@seams/wallet-server 0.5.0

package/dist/esm/core/rpcClients/near/NearClient.js

@@ -0,0 +1,389 @@
+import { base64Decode, base64Encode } from "../../../shared-ts/src/utils/base64.js";
+import { isFunction } from "../../../shared-ts/src/utils/validation.js";
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { decodeJsonRpcEnvelope } from "../../../shared-ts/src/utils/jsonRpc.js";
+import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView, decodeNearBlockReference, decodeNearCodeBase64, decodeNearContractCallResult, decodeNearFinalExecutionOutcome, parseNearContractResult } from "../../../shared-ts/src/utils/nearRpcResults.js";
+//#region src/core/rpcClients/near/NearClient.ts
+function isObj(v) {
+	return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function firstKey(o) {
+	if (!o) return void 0;
+	const keys = Object.keys(o);
+	return keys.length ? keys[0] : void 0;
+}
+var NearRpcError = class NearRpcError extends Error {
+	constructor(params) {
+		super(params.message);
+		this.name = params.name || "NearRpcError";
+		this.code = params.code;
+		this.type = params.type || "Unknown";
+		this.kind = params.kind;
+		this.index = params.index;
+		this.short = params.short;
+		this.details = params.details;
+		this.operation = params.operation;
+		this.failureKind = params.failureKind;
+	}
+	static fromRpcError(operationName, err) {
+		const details = err.data;
+		const rpcMessage = err.message;
+		const { message, type, kind, index, short, failureKind } = describeDetails(operationName, err);
+		return new NearRpcError({
+			message: message || rpcMessage || `${operationName} RPC error`,
+			short: short || kind || "RPC error",
+			failureKind,
+			type: type || "RpcError",
+			kind,
+			index,
+			code: typeof err.code === "number" ? err.code : void 0,
+			name: err.name || "NearRpcError",
+			operation: operationName,
+			details
+		});
+	}
+	static fromOutcome(operationName, outcome, failure) {
+		const { message, type, kind, index, short, failureKind } = describeFailure(operationName, failure);
+		return new NearRpcError({
+			message: message || `${operationName} failed`,
+			short: short || kind || "TxExecutionError",
+			failureKind,
+			type: type || "Failure",
+			kind,
+			index,
+			name: "TxExecutionFailure",
+			operation: operationName,
+			details: {
+				Failure: failure,
+				outcome
+			}
+		});
+	}
+};
+function describeDetails(operationName, error) {
+	const details = error.data;
+	const rpcMessage = typeof error.message === "string" ? error.message : "";
+	const d = isObj(details) ? details : void 0;
+	const txExec = isObj(d?.TxExecutionError) ? d.TxExecutionError : void 0;
+	const directExecution = d && ("InvalidTxError" in d || "ActionError" in d) ? d : void 0;
+	if (txExec) return describeTxExecution(operationName, txExec);
+	if (directExecution) return describeTxExecution(operationName, directExecution);
+	const structuredName = rpcFailureName(error, d);
+	const structuredFailureKind = classifyStructuredRpcFailure(structuredName);
+	const detail = typeof details === "string" && details.trim() ? details.trim() : d ? JSON.stringify(d) : rpcMessage.trim();
+	return {
+		message: `${operationName} RPC error${detail ? `: ${detail}` : ""}`,
+		...structuredName ? { kind: structuredName } : {},
+		failureKind: structuredFailureKind
+	};
+}
+function rpcFailureName(error, details) {
+	const directCause = isObj(error.cause) ? error.cause : void 0;
+	const dataCause = isObj(details?.cause) ? details.cause : void 0;
+	return [
+		directCause?.name,
+		dataCause?.name,
+		details?.name,
