@seams/wallet-server 0.6.1 → 0.7.1

package/cloudflare-router-ab/scripts/bootstrap-local-tenant-root.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 
 import {
@@ -22,21 +22,18 @@ async function main() {
   if (!identityResult.ok) {
     throw new Error('Local tenant-root bootstrap identity is invalid');
   }
-  const localKeys = resolveLocalTenantRootKeyMaterial({
-    repoRoot: options.repoRoot,
-    localEnvRoot: options.localRoot,
-  });
+  // A VM deployment keeps its grant authority in the operator env file the
+  // Rust materializer writes; the local Worker stack derives it from its issuer
+  // key material.
+  const localKeys = options.grantAuthorityEnvPath
+    ? { grantAuthority: grantAuthorityFromOperatorEnv(options.grantAuthorityEnvPath) }
+    : resolveLocalTenantRootKeyMaterial({
+        repoRoot: options.repoRoot,
+        localEnvRoot: options.localRoot,
+        issuerEnvPath: options.issuerEnvPath,
+      });
   const routerEnv = readEnvMap(path.join(options.localRoot, '.env.router-ab.router.local'));
-  const issuedAtMs = Math.max(1, Date.now() - 1);
-  const grant = await signTenantRootCreationGrantV1({
-    identity: identityResult.value,
-    custodyLineage: randomTenantRootCreationGrantBytesV1(16),
-    grantNonce: randomTenantRootCreationGrantBytesV1(32),
-    issuedAtMs,
-    expiresAtMs: issuedAtMs + 300_000,
-    grantKeyId: localKeys.grantAuthority.keyId,
-    signingSeedB64u: localKeys.grantAuthority.signingSeedB64u,
-  });
+  const grantB64u = await resolveCreationGrant(options, identityResult.value, localKeys);
   const response = await fetch(new URL(TENANT_ROOT_CREATION_PATH, options.routerUrl), {
     method: 'POST',
     headers: {
@@ -46,7 +43,7 @@ async function main() {
         'ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET',
       ),
     },
-    body: JSON.stringify({ creation_grant_b64u: grant.grantB64u }),
+    body: JSON.stringify({ creation_grant_b64u: grantB64u }),
   });
   const body = await response.text();
   if (!response.ok) {
@@ -70,6 +67,9 @@ function parseArguments(args) {
   return {
     repoRoot,
     localRoot: path.resolve(requiredOption(values, '--root')),
+    issuerEnvPath: values.get('--issuer-env-path'),
+    grantAuthorityEnvPath: values.get('--grant-authority-env'),
+    grantFile: values.get('--grant-file'),
     routerUrl: requiredUrl(values.get('--router-url') ?? 'http://127.0.0.1:4102'),
     identity: {
       orgId: requiredOption(values, '--org-id'),
@@ -85,6 +85,9 @@ function usage() {
   return [
     'Usage: bootstrap-local-tenant-root.mjs',
     '  --root <local-runtime-directory>',
+    '  [--issuer-env-path <private-issuer-env-file>]',
+    '  [--grant-authority-env <operator-env-file>]',
+    '  [--grant-file <private-grant-file-inside-root>]',
     '  --org-id <organization-id>',
     '  --project-id <project-id>',
     '  --env-id <environment-id>',
@@ -94,6 +97,68 @@ function usage() {
   ].join(' ');
 }
 
