@seams/wallet-server 0.5.0

package/dist/esm/core/nearSignerWasmRuntime.js

@@ -0,0 +1,87 @@
+import __wbg_init, { init_worker } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
+//#region src/core/nearSignerWasmRuntime.ts
+const SIGNER_WASM_PATH_CANDIDATES = ["../wasm/near_signer/pkg/wasm_signer_worker_bg.wasm", "../wasm/near_signer/pkg/wasm_signer_worker_bg.wasm"];
+let signerWasmInitPromise = null;
+let signerWasmReady = false;
+const capturedFetch = typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : null;
+function isNodeEnvironment() {
+	const processObj = globalThis.process;
+	const isNode = Boolean(processObj?.versions?.node);
+	const webSocketPair = globalThis.WebSocketPair;
+	const nav = globalThis.navigator;
+	const isCloudflareWorker = typeof webSocketPair !== "undefined" || typeof nav?.userAgent === "string" && nav.userAgent.includes("Cloudflare-Workers");
+	return isNode && !isCloudflareWorker;
+}
+function getSignerWasmUrls() {
+	const baseUrl = import.meta.url;
+	const resolved = [];
+	for (const path of SIGNER_WASM_PATH_CANDIDATES) try {
+		resolved.push(new URL(path, baseUrl));
+	} catch {}
+	return resolved;
+}
+async function initSignerFromCompiledModule(module) {
+	await __wbg_init({ module_or_path: module });
+	init_worker();
+	signerWasmReady = true;
+}
+async function loadBundledNearSignerWasmModule() {
+	try {
+		const imported = await import("../wasm/near_signer/pkg/wasm_signer_worker_bg.wasm");
+		return imported.default instanceof WebAssembly.Module ? imported.default : null;
+	} catch {
+		return null;
+	}
+}
+async function initNearSignerFromBundledModule() {
+	const module = await loadBundledNearSignerWasmModule();
+	if (!module) return false;
+	await initSignerFromCompiledModule(module);
+	return true;
+}
+async function compileWasmFromUrl(url) {
+	const fetchFn = capturedFetch ?? (typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : null);
+	if (!fetchFn) throw new Error("[near-signer] fetch is not available to load signer WASM");
+	const response = await fetchFn(url.toString());
+	if (!response || typeof response.arrayBuffer !== "function") throw new Error("[near-signer] signer WASM fetch returned a non-Response object");
+	const status = typeof response.status === "number" ? response.status : 0;
+	if (!(typeof response.ok === "boolean" ? response.ok : status === 0 || status >= 200 && status < 300)) throw new Error(`[near-signer] signer WASM fetch failed with status ${status}`);
+	const bytes = await response.arrayBuffer();
+	return WebAssembly.compile(bytes);
+}
+async function initializeNearSignerWasm() {
+	const urls = getSignerWasmUrls();
+	if (isNodeEnvironment()) {
+		const { fileURLToPath } = await import("node:url");
+		const { readFile } = await import("node:fs/promises");
+		for (const url of urls) try {
+			const bytes = await readFile(fileURLToPath(url));
+			const ab = new ArrayBuffer(bytes.byteLength);
+			new Uint8Array(ab).set(bytes);
+			await initSignerFromCompiledModule(await WebAssembly.compile(ab));
+			return;
+		} catch {}
+		throw new Error("[near-signer] Failed to initialize signer WASM from filesystem candidates");
+	}
+	if (await initNearSignerFromBundledModule()) return;
+	let lastErr = null;
+	for (const url of urls) try {
+		await initSignerFromCompiledModule(await compileWasmFromUrl(url));
+		return;
+	} catch (e) {
+		lastErr = e;
+	}
+	throw lastErr instanceof Error ? lastErr : new Error(String(lastErr || "Failed to initialize signer WASM"));
+}
+async function ensureNearSignerWasm() {
+	if (signerWasmReady) return;
+	if (!signerWasmInitPromise) signerWasmInitPromise = initializeNearSignerWasm();
+	await signerWasmInitPromise;
+}
+function isNearSignerWasmReady() {
+	return signerWasmReady;
+}
+//#endregion
+export { ensureNearSignerWasm, isNearSignerWasmReady };
+
+//# sourceMappingURL=nearSignerWasmRuntime.js.map