+		error.name
+	].find((candidate) => typeof candidate === "string");
+}
+function classifyStructuredRpcFailure(name) {
+	switch (name) {
+		case "UNKNOWN_TRANSACTION":
+		case "TRANSACTION_NOT_FOUND": return "transaction_not_found";
+		case "UNKNOWN_ACCOUNT":
+		case "ACCOUNT_DOES_NOT_EXIST": return "account_not_found";
+		case "UNKNOWN_ACCESS_KEY":
+		case "ACCESS_KEY_DOES_NOT_EXIST": return "access_key_not_found";
+		default: return "infrastructure_failure";
+	}
+}
+function describeFailure(operationName, failure) {
+	const f = isObj(failure) ? failure : void 0;
+	if (!f) return {
+		message: `${operationName} failed (Unknown Failure)`,
+		failureKind: "unknown"
+	};
+	return describeTxExecution(operationName, f);
+}
+function describeTxExecution(operationName, exec) {
+	if ("InvalidTxError" in exec) {
+		const kind = invalidTransactionKind(exec.InvalidTxError);
+		const short = kind.startsWith("ActionsValidation.") ? `InvalidTxError: ${kind.split(".")[1] || "ActionsValidation"}` : `InvalidTxError: ${kind}`;
+		return {
+			message: `${operationName} failed (InvalidTxError: ${kind})`,
+			type: "InvalidTxError",
+			kind,
+			short,
+			failureKind: classifyInvalidTransaction(kind)
+		};
+	}
+	if (isObj(exec.ActionError)) {
+		const ae = exec.ActionError;
+		const idx = typeof ae.index === "number" ? ae.index : void 0;
+		const kind = firstKey(isObj(ae.kind) ? ae.kind : void 0) || "ActionError";
+		return {
+			message: `${operationName} failed${typeof idx === "number" ? ` at action ${idx}` : ""} (ActionError: ${kind})`,
+			type: "ActionError",
+			kind,
+			index: idx,
+			short: `ActionError: ${kind}`,
+			failureKind: "action_error"
+		};
+	}
+	return {
+		message: `${operationName} failed (TxExecutionError)`,
+		type: "TxExecutionError",
+		kind: "TxExecutionError",
+		short: "TxExecutionError",
+		failureKind: "execution_failure"
+	};
+}
+function invalidTransactionKind(value) {
+	if (typeof value === "string") return value;
+	if (!isObj(value)) return "InvalidTxError";
+	if (isObj(value.ActionsValidation)) return `ActionsValidation.${firstKey(value.ActionsValidation) || "ActionsValidation"}`;
+	return firstKey(value) || "InvalidTxError";
+}
+function classifyInvalidTransaction(kind) {
+	switch (kind) {
+		case "InvalidNonce": return "invalid_nonce";
+		case "Expired": return "expired";
+		default: return "invalid_transaction";
+	}
+}
+let RpcCallType = /* @__PURE__ */ function(RpcCallType) {
+	RpcCallType["Query"] = "query";
+	RpcCallType["View"] = "view";
+	RpcCallType["Send"] = "send_tx";
+	RpcCallType["Block"] = "block";
+	RpcCallType["Call"] = "call_function";
+	return RpcCallType;
+}({});
+const DEFAULT_WAIT_STATUS = { executeAction: "EXECUTED_OPTIMISTIC" };
+var SignedTransaction = class SignedTransaction {
+	constructor(data) {
+		this.transaction = data.transaction;
+		this.signature = data.signature;
+		this.borsh_bytes = data.borsh_bytes;
+		if (data.nonceLease) this.nonceLease = data.nonceLease;
+		if (data.serverDispatch) this.serverDispatch = data.serverDispatch;
+	}
+	static fromPlain(input) {
+		return new SignedTransaction({
+			transaction: input.transaction,
+			signature: input.signature,
+			borsh_bytes: input.borsh_bytes,
+			...input.nonceLease ? { nonceLease: input.nonceLease } : {},
+			...input.serverDispatch ? { serverDispatch: input.serverDispatch } : {}
+		});
+	}
+	encode() {
+		return new Uint8Array(this.borsh_bytes).buffer;
+	}
+	base64Encode() {
+		return base64Encode(this.encode());
+	}
+};
+function toArrayBufferFromUnknownBytes(bytes) {
+	if (!bytes) return null;