+async function resolveCreationGrant(options, identity, localKeys) {
+  if (!options.grantFile) return (await signNewGrant(identity, localKeys)).grantB64u;
+  const filePath = path.resolve(options.grantFile);
+  const relativePath = path.relative(options.localRoot, filePath);
+  if (!relativePath || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+    throw new Error('Grant file must be inside the local identity root');
+  }
+  if (existsSync(filePath)) {
+    if ((statSync(filePath).mode & 0o077) !== 0) {
+      throw new Error('Existing tenant-root grant file is exposed');
+    }
+    const stored = JSON.parse(readFileSync(filePath, 'utf8'));
+    if (
+      JSON.stringify(stored.identity) !== JSON.stringify(options.identity) ||
+      stored.grantKeyId !== localKeys.grantAuthority.keyId ||
+      typeof stored.grantB64u !== 'string' ||
+      !stored.grantB64u
+    ) {
+      throw new Error('Existing tenant-root grant does not match this identity or authority');
+    }
+    if (!Number.isSafeInteger(stored.expiresAtMs) || Date.now() >= stored.expiresAtMs) {
+      throw new Error('Tenant-root grant expired; reconcile Router state before a new attempt');
+    }
+    return stored.grantB64u;
+  }
+  const created = await signNewGrant(identity, localKeys);
+  mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  process.umask(0o077);
+  writeFileSync(filePath, `${JSON.stringify({
+    identity: options.identity,
+    grantKeyId: localKeys.grantAuthority.keyId,
+    grantB64u: created.grantB64u,
+    expiresAtMs: created.expiresAtMs,
+  })}\n`, { flag: 'wx', mode: 0o600 });
+  return created.grantB64u;
+}
+
+async function signNewGrant(identity, localKeys) {
+  const issuedAtMs = Math.max(1, Date.now() - 1);
+  const expiresAtMs = issuedAtMs + 300_000;
+  const grant = await signTenantRootCreationGrantV1({
+    identity,
+    custodyLineage: randomTenantRootCreationGrantBytesV1(16),
+    grantNonce: randomTenantRootCreationGrantBytesV1(32),
+    issuedAtMs,
+    expiresAtMs,
+    grantKeyId: localKeys.grantAuthority.keyId,
+    signingSeedB64u: localKeys.grantAuthority.signingSeedB64u,
+  });
+  return { grantB64u: grant.grantB64u, expiresAtMs };
+}
+
+function grantAuthorityFromOperatorEnv(filePath) {
+  const operatorEnv = readEnvMap(path.resolve(filePath));
+  const keyId = operatorEnv.get('LOCAL_TENANT_ROOT_GRANT_KEY_ID');
+  const signingSeedB64u = operatorEnv.get('LOCAL_TENANT_ROOT_GRANT_SIGNING_KEY');
+  if (!keyId || !signingSeedB64u) {
+    throw new Error('Operator env file does not carry the tenant-root grant authority');
+  }
+  return Object.freeze({ keyId, signingSeedB64u });
+}
+
 function requiredOption(values, name) {
   const value = values.get(name);
   if (!value) throw new Error(usage());

package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs

@@ -1,5 +1,5 @@
-import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto';
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { createHash, createPrivateKey, createPublicKey, randomBytes, sign } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
@@ -50,6 +50,9 @@ const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
 const LOCAL_CEREMONY_JWT_AUDIENCE = 'router-ab';
 const LOCAL_CEREMONY_JWT_KEY_ID = 'local-router-ab-r1';
 const LOCAL_KEY_EPOCH = 'epoch-1';
+const workerBuildDirectory = process.env.ROUTER_AB_WORKER_BUILD_PROFILE === 'dev'
+  ? 'build/dev'
+  : 'build';
 
 export function prepareLocalHostedWalletGatewayConfig(input) {
   const repoRoot = path.resolve(input.repoRoot);
@@ -95,6 +98,9 @@ export function prepareLocalHostedWalletGatewayConfig(input) {
   writeFileSync(outputConfigPath, config);
 
