@seams/wallet-server 0.5.0

package/dist/esm/authorization/service.js

@@ -0,0 +1,319 @@
+import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
+import "../shared-ts/src/utils/encoders.js";
+import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/parsers.js";
+import { buildActiveWalletSessionQuota, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, walletSessionCapabilitySubjectsV1Equal } from "./domain.js";
+import { buildVerifiedOwnerProof, buildVerifiedWalletOperationFactorEvidenceSet } from "./factorEvidence.js";
+import { secureRandomBase64Url } from "../shared-ts/src/utils/secureRandomId.js";
+//#region src/authorization/service.ts
+var AuthorizationService = class {
+	constructor(ports) {
+		this.ports = ports;
+	}
+	async retireWalletSessionAuthorizationsForAuthMethod(input) {
+		await this.ports.grants.retireWalletSessionAuthorizationsForAuthMethod(input);
+	}
+	async mintHostedWalletSeamsSessionExchange(input) {
+		const expiresAtMs = Math.min(input.expiresAtMs, input.authorization.session.expiresAtMs, input.authorization.quota.expiresAtMs);
+		if (!Number.isSafeInteger(input.issuedAtMs) || input.issuedAtMs <= 0 || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= input.issuedAtMs) throw new Error("hosted-wallet Seams session exchange expiry must follow issuance");
+		const exchangeCode = parseHostedWalletSeamsSessionExchangeCode(secureRandomBase64Url(32, "hosted-wallet Seams session exchange codes"));
+		const nonce = parseHostedWalletSeamsSessionExchangeNonce(secureRandomBase64Url(32, "hosted-wallet Seams session exchange nonces"));
+		const exchangeCodeId = parseRequired(`hwx_${secureRandomBase64Url(18, "hosted-wallet Seams session exchange identifiers")}`, parseHostedWalletSessionExchangeCodeId);
+		await this.ports.sessions.putIssuedHostedWalletSeamsSessionExchange({
+			kind: "issued_hosted_wallet_session_exchange_v2",
+			tenantId: input.authorization.session.tenantId,
+			exchangeCodeId,
+			authorizationId: input.authorization.session.authorizationId,
+			walletSessionId: input.authorization.session.walletSessionId,
+			quotaId: input.authorization.session.quotaId,
+			principalId: input.authorization.session.principalId,
+			walletId: input.authorization.session.walletId,
+			authorityId: input.authorization.session.authorityId,
+			walletAuthMethodId: input.authorization.session.walletAuthMethodId,
+			codeHash: await digestOpaqueValue(exchangeCode),
+			nonceDigest: await digestOpaqueValue(nonce),
+			appOrigin: input.appOrigin,
+			walletOrigin: input.walletOrigin,
+			issuedAtMs: input.issuedAtMs,
+			expiresAtMs
+		});
+		return {
+			kind: "hosted_wallet_session_exchange_delivery_v2",
+			exchangeCode,
+			nonce,
+			appOrigin: input.appOrigin,
+			walletOrigin: input.walletOrigin,
+			expiresAtMs
+		};
+	}
+	async redeemHostedWalletSeamsSessionExchange(input) {
+		const hostedCredentialToken = `wsh_${secureRandomBase64Url(32, "hosted-wallet exchanged child credentials")}`;
+		const hostedCredentialId = parseHostedWalletSessionCredentialId(`hcr_${secureRandomBase64Url(18, "hosted-wallet child credential identifiers")}`);
+		const persisted = await this.ports.sessions.redeemHostedWalletSeamsSessionExchange({
+			codeHash: await digestOpaqueValue(input.exchangeCode),
+			nonceDigest: await digestOpaqueValue(input.nonce),
+			appOrigin: input.appOrigin,
+			walletOrigin: input.walletOrigin,
+			tokenHash: await digestOpaqueValue(hostedCredentialToken),
+			hostedCredentialId,
+			redeemedAtMs: input.redeemedAtMs
+		});
+		if (persisted.kind !== "redeemed") return persisted;
+		const operationCredential = parseHostedWalletSessionOperationCredentialV1({
+			kind: "opaque_hosted_wallet_session_operation_credential_v1",
+			token: hostedCredentialToken,
+			walletSessionId: persisted.walletSessionId
+		});
+		return {
+			kind: "redeemed",
+			walletSessionId: persisted.walletSessionId,
