@seams/wallet-server 0.5.0

package/dist/esm/router/framework/routerApiRouteSurface.js

@@ -0,0 +1,54 @@
+import { createRouterApiRouteDefinitions } from "./routeDefinitions.js";
+import { assertUniqueRouterApiRouteDefinitions, getRouterApiRouteExtensionDefinitions } from "./routeExtensions.js";
+import { resolveRouterApiModuleRouteExtensions } from "./modules.js";
+//#region src/router/framework/routerApiRouteSurface.ts
+const ROUTER_API_ROUTE_SURFACE_SYMBOL = Symbol.for("seams.routerApiRouteSurface");
+const SIGNED_DELEGATE_ROUTE_ID = "signed_delegate";
+function resolveRouterApiRouteDefinitionOptions(opts) {
+	return {
+		enableHealthz: Boolean(opts.healthz),
+		enableSigningSessionSeal: Boolean(opts.signingSessionSeal),
+		enableReadyz: Boolean(opts.readyz),
+		signingSessionSealBasePath: opts.signingSessionSeal?.basePath
+	};
+}
+function findSignedDelegatePath(routeDefinitions) {
+	return routeDefinitions.find((route) => route.id === SIGNED_DELEGATE_ROUTE_ID)?.path || "";
+}
+function resolveRouterApiRouteSurface(opts, input = {}) {
+	const transport = input.transport || "fetch";
+	const routeExtensions = resolveRouterApiModuleRouteExtensions(opts);
+	const routeDefinitions = [...createRouterApiRouteDefinitions(resolveRouterApiRouteDefinitionOptions(opts)), ...getRouterApiRouteExtensionDefinitions(routeExtensions, transport)];
+	assertUniqueRouterApiRouteDefinitions(routeDefinitions);
+	return {
+		routeDefinitions: Object.freeze(routeDefinitions),
+		signedDelegatePath: findSignedDelegatePath(routeDefinitions)
+	};
+}
+function attachRouterApiRouteSurface(target, surface) {
+	Object.defineProperty(target, ROUTER_API_ROUTE_SURFACE_SYMBOL, {
+		configurable: false,
+		enumerable: false,
+		value: Object.freeze({
+			...surface,
+			routeDefinitions: Object.freeze([...surface.routeDefinitions])
+		}),
+		writable: false
+	});
+	return target;
+}
+function getRouterApiRouteSurface(target) {
+	if (!target || typeof target !== "object" && typeof target !== "function") return null;
+	const value = target[ROUTER_API_ROUTE_SURFACE_SYMBOL];
+	if (!value || typeof value !== "object") return null;
+	const surface = value;
+	if (typeof surface.signedDelegatePath !== "string" || !Array.isArray(surface.routeDefinitions)) return null;
+	return {
+		routeDefinitions: surface.routeDefinitions,
+		signedDelegatePath: surface.signedDelegatePath
+	};
+}
+//#endregion
+export { attachRouterApiRouteSurface, getRouterApiRouteSurface, resolveRouterApiRouteDefinitionOptions, resolveRouterApiRouteSurface };
+
+//# sourceMappingURL=routerApiRouteSurface.js.map

package/dist/esm/router/framework/routerApiWebhooks.js

@@ -0,0 +1,60 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+//#region src/router/framework/routerApiWebhooks.ts
+const DEFAULT_ORG_ID_CLAIM_KEYS = [
+	"orgId",
+	"org_id",
+	"tenantId",
+	"tenant_id"
+];
+function resolveOrgIdFromClaims(claims, keys) {
+	if (!claims || typeof claims !== "object") return null;
+	for (const key of keys) {
+		const value = normalizeOptionalTrimmedString(claims[key]);
+		if (value) return value;
+	}
+	return null;
+}
+async function emitRouterApiWebhookEvent(input) {
+	const eventType = normalizeOptionalTrimmedString(input.eventType);
+	if (!eventType) return;
+	const webhooks = input.webhooks;
+	if (!webhooks?.emitter) return;
+	const claimKeys = (Array.isArray(webhooks.orgIdClaimKeys) && webhooks.orgIdClaimKeys.length ? webhooks.orgIdClaimKeys : [...DEFAULT_ORG_ID_CLAIM_KEYS]).map((entry) => normalizeOptionalTrimmedString(entry)).filter((entry) => Boolean(entry));
+	const orgId = normalizeOptionalTrimmedString(webhooks.orgId) || resolveOrgIdFromClaims(input.claims || null, claimKeys) || null;
+	if (!orgId) {
+		input.logger.debug("[router-api][webhooks] skipped event without org scope", {
+			eventType,
+			eventId: input.eventId || null
+		});
+		return;
+	}
+	const actorUserId = normalizeOptionalTrimmedString(webhooks.actorUserId) || "system-relay-webhook";
+	const roles = Array.isArray(webhooks.roles) && webhooks.roles.length ? webhooks.roles : ["ops"];
+	try {
+		await webhooks.emitter.emitEvent({
+			orgId,
+			actorUserId,
+			roles: roles.map((entry) => String(entry || "").trim().toLowerCase()).filter(Boolean)
+		}, {
+			...input.eventId ? { eventId: input.eventId } : {},
+			eventType,
+			payload: {
+				...input.payload,
+				...input.userId ? { userId: input.userId } : {},
+				orgId
+			}
+		});
+	} catch (error) {
+		input.logger.warn("[router-api][webhooks] failed to emit lifecycle event", {
+			eventType,
+			orgId,
+			eventId: input.eventId || null,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+}
+//#endregion
+export { emitRouterApiWebhookEvent };
+
+//# sourceMappingURL=routerApiWebhooks.js.map