package/dist/esm/core/registrationContracts.js

@@ -0,0 +1,2 @@
+import { registrationPreparationIdFromString } from "./types.js";
+export { registrationPreparationIdFromString };

package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js

@@ -0,0 +1,88 @@
+import { coerceThresholdNodeRole, parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
+import { secureRandomIdFragment } from "../ThresholdService/secureRandomId.js";
+import { exportRouterAbLinkedDeviceEcdsaShare, startRouterAbLinkedDeviceEcdsaPresignSession, stepRouterAbLinkedDeviceEcdsaPresignSession } from "../ThresholdService/routerAb/ecdsaDerivationPresignBridge.js";
+import { RouterAbEcdsaDerivationPoolFillHandlers } from "../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js";
+//#region src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.ts
+function parseRouterAbEcdsaPresignRuntimeConfig(input) {
+	return {
+		nodeRole: coerceThresholdNodeRole(input.THRESHOLD_NODE_ROLE),
+		participantIds: parseThresholdEd25519ParticipantIds2p(input)
+	};
+}
+function createPresignSessionId(expiresAtMs) {
+	return `ecdsa-presign-v2:${expiresAtMs}:${secureRandomIdFragment()}`;
+}
+function routerAbEcdsaPresignGlobalFetch(input, init) {
+	return globalThis.fetch(input, init);
+}
+function resolveSigningWorkerTransport(input) {
+	const fetchImpl = input.fetchImpl ?? (typeof globalThis.fetch === "function" ? routerAbEcdsaPresignGlobalFetch : null);
+	if (!fetchImpl) throw new Error("InvalidLocalServiceConfig: fetch is required for Router A/B ECDSA SigningWorker presign transport");
+	return {
+		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
+		auth: input.auth,
+		fetchImpl
+	};
+}
+var RouterAbEcdsaPresignRuntime = class {
+	constructor(input) {
+		this.signingWorkerTransport = resolveSigningWorkerTransport(input.signingWorkerTransport);
+		this.handlers = new RouterAbEcdsaDerivationPoolFillHandlers({
+			nodeRole: input.config.nodeRole,
+			participantIds2p: input.config.participantIds.participantIds2p,
+			ensureReady: input.ensureReady,
+			createPoolFillSessionId: createPresignSessionId,
+			signingWorkerTransport: this.signingWorkerTransport
+		});
+	}
+	healthz() {
+		return { ok: true };
+	}
+	async initializePoolFill(input) {
+		return await this.handlers.routerAbEcdsaDerivationPresignaturePoolFillInit(input);
+	}
+	async advancePoolFill(input) {
+		return await this.handlers.routerAbEcdsaDerivationPresignaturePoolFillStep(input);
+	}
+	async initializeLinkedDevicePresign(input) {
+		const transport = this.signingWorkerTransport;
+		return await startRouterAbLinkedDeviceEcdsaPresignSession({
+			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
+			request: input.request,
+			materialSource: input.materialSource,
+			presignSessionId: input.presignSessionId,
+			expiresAtMs: input.expiresAtMs,
+			auth: transport.auth,
+			fetchImpl: transport.fetchImpl
+		});
+	}
+	async advanceLinkedDevicePresign(input) {
+		const transport = this.signingWorkerTransport;
+		return await stepRouterAbLinkedDeviceEcdsaPresignSession({
+			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
+			request: input.request,
+			materialSource: input.materialSource,
+			presignSessionId: input.presignSessionId,
+			requestedStage: input.requestedStage,
+			outgoingMessagesB64u: input.outgoingMessagesB64u,
+			expiresAtMs: input.expiresAtMs,
+			auth: transport.auth,
+			fetchImpl: transport.fetchImpl
+		});
+	}
+	async exportLinkedDeviceShare(input) {
+		const transport = this.signingWorkerTransport;
+		return await exportRouterAbLinkedDeviceEcdsaShare({
+			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
+			scope: input.scope,
+			materialSource: input.materialSource,
+			binding: input.binding,
+			auth: transport.auth,
+			fetchImpl: transport.fetchImpl
+		});
+	}
+};
+//#endregion
+export { RouterAbEcdsaPresignRuntime, parseRouterAbEcdsaPresignRuntimeConfig };
+
+//# sourceMappingURL=RouterAbEcdsaPresignRuntime.js.map

