@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js

@@ -0,0 +1,136 @@
+import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.ts
+const NONCE_TABLE = "linked_device_request_proof_nonces";
+const NONCE_EXPIRY_CLEANUP_BATCH_LIMIT_V1 = 64;
+var D1LinkedDeviceRequestProofNonceStoreV1 = class {
+	constructor(options) {
+		this.database = options.database;
+		this.scope = normalizeScope(options.scope);
+	}
+	async consumeRequestProofNonceV1(input) {
+		const normalized = parseNonceRecord({
+			linkSessionId: input.linkSessionId,
+			requestNonceB64u: input.requestNonceB64u,
+			proofDigestB64u: input.proofDigestB64u,
+			issuedAtMs: input.issuedAtMs,
+			expiresAtMs: input.expiresAtMs,
+			consumedAtMs: input.consumedAtMs
+		});
+		await this.pruneExpiredNoncesV1(normalized.consumedAtMs);
+		try {
+			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${NONCE_TABLE} (
+             namespace, org_id, project_id, env_id,
+             link_session_id, request_nonce_b64u, proof_digest_b64u,
+             issued_at_ms, expires_at_ms, consumed_at_ms
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), String(normalized.linkSessionId), normalized.requestNonceB64u, normalized.proofDigestB64u, normalized.issuedAtMs, normalized.expiresAtMs, normalized.consumedAtMs).run()) === 1) return { outcome: "consumed" };
+			throw new Error("device request proof nonce insert did not persist");
+		} catch (error) {
+			if (!isUniqueConstraintError(error)) throw error;
+			if (!await this.readNonceV1(normalized.linkSessionId, normalized.requestNonceB64u)) throw error;
+			return { outcome: "already_used" };
+		}
+	}
+	async pruneExpiredNoncesV1(nowMs) {
+		try {
+			await this.database.prepare(`WITH expired AS (
+             SELECT rowid
+               FROM ${NONCE_TABLE}
+              WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+                AND expires_at_ms <= ?
+              ORDER BY expires_at_ms ASC, link_session_id ASC, request_nonce_b64u ASC
+              LIMIT ?
+           )
+           DELETE FROM ${NONCE_TABLE}
+            WHERE rowid IN (SELECT rowid FROM expired)`).bind(...scopeValues(this.scope), nowMs, NONCE_EXPIRY_CLEANUP_BATCH_LIMIT_V1).run();
+		} catch {}
+	}
+	async readNonceV1(linkSessionId, requestNonceB64u) {
+		const row = await this.database.prepare(`SELECT link_session_id, request_nonce_b64u, proof_digest_b64u,
+                issued_at_ms, expires_at_ms, consumed_at_ms
+           FROM ${NONCE_TABLE}
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND link_session_id = ? AND request_nonce_b64u = ?
+          LIMIT 1`).bind(...scopeValues(this.scope), String(linkSessionId), requestNonceB64u).first();
+		if (!row) return null;
+		return parseNonceRowV1(row);
+	}
+};
+function parseNonceRecord(raw) {
+	const linkSessionId = parseSessionId(raw.linkSessionId);
+	const requestNonceB64u = parseFixedB64u(raw.requestNonceB64u, "requestNonceB64u");
+	const proofDigestB64u = parseDigest(raw.proofDigestB64u, "proofDigestB64u");
+	const issuedAtMs = requirePositiveInteger(raw.issuedAtMs, "issuedAtMs");
+	const expiresAtMs = requirePositiveInteger(raw.expiresAtMs, "expiresAtMs");
+	const consumedAtMs = requirePositiveInteger(raw.consumedAtMs, "consumedAtMs");
+	if (expiresAtMs <= issuedAtMs) throw new Error("expiresAtMs must be after issuedAtMs");
+	if (consumedAtMs < issuedAtMs) throw new Error("consumedAtMs precedes issuedAtMs");
+	if (consumedAtMs >= expiresAtMs) throw new Error("consumedAtMs is at or after expiresAtMs");
+	return {
+		linkSessionId,
+		requestNonceB64u,
+		proofDigestB64u,
+		issuedAtMs,
+		expiresAtMs,
+		consumedAtMs
+	};
+}
+function parseNonceRowV1(row) {
+	return parseNonceRecord({
+		linkSessionId: parseSessionId(requireString(row.link_session_id, "link_session_id")),
+		requestNonceB64u: requireString(row.request_nonce_b64u, "request_nonce_b64u"),