package/dist/esm/router/framework/runtimeSnapshotConsumer.js

@@ -0,0 +1,145 @@
+//#region src/router/framework/runtimeSnapshotConsumer.ts
+function parseExpectation(raw) {
+	if (raw === void 0 || raw === null) return { parsed: null };
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {
+		parsed: null,
+		error: "runtimeSnapshot must be an object when provided"
+	};
+	const row = raw;
+	const snapshotId = String(row.snapshotId || "").trim();
+	const checksum = String(row.checksum || "").trim();
+	const hasVersion = row.version !== void 0 && row.version !== null;
+	let version;
+	if (hasVersion) {
+		const parsed = Number(row.version);
+		if (!Number.isFinite(parsed) || parsed <= 0 || Math.floor(parsed) !== parsed) return {
+			parsed: null,
+			error: "runtimeSnapshot.version must be a positive integer when provided"
+		};
+		version = parsed;
+	}
+	if (row.snapshotId !== void 0 && !snapshotId) return {
+		parsed: null,
+		error: "runtimeSnapshot.snapshotId must be a non-empty string"
+	};
+	if (row.checksum !== void 0 && !checksum) return {
+		parsed: null,
+		error: "runtimeSnapshot.checksum must be a non-empty string"
+	};
+	if (!snapshotId && !checksum && version === void 0) return {
+		parsed: null,
+		error: "runtimeSnapshot must include at least one of snapshotId, version, or checksum when provided"
+	};
+	return { parsed: {
+		...snapshotId ? { snapshotId } : {},
+		...version !== void 0 ? { version } : {},
+		...checksum ? { checksum } : {}
+	} };
+}
+async function validateRuntimeSnapshotExpectation(input) {
+	const expectationResult = parseExpectation(input.expectationRaw);
+	if (expectationResult.error) return {
+		ok: false,
+		code: "runtime_snapshot_invalid_expectation",
+		message: expectationResult.error
+	};
+	const expectation = expectationResult.parsed;
+	if (!expectation) return { ok: true };
+	const scope = input.scope;
+	if (!scope) return {
+		ok: false,
+		code: "runtime_snapshot_scope_missing",
+		message: "threshold session is missing runtimePolicyScope"
+	};
+	if (!input.runtimeSnapshots) return {
+		ok: false,
+		code: "runtime_snapshots_not_configured",
+		message: "Runtime snapshot consumer is not configured on this server"
+	};
+	const latest = await input.runtimeSnapshots.getLatestSnapshot(scope);
+	if (!latest) return {
+		ok: false,
+		code: "runtime_snapshot_not_found",
+		message: `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`
+	};
+	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return {
+		ok: false,
+		code: "runtime_snapshot_id_mismatch",
+		message: `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`
+	};
+	if (expectation.version !== void 0 && latest.version !== expectation.version) return {
+		ok: false,
+		code: "runtime_snapshot_version_mismatch",
+		message: `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`
+	};
+	if (expectation.checksum && latest.checksum !== expectation.checksum) return {
+		ok: false,
+		code: "runtime_snapshot_checksum_mismatch",
+		message: `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`
+	};
+	return { ok: true };
+}
+function makeScopeKey(scope) {
+	return `${scope.orgId}::${scope.projectId}::${scope.envId}`;
+}
+function parsePublishedUpdateFromOutboxPayload(payloadRaw) {
+	if (!payloadRaw || typeof payloadRaw !== "object" || Array.isArray(payloadRaw)) return null;
+	const snapshotRaw = payloadRaw.snapshot;
+	if (!snapshotRaw || typeof snapshotRaw !== "object" || Array.isArray(snapshotRaw)) return null;
+	const snapshot = snapshotRaw;
+	const orgId = String(snapshot.orgId || "").trim();
+	const envId = String(snapshot.envId || snapshot.environmentId || "").trim();
+	const projectId = String(snapshot.projectId || "").trim();
+	const signingRootVersion = String(snapshot.signingRootVersion || "").trim();
+	const snapshotId = String(snapshot.snapshotId || "").trim();
+	const checksum = String(snapshot.checksum || "").trim();
+	const effectiveAt = String(snapshot.effectiveAt || "").trim();
+	const versionRaw = Number(snapshot.version);
+	if (!orgId || !projectId || !envId || !signingRootVersion || !snapshotId || !checksum || !effectiveAt || !Number.isFinite(versionRaw) || versionRaw <= 0 || Math.floor(versionRaw) !== versionRaw) return null;
+	return {
+		scope: {
+			orgId,
+			projectId,
+			envId,
+			signingRootVersion
+		},
+		envelope: {
+			snapshotId,
+			version: versionRaw,
+			checksum,
+			effectiveAt
+		}
+	};
+}
+function createInMemoryRouterApiRuntimeSnapshotConsumer() {
+	const latestByScope = /* @__PURE__ */ new Map();
+	return {
+		runtimeSnapshots: { async getLatestSnapshot(scope) {
+			const latest = latestByScope.get(makeScopeKey(scope));
+			return latest ? {
+				snapshotId: latest.snapshotId,
+				version: latest.version,
+				checksum: latest.checksum,
+				effectiveAt: latest.effectiveAt
+			} : null;
+		} },
+		applyPublishedUpdate(update) {
+			latestByScope.set(makeScopeKey(update.scope), {
+				snapshotId: update.envelope.snapshotId,
+				version: update.envelope.version,
+				checksum: update.envelope.checksum,
+				effectiveAt: update.envelope.effectiveAt
+			});
+		},
+		applyOutboxEvent(event) {
+			const parsed = parsePublishedUpdateFromOutboxPayload(event.payload);
+			if (!parsed) throw new Error("Invalid runtime snapshot outbox payload");
+			latestByScope.set(makeScopeKey(parsed.scope), parsed.envelope);
+			return parsed;
+		}
+	};
+}
+//#endregion
+export { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation };
+
+//# sourceMappingURL=runtimeSnapshotConsumer.js.map

