@fased/fased 0.1.62 → 0.1.64

package/dist/wallet/signer-protocol-v2.generated.js

@@ -0,0 +1,90 @@
+//#region src/wallet/signer-protocol-v2.generated.ts
+const SIGNER_PROTOCOL_V2 = {
+	protocol: {
+		current: 2,
+		min: 2,
+		max: 2
+	},
+	nativeFeeReservationLamports: 5e6,
+	intentTypes: [
+		"solana.nativeTransfer",
+		"solana.splTransferChecked",
+		"solana.satAction",
+		"solana.vaultBondAction",
+		"federation.bondChallenge",
+		"solana.jupiter.swap",
+		"solana.jupiter.trigger.create",
+		"solana.jupiter.trigger.cancel"
+	],
+	operationStates: [
+		"reserved",
+		"broadcast",
+		"confirmed",
+		"failed",
+		"unknown"
+	],
+	features: [
+		"failClosedPolicies",
+		"policyHashes",
+		"applicationPolicyTightening",
+		"vaultReviewedOnly",
+		"durableCaps",
+		"atomicMultiAssetCaps",
+		"signerControlledNativeFeeCaps",
+		"atomicIdempotency",
+		"ambiguousBroadcastReconciliation",
+		"signerOwnedKeys",
+		"signerOwnedSuccessorRotation",
+		"permanentRetiredWalletPolicies",
+		"signerOwnedRPC",
+		"typedSolanaTransactions",
+		"typedA2aPaymentMemos",
+		"typedA2aRefundMemos",
+		"idempotentAssociatedTokenCreation",
+		"typedSATActions",
+		"typedVaultBondActions",
+		"domainSeparatedFederationBondChallenges",
+		"federationBondChallengeWrapperV2",
+		"signerOwnedWebAuthn",
+		"signerOwnedWebAuthnCredentialRevocation",
+		"singleUseReviewedAuthorization",
+		"typedJupiterSemantics",
+		"signerOwnedReviewPrepareExecute",
+		"exactPreparedTransactions",
+		"legacyOnlyJupiterTransactions",
+		"reviewedVaultBondActions",
+		"reviewedFederationBondChallenges",
+		"signerOwnedStateRecheck",
+		"durableReviewAuthorization",
+		"signerOwnedJupiterTriggerV2",
+		"signerOwnedJupiterTriggerHistory",
+		"jupiterTriggerSecretsNeverCrossSocket",
+		"jupiterTriggerDurablePhases"
+	]
+};
+const SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES = [
+	"failClosedPolicies",
+	"policyHashes",
+	"applicationPolicyTightening",
+	"durableCaps",
+	"atomicMultiAssetCaps",
+	"signerControlledNativeFeeCaps",
+	"atomicIdempotency",
+	"ambiguousBroadcastReconciliation",
+	"signerOwnedKeys",
+	"signerOwnedRPC",
+	"typedSolanaTransactions",
+	"typedA2aPaymentMemos",
+	"typedA2aRefundMemos",
+	"signerOwnedWebAuthn",
+	"singleUseReviewedAuthorization",
+	"typedJupiterSemantics",
+	"signerOwnedJupiterTriggerV2",
+	"signerOwnedJupiterTriggerHistory",
+	"signerOwnedReviewPrepareExecute",
+	"exactPreparedTransactions",
+	"legacyOnlyJupiterTransactions"
+];
+
+//#endregion
+export { SIGNER_PROTOCOL_V2_REQUIRED_CLIENT_FEATURES };

package/dist/wallet/solana-bond-signing.js

@@ -1,66 +1,99 @@
 import { readWalletProviderRegistry } from "./wallet-provider-registry.js";
 import { resolveFederationBondWalletId } from "../federation/runtime.js";
-import fs from "node:fs/promises";
-import crypto, { scryptSync } from "node:crypto";
+import { assertSecureLocalSignerSocket, callLocalSocketSigner, requireLocalSocketSignerPath } from "./providers/local-socket-signer-adapter.js";
+import { createSignerReviewApprovalRequest } from "./wallet-send-approvals.js";
+import { isDeepStrictEqual } from "node:util";
+import { createHash } from "node:crypto";
 
 //#region src/wallet/solana-bond-signing.ts
-function normalizeWalletIdForEnvSuffix(walletId) {
-	const raw = String(walletId ?? "").trim().toLowerCase();
-	if (!raw) {
-		return undefined;
+const FEDERATION_BOND_INTENT = "federation.bondChallenge";
+const FEDERATION_BOND_POLICY_DOMAIN = "domain:fased:federation-bond-challenge-v1";
+const FEDERATION_BOND_SIGNATURE_DOMAIN = "fased:federation-bond-challenge-signature:v2";
+const REQUIRED_FEDERATION_SIGNER_FEATURES = [
+	"failClosedPolicies",
+	"policyHashes",
+	"durableCaps",
+	"atomicIdempotency",
+	"signerOwnedKeys",
+	"domainSeparatedFederationBondChallenges",
