@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js

@@ -0,0 +1,207 @@
+import { parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
+import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { parseLinkDevicePublicKeyB64u } from "./parsers.js";
+//#region ../shared-ts/src/device-linking/walletSessionCredentialDelivery.ts
+const DELIVERY_AAD_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-aad/v1";
+const DELIVERY_ENVELOPE_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-envelope/v1";
+function encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad) {
+	return alphabetizeStringify({
+		domain: DELIVERY_AAD_DOMAIN,
+		aad
+	});
+}
+function buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1(aad) {
+	return {
+		kind: "linked_device_wallet_session_credential_delivery_binding_v1",
+		namespace: aad.namespace,
+		orgId: aad.orgId,
+		projectId: aad.projectId,
+		envId: aad.envId,
+		tenantId: aad.tenantId,
+		principalId: aad.principalId
+	};
+}
+async function computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(aad) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad))));
+}
+async function computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(envelope) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		domain: DELIVERY_ENVELOPE_DOMAIN,
+		envelope
+	}))));
+}
+async function computeLinkedDeviceActivationCleanupReceiptDigestB64u(receipt) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		domain: "seams/linked-device/activation-cleanup-receipt/v1",
+		receipt
+	}))));
+}
+function parseLinkedDeviceActivationCleanupReceiptV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"devicePublicKeyB64u",
+		"devicePublicKeyDigestB64u",
+		"linkSessionId",
+		"walletId",
+		"authorityId",
+		"walletAuthMethodId",
+		"packageSetDigestB64u",
+		"authorizationId",
+		"walletSessionId",
+		"credentialDigestB64u",
+		"installationReceiptDigestB64u",
+		"acknowledgedAtMs",
+		"expiresAtMs"
+	], "LinkedDeviceActivationCleanupReceiptV1");
+	if (record.kind !== "linked_device_activation_cleanup_receipt_v1") throw new Error("LinkedDeviceActivationCleanupReceiptV1.kind is invalid");
+	const acknowledgedAtMs = positiveInteger(record.acknowledgedAtMs, "acknowledgedAtMs");
+	const expiresAtMs = positiveInteger(record.expiresAtMs, "expiresAtMs");
+	if (expiresAtMs <= acknowledgedAtMs) throw new Error("expiresAtMs must be after acknowledgedAtMs");
+	return {
+		kind: "linked_device_activation_cleanup_receipt_v1",
+		devicePublicKeyB64u: parseLinkDevicePublicKeyB64u(record.devicePublicKeyB64u),
+		devicePublicKeyDigestB64u: parseDigestB64u(record.devicePublicKeyDigestB64u),
+		linkSessionId: parsed(parseLinkDeviceSessionId(record.linkSessionId)),
+		walletId: parsed(parseWalletId(record.walletId)),
+		authorityId: parsed(parseWalletAuthorityId(record.authorityId)),
+		walletAuthMethodId: parsed(parseWalletAuthMethodId(record.walletAuthMethodId)),
+		packageSetDigestB64u: parseDigestB64u(record.packageSetDigestB64u),
+		authorizationId: parsed(parseWalletSessionAuthorizationId(record.authorizationId)),
+		walletSessionId: parsed(parseWalletSessionId(record.walletSessionId)),
+		credentialDigestB64u: parseDigestB64u(record.credentialDigestB64u),
+		installationReceiptDigestB64u: parseDigestB64u(record.installationReceiptDigestB64u),
+		acknowledgedAtMs,
+		expiresAtMs
+	};
+}
+async function assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1(delivery) {
+	if (await computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(delivery.aad) !== delivery.aadDigestB64u) throw new Error("linked-device Wallet Session credential delivery AAD digest is invalid");
+	if (await computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(delivery.envelope) !== delivery.envelopeDigestB64u) throw new Error("linked-device Wallet Session credential delivery envelope digest is invalid");