+			operationCredential,
+			expiresAtMs: persisted.expiresAtMs
+		};
+	}
+	async recordVerifiedWalletOperationFactorEvidenceSet(input) {
+		const evidenceSet = await buildVerifiedWalletOperationFactorEvidenceSet(input);
+		await this.ports.evidence.putVerifiedEvidenceSet(evidenceSet);
+		return evidenceSet;
+	}
+	async buildVerifiedOwnerProof(input) {
+		return await buildVerifiedOwnerProof(input);
+	}
+	async readAuthorizedOperation(input) {
+		return await this.ports.authorizedOperations.readAuthorizedOperation(input);
+	}
+	async readAuthorizedOperationById(input) {
+		return await this.ports.authorizedOperations.readAuthorizedOperationById(input);
+	}
+	async admitAuthorizedOperation(input) {
+		return await this.ports.authorizedOperations.admitAuthorizedOperation(input);
+	}
+	async completeAuthorizedOperation(input) {
+		return await this.ports.authorizedOperations.completeAuthorizedOperation(input);
+	}
+	/**
+	* Issues one exact Wallet Session and its primary credential in the same
+	* persistence transition. The replay branch is credential-free because a
+	* committed digest cannot reproduce plaintext.
+	*/
+	async issueDirectWalletSessionAuthorizationV2(input) {
+		return await this.issueDirectWalletSessionAuthorizationV2WithReplayMode(input, { kind: "strict" });
+	}
+	/** The Ed25519 registration caller validates current authority and owner proof first. */
+	async issueDirectRegistrationPromotedWalletSessionAuthorizationV2(input) {
+		return await this.issueDirectWalletSessionAuthorizationV2WithReplayMode(input, { kind: "validated_registration_authority_projection" });
+	}
+	async issueDirectWalletSessionAuthorizationV2WithReplayMode(input, replayMode) {
+		if (input.authority.walletId !== input.walletId) throw new Error("Wallet Session authorization authority does not identify the wallet");
+		const lookup = {
+			tenantId: input.tenantId,
+			principalId: input.principalId,
+			walletId: input.walletId,
+			authorityId: input.authority.authorityId,
+			walletAuthMethodId: input.walletAuthMethodId,
+			mintId: input.mintId
+		};
+		const prepared = await this.prepareWalletSessionAuthorizationV2(input);
+		const alreadyCommitted = await this.ports.grants.readWalletSessionAuthorizationV2ByMint(lookup);
+		if (alreadyCommitted) return directV2AlreadyCommitted(prepared.session, alreadyCommitted.session, replayMode);
+		const token = `wst_${secureRandomBase64Url(32, "direct V2 Wallet Session operation credentials")}`;
+		const operationCredential = parseWalletSessionOperationCredentialV1({
+			kind: "opaque_wallet_session_operation_credential_v1",
+			token,
+			walletSessionId: prepared.session.walletSessionId
+		});
+		const persisted = buildPersistedActiveWalletSessionAuthorizationV2({
+			session: prepared.session,
+			quota: prepared.quota,
+			primaryOperationCredentialDigestB64u: await digestOpaqueValue(token)
+		});
+		const commit = await this.ports.grants.commitDirectReplayableWalletSessionAuthorizationV2({ persisted });
+		if (commit.kind === "already_committed") return directV2AlreadyCommitted(prepared.session, commit.committed.session, replayMode);
+		const committed = await this.ports.grants.readWalletSessionAuthorizationV2ByMint(lookup);
+		if (!committed) throw new Error("Direct V2 Wallet Session authorization was not persisted");
+		if (committed.primaryOperationCredentialDigestB64u !== persisted.primaryOperationCredentialDigestB64u) throw new Error("Direct V2 Wallet Session credential digest does not match its commit");
+		return {
+			kind: "issued",
+			session: prepared.session,
+			quota: prepared.quota,
+			operationCredential
+		};
+	}
+	async refreshWalletSessionAuthorizationV2AuthorityProjection(input) {
+		const current = input.existing.session;
+		if (current.walletId !== input.authority.walletId || current.authorityId !== input.authority.authorityId || current.walletAuthMethodId !== input.walletAuthMethodId) throw new Error("Direct V2 Wallet Session authority projection identity does not match");