   const internalAuthSecret = requiredEnv(routerEnv, 'ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET');
+  const gatewayToRouterAuthSecret = readOrCreateLocalGatewayToRouterAuthSecret(localEnvRoot);
+  const gatewayToSigningWorkerPresignAuthSecret =
+    readOrCreateLocalGatewayToSigningWorkerPresignAuthSecret(localEnvRoot);
   const secretValues = {
     ACCOUNT_ID_DERIVATION_SECRET: localSecret(internalAuthSecret, 'account-id-derivation'),
     GOOGLE_OIDC_CLIENT_ID: optionalText(input.googleOidcClientId),
@@ -114,6 +120,9 @@ export function prepareLocalHostedWalletGatewayConfig(input) {
       signingWorkerEnv,
     }),
     ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET: internalAuthSecret,
+    ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET: gatewayToRouterAuthSecret,
+    ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET:
+      gatewayToSigningWorkerPresignAuthSecret,
     ROUTER_AB_NORMAL_SIGNING_WORKER_ID: requiredEnv(routerEnv, 'SIGNING_WORKER_ID'),
     ROUTER_AB_PUBLIC_KEYSET_JSON: localPublicKeysetJson({
       routerEnv,
@@ -262,6 +271,45 @@ function localSecret(seed, purpose) {
     .digest('base64url');
 }
 