+	"federationBondChallengeWrapperV2",
+	"signerOwnedWebAuthn",
+	"singleUseReviewedAuthorization",
+	"signerOwnedReviewPrepareExecute",
+	"exactPreparedTransactions",
+	"reviewedFederationBondChallenges",
+	"durableReviewAuthorization"
+];
+var FederationBondReviewAuthorizationRequiredError = class extends Error {
+	constructor(review, approvalId) {
+		super(`federation signer review ${review.requestId} is pending in Wallet Approvals and requires signer-owned WebAuthn authorization`);
+		this.name = "FederationBondReviewAuthorizationRequiredError";
+		this.review = review;
+		this.approvalId = approvalId;
 	}
-	const normalized = raw.replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-	return normalized || undefined;
+};
+function nativeSignerWalletId(walletId) {
+	const normalized = walletId.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+	return normalized || "default";
 }
-function resolveScopedSolanaKeystorePath(env, walletId) {
-	const suffix = normalizeWalletIdForEnvSuffix(walletId)?.toUpperCase();
-	const scoped = suffix ? String(env[`FASED_WALLET_SOLANA_KEYSTORE_PATH__${suffix}`] ?? "").trim() : "";
-	return scoped || String(env.FASED_WALLET_SOLANA_KEYSTORE_PATH ?? "").trim();
-}
-async function resolveWalletPassphrase(env) {
-	const filePath = String(env.FASED_WALLET_PASSPHRASE_FILE ?? "").trim();
-	if (filePath) {
-		return (await fs.readFile(filePath, "utf-8")).trim();
+function federationOrigin(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new Error("federation bond signing requires a valid HTTPS federation origin");
 	}
-	return String(env.FASED_WALLET_PASSPHRASE ?? "").trim();
-}
-function parseSolanaKeystoreEnvelope(raw) {
-	const parsed = JSON.parse(raw);
-	if (parsed.kind !== "fased-solana-keypair" || parsed.version !== 1 || parsed.kdf !== "scrypt" || parsed.cipher !== "aes-256-gcm" || typeof parsed.salt !== "string" || typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string" || typeof parsed.publicKey !== "string") {
-		throw new Error("invalid Solana keystore envelope");
+	if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "") {
+		throw new Error("federation bond signing requires an HTTPS origin without path, credentials, query, or fragment");
 	}
-	return parsed;
+	return parsed.origin;
 }
-function decryptSolanaKeypairEnvelope(envelope, passphrase) {
-	const salt = Buffer.from(envelope.salt, "base64url");
-	const iv = Buffer.from(envelope.iv, "base64url");
-	const authTag = Buffer.from(envelope.authTag, "base64url");
-	const ciphertext = Buffer.from(envelope.ciphertext, "base64url");
-	const key = scryptSync(passphrase, salt, 32);
-	const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
-	decipher.setAuthTag(authTag);
-	const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-	if (plaintext.length !== 64) {
-		throw new Error("invalid Solana secret key length");
+function federationBondChallengeRequestId(challengeId) {
+	const normalized = challengeId.trim();
+	if (!normalized || normalized !== challengeId || normalized.length > 256) {
+		throw new Error("federation bond challengeId is invalid");
 	}
-	return Uint8Array.from(plaintext);
+	return `federation-bond:${createHash("sha256").update(normalized, "utf8").digest("hex")}`;
 }
-function base64url(bytes) {
-	return Buffer.from(bytes).toString("base64url");
+function buildFederationBondChallengeIntent(params) {
+	return {
+		type: FEDERATION_BOND_INTENT,
+		federation: {
+			challengeId: params.challengeId,
+			federationOrigin: federationOrigin(params.federationOrigin),
+			handle: params.handle,
+			nodeId: params.nodeId,
+			tokenId: params.tokenId,
+			bondId: params.bondId,
+			tier: params.tier,
+			...params.amountRaw !== undefined ? { amountRaw: params.amountRaw } : {},
+			expiresAt: params.expiresAt,