package/dist/esm/router/ror-adaptor.js

@@ -0,0 +1,5 @@
+import { normalizeRorHost, sanitizeRorOrigins } from "./framework/ror/normalize.js";
+import { resolveRorRpId, validateRouterApiRorOptions } from "./framework/ror/provider.js";
+import { StaticRorOriginsProvider } from "./framework/ror/staticProvider.js";
+import "./framework/ror/index.js";
+export { StaticRorOriginsProvider, normalizeRorHost, resolveRorRpId, sanitizeRorOrigins, validateRouterApiRorOptions };

package/dist/esm/router/ror.js

@@ -0,0 +1,178 @@
+import "bs58";
+//#region ../shared-ts/src/utils/normalize.ts
+/**
+* Generic normalization helpers shared across client/server.
+*
+* Keep domain-specific normalizers in their domain modules.
+*/
+/** Strict string coercion: returns the value only when it's already a string. */
+function normalizeOptionalString(value) {
+	return typeof value === "string" ? value : "";
+}
+/** Strict string coercion + trimming. */
+function normalizeOptionalTrimmedString(value) {
+	return normalizeOptionalString(value).trim();
+}
+/** String coercion + trimming (useful at IO boundaries). */
+function normalizeTrimmedString(value) {
+	return String(value ?? "").trim();
+}
+/**
+* Strict origin sanitizer for Related Origin Requests (ROR).
+* - Allows `https://<host>[:port]` and `http://localhost[:port]` only.
+* - Rejects paths (except `/`), queries, and hashes.
+* - Normalizes hostname casing.
+*/
+function toRorOriginOrNull(value) {
+	if (typeof value !== "string") return null;
+	const raw = normalizeTrimmedString(value);
+	if (!raw) return null;
+	try {
+		const u = new URL(raw);
+		const scheme = u.protocol;
+		const host = u.hostname.toLowerCase();
+		const port = u.port ? `:${u.port}` : "";
+		if (!(scheme === "https:") && !(scheme === "http:" && host === "localhost")) return null;
+		if (u.pathname && u.pathname !== "/" || u.search || u.hash) return null;
+		return `${scheme}//${host}${port}`;
+	} catch {
+		return null;
+	}
+}
+new Uint8Array([
+	64,
+	12,
+	49,
+	139,
+	102,
+	149,
+	151,
+	54,
+	89,
+	161,
+	105,
+	138,
+	229,
+	128,
+	223,
+	216,
+	0,
+	29,
+	153,
+	81,
+	186,
+	50,
+	198,
+	149,
+	230,
+	52,
+	153,
+	71,
+	80,
+	79,
+	63,
+	132
+]);
+new Uint8Array([
+	38,
+	218,
+	80,
+	229,
+	172,
+	150,
+	74,
+	126,
+	160,
+	132,
+	82,
+	127,
+	182,
+	71,
+	246,
+	51,
+	11,
+	50,
+	222,
+	81,
+	169,
+	175,
+	70,
+	82,
+	75,
+	0,
+	109,
+	143,
+	127,
+	231,
+	244,
+	209
+]);
+//#endregion
+//#region src/router/framework/ror/normalize.ts
+function sanitizeRorOrigins(origins) {
+	const list = Array.isArray(origins) ? origins : [];
+	const out = /* @__PURE__ */ new Set();
+	for (const raw of list) {