+function readOrCreateLocalGatewayToRouterAuthSecret(localEnvRoot) {
+  return readOrCreateLocalGatewayAuthSecret(
+    localEnvRoot,
+    'gateway-router-auth.secret',
+    'Gateway-to-Router auth secret',
+  );
+}
+
+function readOrCreateLocalGatewayToSigningWorkerPresignAuthSecret(localEnvRoot) {
+  return readOrCreateLocalGatewayAuthSecret(
+    localEnvRoot,
+    'gateway-signing-worker-presign-auth.secret',
+    'Gateway-to-SigningWorker presign auth secret',
+  );
+}
+
+function readOrCreateLocalRouterToSigningWorkerEcdsaAuthSecret(localEnvRoot) {
+  return readOrCreateLocalGatewayAuthSecret(
+    localEnvRoot,
+    'router-signing-worker-ecdsa-auth.secret',
+    'Router-to-SigningWorker ECDSA auth secret',
+  );
+}
+
+function readOrCreateLocalGatewayAuthSecret(localEnvRoot, fileName, label) {
+  const secretPath = path.join(
+    localEnvRoot,
+    '.runtime',
+    'wallet-gateway',
+    fileName,
+  );
+  mkdirSync(path.dirname(secretPath), { recursive: true, mode: 0o700 });
+  if (!existsSync(secretPath)) {
+    writeFileSync(secretPath, `${randomBytes(32).toString('base64url')}\n`, { mode: 0o600 });
+  }
+  chmodSync(secretPath, 0o600);
+  return requireNonEmptyInput(readFileSync(secretPath, 'utf8').trim(), label);
+}
+
 function renderDevVars(values) {
   return `${Object.entries(values)
     .filter(([, value]) => value)
@@ -291,6 +339,11 @@ export function prepareRouterAbStrictLocalRuntimeConfigs(input) {
     input.outputRoot ?? path.join(localEnvRoot, '.runtime', 'router-ab-strict'),
   );
   const routerEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.router.local'));
+  const gatewayToRouterAuthSecret = readOrCreateLocalGatewayToRouterAuthSecret(localEnvRoot);
+  const gatewayToSigningWorkerPresignAuthSecret =
+    readOrCreateLocalGatewayToSigningWorkerPresignAuthSecret(localEnvRoot);
+  const routerToSigningWorkerEcdsaAuthSecret =
+    readOrCreateLocalRouterToSigningWorkerEcdsaAuthSecret(localEnvRoot);
   const deriverAEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.deriver-a.local'));
   const deriverBEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.deriver-b.local'));
   const signingWorkerEnv = readEnvMap(
@@ -299,6 +352,7 @@ export function prepareRouterAbStrictLocalRuntimeConfigs(input) {
   const tenantRootKeys = resolveLocalTenantRootKeyMaterial({
     repoRoot,
     localEnvRoot,
+    issuerEnvPath: input.tenantRootIssuerEnvPath,
   });
   const privateD1Keys = Object.freeze({
     deriverA: deriveLocalPrivateD1KeyPair(
@@ -330,12 +384,45 @@ export function prepareRouterAbStrictLocalRuntimeConfigs(input) {
     const mainPath = path
       .relative(
         outputRoot,
-        path.join(runtimeRoot, 'build', role, 'worker', 'shim.mjs'),
+        path.join(runtimeRoot, workerBuildDirectory, role, 'worker', 'shim.mjs'),
       )
       .split(path.sep)
       .join('/');
     let config = stripBuildSection(readFileSync(sourcePath, 'utf8'));
     config = replaceTomlAssignment(config, 'main', mainPath);
+    if (role === 'deriver-b' && process.env.ROUTER_AB_WALLET_DO_HARNESS === 'enabled') {
+      config = config.replace(
+        '[[services]]',
+        `[[durable_objects.bindings]]
+name = "DERIVER_B_WALLET_DO"
+class_name = "RouterAbDeriverBWalletDurableObject"
+
+[[migrations]]
+tag = "r150-deriver-b-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverBWalletDurableObject"]
+
+[[services]]`,
+      );
+    }
+    if (role === 'signing-worker' && process.env.ROUTER_AB_WALLET_DO_HARNESS === 'enabled') {
+      const presignBinding = '  { name = "SIGNING_WORKER_PRESIGN_SESSION_DO", class_name = "RouterAbSigningWorkerPresignSessionDurableObject" },';
+      if (!config.includes(presignBinding)) {
+        throw new Error('SigningWorker presign object binding is missing');
+      }
+      config = config.replace(
+        presignBinding,
+        `${presignBinding}
+  { name = "SIGNING_WORKER_WALLET_DO", class_name = "RouterAbSigningWorkerWalletDurableObject" },`,
+      );
+      config = config.replace(
+        '[vars]',
+        `[[migrations]]
+tag = "r150-signing-worker-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbSigningWorkerWalletDurableObject"]
+
+[vars]`,
+      );
+    }
     config = applyRoleVars(config, role, {
       sdkRouterUrl,
       routerEnv,
@@ -356,6 +443,9 @@ export function prepareRouterAbStrictLocalRuntimeConfigs(input) {
       secretPath,
       strictRoleSecretFile(role, {
         routerEnv,
+        gatewayToRouterAuthSecret,
+        gatewayToSigningWorkerPresignAuthSecret,
+        routerToSigningWorkerEcdsaAuthSecret,
         deriverAEnv,
         deriverBEnv,
         signingWorkerEnv,
@@ -705,7 +795,12 @@ function strictRoleSecretFile(role, env) {
   )}`;
   switch (role) {
     case 'router':
-      return `${internalAuthSecret}\n`;
+      return [
+        internalAuthSecret,
+        `ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET=${env.gatewayToRouterAuthSecret}`,
+        `ROUTER_AB_ROUTER_TO_SIGNING_WORKER_ECDSA_AUTH_SECRET=${env.routerToSigningWorkerEcdsaAuthSecret}`,
+        '',
+      ].join('\n');
     case 'deriver-a':
       return [
         internalAuthSecret,
@@ -753,6 +848,8 @@ function strictRoleSecretFile(role, env) {
     case 'signing-worker':
       return [
         internalAuthSecret,
+        `ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET=${env.gatewayToSigningWorkerPresignAuthSecret}`,
+        `ROUTER_AB_ROUTER_TO_SIGNING_WORKER_ECDSA_AUTH_SECRET=${env.routerToSigningWorkerEcdsaAuthSecret}`,
         `SIGNING_WORKER_SERVER_OUTPUT_HPKE_PRIVATE_KEY=${versionedHexSecret(
           requiredEnv(env.signingWorkerEnv, 'SIGNING_WORKER_SERVER_OUTPUT_HPKE_PRIVATE_KEY'),
           'hpke-x25519-server-output-private-v1:',
@@ -843,11 +940,7 @@ export function resolveLocalTenantRootKeyMaterial(input) {
   const repoRoot = path.resolve(input.repoRoot);
   const localEnvRoot = path.resolve(input.localEnvRoot ?? repoRoot);
   const controlPlaneEnv = readEnvMap(
-    path.join(
-      runtimeRoot,
-      'env',
-      'tenant-root-control-plane.local.example',
-    ),
+    input.issuerEnvPath ?? path.join(runtimeRoot, 'env', 'tenant-root-control-plane.local.example'),
   );
   const deriverAEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.deriver-a.local'));
   const deriverBEnv = readEnvMap(path.join(localEnvRoot, '.env.router-ab.deriver-b.local'));