package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js

@@ -0,0 +1,101 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS } from "../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseRouterAbNormalSigningServerPolicy, validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
+//#region src/core/routerAbSigning/RouterAbNormalSigningRuntime.ts
+function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport) {
+	if (transport.kind !== "configured") throw new Error("InvalidLocalServiceConfig: ROUTER_AB_SIGNING_WORKER_URL and ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET are required for Router A/B ECDSA presign");
+	return transport;
+}
+function parseSigningWorkerTransport(config) {
+	const signingWorkerBaseUrl = normalizeOptionalTrimmedString(config.ROUTER_AB_SIGNING_WORKER_URL);
+	const secret = normalizeOptionalTrimmedString(config.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET);
+	const fetchImpl = typeof config.routerAbSigningWorkerFetch === "function" ? config.routerAbSigningWorkerFetch : void 0;
+	if (!signingWorkerBaseUrl && !secret) return { kind: "unconfigured" };
+	if (!signingWorkerBaseUrl) throw new Error("ROUTER_AB_SIGNING_WORKER_URL is required when Router A/B internal service auth is configured");
+	if (!secret) throw new Error("ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET is required when Router A/B SigningWorker URL is configured");
+	return {
+		kind: "configured",
+		signingWorkerBaseUrl,
+		auth: {
+			kind: "internal_service_auth_secret",
+			secret
+		},
+		...fetchImpl ? { fetchImpl } : {}
+	};
+}
+function parseRouterAbNormalSigningRuntimeConfig(config) {
+	return {
+		policy: parseRouterAbNormalSigningServerPolicy(config),
+		signingWorkerTransport: parseSigningWorkerTransport(config)
+	};
+}
+var RouterAbNormalSigningRuntime = class {
+	constructor(input) {
+		this.walletSessionStore = input.walletSessionStore;
+		this.ecdsaWalletSessionStore = input.ecdsaWalletSessionStore;
+		this.config = input.config;
+	}
+	getSigningWorkerId() {
+		return this.config.policy.signingWorkerId;
+	}
+	getSigningWorkerPrivateTransport() {
+		return this.config.signingWorkerTransport;
+	}
+	validateSessionPolicy(requested) {
+		return validateRouterAbNormalSigningServerPolicy({
+			requested,
+			policy: this.config.policy
+		});
+	}
+	clampSessionPolicy(input) {
+		const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
+		const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
+		return {
+			ttlMs: Math.min(ttlMs, MAX_WALLET_SESSION_TTL_MS),
+			remainingUses: Math.min(remainingUses, MAX_WALLET_SESSION_REMAINING_USES)
+		};
+	}
+	async reservePrepareReplay(input) {
+		const replayIdentityValue = normalizeOptionalTrimmedString(input.authorizationIdentity.kind === "reusable_wallet_session" ? input.authorizationIdentity.walletSessionId : input.authorizationIdentity.materialActivationId);
+		const requestId = normalizeOptionalTrimmedString(input.requestId);
+		const expiresAtMs = Number(input.expiresAtMs);
+		if (!replayIdentityValue || !requestId || !Number.isFinite(expiresAtMs) || expiresAtMs <= 0) return {
+			ok: false,
+			status: 400,
+			code: "invalid_body",
+			message: "Router A/B normal-signing replay reservation requires authorization identity, request id, and expiry"
+		};
+		const store = input.curve === "ed25519" ? this.walletSessionStore : this.ecdsaWalletSessionStore;
+		const replayIdentity = `${input.authorizationIdentity.kind}:${replayIdentityValue}`;
+		const replayGuard = await store.reserveReplayGuard([
+			"router-ab-normal-signing",
+			input.curve,
+			"prepare",
+			replayIdentity
+		].join(":"), requestId, expiresAtMs);
+		if (replayGuard.ok) return { ok: true };
+		if (replayGuard.code === "export_nonce_replay") return {
+			ok: false,
+			status: 400,
+			code: "one_use_replay_rejected",
+			message: "Router A/B normal-signing prepare request id already used"
+		};
+		if (replayGuard.code === "export_authorization_expired") return {
+			ok: false,
+			status: 400,
+			code: "expired_request",
+			message: "Router A/B normal-signing prepare request is expired"
+		};
+		return {
+			ok: false,
+			status: 500,
+			code: "internal",
+			message: replayGuard.message
+		};
+	}
+};
+//#endregion
+export { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport };
+
+//# sourceMappingURL=RouterAbNormalSigningRuntime.js.map