+	if (parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		domain: "seams/linked-device/delivery-recipient/v1",
+		recipientPublicKey65B64u: delivery.aad.recipientPublicKey65B64u
+	})))) !== delivery.recipientBindingDigestB64u) throw new Error("linked-device Wallet Session credential delivery recipient binding is invalid");
+}
+function parseLinkedDeviceWalletSessionCredentialDeliveryV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"aad",
+		"aadDigestB64u",
+		"recipientBindingDigestB64u",
+		"envelope",
+		"envelopeDigestB64u",
+		"installationReceiptDigestB64u"
+	], "LinkedDeviceWalletSessionCredentialDeliveryV1");
+	if (record.kind !== "linked_device_wallet_session_credential_delivery_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid");
+	return {
+		kind: "linked_device_wallet_session_credential_delivery_v1",
+		aad: parseDeliveryAad(record.aad),
+		aadDigestB64u: parseDigestB64u(record.aadDigestB64u),
+		recipientBindingDigestB64u: parseDigestB64u(record.recipientBindingDigestB64u),
+		envelope: parseDeliveryEnvelope(record.envelope),
+		envelopeDigestB64u: parseDigestB64u(record.envelopeDigestB64u),
+		installationReceiptDigestB64u: parseDigestB64u(record.installationReceiptDigestB64u)
+	};
+}
+function parseDeliveryAad(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"namespace",
+		"orgId",
+		"projectId",
+		"envId",
+		"tenantId",
+		"principalId",
+		"linkSessionId",
+		"walletId",
+		"authorityId",
+		"walletAuthMethodId",
+		"authorizationId",
+		"walletSessionId",
+		"quotaId",
+		"credentialDigestB64u",
+		"recipientPublicKey65B64u",
+		"issuedAtMs",
+		"expiresAtMs"
+	], "LinkedDeviceWalletSessionCredentialDeliveryAadV1");
+	if (record.kind !== "linked_device_wallet_session_credential_delivery_aad_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid");
+	const issuedAtMs = positiveInteger(record.issuedAtMs, "issuedAtMs");
+	const expiresAtMs = positiveInteger(record.expiresAtMs, "expiresAtMs");
+	if (expiresAtMs <= issuedAtMs) throw new Error("expiresAtMs must be after issuedAtMs");
+	return {
+		kind: "linked_device_wallet_session_credential_delivery_aad_v1",
+		namespace: nonEmpty(record.namespace, "namespace"),
+		orgId: nonEmpty(record.orgId, "orgId"),
+		projectId: nonEmpty(record.projectId, "projectId"),
+		envId: nonEmpty(record.envId, "envId"),
+		tenantId: parsed(parseTenantId(record.tenantId)),
+		principalId: parsed(parsePrincipalId(record.principalId)),
+		linkSessionId: parsed(parseLinkDeviceSessionId(record.linkSessionId)),
+		walletId: parsed(parseWalletId(record.walletId)),
+		authorityId: parsed(parseWalletAuthorityId(record.authorityId)),
+		walletAuthMethodId: parsed(parseWalletAuthMethodId(record.walletAuthMethodId)),
+		authorizationId: parsed(parseWalletSessionAuthorizationId(record.authorizationId)),
+		walletSessionId: parsed(parseWalletSessionId(record.walletSessionId)),
+		quotaId: parsed(parseMpcWalletSigningQuotaId(record.quotaId)),
+		credentialDigestB64u: parseDigestB64u(record.credentialDigestB64u),
+		recipientPublicKey65B64u: fixedBase64Url(record.recipientPublicKey65B64u, 65),
+		issuedAtMs,
+		expiresAtMs
+	};
+}
+function parseDeliveryEnvelope(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"algorithm",
+		"serverEphemeralPublicKey65B64u",
+		"nonce12B64u",
+		"ciphertextB64u"
+	], "LinkedDeviceWalletSessionCredentialEnvelopeV1");
+	if (record.kind !== "linked_device_wallet_session_credential_envelope_v1" || record.algorithm !== "p256-ecdh-aes256gcm-v1") throw new Error("LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid");
+	return {
+		kind: "linked_device_wallet_session_credential_envelope_v1",
+		algorithm: "p256-ecdh-aes256gcm-v1",
+		serverEphemeralPublicKey65B64u: fixedBase64Url(record.serverEphemeralPublicKey65B64u, 65),
+		nonce12B64u: fixedBase64Url(record.nonce12B64u, 12),