+		proofDigestB64u: parseDigest(row.proof_digest_b64u, "proof_digest_b64u"),
+		issuedAtMs: requirePositiveInteger(row.issued_at_ms, "issued_at_ms"),
+		expiresAtMs: requirePositiveInteger(row.expires_at_ms, "expires_at_ms"),
+		consumedAtMs: requirePositiveInteger(row.consumed_at_ms, "consumed_at_ms")
+	});
+}
+function parseSessionId(raw) {
+	const result = parseLinkDeviceSessionId(raw);
+	if (!result.ok) throw new Error(`linkSessionId is invalid: ${result.error.message}`);
+	return result.value;
+}
+function parseFixedB64u(raw, field) {
+	if (typeof raw !== "string" || !/^[A-Za-z0-9_-]+$/.test(raw)) throw new Error(`${field} is invalid`);
+	const bytes = base64UrlDecode(raw);
+	if (bytes.length !== 32 || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is invalid`);
+	return raw;
+}
+function parseDigest(raw, field) {
+	try {
+		return parseDigestB64u(raw);
+	} catch {
+		throw new Error(`${field} is invalid`);
+	}
+}
+function requireString(raw, field) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${field} is invalid`);
+	return raw;
+}
+function requirePositiveInteger(raw, field) {
+	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^\d+$/.test(raw) ? Number(raw) : NaN;
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${field} is invalid`);
+	return value;
+}
+function normalizeScope(scope) {
+	for (const [field, value] of Object.entries(scope)) if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`invalid linked-device proof scope ${field}`);
+	return { ...scope };
+}
+function scopeValues(scope) {
+	return [
+		scope.namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId
+	];
+}
+function isUniqueConstraintError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return /unique|constraint/i.test(message);
+}
+//#endregion
+export { D1LinkedDeviceRequestProofNonceStoreV1 };
+
+//# sourceMappingURL=d1LinkedDeviceRequestProofNonceStore.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js

@@ -0,0 +1,95 @@
+import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { readJson } from "../../../framework/http.js";
+import { LinkedDeviceRequestProofVerifierV1 } from "../../../../core/deviceLinking/requestProof.js";
+import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519ExportRootStore.js";
+import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
+import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
+import { D1LinkedDeviceSessionStoreV1 } from "./d1LinkedDeviceSessionStore.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.ts
+function createD1LinkedDeviceRouteServiceV1(options) {
+	const nowV1 = options.nowV1 ?? Date.now;
+	const proofVerifier = new LinkedDeviceRequestProofVerifierV1({ nonceStore: new D1LinkedDeviceRequestProofNonceStoreV1({
+		database: options.database,
+		scope: options.scope
+	}) });
+	const { sessionService } = createD1LinkedDeviceSessionServiceV1({
+		sessionStore: new D1LinkedDeviceSessionStoreV1({
+			database: options.database,
+			scope: options.scope,
+			now: nowV1
+		}),
+		ownerAuthorization: options.ownerAuthorization
+	});
+	return {
+		sessionService: {
+			createUnclaimedSessionV1: sessionService.createUnclaimedSessionV1.bind(sessionService),
+			claimSessionV1: sessionService.claimSessionV1.bind(sessionService),
+			recordOwnerApprovalV1: sessionService.recordOwnerApprovalV1.bind(sessionService),
+			recordTargetCredentialV1: sessionService.recordTargetCredentialV1.bind(sessionService),
+			recordSourceContributionV1: sessionService.recordSourceContributionV1.bind(sessionService),
+			recordEmailOtpChallengeStateV1: sessionService.recordEmailOtpChallengeStateV1.bind(sessionService),
+			failBeforeCommitV1: sessionService.failBeforeCommitV1.bind(sessionService),
+			cancelSessionV1: sessionService.cancelSessionV1.bind(sessionService),
+			getSessionV1: sessionService.getSessionV1.bind(sessionService),
+			listSessionsForWalletV1: sessionService.listSessionsForWalletV1.bind(sessionService)
