feat: mint app delegations from the Internet Identity canister

[sea-snake]

Two calls behind the source the refreshing identity mints through: app_prepare_delegation, then app_get_delegation with exactly the expiration prepare returned, since a different value is a different signature. The result is assembled into the one-hop chain an app signs with, rooted at the account's own key.

• Only NoMatchingSession ends a session. A transport failure or an internal canister error leaves it alone and is worth retrying, so the unwrapping is where that distinction is made rather than at every call site.
• A session chain is refused before the first call unless its targets name this canister and nothing else. The unrestricted case is the one worth refusing hardest: the session key signs with that chain, so accepting one would leave the library holding a credential good for any call rather than only the two made here.
• A delegation carrying permissions is refused with a named error — a read-only session is not something a DelegationChain can represent, and sending one without the field would fail verification at the boundary node with nothing to point at.

The interface is written out rather than generated: this package carries no Internet Identity declarations, and generating them for three methods would mean carrying the whole interface.

Read hardest: assertChainReaches.

[Copilot]

Pull request overview

Adds a SessionMinter implementation that can mint app delegations by calling the Internet Identity canister session APIs, plus tests covering result/error classification and delegation-chain assembly/validation.

Changes:

• Introduces src/client/session-minter.ts with a handwritten Candid interface for the three II session methods and logic to mint + assemble a one-hop app delegation chain.
• Adds chain validation helpers (unwrapSessionResult, appDelegationChain, assertChainReaches) and session error classification (NoMatchingSession → SessionGoneError).
• Adds tests/client/session-minter.test.ts to cover the error classification, chain assembly (including read-only refusal), and target/reachability checks.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
tests/client/session-minter.test.ts	New unit tests for SessionMinter helpers and delegation-chain behavior.
src/client/session-minter.ts	New SessionMinter and helper functions + handwritten Candid factory for II session APIs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

src/client/session-minter.ts:102

• SessionMinterOptions.sessionChain is documented as "Restricted to II", but create() actually validates the chain against the provided canisterId. This makes the doc misleading (and it’s not necessarily the mainnet II canister when using a local II). Update the comments to reflect the actual contract: the chain must be restricted to canisterId, and canisterId is the Internet Identity canister being called.

  /** The chain proving those calls come from the session. Restricted to II. */
  sessionChain: DelegationChain;

  /** The canister these calls go to. */
  canisterId: Principal;