+		ciphertextB64u: canonicalBase64Url(record.ciphertextB64u)
+	};
+}
+function exactRecord(raw, fields, label) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
+	const record = raw;
+	const expected = new Set(fields);
+	for (const field of Object.keys(record)) if (!expected.has(field)) throw new Error(`${label}.${field} is not supported`);
+	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+function nonEmpty(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} is required`);
+	return raw;
+}
+function positiveInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${label} is invalid`);
+	return Number(raw);
+}
+function canonicalBase64Url(raw) {
+	const encoded = nonEmpty(raw, "base64url");
+	if (base64UrlEncode(base64UrlDecode(encoded)) !== encoded) throw new Error("base64url is not canonical");
+	return encoded;
+}
+function fixedBase64Url(raw, length) {
+	const encoded = canonicalBase64Url(raw);
+	const bytes = base64UrlDecode(encoded);
+	if (bytes.length !== length) throw new Error(`base64url must contain ${length} bytes`);
+	if (length === 65 && bytes[0] !== 4) throw new Error("P-256 public key is invalid");
+	return encoded;
+}
+function parsed(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
+//#endregion
+export { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1, computeLinkedDeviceActivationCleanupReceiptDigestB64u, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceActivationCleanupReceiptV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 };
+
+//# sourceMappingURL=walletSessionCredentialDelivery.js.map

package/dist/esm/shared-ts/src/near/actions.js

@@ -0,0 +1,75 @@
+import "../utils/validation.js";
+//#region ../shared-ts/src/near/actions.ts
+let ActionType = /* @__PURE__ */ function(ActionType) {
+	ActionType["CreateAccount"] = "CreateAccount";
+	ActionType["DeployContract"] = "DeployContract";
+	ActionType["FunctionCall"] = "FunctionCall";
+	ActionType["Transfer"] = "Transfer";
+	ActionType["Stake"] = "Stake";
+	ActionType["AddKey"] = "AddKey";
+	ActionType["DeleteKey"] = "DeleteKey";
+	ActionType["DeleteAccount"] = "DeleteAccount";
+	ActionType["SignedDelegate"] = "SignedDelegate";
+	ActionType["DeployGlobalContract"] = "DeployGlobalContract";
+	ActionType["UseGlobalContract"] = "UseGlobalContract";
+	return ActionType;
+}({});
+function validateActionArgsWasm(actionArgsWasm) {
+	switch (actionArgsWasm.action_type) {
+		case ActionType.FunctionCall:
+			if (!actionArgsWasm.method_name) throw new Error("method_name required for FunctionCall");
+			if (!actionArgsWasm.args) throw new Error("args required for FunctionCall");
+			if (!actionArgsWasm.gas) throw new Error("gas required for FunctionCall");
+			if (!actionArgsWasm.deposit) throw new Error("deposit required for FunctionCall");
+			if (typeof actionArgsWasm.args !== "string") throw new Error("FunctionCall action args must be a valid JSON string");
+			try {
+				JSON.parse(actionArgsWasm.args);
+			} catch {
+				throw new Error("FunctionCall action args must be valid JSON string");
+			}
+			break;
+		case ActionType.Transfer:
+			if (!actionArgsWasm.deposit) throw new Error("deposit required for Transfer");
+			break;
+		case ActionType.CreateAccount: break;
+		case ActionType.DeployContract:
+			if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) throw new Error("code required for DeployContract");
+			break;
+		case ActionType.Stake:
+			if (!actionArgsWasm.stake) throw new Error("stake amount required for Stake");
+			if (!actionArgsWasm.public_key) throw new Error("public_key required for Stake");
+			break;
+		case ActionType.AddKey:
+			if (!actionArgsWasm.public_key) throw new Error("public_key required for AddKey");
+			if (!actionArgsWasm.access_key) throw new Error("access_key required for AddKey");
+			if (typeof actionArgsWasm.access_key !== "string") throw new Error("AddKey action access_key must be a valid JSON string");