+		},
+		nowV1,
+		...options.emailOtpTargetFactor === void 0 ? {} : { emailOtpTargetFactor: options.emailOtpTargetFactor },
+		ed25519ExportRoot: new D1LinkedDeviceEd25519ExportRootStoreV1({
+			database: options.database,
+			scope: options.scope
+		}),
+		verifyPublicSessionProofV1: async (input) => {
+			const result = await proofVerifier.verifyPublicCreateV1({
+				proof: input.proof,
+				devicePublicKeyB64u: input.payload.devicePublicKeyB64u,
+				devicePublicKeyDigestB64u: input.devicePublicKeyDigestB64u,
+				linkSessionId: input.payload.linkSessionId,
+				method: input.method,
+				canonicalPath: input.canonicalPath,
+				bodyDigestB64u: input.bodyDigestB64u,
+				nowMs: input.requestedAtMs
+			});
+			return result.kind === "authorized" ? result : mapProofDenied(result);
+		},
+		authenticateOwnerRequestV1: options.authenticateOwnerRequestV1,
+		authenticateDeviceRequestV1: async (input) => {
+			const linkSessionId = parseSessionId(input.linkSessionId);
+			const result = await proofVerifier.verifyV1({
+				proof: input.proof,
+				expectedDevicePublicKeyB64u: input.expectedDevicePublicKeyB64u,
+				expectedDevicePublicKeyDigestB64u: input.expectedDevicePublicKeyDigestB64u,
+				expectedLinkSessionId: linkSessionId,
+				expectedMethod: input.method,
+				expectedCanonicalPath: input.pathname,
+				expectedBodyDigestB64u: input.bodyDigestB64u,
+				nowMs: input.requestedAtMs
+			});
+			if (result.kind === "denied") return mapProofDenied(result);
+			return {
+				kind: "authorized",
+				body: input.method === "GET" ? null : await readJson(input.request),
+				proof: input.proof
+			};
+		},
+		targetCredential: options.targetCredential,
+		...options.installationReceipt === void 0 ? {} : { installationReceipt: options.installationReceipt },
+		...options.sourceContributionRouter === void 0 ? {} : { sourceContributionRouter: options.sourceContributionRouter }
+	};
+}
+function parseSessionId(raw) {
+	const result = parseLinkDeviceSessionId(raw);
+	if (!result.ok) throw new Error(`link session id is invalid: ${result.error.message}`);
+	return result.value;
+}
+function mapProofDenied(result) {
+	return {
+		kind: "denied",
+		code: result.code,
+		message: result.message
+	};
+}
+//#endregion
+export { createD1LinkedDeviceRouteServiceV1 };
+
+//# sourceMappingURL=d1LinkedDeviceRouteService.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js

@@ -0,0 +1,91 @@
+import { parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseLinkedDeviceSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.ts
+function parseD1LinkedDeviceSessionRowV1(row) {
+	const record = parseLinkedDeviceSessionRecordV1(parseJson(row.record_json, "record_json"));
+	const linkSessionId = requiredString(row.link_session_id, "link_session_id");
+	const linkPublicKeyB64u = requiredString(row.link_public_key_b64u, "link_public_key_b64u");
+	const devicePublicKeyB64u = requiredString(row.device_public_key_b64u, "device_public_key_b64u");
+	const state = requiredString(row.state, "state");
+	const revision = requiredPositiveInteger(row.revision, "revision");
+	const expiresAtMs = requiredPositiveInteger(row.expires_at_ms, "expires_at_ms");
+	const claimExpiresAtMs = optionalPositiveInteger(row.claim_expires_at_ms, "claim_expires_at_ms");
+	const claimDigestB64u = optionalDigest(row.claim_digest_b64u, "claim_digest_b64u");
+	const approvalDigestB64u = optionalDigest(row.approval_digest_b64u, "approval_digest_b64u");
+	const authorityId = optionalAuthorityId(row.authority_id);
+	const packageSetDigestB64u = optionalDigest(row.package_set_digest_b64u, "package_set_digest_b64u");
+	const createdAtMs = requiredPositiveInteger(row.created_at_ms, "created_at_ms");
+	const updatedAtMs = requiredPositiveInteger(row.updated_at_ms, "updated_at_ms");