package/cloudflare-router-ab/scripts/start-local-role-workers.mjs

@@ -11,6 +11,9 @@ import { prepareRouterAbStrictLocalRuntimeConfigs } from './prepare-local-runtim
 
 const repoRoot = process.cwd();
 const runtimeRoot = fileURLToPath(new URL('../', import.meta.url));
+const workerBuildDirectory = process.env.ROUTER_AB_WORKER_BUILD_PROFILE === 'dev'
+  ? 'build/dev'
+  : 'build';
 const options = parseArguments(process.argv.slice(2));
 const localRoot = path.resolve(
   options.root || path.join(tmpdir(), `${path.basename(repoRoot)}-wallet-router-ab`),
@@ -117,7 +120,7 @@ function assertWorkerArtifacts() {
 }
 
 function workerArtifactPath(role) {
-  return path.join(runtimeRoot, 'build', role, 'worker', 'shim.mjs');
+  return path.join(runtimeRoot, workerBuildDirectory, role, 'worker', 'shim.mjs');
 }
 
 function isMissingPath(filePath) {

package/cloudflare-router-ab/wrangler.deriver-a.toml

@@ -24,6 +24,14 @@ name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 script_name = "router-ab-mpc-router"
 
+[[durable_objects.bindings]]
+name = "DERIVER_A_WALLET_DO"
+class_name = "RouterAbDeriverAWalletDurableObject"
+
+[[migrations]]
+tag = "r150-deriver-a-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverAWalletDurableObject"]
+
 [[services]]
 binding = "DERIVER_B"
 service = "router-ab-deriver-b"
@@ -59,6 +67,14 @@ name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 script_name = "router-ab-mpc-router-staging"
 
+[[env.staging.durable_objects.bindings]]
+name = "DERIVER_A_WALLET_DO"
+class_name = "RouterAbDeriverAWalletDurableObject"
+
+[[env.staging.migrations]]
+tag = "r150-deriver-a-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverAWalletDurableObject"]
+
 [[env.staging.services]]
 binding = "DERIVER_B"
 service = "router-ab-deriver-b-staging"
@@ -97,6 +113,14 @@ name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 script_name = "router-ab-mpc-router-testnet"
 
+[[env.production-testnet.durable_objects.bindings]]
+name = "DERIVER_A_WALLET_DO"
+class_name = "RouterAbDeriverAWalletDurableObject"
+
+[[env.production-testnet.migrations]]
+tag = "r150-deriver-a-wallet-sqlite-v1"
+new_sqlite_classes = ["RouterAbDeriverAWalletDurableObject"]
+
 [[env.production-testnet.services]]
 binding = "DERIVER_B"
 service = "router-ab-deriver-b-testnet"

package/cloudflare-router-ab/wrangler.router.toml

@@ -7,12 +7,17 @@ workers_dev = false
 [durable_objects]
 bindings = [
   { name = "ROUTER_TENANT_ROOT_CREATION_DO", class_name = "RouterAbTenantRootCreationDurableObject" },
+  { name = "ROUTER_WALLET_DO", class_name = "RouterAbRouterWalletDurableObject" },
 ]
 
 [[migrations]]
 tag = "router_ab_router_tenant_root_creation_v1"
 new_sqlite_classes = ["RouterAbTenantRootCreationDurableObject"]
 
