@seams/wallet-server 0.5.0

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -0,0 +1,187 @@
+import { parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseAuthFactorId, parsePrincipalId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
+import { buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { json, readJson } from "../../../framework/http.js";
+import { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest } from "../../../domains/syncAccount/syncAccountRequestValidation.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";
+//#region src/router/transport/fetch/routes/syncAccount.ts
+function syncAccountResponseStatus(result) {
+	if (result.ok && result.verified) return 200;
+	switch (result.code) {
+		case "internal": return 500;
+		case "ed25519_not_provisioned": return 409;
+		default: return 400;
+	}
+}
+function passkeyWalletAuthAuthorityForMethod(input) {
+	const walletId = parseWalletId(input.walletId);
+	const rpId = parseWebAuthnRpId(input.rpId);
+	const credentialIdB64u = parseWebAuthnCredentialIdB64u(input.credentialIdB64u);
+	if (!walletId.ok || !rpId.ok || !credentialIdB64u.ok) throw new Error("Verified passkey Wallet Session authority identity is invalid");
+	return {
+		walletId: walletId.value,
+		factor: {
+			kind: "passkey",
+			credentialIdB64u: credentialIdB64u.value
+		},
+		verifier: {
+			kind: "webauthn",
+			rpId: rpId.value
+		},
+		bindingId: input.walletAuthMethodId
+	};
+}
+async function handleSyncAccount(ctx) {
+	if (ctx.method !== "POST") return null;
+	if (ctx.pathname === "/sync-account/options") {
+		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
+		if (!parsed.ok) return json(parsed.body, { status: parsed.status });
+		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
+		return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+	}
+	if (ctx.pathname === "/sync-account/verify") {
+		const parsed = parseSyncAccountVerifyRequest({
+			body: await readJson(ctx.request),
+			origin: ctx.request.headers.get("origin")
+		});
+		if (!parsed.ok) return json(parsed.body, { status: parsed.status });
+		const result = await ctx.service.webAuthn.verifyWebAuthnSyncAccount(parsed.request);
+		let responseBody = result;
+		if (result.ok && result.verified && result.thresholdEd25519) {
+			const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
+			if (!custodyKeyManifestDigestB64u) return json({
+				ok: false,
+				code: "internal",
+				message: "Sync verification did not resolve the wallet key manifest"
+			}, { status: 500 });
+			const thresholdEd25519 = result.thresholdEd25519;
+			const walletId = String(result.walletId || "").trim();
+			const nearAccountId = String(result.nearAccountId || "").trim();
+			const nearEd25519SigningKeyId = String(result.nearEd25519SigningKeyId || "").trim();
+			const signerSlot = Number(result.signerSlot);
+			const walletBinding = result.walletBinding;
+			const credentialIdB64u = String(result.credentialIdB64u || "").trim();
+			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return json({
+				ok: false,
+				code: "internal",
+				message: "verified passkey wallet is missing its Ed25519 Yao identity"
+			}, { status: 500 });
+			const authority = passkeyWalletAuthAuthorityForMethod({
+				walletId: walletBinding.walletId,
+				rpId: walletBinding.rpId,
+				credentialIdB64u,
+				walletAuthMethodId: result.walletAuthMethodId
+			});
+			const activeAuthority = await ctx.service.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+				walletId: authority.walletId,
+				rpId: authority.verifier.rpId,
+				credentialIdB64u: authority.factor.credentialIdB64u
+			});
+			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return json({
+				ok: false,
+				code: "internal",
+				message: "Verified passkey wallet authority is unavailable"
+			}, { status: 500 });
+			const authorityRef = await walletAuthAuthorityRef({ authority });
+			const principalId = parsePrincipalId(walletId);
+			const mintId = parseWalletSessionMintId(parsed.request.challengeId);
+			if (!principalId.ok || !mintId.ok) return json({
+				ok: false,
+				code: "internal",
+				message: "Verified passkey Wallet Session identity is invalid"
+			}, { status: 500 });
+			const issuedAtMs = Date.now();
+			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
+			const origin = parseSessionOrigin(parsed.request.expected_origin);
+			const factorId = parseAuthFactorId(`passkey:${credentialIdB64u}`);