+	if (Array.isArray(bytes)) return new Uint8Array(bytes).buffer;
+	if (ArrayBuffer.isView(bytes)) {
+		const view = bytes;
+		return view.buffer.slice(view.byteOffset, view.byteOffset + view.byteLength);
+	}
+	if (bytes instanceof ArrayBuffer) return bytes;
+	return null;
+}
+function encodeSignedTransactionBase64(signed) {
+	const maybeSigned = signed?.signedTransaction;
+	const txPayload = maybeSigned && typeof maybeSigned === "object" ? maybeSigned : signed;
+	const maybeBase64 = txPayload.base64Encode;
+	if (isFunction(maybeBase64)) return maybeBase64.call(txPayload);
+	const maybeEncode = txPayload.encode;
+	if (isFunction(maybeEncode)) return base64Encode(maybeEncode.call(txPayload));
+	const snakeBuf = toArrayBufferFromUnknownBytes(txPayload.borsh_bytes);
+	if (snakeBuf) return base64Encode(snakeBuf);
+	const camelBuf = toArrayBufferFromUnknownBytes(txPayload.borshBytes);
+	if (camelBuf) return base64Encode(camelBuf);
+	throw new Error("Invalid signed transaction payload: cannot serialize to base64");
+}
+var MinimalNearClient = class MinimalNearClient {
+	constructor(rpcUrl) {
+		this.rpcUrls = MinimalNearClient.normalizeRpcUrls(rpcUrl);
+	}
+	static normalizeRpcUrls(input) {
+		const normalized = (Array.isArray(input) ? input : input.split(/[\s,]+/).map((url) => url.trim()).filter(Boolean)).map((url) => {
+			try {
+				return new URL(url).toString();
+			} catch (err) {
+				throw new Error(errorMessage(err) || `Invalid NEAR RPC URL: ${url}`);
+			}
+		});
+		if (!normalized.length) throw new Error("NEAR RPC URL cannot be empty");
+		return Array.from(new Set(normalized));
+	}
+	buildRequestBody(method, params) {
+		return JSON.stringify({
+			jsonrpc: "2.0",
+			id: secureRandomId("near-rpc", 32, "NEAR JSON-RPC request IDs"),
+			method,
+			params
+		});
+	}
+	async postOnce(url, requestBody) {
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: requestBody
+		});
+		if (!response.ok) throw new Error(`RPC request failed: ${response.status} ${response.statusText}`);
+		const text = await response.text();
+		if (!text?.trim()) throw new Error("Empty response from RPC server");
+		const decoded = decodeJsonRpcEnvelope(JSON.parse(text));
+		if (!decoded.ok) throw new Error(`Invalid NEAR JSON-RPC response: ${decoded.error}`);
+		return decoded.value;
+	}
+	async requestWithFallback(requestBody) {
+		let lastError;
+		for (const [index, url] of this.rpcUrls.entries()) try {
+			const result = await this.postOnce(url, requestBody);
+			if (index > 0) console.warn(`[NearClient] RPC succeeded via fallback: ${url}`);
+			return result;
+		} catch (err) {
+			lastError = err;
+			const remaining = index < this.rpcUrls.length - 1;
+			console.warn(`[NearClient] RPC call to ${url} failed${remaining ? ", trying next" : ""}: ${errorMessage(err) || "RPC request failed"}`);
+			if (!remaining) throw err instanceof Error ? err : new Error(String(err));
+		}
+		throw new Error(errorMessage(lastError) || "RPC request failed");
+	}
+	unwrapRpcResult(rpc, operationName) {
+		if (rpc.kind === "failure") throw NearRpcError.fromRpcError(operationName, rpc.error);
+		const result = rpc.result;
+		if (typeof result === "object" && result !== null && "error" in result) {
+			const wrappedError = Reflect.get(result, "error");
+			throw new NearRpcError({
+				message: `${operationName} Error: ${typeof wrappedError === "string" ? wrappedError : JSON.stringify(wrappedError)}`,
+				short: "RpcError",
+				failureKind: "infrastructure_failure",
+				type: "RpcError"
+			});
+		}
+		return rpc.result;
+	}