+		const session = buildWalletSessionAuthorizationV2({
+			tenantId: current.tenantId,
+			principalId: current.principalId,
+			walletId: current.walletId,
+			authorityId: current.authorityId,
+			walletAuthMethodId: current.walletAuthMethodId,
+			authorityDigestB64u: input.authority.authorityDigestB64u,
+			authorityRevocationEpoch: input.authority.revocationEpoch,
+			mintId: current.mintId,
+			authorizationId: current.authorizationId,
+			walletSessionId: current.walletSessionId,
+			quotaId: current.quotaId,
+			capabilitySubjects: buildWalletSessionCapabilitySubjectsV1(input.authority),
+			createdAtMs: current.createdAtMs,
+			expiresAtMs: current.expiresAtMs
+		});
+		const persisted = await this.ports.grants.readWalletSessionAuthorizationV2ByAuthorizationId({
+			expected: current,
+			nowMs: Date.now()
+		});
+		if (!persisted) throw new Error("Direct V2 Wallet Session authority projection is unavailable");
+		await this.ports.grants.replaceWalletSessionAuthorizationV2AuthorityProjection({
+			session,
+			quota: persisted.quota
+		});
+		const refreshed = await this.ports.grants.readWalletSessionAuthorizationV2ByAuthorizationId({
+			expected: session,
+			nowMs: Date.now()
+		});
+		if (!refreshed) throw new Error("Direct V2 Wallet Session authority projection was not refreshed");
+		return refreshed;
+	}
+	async prepareWalletSessionAuthorizationV2(input) {
+		if (input.authority.walletId !== input.walletId) throw new Error("Wallet Session authorization authority does not identify the wallet");
+		const authorizationId = parseRequired(await deriveWalletSessionAuthorizationV2Id(input, "authorization"), parseWalletSessionAuthorizationId);
+		const walletSessionId = parseRequired(await deriveWalletSessionAuthorizationV2Id(input, "wallet_session"), parseWalletSessionId);
+		const quotaId = parseRequired(await deriveWalletSessionAuthorizationV2Id(input, "quota"), parseMpcWalletSigningQuotaId);
+		const session = buildWalletSessionAuthorizationV2({
+			tenantId: input.tenantId,
+			principalId: input.principalId,
+			walletId: input.walletId,
+			authorityId: input.authority.authorityId,
+			walletAuthMethodId: input.walletAuthMethodId,
+			authorityDigestB64u: input.authority.authorityDigestB64u,
+			authorityRevocationEpoch: input.authority.revocationEpoch,
+			mintId: input.mintId,
+			authorizationId,
+			walletSessionId,
+			quotaId,
+			capabilitySubjects: buildWalletSessionCapabilitySubjectsV1(input.authority),
+			createdAtMs: input.issuedAtMs,
+			expiresAtMs: input.expiresAtMs
+		});
+		return {
+			session,
+			quota: buildActiveWalletSessionQuota({
+				tenantId: session.tenantId,
+				principalId: session.principalId,
+				walletSessionId,
+				quotaId,
+				remainingUses: input.remainingUses,
+				expiresAtMs: session.expiresAtMs
+			})
+		};
+	}
+	async readWalletSessionAuthorizationV2ByMint(input) {
+		return await this.ports.grants.readWalletSessionAuthorizationV2ByMint(input);
+	}
+	async readWalletSessionAuthorizationV2ByAuthorizationId(input) {
+		return await this.ports.grants.readWalletSessionAuthorizationV2ByAuthorizationId(input);
+	}
+	async readWalletSessionAuthorizationV2ByIdentity(input) {
+		return await this.ports.grants.readWalletSessionAuthorizationV2ByIdentity(input);
+	}
+	async readWalletSessionAuthorizationV2ByOperationCredential(input) {
+		return await this.ports.grants.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: input.tenantId,
+			tokenHash: await digestOpaqueValue(input.token),
+			nowMs: input.nowMs
+		});
+	}
+	/**
+	* Resolves the exact `/wallet/session/status` lifecycle. A credential from
+	* another family never reaches persistence: only the primary `wst_` token
+	* names a V2 authorization, so anything else is absent by construction.