+			const credentialId = parseWebAuthnCredentialIdB64u(credentialIdB64u);
+			if (!factorId.ok || !credentialId.ok) return json({
+				ok: false,
+				code: "internal",
+				message: "Verified passkey factor identity is invalid"
+			}, { status: 500 });
+			const proof = await ctx.service.authorizedOperations.buildVerifiedOwnerProof({
+				purpose: "wallet_session",
+				proofId: parseVerifiedOwnerProofId(`sync-account:${parsed.request.challengeId}`),
+				factor: buildVerifiedWalletSessionPasskeyFactorResult({
+					tenantId: ctx.service.authorizationSessions.tenantId,
+					principalId: principalId.value,
+					walletId: walletIdFromString(walletId),
+					authorityRef,
+					requestOrigin: origin,
+					audience: origin,
+					factorId: factorId.value,
+					credentialIdB64u: credentialId.value,
+					assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(parsed.request)))),
+					verifiedAtMs: issuedAtMs,
+					expiresAtMs
+				})
+			});
+			if (proof.purpose !== "wallet_session") return json({
+				ok: false,
+				code: "internal",
+				message: "Owner proof purpose is invalid"
+			}, { status: 500 });
+			const bootstrap = await issueSyncAccountBootstrapV1({
+				ctx,
+				result: {
+					ok: true,
+					verified: true,
+					accountId: String(result.accountId || walletId),
+					walletId,
+					nearAccountId,
+					nearEd25519SigningKeyId,
+					walletAuthMethodId: result.walletAuthMethodId,
+					walletAuthorityId: result.walletAuthorityId,
+					foundingAuthority: activeAuthority.walletAuthority,
+					foundingAuthMethod: activeAuthority.authMethod,
+					custodyKeyManifestDigestB64u,
+					walletBinding,
+					rpId: walletBinding.rpId,
+					signerSlot,
+					publicKey: String(result.publicKey),
+					...result.relayerKeyId ? { relayerKeyId: String(result.relayerKeyId) } : {},
+					credentialIdB64u,
+					credentialPublicKeyB64u: String(result.credentialPublicKeyB64u),
+					thresholdEd25519
+				},
+				authority,
+				activeAuthority: activeAuthority.walletAuthority,
+				foundingAuthMethod: activeAuthority.authMethod,
+				walletAuthMethodId: activeAuthority.authMethod.walletAuthMethodId,
+				authorityRef,
+				proof,
+				mintId: mintId.value,
+				issuedAtMs,
+				ecdsaThresholdSessionId: `sync-account-ecdsa:${parsed.request.challengeId}`,
+				custody: { kind: "read_verified_factor" }
+			});
+			if (bootstrap.kind === "already_committed") return json({
+				ok: false,
+				code: "already_committed",
+				message: "Wallet Session sync is already committed; retry the exact method",
+				...bootstrap.committed
+			}, { status: 409 });
+			if (bootstrap.kind === "error") return json({
+				ok: false,
+				code: bootstrap.code,
+				message: bootstrap.message
+			}, { status: bootstrap.status });
+			responseBody = bootstrap.body;
+		}
+		return json(responseBody, { status: syncAccountResponseStatus(result) });
+	}
+	return null;
+}
+//#endregion
+export { handleSyncAccount };
+
+//# sourceMappingURL=syncAccount.js.map

package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js

@@ -0,0 +1,214 @@
+import { mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { projectActiveWalletSession } from "../../../../authorization/domain.js";
+import { handleStrictEcdsaSessionActivation } from "./thresholdEcdsa.js";
+import { authorWalletUnlockEcdsaRequest } from "./sessions.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+//#region src/router/transport/fetch/routes/syncAccountBootstrap.ts
+function isEcdsaSignWalletSessionSubject(subject) {
+	return subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1";
+}
+function findEcdsaSignWalletSessionSubject(subjects) {
+	for (const subject of subjects) if (isEcdsaSignWalletSessionSubject(subject)) return subject;
+	return null;
+}
+async function issueSyncAccountBootstrapV1(input) {
+	const { ctx, result } = input;
+	const yaoRuntime = ctx.opts.routerAbEd25519YaoProduct;
+	const thresholdEd25519 = result.thresholdEd25519;
+	const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
+	const walletBinding = result.walletBinding;
+	const walletId = String(result.walletId).trim();
+	const nearAccountId = String(result.nearAccountId).trim();
+	const nearEd25519SigningKeyId = String(result.nearEd25519SigningKeyId).trim();
+	const signingWorkerId = String(thresholdEd25519?.relayerKeyId || "").trim();
+	const signerSlot = Number(result.signerSlot);
+	const credentialIdB64u = String(result.credentialIdB64u).trim();