+			try {
+				JSON.parse(actionArgsWasm.access_key);
+			} catch {
+				throw new Error("AddKey action access_key must be valid JSON string");
+			}
+			break;
+		case ActionType.DeleteKey:
+			if (!actionArgsWasm.public_key) throw new Error("public_key required for DeleteKey");
+			break;
+		case ActionType.DeleteAccount:
+			if (!actionArgsWasm.beneficiary_id) throw new Error("beneficiary_id required for DeleteAccount");
+			break;
+		case ActionType.SignedDelegate:
+			if (!actionArgsWasm.delegate_action || typeof actionArgsWasm.delegate_action !== "object") throw new Error("delegate_action required for SignedDelegate");
+			if (!actionArgsWasm.signature || typeof actionArgsWasm.signature !== "object") throw new Error("signature required for SignedDelegate");
+			break;
+		case ActionType.DeployGlobalContract:
+			if (!actionArgsWasm.code || actionArgsWasm.code.length === 0) throw new Error("code required for DeployGlobalContract");
+			if (!actionArgsWasm.deploy_mode || actionArgsWasm.deploy_mode !== "CodeHash" && actionArgsWasm.deploy_mode !== "AccountId") throw new Error("deploy_mode must be CodeHash or AccountId for DeployGlobalContract");
+			break;
+		case ActionType.UseGlobalContract:
+			if (!!actionArgsWasm.account_id === !!actionArgsWasm.code_hash) throw new Error("UseGlobalContract requires exactly one of account_id or code_hash");
+			break;
+		default: throw new Error(`Unsupported action type: ${actionArgsWasm.action_type}`);
+	}
+}
+//#endregion
+export { ActionType, validateActionArgsWasm };
+
+//# sourceMappingURL=actions.js.map

package/dist/esm/shared-ts/src/passkey-custody/ceremonyCommitPayload.js

@@ -0,0 +1,69 @@
+//#region ../shared-ts/src/passkey-custody/ceremonyCommitPayload.ts
+/**
+* Reads a commit payload off the wire without judging it.
+*
+* Deliberately total: it never throws and never reports a payload as absent
+* when one was sent. Malformed custody must reach the admission gate and come
+* back as a reported `rejected`, because the two outcomes lead the client
+* somewhere completely different — `not_requested` says custody was never
+* asked for, and a client that believed that would treat a wallet with no
+* recoverable seed as fully registered.
+*
+* Nothing here validates. The nested `establishedCustody` is carried through
+* verbatim: every one of its fields is parsed by the commit builder through the
+* same boundary parsers every other reader uses, and anything it cannot parse
+* becomes a rejection there.
+*/
+function walletCustodyCeremonyCommitPayloadFromWire(value) {
+	if (value === void 0 || value === null) return void 0;
+	const record = typeof value === "object" && !Array.isArray(value) ? value : {};
+	const custody = record.establishedCustody;
+	return {
+		walletId: asWireString(record.walletId),
+		keySet: asWireString(record.keySet),
+		keyManifestDigestB64u: asWireString(record.keyManifestDigestB64u),
+		...custody === void 0 || custody === null ? {} : { establishedCustody: custody },
+		...record.recoveryBackupAcknowledged === true ? { recoveryBackupAcknowledged: true } : {},
+		...record.registeredPublicKeyB64u === void 0 ? {} : { registeredPublicKeyB64u: asWireString(record.registeredPublicKeyB64u) },
+		...record.clientRootPublicKey33B64u === void 0 ? {} : { clientRootPublicKey33B64u: asWireString(record.clientRootPublicKey33B64u) },
+		...record.ecdsaPublicFacts === void 0 || record.ecdsaPublicFacts === null ? {} : { ecdsaPublicFacts: record.ecdsaPublicFacts }
+	};
+}
+function asWireString(value) {
+	return typeof value === "string" ? value : "";
+}
+/**
+* Parses the outcome a registration response carries. Throws, because this runs
+* on the client against its own Gateway's response: an unrecognised custody
+* status is a version skew the client must not paper over by guessing.