+	async makeRpcCall(method, params, operationName, decodeResult) {
+		const requestBody = this.buildRequestBody(method, params);
+		try {
+			const envelope = await this.requestWithFallback(requestBody);
+			return decodeResult(this.unwrapRpcResult(envelope, operationName));
+		} catch (error) {
+			throw normalizeNearRpcFailure(operationName, error);
+		}
+	}
+	async query(params, decodeResult) {
+		return this.makeRpcCall(RpcCallType.Query, params, "Query", decodeResult);
+	}
+	async viewAccessKey(accountId, publicKey, finalityQuery) {
+		const params = {
+			request_type: "view_access_key",
+			finality: finalityQuery?.finality || "final",
+			account_id: accountId,
+			public_key: publicKey
+		};
+		return this.makeRpcCall(RpcCallType.Query, params, "View Access Key", decodeNearAccessKeyView);
+	}
+	async viewAccessKeyList(accountId, finalityQuery) {
+		const params = {
+			request_type: "view_access_key_list",
+			finality: finalityQuery?.finality || "final",
+			account_id: accountId
+		};
+		return this.makeRpcCall(RpcCallType.Query, params, "View Access Key List", decodeNearAccessKeyList);
+	}
+	async viewAccount(accountId) {
+		const params = {
+			request_type: "view_account",
+			finality: "final",
+			account_id: accountId
+		};
+		return this.makeRpcCall(RpcCallType.Query, params, "View Account", decodeNearAccountView);
+	}
+	async viewCode(accountId, finalityQuery) {
+		const params = {
+			request_type: "view_code",
+			finality: finalityQuery?.finality || "final",
+			account_id: accountId
+		};
+		return base64Decode(await this.makeRpcCall(RpcCallType.Query, params, "View Code", decodeNearCodeBase64));
+	}
+	async viewBlock(params) {
+		return this.makeRpcCall(RpcCallType.Block, params, "View Block", decodeNearBlockReference);
+	}
+	async sendTransaction(signedTransaction, waitUntil = DEFAULT_WAIT_STATUS.executeAction) {
+		const params = {
+			signed_tx_base64: encodeSignedTransactionBase64(signedTransaction),
+			wait_until: waitUntil
+		};
+		const outcome = await this.makeRpcCall(RpcCallType.Send, params, "Send Transaction", decodeNearFinalExecutionOutcome);
+		const status = outcome.status;
+		if (status && typeof status === "object" && "Failure" in status) throw NearRpcError.fromOutcome("Send Transaction", outcome, status.Failure);
+		return outcome;
+	}
+	async txStatus(txHash, senderAccountId) {
+		return this.makeRpcCall("EXPERIMENTAL_tx_status", {
+			tx_hash: txHash,
+			sender_account_id: senderAccountId
+		}, "Tx Status", decodeNearFinalExecutionOutcome);
+	}
+	async callFunction(accountId, method, args, decodeResult, blockQuery) {
+		const rpcParams = {
+			request_type: "call_function",
+			...blockQuery ?? { finality: "final" },
+			account_id: accountId,
+			method_name: method,
+			args_base64: base64Encode(new TextEncoder().encode(JSON.stringify(args)).buffer)
+		};
+		return decodeResult(parseNearContractResult((await this.makeRpcCall(RpcCallType.Query, rpcParams, "View Function", decodeNearContractCallResult)).result));
+	}
+	async view(params) {
+		return this.callFunction(params.account, params.method, params.args, params.decodeResult);
+	}
+	async getAccessKeys({ account, block_id }) {
+		const params = {
+			request_type: "view_access_key_list",
+			account_id: account,
+			finality: "final"
+		};
+		if (block_id) params.block_id = block_id;
+		const keys = (await this.makeRpcCall(RpcCallType.Query, params, "Get Access Keys", decodeNearAccessKeyList)).keys || [];
+		const fullAccessKeys = [];
+		const functionCallAccessKeys = [];
+		for (const key of keys) {
+			const permission = key.access_key.permission;