+	const firstParticipantId = thresholdEd25519?.participantIds?.[0];
+	const secondParticipantId = thresholdEd25519?.participantIds?.[1];
+	if (!custodyKeyManifestDigestB64u) return bootstrapError("internal", "Sync verification did not resolve the wallet key manifest", 500);
+	if (!yaoRuntime) return bootstrapError("internal", "Ed25519 Yao product registration is not configured", 500);
+	if (thresholdEd25519?.participantIds?.length !== 2 || firstParticipantId === void 0 || secondParticipantId === void 0 || !signingWorkerId || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !String(thresholdEd25519?.keyVersion || "").trim() || !walletBinding || !credentialIdB64u || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot || input.authority.walletId !== walletId || input.authorityRef.walletId !== walletId) return bootstrapError("internal", "verified passkey wallet is missing its Ed25519 Yao identity", 500);
+	const capability = await yaoRuntime.resolveActiveCapability({
+		kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+		walletId,
+		nearEd25519SigningKeyId,
+		signerSlot,
+		signingWorkerId,
+		participantIds: [firstParticipantId, secondParticipantId]
+	});
+	if (!capability.ok) return bootstrapError(capability.code, capability.message, capability.code === "unknown_capability" ? 404 : 409);
+	if (capability.capability.nearAccountId !== nearAccountId) return bootstrapError("capability_conflict", "Active Ed25519 Yao capability does not match the verified NEAR account", 409);
+	const authorityEd25519Activation = input.activeAuthority.signerActivations.ed25519;
+	if (!authorityEd25519Activation || !mpcMaterialActivationRefsEqual(authorityEd25519Activation.materialActivation, routerAbMpcMaterialActivationRefFromWire(capability.capability.materialActivation))) return bootstrapError("capability_conflict", "Active Ed25519 Yao capability does not match the wallet authority material activation", 409);
+	const custodyEnvelope = await resolveCustodyEnvelope(input, walletId, walletBinding);
+	if (custodyEnvelope.kind !== "active") {
+		const manifestUnavailable = custodyEnvelope.kind === "manifest_unavailable";
+		return bootstrapError(manifestUnavailable ? "custody_manifest_unavailable" : `custody_envelope_${custodyEnvelope.kind}`, manifestUnavailable ? "Wallet custody key manifest is unavailable" : "Verified passkey has no unique active wallet custody envelope", manifestUnavailable ? 503 : custodyEnvelope.kind === "conflict" ? 409 : 404);
+	}
+	const principalId = parsePrincipalId(walletId);
+	if (!principalId.ok) return bootstrapError("internal", "Verified passkey Wallet Session identity is invalid", 500);
+	const directIssue = await ctx.service.authorizationSessions.issueDirectWalletSessionAuthorizationV2({
+		tenantId: ctx.service.authorizationSessions.tenantId,
+		principalId: principalId.value,
+		walletId: walletIdFromString(walletId),
+		authority: input.activeAuthority,
+		walletAuthMethodId: input.walletAuthMethodId,
+		mintId: input.mintId,
+		remainingUses: 3,
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS
+	});
+	if (directIssue.kind === "already_committed") return {
+		kind: "already_committed",
+		committed: directIssue
+	};
+	const ecdsaSigners = await ctx.service.walletRegistration.listWalletEcdsaCustodyContinuity({ walletId });
+	let ecdsaSessionActivation = null;
+	let ecdsaActivationReceipt = null;
+	const firstEcdsaSigner = ecdsaSigners[0];
+	if (firstEcdsaSigner) {
+		const authored = await authorWalletUnlockEcdsaRequest(ctx, walletId, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1({
+			kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
+			key_handle: firstEcdsaSigner.walletKey.keyHandle,
+			session_policy: {
+				threshold_session_id: input.ecdsaThresholdSessionId,
+				wallet_session_mint_id: input.mintId,
+				ttl_ms: DEFAULT_WALLET_SESSION_TTL_MS,
+				remaining_uses: 3,
+				runtime_policy_scope: firstEcdsaSigner.runtimePolicyScope
+			}
+		}));
+		if (!authored.ok) return bootstrapError(authored.code, authored.message, authored.status);
+		const activatedResponse = await handleStrictEcdsaSessionActivation({
+			ctx,
+			body: authored.value.request,
+			source: "wallet_session_operation_credential_v1",
+			operationCredential: directIssue.operationCredential,
+			proof: input.proof
+		});
+		const activatedBody = await activatedResponse.json();
+		if (!activatedResponse.ok) {
+			const failure = isPlainObject(activatedBody) ? activatedBody : {};