+	if (String(record.linkSessionId) !== linkSessionId || record.qrPayload.linkPublicKeyB64u !== linkPublicKeyB64u || record.qrPayload.devicePublicKeyB64u !== devicePublicKeyB64u || record.state.state !== state || record.revision !== revision || record.qrPayload.expiresAtMs !== expiresAtMs || record.createdAtMs !== createdAtMs || record.updatedAtMs !== updatedAtMs) throw new Error("linked-device session columns do not match record_json");
+	const expectedClaimExpiry = record.claimTranscript?.value.claimExpiresAtMs ?? null;
+	if ((claimExpiresAtMs ?? null) !== expectedClaimExpiry) throw new Error("claim expiry column does not match record_json");
+	const expectedClaimDigest = record.claimTranscript?.digestB64u ?? null;
+	const expectedApprovalDigest = record.approvalTranscript?.digestB64u ?? null;
+	if (claimDigestB64u !== expectedClaimDigest || approvalDigestB64u !== expectedApprovalDigest) throw new Error("transcript digest columns do not match record_json");
+	if ((record.authorityId ? String(record.authorityId) : null) !== (authorityId ? String(authorityId) : null)) throw new Error("authority id column does not match record_json");
+	if ((record.packageSetDigestB64u ?? null) !== packageSetDigestB64u) throw new Error("package set digest column does not match record_json");
+	return {
+		record,
+		claimDigestB64u,
+		approvalDigestB64u
+	};
+}
+function parseD1LinkedDeviceSessionTranscriptRowV1(row) {
+	const kind = requiredString(row.transcript_kind, "transcript_kind");
+	if (kind !== "claim" && kind !== "approval" && kind !== "source_contribution") throw new Error("transcript_kind is invalid");
+	return {
+		kind,
+		digestB64u: requiredDigest(row.digest_b64u, "digest_b64u"),
+		transcriptJson: parseJson(row.transcript_json, "transcript_json"),
+		createdAtMs: requiredPositiveInteger(row.created_at_ms, "created_at_ms")
+	};
+}
+function parseJson(raw, field) {
+	if (typeof raw === "string") try {
+		return JSON.parse(raw);
+	} catch {
+		throw new Error(`${field} is invalid JSON`);
+	}
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object`);
+	return raw;
+}
+function requiredString(raw, field) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${field} is invalid`);
+	return raw;
+}
+function optionalAuthorityId(raw) {
+	if (raw === null || raw === void 0) return null;
+	const parsed = parseWalletAuthorityId(raw);
+	if (!parsed.ok) throw new Error("authority_id is invalid");
+	return parsed.value;
+}
+function requiredNonNegativeInteger(raw, field) {
+	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^\d+$/.test(raw) ? Number(raw) : NaN;
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${field} is invalid`);
+	return value;
+}
+function requiredPositiveInteger(raw, field) {
+	const value = requiredNonNegativeInteger(raw, field);
+	if (value < 1) throw new Error(`${field} must be positive`);
+	return value;
+}
+function optionalPositiveInteger(raw, field) {
+	if (raw === null || raw === void 0) return null;
+	return requiredPositiveInteger(raw, field);
+}
+function optionalDigest(raw, field) {
+	if (raw === null || raw === void 0) return null;
+	return requiredDigest(raw, field);
+}
+function requiredDigest(raw, field) {
+	try {
+		return parseDigestB64u(raw);
+	} catch {
+		throw new Error(`${field} is invalid`);
+	}
+}
+//#endregion
+export { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 };
+
+//# sourceMappingURL=d1LinkedDeviceSessionRecords.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.js

@@ -0,0 +1,15 @@
+import { LinkedDeviceSessionServiceV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionService.ts
+function createD1LinkedDeviceSessionServiceV1(options) {
+	return {
+		sessionService: new LinkedDeviceSessionServiceV1({
+			store: options.sessionStore,
+			authorization: options.ownerAuthorization
+		}),
+		sessionStore: options.sessionStore
+	};
+}
+//#endregion
+export { createD1LinkedDeviceSessionServiceV1 };
+
+//# sourceMappingURL=d1LinkedDeviceSessionService.js.map