+	*/
+	async readExactWalletSessionStatusByOperationCredential(input) {
+		let token;
+		try {
+			token = parsePrimaryWalletSessionOperationCredentialToken(input.token);
+		} catch {
+			return { kind: "missing" };
+		}
+		return await this.ports.grants.readExactWalletSessionStatusByOperationCredential({
+			tenantId: input.tenantId,
+			tokenHash: await digestOpaqueValue(token),
+			nowMs: input.nowMs
+		});
+	}
+	async readHostedWalletSessionOperationCredentialV2(input) {
+		if (!/^wsh_[A-Za-z0-9_-]{43}$/.test(input.token)) return null;
+		return await this.ports.sessions.readHostedWalletSessionOperationCredentialV2({
+			tenantId: input.tenantId,
+			tokenHash: await digestOpaqueValue(input.token),
+			requestOrigin: input.requestOrigin,
+			nowMs: input.nowMs
+		});
+	}
+	parseEvidenceRequirement(value) {
+		return this.ports.policy.parseEvidenceRequirement(value);
+	}
+	evaluateEvidenceRequirement(requirement, evidenceSet) {
+		return this.ports.policy.evaluateEvidenceRequirement(requirement, evidenceSet);
+	}
+};
+async function deriveWalletSessionAuthorizationV2Id(input, kind) {
+	const digest = base64UrlEncode(await sha256BytesUtf8([
+		"seams:wallet-session-authorization-v2-issuance:v1",
+		kind,
+		input.tenantId,
+		input.principalId,
+		input.walletId,
+		input.authority.authorityId,
+		input.walletAuthMethodId,
+		input.authority.authorityDigestB64u,
+		String(input.authority.revocationEpoch),
+		input.mintId
+	].join("\0")));
+	return `${kind === "authorization" ? "wlt" : kind === "wallet_session" ? "wls" : "wsq"}_${digest}`;
+}
+async function digestOpaqueValue(value) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(value)));
+}
+function directV2AlreadyCommitted(prepared, committed, replayMode) {
+	switch (replayMode.kind) {
+		case "strict":
+			if (!directV2StrictReplayMatches(prepared, committed)) throw new Error("Direct V2 Wallet Session mint replay does not match its committed session");
+			break;
+		case "validated_registration_authority_projection":
+			if (!directV2MintScopeMatches(prepared, committed)) throw new Error("Registration Ed25519 Wallet Session mint replay does not match its committed identity");
+			break;
+		default: return assertNeverDirectWalletSessionReplayMode(replayMode);
+	}
+	return {
+		kind: "already_committed",
+		walletId: committed.walletId,
+		authorityId: committed.authorityId,
+		walletAuthMethodId: committed.walletAuthMethodId,
+		mintId: committed.mintId,
+		authorizationId: committed.authorizationId,
+		walletSessionId: committed.walletSessionId,
+		quotaId: committed.quotaId,
+		next: "unlock_exact_method"
+	};
+}
+function directV2StrictReplayMatches(prepared, committed) {
+	return prepared.kind === committed.kind && prepared.tenantId === committed.tenantId && prepared.principalId === committed.principalId && prepared.walletId === committed.walletId && prepared.authorityId === committed.authorityId && prepared.walletAuthMethodId === committed.walletAuthMethodId && prepared.authorityDigestB64u === committed.authorityDigestB64u && prepared.authorityRevocationEpoch === committed.authorityRevocationEpoch && prepared.mintId === committed.mintId && prepared.authorizationId === committed.authorizationId && prepared.walletSessionId === committed.walletSessionId && prepared.quotaId === committed.quotaId && walletSessionCapabilitySubjectsV1Equal(prepared.capabilitySubjects, committed.capabilitySubjects) && prepared.expiresAtMs - prepared.createdAtMs === committed.expiresAtMs - committed.createdAtMs;
+}
+function directV2MintScopeMatches(prepared, committed) {
+	return prepared.tenantId === committed.tenantId && prepared.principalId === committed.principalId && prepared.walletId === committed.walletId && prepared.authorityId === committed.authorityId && prepared.walletAuthMethodId === committed.walletAuthMethodId && prepared.mintId === committed.mintId;