package/dist/esm/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.js

@@ -0,0 +1,39 @@
+import { coerceLogger } from "../logger.js";
+import { RouterAbEcdsaPresignRuntime, parseRouterAbEcdsaPresignRuntimeConfig } from "./RouterAbEcdsaPresignRuntime.js";
+import { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores } from "../ThresholdService/stores/CloudflareDurableObjectStore.js";
+import { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport } from "./RouterAbNormalSigningRuntime.js";
+//#region src/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.ts
+async function ensureCloudflareRouterAbSigningRuntimeReady() {
+	await this.getRelayerAccount();
+}
+function createCloudflareDurableObjectRouterAbSigningRuntimes(input) {
+	const logger = coerceLogger(input.logger);
+	const ed25519Stores = createCloudflareDurableObjectThresholdEd25519Stores({
+		config: input.thresholdStore,
+		logger
+	});
+	const ecdsaStores = createCloudflareDurableObjectThresholdEcdsaStores({
+		config: input.thresholdStore,
+		logger
+	});
+	if (!ed25519Stores || !ecdsaStores) throw new Error("Cloudflare D1 Router API thresholdStore must use kind: \"cloudflare-do\"");
+	const ensureReady = ensureCloudflareRouterAbSigningRuntimeReady.bind(input.auth);
+	const normalSigningConfig = parseRouterAbNormalSigningRuntimeConfig(input.thresholdStore);
+	const signingWorkerTransport = requireRouterAbConfiguredSigningWorkerPrivateTransport(normalSigningConfig.signingWorkerTransport);
+	return {
+		normalSigning: new RouterAbNormalSigningRuntime({
+			walletSessionStore: ed25519Stores.walletSessionStore,
+			ecdsaWalletSessionStore: ecdsaStores.walletSessionStore,
+			config: normalSigningConfig
+		}),
+		ecdsaPresign: new RouterAbEcdsaPresignRuntime({
+			config: parseRouterAbEcdsaPresignRuntimeConfig(input.thresholdStore),
+			signingWorkerTransport,
+			ensureReady
+		})
+	};
+}
+//#endregion
+export { createCloudflareDurableObjectRouterAbSigningRuntimes };
+
+//# sourceMappingURL=createCloudflareDurableObjectRouterAbSigningRuntimes.js.map

