@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -13,6 +13,17 @@ function requireThresholdEd25519SessionId(value, label) {
 	if (!parsed.ok) throw new Error(`${label} is invalid`);
 	return parsed.value;
 }
+/**
+* A live admission claim older than this is presumed dead. The same attempt
+* takes it over, and a new attempt of the same recovery may supersede it.
+*/
+const RECOVERY_ADMISSION_CLAIM_RESUME_AFTER_MS = 3e4;
+/**
+* A live execution claim older than this is presumed dead: the same attempt
+* replays its payload, and a new attempt of the same recovery may supersede
+* it. It outlasts the Router's longest execution.
+*/
+const RECOVERY_EXECUTION_CLAIM_RESUME_AFTER_MS = 6e4;
 function resolveTraceContext(request) {
 	const parsed = parseRouterAbTraceContextV1(request.headers.get(ROUTER_AB_TRACE_ID_HEADER_V1));
 	if (parsed.ok) return parsed;
@@ -61,10 +72,11 @@ function recoveryAuthorityProjection(authorization) {
 	return authorization.kind === "wallet_recovery" ? { kind: "replace_continuity_authority_projections" } : { kind: "replace_active_authority_projection" };
 }
 var EphemeralRouterAbEd25519YaoCapabilityPersistenceV1 = class {
-	replaceActiveCapability() {
+	prepareActiveCapabilityReplacement() {
 		return {
 			ok: true,
-			disposition: "applied"
+			disposition: "prepared",
+			write: { statements: [] }
 		};
 	}
 };
@@ -509,9 +521,11 @@ function activationReceiptMatches(request, context, receipt) {
 function admittedReceiptForState(state) {
 	switch (state.kind) {
 		case "admitting":
-		case "admission_failed": return null;
+		case "admission_failed":
+		case "superseded": return null;
 		case "admitted":
 		case "executing":
+		case "execution_interrupted":
 		case "execution_failed":
 		case "staged":
 		case "activating":
@@ -528,8 +542,10 @@ function admissionReplayResult(state) {
 			message: "recovery admission is already in progress"
 		});
 		case "admission_failed": return state.failure;
+		case "superseded": return recoverySupersededFailure();
 		case "admitted":
 		case "executing":
+		case "execution_interrupted":
 		case "execution_failed":
 		case "staged":
 		case "activating":
@@ -542,6 +558,52 @@ function admissionReplayResult(state) {
 		default: return assertNever(state);
 	}
 }
+function recoverySupersededFailure() {
+	return recoveryFailure({
+		status: 409,
+		code: "recovery_superseded",
+		message: "a newer attempt of this recovery took its place"
+	});
+}
+/**
+* Whether a new attempt of the same recovery may take the place of
+* `previous`, the attempt holding the capability's suspension. It must be the
+* same recovery, the same lifecycle authorized the same way, and `previous`
+* must not have begun activating: its promotion could already be at the
+* SigningWorker, so it can only be resumed.
+*/
+function supersedesRecoveryAttempt(previous, request, authorization, nowMs) {
+	if (previous.context.admissionRequest.scope.lifecycle_id !== request.scope.lifecycle_id) return false;
+	if (!sameRecoveryAuthorizationBindingV1(previous.context.authorization, authorization)) return false;
+	switch (previous.kind) {
+		case "admission_failed":
+		case "admitted":
+		case "execution_interrupted":
+		case "execution_failed":
+		case "staged": return true;
+		case "admitting": return nowMs - previous.claimedAtMs >= RECOVERY_ADMISSION_CLAIM_RESUME_AFTER_MS;
+		case "executing": return nowMs - previous.claimedAtMs >= RECOVERY_EXECUTION_CLAIM_RESUME_AFTER_MS;
+		case "activating":
+		case "activation_failed":
+		case "promoted":
+		case "superseded": return false;
+		default: return assertNever(previous);
+	}
+}
+/**
+* A Router or SigningWorker answer that ends an execution or promotion
+* without deciding it: a role or the Router was unavailable, another run held
+* the execution, or the call failed in transit. Retrying reconciles it.