+		const normalized = toRorOriginOrNull(raw);
+		if (normalized) out.add(normalized);
+	}
+	return Array.from(out);
+}
+function normalizeRorHost(hostRaw) {
+	const host = normalizeOptionalTrimmedString(hostRaw);
+	if (!host) return null;
+	try {
+		return new URL(`https://${host}`).hostname.toLowerCase();
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/router/framework/ror/provider.ts
+function validateRouterApiRorOptions(ror) {
+	if (!ror || typeof ror !== "object") throw new Error("[router.ror] Invalid ROR options: expected object");
+	if (!ror.provider || typeof ror.provider.getAllowedOrigins !== "function") throw new Error("[router.ror] Invalid ROR options: provider.getAllowedOrigins is required");
+	const staticRpId = normalizeOptionalTrimmedString(ror.rpId).toLowerCase();
+	const hasStaticRpId = Boolean(staticRpId);
+	const hostMap = ror.rpIdByHost;
+	const hasHostMap = Boolean(hostMap && typeof hostMap === "object" && Object.keys(hostMap).length > 0);
+	if (hasStaticRpId === hasHostMap) throw new Error("[router.ror] Configure exactly one RP ID strategy: `rpId` or `rpIdByHost`");
+	if (hasHostMap) for (const [rawHost, rawRpId] of Object.entries(hostMap || {})) {
+		const host = normalizeRorHost(rawHost);
+		const rpId = normalizeOptionalTrimmedString(rawRpId).toLowerCase();
+		if (!host || !rpId) throw new Error("[router.ror] Invalid `rpIdByHost` entry: host and rpId must be non-empty strings");
+	}
+}
+function resolveRorRpId(input) {
+	const ror = input.ror;
+	if (!ror) return null;
+	const staticRpId = normalizeOptionalTrimmedString(ror.rpId).toLowerCase();
+	if (staticRpId) return staticRpId;
+	const hostMap = ror.rpIdByHost;
+	if (!hostMap || typeof hostMap !== "object") return null;
+	const host = normalizeRorHost(input.host);
+	if (!host) return null;
+	return normalizeOptionalTrimmedString(hostMap[host]).toLowerCase() || null;
+}
+//#endregion
+//#region src/router/framework/ror/staticProvider.ts
+var StaticRorOriginsProvider = class {
+	constructor(input) {
+		this.byRpId = /* @__PURE__ */ new Map();
+		const byRpId = input?.byRpId || {};
+		for (const [rawRpId, rawOrigins] of Object.entries(byRpId)) {
+			const rpId = normalizeOptionalTrimmedString(rawRpId).toLowerCase();
+			if (!rpId) continue;
+			this.byRpId.set(rpId, sanitizeRorOrigins(rawOrigins));
+		}
+	}
+	async getAllowedOrigins(input) {
+		const rpId = normalizeOptionalTrimmedString(input.rpId).toLowerCase();
+		if (!rpId) return [];
+		return this.byRpId.get(rpId) || [];
+	}
+};
+//#endregion
+export { StaticRorOriginsProvider, normalizeRorHost, resolveRorRpId, sanitizeRorOrigins, validateRouterApiRorOptions };
+
+//# sourceMappingURL=ror.js.map