+*/
+function parseWalletCustodyRegistrationOutcome(value, label) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} walletCustody must be an object`);
+	const record = value;
+	switch (record.status) {
+		case "not_requested":
+		case "committed":
+		case "custody_already_established": return { status: record.status };
+		case "joined": {
+			const digest = record.keyManifestDigestB64u;
+			if (typeof digest !== "string" || !digest) throw new Error(`${label} joined custody carries no key manifest digest`);
+			return {
+				status: "joined",
+				keyManifestDigestB64u: digest
+			};
+		}
+		case "rejected": {
+			const reason = record.reason;
+			if (typeof reason !== "string" || !reason) throw new Error(`${label} rejected custody carries no reason`);
+			return {
+				status: "rejected",
+				reason
+			};
+		}
+		default: throw new Error(`${label} walletCustody status is unrecognised`);
+	}
+}
+//#endregion
+export { parseWalletCustodyRegistrationOutcome, walletCustodyCeremonyCommitPayloadFromWire };
+
+//# sourceMappingURL=ceremonyCommitPayload.js.map

package/dist/esm/shared-ts/src/passkey-custody/credentialActivity.js

@@ -0,0 +1,81 @@
+function parseWalletCredentialActivityRecordV1(raw, options) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
+		ok: false,
+		reason: "credential activity record must be an object"
+	};
+	const record = raw;
+	if (record.kind !== "wallet_credential_activity_v1") return {
+		ok: false,
+		reason: "credential activity record kind is invalid"
+	};
+	const walletId = trimmed(record.walletId);
+	const envelopeId = trimmed(record.envelopeId);
+	if (!walletId || !envelopeId) return {
+		ok: false,
+		reason: "credential activity record must name its wallet and envelope"
+	};
+	if (walletId !== String(options.expectedWalletId).trim()) return {
+		ok: false,
+		reason: "credential activity record is outside the authenticated wallet"
+	};
+	const createdAtMs = timestamp(record.createdAtMs);
+	const updatedAtMs = timestamp(record.updatedAtMs);
+	if (createdAtMs === null || updatedAtMs === null) return {
+		ok: false,
+		reason: "credential activity record needs valid timestamps"
+	};
+	const useCount = record.useCount;
+	if (typeof useCount !== "number" || !Number.isInteger(useCount) || useCount < 0) return {
+		ok: false,
+		reason: "credential activity useCount must be a non-negative integer"
+	};
+	let lastUsedAtMs;
+	if (record.lastUsedAtMs !== void 0 && record.lastUsedAtMs !== null) {
+		const parsed = timestamp(record.lastUsedAtMs);
+		if (parsed === null) return {
+			ok: false,
+			reason: "credential activity lastUsedAtMs is invalid"
+		};
+		lastUsedAtMs = parsed;
+	}
+	if (useCount > 0 !== (lastUsedAtMs !== void 0)) return {
+		ok: false,
+		reason: "credential activity useCount and lastUsedAtMs disagree"
+	};
+	const label = normalizeLabel(record.label);
+	if (label === "invalid") return {
+		ok: false,
+		reason: "credential activity label is too long"
+	};
+	return {
+		ok: true,
+		record: {
+			kind: "wallet_credential_activity_v1",
+			walletId,
+			envelopeId,
+			...label === void 0 ? {} : { label },
+			createdAtMs,
+			updatedAtMs,
+			...lastUsedAtMs === void 0 ? {} : { lastUsedAtMs },
+			useCount
+		}
+	};
+}
+function trimmed(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function timestamp(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : null;
+}
+function normalizeLabel(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value !== "string") return "invalid";
+	const label = value.trim();
+	if (!label) return void 0;
+	if (label.length > 64) return "invalid";
+	return label;
+}
+//#endregion
+export { parseWalletCredentialActivityRecordV1 };
+
+//# sourceMappingURL=credentialActivity.js.map