+}
+function assertNeverDirectWalletSessionReplayMode(value) {
+	throw new Error(`Unsupported direct Wallet Session replay mode: ${String(value)}`);
+}
+function parseRequired(value, parser) {
+	const parsed = parser(value);
+	if (!parsed.ok) throw new Error("generated authorization identifier was invalid");
+	return parsed.value;
+}
+//#endregion
+export { AuthorizationService, digestOpaqueValue };
+
+//# sourceMappingURL=service.js.map

package/dist/esm/authorization/vaultProxyUse.js

@@ -0,0 +1,295 @@
+import { buildVaultOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
+import { buildCapabilityOperationEnvelope } from "../shared-ts/src/authorization/operationFingerprint.js";
+import { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit } from "./domain.js";
+import { defineRoute } from "../router/framework/routeDefinitions.js";
+//#region src/authorization/vaultProxyUse.ts
+const VAULT_PROXY_LANE_DIGEST_DOMAIN_V1 = "seams:vault:proxy-use-lane:v1";
+const VAULT_PROXY_INTENT_DIGEST_DOMAIN_V1 = "seams:vault:proxy-use-intent:v1";
+const VAULT_PROXY_DISPLAY_DIGEST_DOMAIN_V1 = "seams:vault:proxy-use-display:v1";
+var LocalWorkerVaultProxyGateway = class {
+	constructor(fetcher) {
+		this.fetcher = fetcher;
+	}
+	async proxy(input) {
+		const credential = new TextDecoder().decode(input.secret);
+		return await this.fetcher(new Request(input.destination, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${credential}`,
+				"content-type": "application/json"
+			},
+			body: input.payload
+		}));
+	}
+};
+var VaultProxyUseService = class {
+	constructor(authorization, secrets, gateway) {
+		this.authorization = authorization;
+		this.secrets = secrets;
+		this.gateway = gateway;
+	}
+	async execute(input) {
+		const expectedOperation = await buildVaultProxyUseOperation({
+			tenantId: input.secretRef.tenantId,
+			principalId: input.claim.operation.principalId,
+			capabilityId: input.secretRef.capabilityId,
+			operationId: input.claim.operation.operationId,
+			vaultId: input.secretRef.vaultId,
+			itemId: input.secretRef.itemId,
+			destination: input.secretRef.destination
+		});
+		if (input.claim.operation.operation.capabilityKind !== "vault_access" || input.claim.operation.operation.operationKind !== "vault.proxy_use" || input.claim.operation.tenantId !== input.secretRef.tenantId || input.claim.operation.capabilityId !== input.secretRef.capabilityId || input.claim.operation.digests.laneDigest !== expectedOperation.digests.laneDigest || input.claim.operation.digests.intentDigest !== expectedOperation.digests.intentDigest || input.claim.operation.digests.displayDigest !== expectedOperation.digests.displayDigest) return {
+			kind: "rejected",
+			reason: "authorization_failed"
+		};
+		const claimResult = await this.authorization.admitAuthorizedOperation({ operation: input.claim });
+		switch (claimResult.kind) {
+			case "operation_in_progress": return { kind: "operation_in_progress" };
+			case "replayed": return claimResult.operation.lifecycle === "completed" ? {
+				kind: "replayed",
+				response: claimResult.operation.response
+			} : { kind: "operation_in_progress" };
+			case "authorization_grant_rejected":
+			case "verified_step_up_rejected":
+			case "wallet_session_quota_exhausted":
+			case "material_mismatch": return {
+				kind: "rejected",
+				reason: "authorization_failed"
+			};
+			case "claimed": break;
+		}
+		const operation = claimResult.operation;
+		const secret = await this.secrets.openSecret(input.secretRef);
+		if (!secret) {
+			const result = {
+				kind: "rejected",
+				reason: "secret_unavailable"
