle.wrapKdfInfo,
+        wrapKdfSaltB64: bundle.wrapKdfSaltB64,
+        wrapAead: bundle.wrapAead,
+        wrapIvB64: bundle.wrapIvB64,
+        wrapAadB64: bundle.wrapAadB64,
+        recipientSuites: bundle.recipientSuites ?? [DEFAULT_RECIPIENT_SUITE],
+    };
+}
+function pickString(obj, ...keys) {
+    for (const k of keys) {
+        const v = obj[k];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+    }
+    return null;
+}
+function extractError(parsed, fallback, options) {
+    const authHint = options?.status != null
+        ? (0, token_auth_1.tokenServiceAuthErrorMessage)(options.status, options.email)
+        : null;
+    if (authHint)
+        return authHint;
+    if (parsed && typeof parsed === "object") {
+        const p = parsed;
+        if (typeof p.error === "string")
+            return p.error;
+        if (typeof p.message === "string")
+            return p.message;
+    }
+    return fallback;
+}
+async function safeJson(response) {
+    const ct = response.headers.get("content-type") || "";
+    if (!ct.includes("json"))
+        return null;
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function registerEmailWithDelivery(baseUrl, email, verificationDelivery) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/register`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                email: email.trim().toLowerCase(),
+                verificationDelivery,
+            }),
+        });
+    }
+    catch (err) {
+        return { success: false, error: (0, token_service_fetch_1.formatTokenServiceFetchError)(url, err) };
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        return {
+            success: false,
+            error: extractError(parsed, `HTTP ${res.status}`),
+        };
+    }
+    return {
+        success: true,
+        message: typeof parsed.message === "string" ? parsed.message : "Verification email sent.",
+    };
+}
+/** Desktop-style registration (deep link email). */
+async function registerEmailApp(baseUrl, email) {
+    return registerEmailWithDelivery(baseUrl, email, "app");
+}
+/** Terminal / neozip connect registration (6-digit code only). */
+async function registerEmailCli(baseUrl, email) {
+    return registerEmailWithDelivery(baseUrl, email, "cli");
+}
+async function verifyEmailAndExtractToken(baseUrl, email, code) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/verify-email-code`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ email: email.trim().toLowerCase(), code: code.trim() }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Verification failed (HTTP ${res.status})`, {
+            status: res.status,
+            email,
+        }));
+    }
+    const accessToken = pickString(parsed, "accessToken", "token", "bearerToken") ?? null;
+    if (!accessToken) {
+        throw new Error("Verification succeeded but no accessToken in response. Set NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN manually or update neozip-blockchain.");
+    }
+    const verifiedEmail = pickString(parsed, "email") ?? email.trim().toLowerCase();
+    return {
+        accessToken,
+        email: verifiedEmail,
+        expiresAt: (0, token_auth_1.parseAccessTokenExpiry)(parsed),
+    };
+}
+async function exchangeMagicLinkToken(baseUrl, token) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/exchange-token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ token: token.trim() }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Magic link exchange failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const accessToken = pickString(parsed, "accessToken", "token", "bearerToken") ?? null;
+    if (!accessToken) {
+        throw new Error("Magic link exchange succeeded but no accessToken in response.");
+    }
+    const verifiedEmail = pickString(parsed, "email") ?? "";
+    if (!verifiedEmail) {
+        throw new Error("Magic link exchange succeeded but no email in response.");
+    }
+    return {
+        accessToken,
+        email: verifiedEmail,
+        expiresAt: (0, token_auth_1.parseAccessTokenExpiry)(parsed),
+    };
+}
+/** Thrown when the Token Service does not expose the wallet-login endpoints (older deployment). */
+class WalletLoginUnavailableError extends Error {
+    constructor(message = 'Token Service does not support wallet login') {
+        super(message);
+        this.name = 'WalletLoginUnavailableError';
+    }
+}
+exports.WalletLoginUnavailableError = WalletLoginUnavailableError;
+async function requestWalletLoginChallenge(baseUrl, evmAddress) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const checksummed = (0, ethers_1.getAddress)(evmAddress.trim());
+    let res;
+    try {
+        res = await fetch(`${url}/auth/wallet-login/challenge`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ evmAddress: checksummed }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new WalletLoginUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet login challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, 'challengeId');
+    const message = pickString(parsed, 'message');
+    const addr = pickString(parsed, 'evmAddress');
+    if (!challengeId || !message || !addr) {
+        throw new Error('Wallet login challenge response missing fields');
+    }
+    return { challengeId, message, evmAddress: addr };
+}
+async function walletLogin(baseUrl, input) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/wallet-login`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                evmAddress: (0, ethers_1.getAddress)(input.evmAddress.trim()),