+			payloadBase64: params.payloadBase64
+		}
+	};
 }
-function signEd25519Message(message, secretKey) {
-	const seed = secretKey.slice(0, 32);
-	const publicKey = secretKey.slice(32, 64);
-	const privateKey = crypto.createPrivateKey({
-		key: {
-			kty: "OKP",
-			crv: "Ed25519",
-			d: base64url(seed),
-			x: base64url(publicKey)
-		},
-		format: "jwk"
+function federationBondSigningMessageBase64(params) {
+	const payload = Buffer.from(params.payloadBase64, "base64");
+	if (payload.length === 0 || payload.toString("base64") !== params.payloadBase64) {
+		throw new Error("federation bond signing payload must be canonical non-empty base64");
+	}
+	const message = JSON.stringify({
+		domain: FEDERATION_BOND_SIGNATURE_DOMAIN,
+		challengeId: params.challengeId,
+		federationOrigin: federationOrigin(params.federationOrigin),
+		payloadBase64: params.payloadBase64
 	});
-	return crypto.sign(null, message, privateKey).toString("base64");
+	return Buffer.from(message, "utf8").toString("base64");
+}
+async function requireFederationSigner(socketPath) {
+	assertSecureLocalSignerSocket(socketPath);
+	const health = await callLocalSocketSigner(socketPath, { op: "v2.capabilities" });
+	const capabilities = health.capabilities;
+	const features = new Set(capabilities?.features ?? []);
+	const missing = REQUIRED_FEDERATION_SIGNER_FEATURES.filter((feature) => !features.has(feature));
+	if (health.ready !== true || capabilities?.protocol?.current !== 2 || typeof capabilities.protocol.min !== "number" || capabilities.protocol.min > 2 || typeof capabilities.protocol.max !== "number" || capabilities.protocol.max < 2 || !capabilities.intentTypes?.includes(FEDERATION_BOND_INTENT) || missing.length > 0) {
+		throw new Error(`local-socket-signer does not support secure federation bond challenges${missing.length > 0 ? `; missing features: ${missing.join(", ")}` : ""}`);
+	}
 }
 async function resolveFederationBondWallet(params) {
 	const env = params?.env ?? process.env;
@@ -70,21 +103,25 @@ async function resolveFederationBondWallet(params) {
 		cfg: params?.cfg
 	}) || "default";
 	const registryWallet = registry.wallets.find((entry) => entry.id === walletId);
-	const keystorePath = resolveScopedSolanaKeystorePath(env, walletId);
-	if (!keystorePath) {
-		throw new Error(`bond Vault ${walletId} has no Solana keystore path configured`);
+	const socketPath = requireLocalSocketSignerPath(env);
+	await requireFederationSigner(socketPath);
+	const wallet = await callLocalSocketSigner(socketPath, {
+		op: "v2.wallet.get",
+		walletId
+	});
+	const walletAddress = wallet.publicKey.trim();
+	if (!walletAddress || wallet.walletId !== nativeSignerWalletId(walletId)) {
+		throw new Error(`bond Vault ${walletId} is not available in the native signer`);
 	}
-	const raw = await fs.readFile(keystorePath, "utf-8");
-	const envelope = parseSolanaKeystoreEnvelope(raw);
-	const walletAddress = registryWallet?.addresses?.solana?.trim() || envelope.publicKey.trim() || "";
-	if (!walletAddress) {
-		throw new Error(`bond Vault ${walletId} has no Solana address`);
+	const registryAddress = registryWallet?.addresses?.solana?.trim();
+	if (registryAddress && registryAddress !== walletAddress) {
+		throw new Error(`bond Vault ${walletId} registry address does not match the native signer`);
 	}
 	return {
 		walletId,
 		walletAddress,
 		providerId: registryWallet?.providerId,
-		keystorePath
+		socketPath
 	};
 }
 async function signFederationBondChallenge(params) {
@@ -94,21 +131,72 @@ async function signFederationBondChallenge(params) {
 		cfg: params.cfg,
 		walletId: params.walletId
 	});
-	const passphrase = await resolveWalletPassphrase(env);
-	if (!passphrase) {
-		throw new Error("wallet passphrase is required to sign federation bond challenge");