+[[migrations]]
+tag = "router_ab_router_wallet_v1"
+new_sqlite_classes = ["RouterAbRouterWalletDurableObject"]
+
 [[services]]
 binding = "DERIVER_A"
 service = "router-ab-deriver-a"
@@ -48,6 +53,10 @@ workers_dev = true
 name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 
+[[env.staging.durable_objects.bindings]]
+name = "ROUTER_WALLET_DO"
+class_name = "RouterAbRouterWalletDurableObject"
+
 [[env.staging.services]]
 binding = "DERIVER_A"
 service = "router-ab-deriver-a-staging"
@@ -89,6 +98,10 @@ workers_dev = true
 name = "ROUTER_TENANT_ROOT_CREATION_DO"
 class_name = "RouterAbTenantRootCreationDurableObject"
 
+[[env.production-testnet.durable_objects.bindings]]
+name = "ROUTER_WALLET_DO"
+class_name = "RouterAbRouterWalletDurableObject"
+
 [[env.production-testnet.services]]
 binding = "DERIVER_A"
 service = "router-ab-deriver-a-testnet"

package/dist/esm/authorization/capabilityPolicy.js

@@ -91,6 +91,6 @@ function assertNeverRequirementMode(value) {
 	throw new Error(`unsupported authorization evidence requirement mode: ${String(value)}`);
 }
 //#endregion
-export { capabilityPolicyPort, evaluateAuthorizationEvidenceRequirement, parseAuthorizationEvidenceRequirement };
+export { capabilityPolicyPort, evaluateAuthorizationEvidenceRequirement };
 
 //# sourceMappingURL=capabilityPolicy.js.map

package/dist/esm/authorization/domain.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
 import "../shared-ts/src/utils/encoders.js";
-import { parseActiveWalletSessionV1 } from "../shared-ts/src/device-linking/parsers.js";
+import { parseActiveWalletSessionV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import "../shared-ts/src/device-linking/index.js";
 //#region src/authorization/domain.ts
 function buildExactWalletSessionQuotaProjectionV1(fields) {