+                challengeId: input.challengeId,
+                evmSignature: input.evmSignature,
+            }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new WalletLoginUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet login failed (HTTP ${res.status})`, { status: res.status }));
+    }
+    const accessToken = pickString(parsed, 'accessToken', 'token', 'bearerToken');
+    if (!accessToken) {
+        throw new Error('Wallet login succeeded but no accessToken in response.');
+    }
+    return {
+        accessToken,
+        email: pickString(parsed, 'email'),
+        expiresAt: (0, token_auth_1.parseAccessTokenExpiry)(parsed),
+    };
+}
+async function requestPhoneOtp(baseUrl, accessToken, phoneE164) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/phone/request-otp`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ phoneE164: phoneE164.trim() }),
+        });
+    }
+    catch (err) {
+        return { success: false, error: (0, token_service_fetch_1.formatTokenServiceFetchError)(url, err) };
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        return {
+            success: false,
+            error: extractError(parsed, `Phone OTP request failed (HTTP ${res.status})`),
+        };
+    }
+    return { success: true };
+}
+async function verifyPhoneOtp(baseUrl, accessToken, phoneE164, code) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/phone/verify`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                phoneE164: phoneE164.trim(),
+                code: code.trim(),
+            }),
+        });
+    }
+    catch (err) {
+        return { success: false, error: (0, token_service_fetch_1.formatTokenServiceFetchError)(url, err) };
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        return {
+            success: false,
+            error: extractError(parsed, `Phone verification failed (HTTP ${res.status})`),
+        };
+    }
+    return { success: true };
+}
+class IdentityKeyConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IdentityKeyConflictError";
+    }
+}
+exports.IdentityKeyConflictError = IdentityKeyConflictError;
+function authHeaders(accessToken) {
+    return {
+        Authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json",
+    };
+}
+async function fetchCoordinatorConfig(baseUrl) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    try {
+        const res = await fetch(`${url}/crypto/coordinator-config`, { method: "GET" });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function requestWalletEnsureChallenge(baseUrl, evmAddress) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const checksummed = (0, ethers_1.getAddress)(evmAddress.trim());
+    const res = await fetch(`${url}/identity/wallets/challenge`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ evmAddress: checksummed }),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, "challengeId");
+    const message = pickString(parsed, "message");
+    const addr = pickString(parsed, "evmAddress");
+    if (!challengeId || !message || !addr) {
+        throw new Error("Wallet challenge response missing fields");
+    }
+    return { challengeId, message, evmAddress: addr };
+}
+async function completeWalletEnsure(baseUrl, input) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const checksummed = (0, ethers_1.getAddress)(input.evmAddress.trim());
+    const res = await fetch(`${url}/identity/wallets/ensure`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            evmAddress: checksummed,
+            challengeId: input.challengeId,
+            evmSignature: input.evmSignature,
+        }),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet ensure failed (HTTP ${res.status})`));
+    }
+    const walletId = typeof parsed.walletId === "number" ? parsed.walletId : Number(parsed.walletId);
+    const addr = pickString(parsed, "evmAddress");
+    if (!Number.isFinite(walletId) || !addr) {
+        throw new Error("Wallet ensure response missing walletId");
+    }
+    return { walletId, evmAddress: addr };
+}
+async function requestWalletAttachChallenge(baseUrl, accessToken, walletId) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/users/me/wallets/${walletId}/attach/challenge`, { method: "POST", headers: authHeaders(accessToken) });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Attach challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, "challengeId");
+    const message = pickString(parsed, "message");
+    const wid = typeof parsed.walletId === "number" ? parsed.walletId : Number(parsed.walletId);
+    const addr = pickString(parsed, "evmAddress");
+    if (!challengeId || !message || !Number.isFinite(wid) || !addr) {
+        throw new Error("Attach challenge response missing fields");
+    }
+    return { challengeId, message, walletId: wid, evmAddress: addr };
+}
+async function completeWalletAttach(baseUrl, accessToken, walletId, input) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/users/me/wallets/${walletId}/attach/complete`, {
+        method: "POST",
+        headers: authHeaders(accessToken),
+        body: JSON.stringify({
+            challengeId: input.challengeId,
+            evmSignature: input.evmSignature,
+            setPrimary: true,
+        }),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Attach complete failed (HTTP ${res.status})`));
+    }
+    const linkId = typeof parsed.linkId === "number" ? parsed.linkId : Number(parsed.linkId);
+    if (!Number.isFinite(linkId)) {
+        throw new Error("Attach complete response missing linkId");