+			return bootstrapError(String(failure.code || "ecdsa_session_activation_failed"), String(failure.message || "ECDSA Wallet Session activation failed"), activatedResponse.status);
+		}
+		ecdsaSessionActivation = parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1(activatedBody);
+		ecdsaActivationReceipt = authored.value.activationReceipt;
+		const ecdsaSignSubject = findEcdsaSignWalletSessionSubject(directIssue.session.capabilitySubjects);
+		if (!ecdsaSignSubject || ecdsaSessionActivation.session.authorization_id !== directIssue.session.authorizationId || !mpcMaterialActivationRefsEqual(ecdsaSignSubject.materialActivation, routerAbMpcMaterialActivationRefFromWire(ecdsaSessionActivation.public_capability.material_activation))) return bootstrapError("capability_conflict", "ECDSA activation does not match the exact Wallet Session capability", 409);
+	}
+	const bodyBase = {
+		ok: true,
+		verified: true,
+		accountId: String(result.accountId).trim(),
+		walletId,
+		nearAccountId,
+		nearEd25519SigningKeyId,
+		walletAuthMethodId: input.walletAuthMethodId,
+		walletAuthorityId: input.activeAuthority.authorityId,
+		foundingAuthority: input.activeAuthority,
+		foundingAuthMethod: input.foundingAuthMethod,
+		custodyKeyManifestDigestB64u,
+		walletBinding,
+		rpId: String(result.rpId).trim(),
+		signerSlot,
+		publicKey: String(result.publicKey).trim(),
+		relayerKeyId: signingWorkerId,
+		credentialIdB64u,
+		credentialPublicKeyB64u: String(result.credentialPublicKeyB64u).trim(),
+		thresholdEd25519: {
+			relayerKeyId: signingWorkerId,
+			keyVersion: String(thresholdEd25519.keyVersion).trim(),
+			participantIds: [firstParticipantId, secondParticipantId],
+			session: {
+				walletId,
+				nearAccountId,
+				nearEd25519SigningKeyId,
+				thresholdSessionId: capability.capability.lifecycle.thresholdSessionId,
+				walletSessionId: directIssue.session.walletSessionId,
+				quotaId: directIssue.session.quotaId,
+				expiresAtMs: directIssue.session.expiresAtMs,
+				remainingUses: directIssue.quota.remainingUses,
+				runtimePolicyScope: capability.capability.runtimePolicyScope,
+				routerAbNormalSigning: {
+					kind: "router_ab_ed25519_normal_signing_v1",
+					signingWorkerId: yaoRuntime.signingWorkerId
+				}
+			}
+		},
+		walletSession: projectActiveWalletSession({
+			session: directIssue.session,
+			quota: directIssue.quota
+		}),
+		operationCredential: directIssue.operationCredential,
+		ed25519YaoRecovery: {
+			kind: "router_ab_ed25519_yao_sync_recovery_v1",
+			authorityRef: input.authorityRef,
+			capability: capability.capability
+		},
+		walletCustody: {
+			kind: "wallet_custody_sync_bootstrap_v1",
+			envelope: custodyEnvelope.envelope,
+			storeVersion: custodyEnvelope.storeVersion
+		},
+		ecdsaCustody: {
+			kind: "wallet_custody_ecdsa_sync_continuity_v1",
+			signers: ecdsaSigners.map((signer) => ({
+				chainTarget: signer.chainTarget,
+				walletKey: signer.walletKey,
+				activationReceipt: signer.activationReceipt,
+				runtimePolicyScope: signer.runtimePolicyScope
+			}))
+		}
+	};
+	if (ecdsaSessionActivation && ecdsaActivationReceipt) return {
+		kind: "ok",
+		body: {
+			...bodyBase,
+			ecdsaSession: ecdsaSessionActivation,
+			ecdsaActivationReceipt
+		}
+	};
+	return {
+		kind: "ok",
+		body: bodyBase
+	};
+}
+async function resolveCustodyEnvelope(input, walletId, walletBinding) {
+	if (input.custody.kind === "provided") {
+		const factor = input.custody.envelope.factor;
+		if (input.custody.envelope.walletId !== walletId || factor.kind !== "passkey" || factor.rpId !== walletBinding.rpId || factor.credentialIdB64u !== walletBinding.credentialIdB64u) return { kind: "conflict" };
+		return {
+			kind: "active",
+			envelope: input.custody.envelope,
+			storeVersion: input.custody.storeVersion
+		};
+	}
+	const rpId = parseWebAuthnRpId(walletBinding.rpId);
+	const credentialId = parseWebAuthnCredentialIdB64u(walletBinding.credentialIdB64u);
+	if (!rpId.ok || !credentialId.ok) return { kind: "conflict" };
+	return await input.ctx.service.passkeyCustody.readVerifiedFactorCustody({
+		walletId: walletIdFromString(walletId),
+		factor: {
+			kind: "passkey",
+			rpId: rpId.value,
+			credentialIdB64u: credentialId.value
+		}
+	});
+}
+function bootstrapError(code, message, status) {
+	return {
+		kind: "error",
+		code,
+		message,
+		status
+	};
+}
+//#endregion
+export { issueSyncAccountBootstrapV1 };
+
+//# sourceMappingURL=syncAccountBootstrap.js.map