+			if (permission === "FullAccess") fullAccessKeys.push(key);
+			else if (typeof permission === "object" && "FunctionCall" in permission) functionCallAccessKeys.push(key);
+		}
+		return {
+			fullAccessKeys,
+			functionCallAccessKeys
+		};
+	}
+};
+function normalizeNearRpcFailure(operationName, error) {
+	if (error instanceof NearRpcError) return error;
+	const cause = errorMessage(error) || "RPC request failed";
+	return new NearRpcError({
+		message: `${operationName} RPC infrastructure failure: ${cause}`,
+		short: "RPC infrastructure failure",
+		failureKind: "infrastructure_failure",
+		type: "RpcError",
+		operation: operationName,
+		details: { cause }
+	});
+}
+//#endregion
+export { MinimalNearClient, NearRpcError, RpcCallType, SignedTransaction };
+
+//# sourceMappingURL=NearClient.js.map

package/dist/esm/core/signingLanes/LaneAggregateRevocationApplicationService.js

@@ -0,0 +1,86 @@
+import { parseRevokeLaneEnrollmentV1 } from "../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { computeLaneEnrollmentManifestDigestV1 } from "../../shared-ts/src/signing-lanes/rotationDigests.js";
+//#region src/core/signingLanes/LaneAggregateRevocationApplicationService.ts
+var LaneAggregateRevocationApplicationService = class {
+	constructor(options) {
+		this.options = options;
+	}
+	/**
+	* Establish the enrollment lifecycle fence before management revokes any
+	* child authorization. The full aggregate path calls the same durable fence
+	* again, so retries remain idempotent.
+	*/
+	async fenceLaneEnrollmentV1(input) {
+		const command = parseRevokeLaneEnrollmentV1(input);
+		const admission = await this.options.lifecycleStore.getEnrollment(command.enrollmentId);
+		if (!admission) return { kind: "conflict" };
+		const manifestDigest = await computeLaneEnrollmentManifestDigestV1(admission.value.manifest);
+		if (admission.value.manifest.walletId !== command.walletId || manifestDigest !== command.manifestDigestB64u) return { kind: "conflict" };
+		const fenced = await this.options.lifecycleStore.fenceEnrollmentRevocation(command);
+		return fenced.outcome === "conflict" ? { kind: "conflict" } : { kind: fenced.outcome };
+	}
+	async revokeLaneEnrollmentV1(input) {
+		const command = parseRevokeLaneEnrollmentV1(input.command);
+		const admission = await this.options.lifecycleStore.getEnrollment(command.enrollmentId);
+		if (!admission) throw new Error("lane enrollment revocation target is missing");
+		const manifestDigest = await computeLaneEnrollmentManifestDigestV1(admission.value.manifest);
+		if (admission.value.manifest.walletId !== command.walletId || manifestDigest !== command.manifestDigestB64u) throw new Error("lane enrollment revocation differs from its admitted manifest");
+		if (input.orderedChildren.length !== admission.value.manifest.orderedChildren.length) throw new Error("lane enrollment revocation child count differs from its manifest");
+		const fenced = await this.options.lifecycleStore.fenceEnrollmentRevocation(command);
+		if (fenced.outcome === "conflict") throw new Error(`lane enrollment revocation fence conflicted at version ${fenced.actualVersion}`);
+		const productsByOperation = indexProducts(await this.options.lifecycleStore.listEnrollmentProductEpochs(command.enrollmentId));
+		for (let index = 0; index < admission.value.manifest.orderedChildren.length; index += 1) {
+			const manifestChild = admission.value.manifest.orderedChildren[index];
+			const childRequest = input.orderedChildren[index];