+    }
+    return { linkId };
+}
+async function runWalletEnsureAndAttach(baseUrl, accessToken, evmPrivateKey, evmAddress) {
+    const ensureCh = await requestWalletEnsureChallenge(baseUrl, evmAddress);
+    const ensureSig = await (0, wallet_evm_1.signEvmMessage)(evmPrivateKey, ensureCh.message);
+    const ensured = await completeWalletEnsure(baseUrl, {
+        evmAddress,
+        challengeId: ensureCh.challengeId,
+        evmSignature: ensureSig,
+    });
+    const attachCh = await requestWalletAttachChallenge(baseUrl, accessToken, ensured.walletId);
+    const attachSig = await (0, wallet_evm_1.signEvmMessage)(evmPrivateKey, attachCh.message);
+    const { linkId } = await completeWalletAttach(baseUrl, accessToken, ensured.walletId, {
+        challengeId: attachCh.challengeId,
+        evmSignature: attachSig,
+    });
+    return { walletId: ensured.walletId, evmAddress: ensured.evmAddress, linkId };
+}
+async function getIdentityKeyBundle(baseUrl, accessToken, walletId) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key`, {
+        method: "GET",
+        headers: authHeaders(accessToken),
+    });
+    if (res.status === 404)
+        return { found: false };
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `identity-key GET failed (HTTP ${res.status})`));
+    }
+    const ik = parsed.identityKey;
+    if (!ik)
+        throw new Error("identity-key response missing identityKey");
+    const identityKeyId = typeof ik.identityKeyId === "number" ? ik.identityKeyId : Number(ik.identityKeyId);
+    const x25519PublicKey = pickString(ik, "x25519PublicKeyB64", "x25519PublicKey");
+    if (!Number.isFinite(identityKeyId) || !x25519PublicKey) {
+        throw new Error("identity-key response incomplete");
+    }
+    return { found: true, identityKeyId, x25519PublicKey };
+}
+async function requestIdentityKeyInitChallenge(baseUrl, accessToken, walletId, bundle) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key/init/challenge`, {
+        method: "POST",
+        headers: authHeaders(accessToken),
+        body: JSON.stringify(challengeBody(bundle)),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `init challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, "challengeId");
+    const message = pickString(parsed, "message");
+    const evmAddress = pickString(parsed, "evmAddress");
+    const wrappedSha256Hex = pickString(parsed, "wrappedSha256Hex");
+    if (!challengeId || !message || !evmAddress || !wrappedSha256Hex) {
+        throw new Error("init challenge response missing fields");
+    }
+    return { challengeId, message, evmAddress, wrappedSha256Hex };
+}
+async function completeIdentityKeyInit(baseUrl, accessToken, walletId, bundle, challengeId, evmSignature) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key/init/complete`, {
+        method: "POST",
+        headers: authHeaders(accessToken),
+        body: JSON.stringify({
+            ...challengeBody(bundle),
+            challengeId,
+            evmSignature,
+        }),
+    });
+    const parsed = await safeJson(res);
+    if (res.status === 409) {
+        throw new IdentityKeyConflictError(extractError(parsed, "Identity key already exists for this wallet."));
+    }
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `init complete failed (HTTP ${res.status})`));
+    }
+    const ik = parsed.identityKey;
+    if (!ik)
+        throw new Error("init complete missing identityKey");
+    const identityKeyId = typeof ik.identityKeyId === "number" ? ik.identityKeyId : Number(ik.identityKeyId);
+    const x25519PublicKey = pickString(ik, "x25519PublicKeyB64", "x25519PublicKey");
+    if (!Number.isFinite(identityKeyId) || !x25519PublicKey) {
+        throw new Error("init complete response incomplete");
+    }
+    return { identityKeyId, x25519PublicKey };
+}
+//# sourceMappingURL=token-service-identity.js.map

package/dist/src/account/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/src/account/wallet-evm.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateEvmIdentity = generateEvmIdentity;
+exports.evmIdentityFromMnemonic = evmIdentityFromMnemonic;
+exports.evmIdentityFromPrivateKey = evmIdentityFromPrivateKey;
+exports.signEvmMessage = signEvmMessage;
+exports.rawEoaBytes = rawEoaBytes;
+const ethers_1 = require("ethers");
+function generateEvmIdentity() {
+    const wallet = ethers_1.Wallet.createRandom();
+    return {
+        address: wallet.address,
+        privateKey: wallet.privateKey,
+        mnemonic: wallet.mnemonic?.phrase ?? null,
+    };
+}
+function evmIdentityFromMnemonic(mnemonic) {
+    const phrase = mnemonic.trim().split(/\s+/).join(" ");
+    const wallet = ethers_1.Wallet.fromPhrase(phrase);
+    return {
+        address: wallet.address,
+        privateKey: wallet.privateKey,
+        mnemonic: wallet.mnemonic?.phrase ?? phrase,
+    };
+}
+function evmIdentityFromPrivateKey(privateKey) {
+    const raw = privateKey.trim();
+    const normalized = raw.startsWith("0x") ? raw : `0x${raw}`;
+    const wallet = new ethers_1.Wallet(normalized);
+    return {
+        address: wallet.address,
+        privateKey: wallet.privateKey,
+        mnemonic: null,
+    };
+}
+function signEvmMessage(privateKey, message) {
+    const wallet = new ethers_1.Wallet(privateKey);
+    return wallet.signMessage(message);
+}
+function rawEoaBytes(privateKey) {
+    const stripped = privateKey.startsWith("0x")
+        ? privateKey.slice(2)
+        : privateKey;
+    return Buffer.from(stripped, "hex");
+}
+//# sourceMappingURL=wallet-evm.js.map