package/dist/esm/authorization/factorEvidence.js

@@ -1,12 +1,8 @@
-import { parseProviderSubject, parseWalletId } from "../shared-ts/src/utils/domainIds.js";
-import { AUTHORIZATION_EVIDENCE_KINDS, isAuthorizationEvidenceKind, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseCapabilityOperationRef, parsePrincipalId, parseTenantId } from "../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
+import { parseProviderSubject } from "../shared-ts/src/utils/domainIds.js";
+import { AUTHORIZATION_EVIDENCE_KINDS } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { alphabetizeStringify } from "../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
-import "../shared-ts/src/utils/encoders.js";
-import { parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseSessionOrigin } from "./domain.js";
 //#region src/authorization/factorEvidence.ts
 const FACTOR_EVIDENCE_DIGEST_DOMAIN_V1 = "seams:authorization:factor-evidence:v1";
 const EVIDENCE_SET_DIGEST_DOMAIN_V1 = "seams:authorization:evidence-set:v1";
@@ -165,53 +161,6 @@ async function buildVerifiedWalletOperationFactorEvidenceSet(input) {
 		expiresAtMs: input.factor.expiresAtMs
 	});
 }
-function parseVerifiedAuthorizationEvidenceSetFromPersistence(raw) {
-	return parseVerifiedWalletOperationEvidenceSetFromPersistence(raw);
-}
-function parseVerifiedWalletOperationEvidenceSetFromPersistence(raw) {
-	const record = requireExactRecord(raw, [
-		"kind",
-		"tenantId",
-		"principalId",
-		"walletId",
-		"authorityRef",
-		"requestOrigin",
-		"audience",
-		"evidenceSetId",
-		"evidence",
-		"evidenceSetDigest",
-		"operation",
-		"laneDigest",
-		"intentDigest",
-		"displayDigest",
-		"assurance",
-		"verifiedAtMs",
-		"expiresAtMs"
-	]);
-	if (record.kind !== "verified_wallet_operation_evidence_set" || record.assurance !== "step_up") throw new Error("persisted wallet operation evidence set kind is invalid");
-	const authorityRef = parseWalletAuthAuthorityRef(record.authorityRef);
-	if (!authorityRef) throw new Error("persisted wallet operation evidence authority is invalid");
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok) throw new Error("persisted wallet operation evidence wallet is invalid");
-	return new VerifiedWalletOperationEvidenceSetProof({
-		tenantId: parseAuthorizationField(record.tenantId, parseTenantId, "tenantId"),
-		principalId: parseAuthorizationField(record.principalId, parsePrincipalId, "principalId"),
-		walletId: walletId.value,
-		authorityRef,
-		requestOrigin: parseSessionOrigin(record.requestOrigin),
-		audience: parseSessionOrigin(record.audience),
-		evidenceSetId: parseAuthorizationField(record.evidenceSetId, parseAuthorizationEvidenceSetId, "evidenceSetId"),
-		evidence: parsePersistedEvidence(record.evidence),
-		evidenceSetDigest: parsePersistenceDigest(record.evidenceSetDigest, "evidenceSetDigest"),
-		operation: parseAuthorizationField(record.operation, parseCapabilityOperationRef, "operation"),
-		laneDigest: parsePersistenceDigest(record.laneDigest, "laneDigest"),
-		intentDigest: parsePersistenceDigest(record.intentDigest, "intentDigest"),
-		displayDigest: parsePersistenceDigest(record.displayDigest, "displayDigest"),
-		assurance: "step_up",
-		verifiedAtMs: requirePositiveSafeInteger(record.verifiedAtMs, "verifiedAtMs"),
-		expiresAtMs: requirePositiveSafeInteger(record.expiresAtMs, "expiresAtMs")
-	});
-}
 async function requireExactWalletOperationFactorBinding(input) {
 	const factor = input.factor;
 	if (factor.tenantId !== input.operation.tenantId || factor.principalId !== input.operation.principalId || factor.authorityRef.walletId !== factor.walletId) throw new Error("verified factor does not match the wallet operation identity");
@@ -345,7 +294,7 @@ async function digestCanonicalEvidenceSet(value) {
 	return await digestCanonical(EVIDENCE_SET_DIGEST_DOMAIN_V1, value);
 }
 async function digestCanonical(domain, value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${domain}|${alphabetizeStringify(value)}`)));
+	return sha256Utf8DigestB64u(`${domain}|${alphabetizeStringify(value)}`);
 }
 function requireWalletOperationEvidenceSetFields(fields) {
 	if (fields.authorityRef.walletId !== fields.walletId) throw new Error("wallet operation evidence authority must identify the wallet");
@@ -356,50 +305,7 @@ function requireWalletOperationEvidenceSetFields(fields) {
 function evidenceIdFromEvidence(evidence) {
 	return evidence.evidenceId;
 }
-function parsePersistedEvidence(raw) {
-	if (!Array.isArray(raw) || raw.length === 0) throw new Error("persisted evidence set requires evidence");
-	const [first, ...remaining] = raw.map(parsePersistedEvidenceEntry);
-	if (!first) throw new Error("persisted evidence set requires evidence");
-	return [first, ...remaining];
-}
-function parsePersistedEvidenceEntry(raw) {
-	const record = requireExactRecord(raw, [
-		"evidenceId",
-		"evidenceKind",
-		"evidenceDigest"
-	]);
-	if (!isAuthorizationEvidenceKind(record.evidenceKind)) throw new Error("persisted evidence kind is invalid");
-	return {
-		evidenceId: parseAuthorizationField(record.evidenceId, parseAuthorizationEvidenceId, "evidenceId"),
-		evidenceKind: record.evidenceKind,
-		evidenceDigest: parsePersistenceDigest(record.evidenceDigest, "evidenceDigest")
-	};
-}
-function parseAuthorizationField(raw, parser, field) {
-	const parsed = parser(raw);
-	if (!parsed.ok) throw new Error(`persisted evidence set ${field} is invalid: ${parsed.error.message}`);
-	return parsed.value;
-}
-function parsePersistenceDigest(raw, field) {
-	try {
-		return parseDigestB64u(raw);
-	} catch {
-		throw new Error(`persisted evidence set ${field} is invalid`);
-	}
-}
-function requirePositiveSafeInteger(raw, field) {
-	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`persisted evidence set ${field} must be a positive safe integer`);
-	return Number(raw);
-}
-function requireExactRecord(raw, fields) {
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("persisted evidence set must be an object");
-	const record = raw;
-	const keys = Object.keys(record);
-	if (keys.length !== fields.length) throw new Error("persisted evidence set fields are invalid");
-	for (const key of keys) if (!fields.includes(key)) throw new Error("persisted evidence set fields are invalid");
-	return record;
-}
 //#endregion
-export { buildVerifiedOwnerProof, buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationFactorEvidenceSet, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult, parseVerifiedAuthorizationEvidenceSetFromPersistence };
+export { buildVerifiedOwnerProof, buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationFactorEvidenceSet, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult };
 