package/dist/esm/core/routerAbSigning/createRouterAbSigningRuntimes.js

@@ -0,0 +1,91 @@
+import { isObject } from "../../shared-ts/src/utils/validation.js";
+import { coerceLogger } from "../logger.js";
+import { RouterAbEcdsaPresignRuntime, parseRouterAbEcdsaPresignRuntimeConfig } from "./RouterAbEcdsaPresignRuntime.js";
+import { createThresholdEcdsaSigningStores } from "../ThresholdService/stores/EcdsaSigningStore.js";
+import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "../ThresholdService/stores/WalletSessionStore.js";
+import { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport } from "./RouterAbNormalSigningRuntime.js";
+//#region src/core/routerAbSigning/createRouterAbSigningRuntimes.ts
+async function ensureRouterAbSigningRuntimeReady() {
+	await this.getRelayerAccount();
+}
+function isNodeEnvironment() {
+	const processObject = globalThis.process;
+	const isNode = Boolean(processObject?.versions?.node);
+	const isCloudflareWorker = typeof globalThis.WebSocketPair !== "undefined" || typeof navigator !== "undefined" && String(navigator.userAgent || "").includes("Cloudflare-Workers");
+	return isNode && !isCloudflareWorker;
+}
+function thresholdStoreConfigFromEnvironment(environment) {
+	if (!environment) return null;
+	return {
+		UPSTASH_REDIS_REST_URL: environment.UPSTASH_REDIS_REST_URL,
+		UPSTASH_REDIS_REST_TOKEN: environment.UPSTASH_REDIS_REST_TOKEN,
+		REDIS_URL: environment.REDIS_URL,
+		THRESHOLD_PREFIX: environment.THRESHOLD_PREFIX,
+		THRESHOLD_ED25519_KEYSTORE_PREFIX: environment.THRESHOLD_ED25519_KEYSTORE_PREFIX,
+		THRESHOLD_ED25519_WALLET_SESSION_PREFIX: environment.THRESHOLD_ED25519_WALLET_SESSION_PREFIX,
+		THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX: environment.THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX,
+		THRESHOLD_ECDSA_KEYSTORE_PREFIX: environment.THRESHOLD_ECDSA_KEYSTORE_PREFIX,
+		THRESHOLD_ECDSA_SESSION_PREFIX: environment.THRESHOLD_ECDSA_SESSION_PREFIX,
+		THRESHOLD_ECDSA_WALLET_SESSION_PREFIX: environment.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX,
+		THRESHOLD_ECDSA_PRESIGN_PREFIX: environment.THRESHOLD_ECDSA_PRESIGN_PREFIX,
+		THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: environment.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID,
+		THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: environment.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID,
+		THRESHOLD_NODE_ROLE: environment.THRESHOLD_NODE_ROLE,
+		THRESHOLD_COORDINATOR_INSTANCE_ID: environment.THRESHOLD_COORDINATOR_INSTANCE_ID,
+		THRESHOLD_COORDINATOR_PEERS: environment.THRESHOLD_COORDINATOR_PEERS,
+		ROUTER_AB_NORMAL_SIGNING_WORKER_ID: environment.ROUTER_AB_NORMAL_SIGNING_WORKER_ID,
+		ROUTER_AB_SIGNING_WORKER_URL: environment.ROUTER_AB_SIGNING_WORKER_URL,
+		ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET: environment.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET
+	};
+}
+function resolveThresholdStoreConfig(input) {
+	if (isObject(input.environmentConfig) && isObject(input.explicitConfig)) return {
+		...input.environmentConfig,
+		...input.explicitConfig
+	};
+	return input.explicitConfig ?? input.environmentConfig;
+}
+function createRouterAbSigningRuntimes(input) {
+	const logger = coerceLogger(input.logger);
+	const isNode = input.isNode ?? isNodeEnvironment();
+	const environment = isNode ? globalThis.process?.env : void 0;
+	const config = resolveThresholdStoreConfig({
+		explicitConfig: input.thresholdStore,
+		environmentConfig: thresholdStoreConfigFromEnvironment(environment)
+	});
+	const configRecord = isObject(config) ? config : {};
+	const ed25519WalletSessionStore = createEd25519WalletSessionStore({
+		config,
+		logger,
+		isNode
+	});
+	const ecdsaWalletSessionStore = createEcdsaWalletSessionStore({
+		config,
+		logger,
+		isNode
+	});
+	createThresholdEcdsaSigningStores({
+		config,
+		logger,
+		isNode
+	});
+	const ensureReady = ensureRouterAbSigningRuntimeReady.bind(input.authService);
+	const normalSigningConfig = parseRouterAbNormalSigningRuntimeConfig(configRecord);
+	const signingWorkerTransport = requireRouterAbConfiguredSigningWorkerPrivateTransport(normalSigningConfig.signingWorkerTransport);
+	return {
+		normalSigning: new RouterAbNormalSigningRuntime({
+			walletSessionStore: ed25519WalletSessionStore,
+			ecdsaWalletSessionStore,
+			config: normalSigningConfig
+		}),
+		ecdsaPresign: new RouterAbEcdsaPresignRuntime({
+			config: parseRouterAbEcdsaPresignRuntimeConfig(configRecord),
+			signingWorkerTransport,
+			ensureReady
+		})
+	};
+}
+//#endregion
+export { createRouterAbSigningRuntimes };
+
+//# sourceMappingURL=createRouterAbSigningRuntimes.js.map