+			if (!manifestChild || !childRequest) throw new Error("lane enrollment revocation child ordering is incomplete");
+			const product = productsByOperation.get(String(manifestChild.operationId));
+			if (!product) throw new Error(`lane enrollment revocation product is missing ${String(manifestChild.operationId)}`);
+			assertAggregateChildMatches(command, manifestChild, product, childRequest);
+			if ((await this.options.laneLifecycle.revokeSigningLaneV1(childRequest)).outcome === "conflict") throw new Error(`lane enrollment child revocation conflicted for ${String(manifestChild.operationId)}`);
+		}
+		return await this.options.enrollmentRevocation.completeLaneEnrollmentRevocationV1({
+			command,
+			expectedVersion: fenced.version
+		});
+	}
+};
+function indexProducts(products) {
+	const indexed = /* @__PURE__ */ new Map();
+	for (const product of products) {
+		const key = String(product.operationId);
+		if (indexed.has(key)) throw new Error("lane enrollment product operation ids are duplicated");
+		indexed.set(key, product);
+	}
+	return indexed;
+}
+function assertAggregateChildMatches(parent, manifest, product, request) {
+	const command = request.command;
+	const expectedCurve = manifest.keyFamily === "ed25519" ? "ed25519_yao" : "ecdsa_additive";
+	if (request.curve !== expectedCurve || command.walletId !== parent.walletId || command.walletKeyId !== manifest.walletKeyId || command.laneId !== manifest.targetLaneId || command.laneShareEpoch !== manifest.targetLaneShareEpoch || command.requestedAtMs !== parent.requestedAtMs || command.reason !== childReason(parent.reason) || product.enrollmentId !== parent.enrollmentId || product.operationId !== manifest.operationId || product.walletId !== parent.walletId || product.walletKeyId !== manifest.walletKeyId || product.keyFamily !== manifest.keyFamily || product.laneId !== manifest.targetLaneId || product.laneShareEpoch !== manifest.targetLaneShareEpoch || product.targetMaterialActivationId !== manifest.targetMaterialActivationId || product.holderParticipant.participantBindingDigestB64u !== manifest.holderParticipantBindingDigestB64u || product.signingWorkerParticipant.participantBindingDigestB64u !== manifest.signingWorkerParticipantBindingDigestB64u || command.expectedRevocationEpoch !== expectedSourceRevocationEpoch(product)) throw new Error("lane enrollment child revocation differs from its admitted product");
+	if ((product.state === "revocation_pending" || product.state === "revoked") && product.retirementEffectBindingDigestB64u !== command.retirementEffectBindingDigestB64u) throw new Error("lane enrollment child revocation changed its authorized effect binding");
+}
+function expectedSourceRevocationEpoch(product) {
+	switch (product.state) {
+		case "pending_visibility":
+		case "active": return product.revocationEpoch;
+		case "revocation_pending":
+		case "revoked":
+			if (product.revocationEpoch < 1) throw new Error("lane enrollment child revocation epoch is invalid");
+			return product.revocationEpoch - 1;
+		case "retired": throw new Error("retired lane products cannot be revoked through an active enrollment");
+	}
+}
+function childReason(reason) {
+	switch (reason) {
+		case "user_revoked": return "user_revoked";
+		case "device_compromise": return "device_compromise";
+		case "agent_compromise": return "agent_compromise";
+		case "cancelled_after_commit":
+		case "expired_after_commit":
+		case "revoked_during_activation": return "policy_revoked";
+	}
+}
+//#endregion
+export { LaneAggregateRevocationApplicationService };
+
+//# sourceMappingURL=LaneAggregateRevocationApplicationService.js.map