+			};
+			await this.complete(operation, "failed_before_side_effect", vaultProxyUseReplayResponse(result), input.completedAtMs);
+			return result;
+		}
+		try {
+			const response = await this.gateway.proxy({
+				destination: input.secretRef.destination,
+				secret,
+				payload: input.payload
+			});
+			const body = await response.text();
+			const result = {
+				kind: "succeeded",
+				status: response.status,
+				body
+			};
+			const replayResponse = vaultProxyUseReplayResponse(result);
+			if (!isReplayResponseWithinBound(replayResponse)) {
+				const boundedFailure = {
+					kind: "rejected",
+					reason: "gateway_failed_after_side_effect"
+				};
+				await this.complete(operation, "failed_after_side_effect", vaultProxyUseReplayResponse(boundedFailure), input.completedAtMs);
+				return boundedFailure;
+			}
+			await this.complete(operation, "succeeded", replayResponse, input.completedAtMs);
+			return result;
+		} catch {
+			const result = {
+				kind: "rejected",
+				reason: "gateway_failed_after_side_effect"
+			};
+			await this.complete(operation, "failed_after_side_effect", vaultProxyUseReplayResponse(result), input.completedAtMs);
+			return result;
+		} finally {
+			secret.fill(0);
+		}
+	}
+	async complete(claim, result, response, completedAtMs) {
+		await this.authorization.completeAuthorizedOperation({
+			operation: claim,
+			result,
+			response,
+			completedAtMs
+		});
+	}
+};
+function createVaultProxyUseRouteExtension(input) {
+	return new VaultProxyUseRouteExtension(input.service, input.now ?? Date.now);
+}
+var VaultProxyUseRouteExtension = class {
+	constructor(service, now) {
+		this.service = service;
+		this.now = now;
+		this.kind = "fetch_route_extension";
+		this.id = "vault_proxy_use";
+		this.routes = [defineRoute({
+			id: "vault_proxy_use",
+			surface: "relay",
+			method: "POST",
+			path: "/vault/proxy-use",
+			auth: {
+				plane: "public",
+				proof: "intent_grant",
+				rationale: "The exact one-use capability grant authorizes this vault proxy operation."
+			},
+			metering: { kind: "none" },
+			summary: "Use one persisted vault secret through the configured gateway"
+		})];
+	}
+	async handleFetchRoute(input) {
+		const parsed = await parseVaultProxyUseRequest(await readJson(input.request), this.now());
+		return vaultProxyUseResponse(await this.service.execute({
+			claim: parsed.claim,
+			secretRef: parsed.secretRef,
+			payload: parsed.payload,
+			completedAtMs: this.now()
+		}));
+	}
+};
+async function buildVaultProxyUseOperation(input) {
+	const operation = buildVaultOperationRef("vault.proxy_use");
+	return buildCapabilityOperationEnvelope({
+		tenantId: input.tenantId,
+		principalId: input.principalId,
+		capabilityId: input.capabilityId,
+		operationId: input.operationId,
+		operation,
+		digests: {
+			laneDigest: await digest(VAULT_PROXY_LANE_DIGEST_DOMAIN_V1, {
+				tenantId: input.tenantId,
+				capabilityId: input.capabilityId,
+				operation
+			}),
+			intentDigest: await digest(VAULT_PROXY_INTENT_DIGEST_DOMAIN_V1, {
+				tenantId: input.tenantId,
+				capabilityId: input.capabilityId,
+				vaultId: input.vaultId,
+				itemId: input.itemId,
+				destination: input.destination,
+				operationId: input.operationId
+			}),
+			displayDigest: await digest(VAULT_PROXY_DISPLAY_DIGEST_DOMAIN_V1, {
+				vaultId: input.vaultId,
+				itemId: input.itemId,
+				destination: input.destination
+			})
+		}
+	});
+}
+function parseVaultProxyDestination(value) {
+	if (typeof value !== "string" || value.trim() !== value) throw new Error("vault proxy destination must be a canonical HTTPS URL");
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new Error("vault proxy destination must be a canonical HTTPS URL");