 //# sourceMappingURL=factorEvidence.js.map

package/dist/esm/authorization/service.js

@@ -1,9 +1,9 @@
 import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
 import "../shared-ts/src/utils/encoders.js";
-import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/parsers.js";
+import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildActiveWalletSessionQuota, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, walletSessionCapabilitySubjectsV1Equal } from "./domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletOperationFactorEvidenceSet } from "./factorEvidence.js";
 import { secureRandomBase64Url } from "../shared-ts/src/utils/secureRandomId.js";
@@ -90,6 +90,12 @@ var AuthorizationService = class {
 	async admitAuthorizedOperation(input) {
 		return await this.ports.authorizedOperations.admitAuthorizedOperation(input);
 	}
+	async prepareAuthorizedOperationAdmission(input) {
+		return await this.ports.authorizedOperations.prepareAuthorizedOperationAdmission(input);
+	}
+	classifyAuthorizedOperationAdmissionFailure(error) {
+		return this.ports.authorizedOperations.classifyAuthorizedOperationAdmissionFailure(error);
+	}
 	async completeAuthorizedOperation(input) {
 		return await this.ports.authorizedOperations.completeAuthorizedOperation(input);
 	}
@@ -223,6 +229,14 @@ var AuthorizationService = class {
 			nowMs: input.nowMs
 		});
 	}
+	/** The session, its authority and its auth method from one read. */
+	async readWalletSessionAdmissionSnapshotByOperationCredential(input) {
+		return await this.ports.grants.readWalletSessionAdmissionSnapshotByOperationCredential({
+			tenantId: input.tenantId,
+			tokenHash: await digestOpaqueValue(input.token),
+			nowMs: input.nowMs
+		});
+	}
 	async readLiveWalletSessionAuthorizationProjectionByCredential(input) {
 		const status = await this.readExactWalletSessionStatusByOperationCredential(input);
 		if (status.kind !== "active" && status.kind !== "exhausted") return null;
@@ -262,6 +276,24 @@ var AuthorizationService = class {
 			nowMs: input.nowMs
 		});
 	}
+	/** The exact status with the authority and auth method it was judged against. */
+	async readExactWalletSessionStatusSnapshotByOperationCredential(input) {
+		let token;
+		try {
+			token = parsePrimaryWalletSessionOperationCredentialToken(input.token);
+		} catch {
+			return {
+				status: { kind: "missing" },
+				authority: null,
+				authMethod: null
+			};
+		}
+		return await this.ports.grants.readExactWalletSessionStatusSnapshotByOperationCredential({
+			tenantId: input.tenantId,
+			tokenHash: await digestOpaqueValue(token),
+			nowMs: input.nowMs
+		});
+	}
 	async readHostedWalletSessionOperationCredentialV2(input) {
 		if (!/^wsh_[A-Za-z0-9_-]{43}$/.test(input.token)) return null;
 		return await this.ports.sessions.readHostedWalletSessionOperationCredentialV2({