+	const requestId = federationBondChallengeRequestId(params.challengeId);
+	const policy = await callLocalSocketSigner(resolved.socketPath, {
+		op: "v2.policy.get",
+		walletId: resolved.walletId
+	});
+	if (policy.role !== "vault" || !policy.operations.includes(FEDERATION_BOND_INTENT) || !policy.programs.includes(FEDERATION_BOND_POLICY_DOMAIN) || !policy.hash.startsWith("sha256:")) {
+		throw new Error(`bond Vault ${resolved.walletId} does not have an explicit reviewed federation challenge policy`);
+	}
+	const intent = buildFederationBondChallengeIntent(params);
+	const signingMessageBase64 = federationBondSigningMessageBase64(intent.federation);
+	let review;
+	try {
+		review = await callLocalSocketSigner(resolved.socketPath, {
+			op: "v2.review.get",
+			walletId: resolved.walletId,
+			request: { requestId }
+		});
+	} catch (error) {
+		if (!String(error).includes("signer review not found; review.prepare is required")) {
+			throw error;
+		}
+		review = await callLocalSocketSigner(resolved.socketPath, {
+			op: "v2.review.prepare",
+			walletId: resolved.walletId,
+			request: {
+				requestId,
+				policyHash: policy.hash,
+				mode: "reviewed",
+				intent
+			}
+		});
 	}
-	const raw = await fs.readFile(resolved.keystorePath, "utf-8");
-	const envelope = parseSolanaKeystoreEnvelope(raw);
-	const secretKey = decryptSolanaKeypairEnvelope(envelope, passphrase);
-	if (envelope.publicKey.trim() && envelope.publicKey.trim() !== resolved.walletAddress) {
-		throw new Error("bond Vault address does not match keystore public key");
+	if (review.requestId !== requestId || review.walletId !== nativeSignerWalletId(resolved.walletId) || review.walletPublicKey !== resolved.walletAddress || review.intentType !== FEDERATION_BOND_INTENT || !isDeepStrictEqual(review.semanticIntent, intent) || review.policyHash !== policy.hash || review.mode !== "reviewed" || review.artifactKind !== "domain-separated-message" || review.messageBase64 !== signingMessageBase64 || review.asset !== "federation:bond-challenge" || review.amount !== "1" || review.destination !== resolved.walletAddress || review.policyOperation !== FEDERATION_BOND_INTENT || review.requiredPrograms.length !== 1 || review.requiredPrograms[0] !== FEDERATION_BOND_POLICY_DOMAIN || review.requiredRole !== "vault") {
+		throw new Error(`federation signer review ${requestId} does not match the exact challenge`);
+	}
+	if (review.state === "prepared" && !params.authorization) {
+		const approval = createSignerReviewApprovalRequest({
+			review,
+			role: "vault",
+			walletId: resolved.walletId,
+			requestedBy: "federation-bond",
+			walletName: resolved.walletId,
+			assetName: "Federation bond proof",
+			assetSymbol: "Proof",
+			memo: `Federation bond challenge for ${params.handle}`,
+			env
+		});
+		throw new FederationBondReviewAuthorizationRequiredError(review, approval.id);
+	}
+	const executed = await callLocalSocketSigner(resolved.socketPath, {
+		op: "v2.review.execute",
+		walletId: resolved.walletId,
+		request: {
+			requestId,
+			authorization: params.authorization
+		}
+	});
+	if (executed.operation.state !== "confirmed" || !executed.signatureBase64 || executed.review.artifactKind !== "domain-separated-message" || executed.review.artifactDigest !== review.artifactDigest) {
+		throw new Error(`federation signer request ${requestId} did not complete one exact reviewed message signature`);
 	}
 	return {
 		...resolved,
-		signatureBase64: signEd25519Message(Buffer.from(params.payload, "utf-8"), secretKey)
+		requestId,
+		signatureBase64: executed.signatureBase64
 	};
 }
 
 //#endregion
-export { resolveFederationBondWallet, signFederationBondChallenge };
+export { FEDERATION_BOND_SIGNATURE_DOMAIN, federationBondSigningMessageBase64, resolveFederationBondWallet, signFederationBondChallenge };