+	}
+	if (parsed.protocol !== "https:" || parsed.href !== value || parsed.username || parsed.password || parsed.hash) throw new Error("vault proxy destination must be a canonical HTTPS URL");
+	return value;
+}
+async function parseVaultProxyUseRequest(raw, claimedAtMs) {
+	if (!isExactRecord(raw, [
+		"tenantId",
+		"principalId",
+		"capabilityId",
+		"operationId",
+		"authorizedOperationId",
+		"auditEventId",
+		"evidenceSetDigest",
+		"vaultId",
+		"itemId",
+		"destination",
+		"payload"
+	])) throw new Error("vault proxy request has invalid fields");
+	if (typeof raw.payload !== "string") throw new Error("vault proxy payload must be a string");
+	const tenantId = requireAuthorizationId(raw.tenantId, parseTenantId);
+	const principalId = requireAuthorizationId(raw.principalId, parsePrincipalId);
+	const capabilityId = requireAuthorizationId(raw.capabilityId, parseCapabilityId);
+	const operationId = requireAuthorizationId(raw.operationId, parseCapabilityOperationId);
+	const vaultId = requireAuthorizationId(raw.vaultId, parseVaultId);
+	const itemId = requireAuthorizationId(raw.itemId, parseVaultItemId);
+	const destination = parseVaultProxyDestination(raw.destination);
+	const operation = await buildVaultProxyUseOperation({
+		tenantId,
+		principalId,
+		capabilityId,
+		operationId,
+		vaultId,
+		itemId,
+		destination
+	});
+	return {
+		secretRef: {
+			tenantId,
+			capabilityId,
+			vaultId,
+			itemId,
+			destination
+		},
+		payload: raw.payload,
+		claim: {
+			tenantId,
+			authorizedOperationId: requireAuthorizationId(raw.authorizedOperationId, parseAuthorizedOperationId),
+			auditEventId: requireAuthorizationId(raw.auditEventId, parseAuthorizationAuditEventId),
+			operation,
+			claimedAtMs,
+			authorization: {
+				kind: "verified_step_up",
+				evidenceSetDigest: parseDigestB64u(raw.evidenceSetDigest)
+			},
+			quota: { kind: "quota_neutral" }
+		}
+	};
+}
+async function digest(domain, value) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${domain}|${alphabetizeStringify(value)}`)));
+}
+async function readJson(request) {
+	try {
+		return await request.json();
+	} catch {
+		throw new Error("vault proxy request body must be JSON");
+	}
+}
+function vaultProxyUseResponse(result) {
+	if (result.kind === "replayed") return responseFromReplay(result.response);
+	return responseFromReplay(vaultProxyUseReplayResponse(result));
+}
+function vaultProxyUseReplayResponse(result) {
+	switch (result.kind) {
+		case "succeeded": return jsonReplayResponse(result, 200);
+		case "operation_in_progress": return jsonReplayResponse(result, 409);
+		case "rejected": return jsonReplayResponse(result, result.reason === "secret_unavailable" ? 404 : result.reason === "gateway_failed_after_side_effect" ? 502 : 403);
+	}
+}
+function jsonReplayResponse(body, status) {
+	return {
+		status,
+		contentType: "application/json",
+		bodyText: JSON.stringify(body)
+	};
+}
+function isReplayResponseWithinBound(response) {
+	return new TextEncoder().encode(response.bodyText).byteLength <= AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES;
+}
+function responseFromReplay(response) {
+	return new Response(authorizedOperationReplayBodyInit(response), {
+		status: response.status,
+		headers: { "content-type": response.contentType }
+	});
+}
+function isExactRecord(value, fields) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === fields.length && keys.every((key) => fields.includes(key));
+}
+function requireAuthorizationId(value, parser) {
+	const parsed = parser(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+//#endregion
+export { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination };
+
+//# sourceMappingURL=vaultProxyUse.js.map