+*/
+function isRecoverableRecoveryBackendFailure(result) {
+	switch (result.code) {
+		case "router_execution_retryable":
+		case "execution_in_progress":
+		case "worker_unavailable":
+		case "worker_rejected": return true;
+		default: return false;
+	}
+}
 function executionReplayResult(state, fingerprint) {
 	if (state.executeFingerprint !== fingerprint) return recoveryFailure({
 		status: 409,
@@ -720,7 +782,8 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		};
 	}
 	async admitRecovery(request, authorization, traceContext) {
-		const preparation = this.prepareAdmitRecovery(request, authorization);
+		const dispatchRoot = await this.backend.resolveRecoveryDispatchRoot(request);
+		const preparation = this.prepareAdmitRecovery(request, authorization, dispatchRoot, Date.now());
 		switch (preparation.kind) {
 			case "completed": return {
 				ok: true,
@@ -746,7 +809,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			}
 		}
 	}
-	prepareAdmitRecovery(request, authorization) {
+	prepareAdmitRecovery(request, authorization, dispatchRoot, nowMs) {
 		const parsed = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(request);
 		if (!parsed.ok) return {
 			kind: "failed",
@@ -768,6 +831,21 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				kind: "failed",
 				failure: recoveryAuthorizationMismatchFailure()
 			};
+			if (existingRecovery.kind === "admitting" && nowMs - existingRecovery.claimedAtMs >= RECOVERY_ADMISSION_CLAIM_RESUME_AFTER_MS) {
+				this.recoveries.set(recoveryKey, {
+					kind: "admitting",
+					context: existingRecovery.context,
+					claimedAtMs: nowMs
+				});
+				return {
+					kind: "claimed",
+					claim: {
+						kind: "router_ab_ed25519_yao_recovery_admission_claim_v1",
+						lifecycleId: admittedRequest.scope.lifecycle_id,
+						recoveryKey
+					}
+				};
+			}
 			const replay = admissionReplayResult(existingRecovery);
 			return replay.ok ? {
 				kind: "completed",
@@ -787,15 +865,21 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				message: "recovery active capability was not found"
 			})
 		};
+		let superseded = null;
 		switch (activeCapability.kind) {
-			case "suspended": return {
-				kind: "failed",
-				failure: recoveryFailure({
-					status: 409,
-					code: "capability_suspended",
-					message: "recovery active capability is already suspended"
-				})
-			};
+			case "suspended": {
+				const holder = this.recoveries.get(activeCapability.recoveryKey);
+				if (!holder || !supersedesRecoveryAttempt(holder, admittedRequest, authorization, nowMs)) return {
+					kind: "failed",
+					failure: recoveryFailure({
+						status: 409,
+						code: "capability_suspended",
+						message: "recovery active capability is already suspended"
+					})
+				};
+				superseded = holder;
+				break;
+			}
 			case "retired": return {
 				kind: "failed",
 				failure: recoveryFailure({
@@ -829,8 +913,15 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			recoveryKey,
 			admissionRequest: admittedRequest,
 			activeCapability: activeCapability.identity,
-			authorization
+			authorization,
+			dispatchRoot,
+			attempt: superseded ? superseded.context.attempt + 1 : 1
 		};
+		if (superseded) this.recoveries.set(superseded.context.recoveryKey, {
+			kind: "superseded",
+			context: superseded.context,
+			supersededByRecoveryKey: recoveryKey
+		});
 		this.capabilities.set(activeCapabilityKey, {
 			kind: "suspended",
 			identity: activeCapability.identity,
@@ -838,7 +929,8 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		});
 		this.recoveries.set(recoveryKey, {
 			kind: "admitting",
-			context
+			context,
+			claimedAtMs: nowMs
 		});
 		return {
 			kind: "claimed",
@@ -893,7 +985,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		};
 	}
 	async executeRecovery(request, authorization, traceContext) {
-		const preparation = this.prepareExecuteRecovery(request, authorization);
+		const preparation = this.prepareExecuteRecovery(request, authorization, Date.now());
 		switch (preparation.kind) {
 			case "completed": return {
 				ok: true,
@@ -906,7 +998,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.executeRecovery(request, preparation.claim.admissionRequest, traceContext)
+						result: await this.backend.executeRecovery(request, preparation.claim.admissionRequest, preparation.claim.dispatchRoot, preparation.claim.attempt, preparation.claim.replay, traceContext)
 					};
 				} catch (error) {
 					return this.failUncertainExecution(preparation.claim, error);
@@ -919,7 +1011,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			}
 		}
 	}
-	prepareExecuteRecovery(request, authorization) {
+	prepareExecuteRecovery(request, authorization, nowMs) {
 		const parsed = parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(request);
 		if (!parsed.ok) return {
 			kind: "failed",
@@ -945,6 +1037,10 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			kind: "failed",
 			failure: recoveryAuthorizationMismatchFailure()
 		};
+		if (state.kind === "superseded") return {
+			kind: "failed",
+			failure: recoverySupersededFailure()
+		};
 		const admissionReceipt = admittedReceiptForState(state);
 		if (!admissionReceipt || !sameRouterAbEd25519YaoActivationBindingV1(executionRequest.binding, admissionReceipt.binding)) return {
 			kind: "failed",
@@ -955,28 +1051,50 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			})
 		};
 		const executeFingerprint = canonicalFingerprint(executionRequest);
+		const claimExecution = (claimed, replay) => {
+			this.recoveries.set(claimed.context.recoveryKey, {
+				kind: "executing",
+				context: claimed.context,
+				admissionReceipt: claimed.admissionReceipt,
+				executeFingerprint,
+				claimedAtMs: nowMs
+			});
+			return {
+				kind: "claimed",
+				claim: {
+					kind: "router_ab_ed25519_yao_recovery_execute_claim_v1",
+					lifecycleId: executionRequest.binding.lifecycle.lifecycle_id,
+					recoveryKey: claimed.context.recoveryKey,
+					sessionId,
+					executeFingerprint,
+					admissionRequest: claimed.context.admissionRequest,
+					dispatchRoot: claimed.context.dispatchRoot,
+					attempt: claimed.context.attempt,
+					replay
+				}
+			};
+		};
 		switch (state.kind) {
-			case "admitted": {
-				const executing = {
-					kind: "executing",
-					context: state.context,
-					admissionReceipt: state.admissionReceipt,
-					executeFingerprint
-				};
-				this.recoveries.set(state.context.recoveryKey, executing);
-				return {
-					kind: "claimed",
-					claim: {
-						kind: "router_ab_ed25519_yao_recovery_execute_claim_v1",
-						lifecycleId: executionRequest.binding.lifecycle.lifecycle_id,
-						recoveryKey: state.context.recoveryKey,
-						sessionId,
-						executeFingerprint,
-						admissionRequest: state.context.admissionRequest
-					}
+			case "admitted": return claimExecution(state, false);
+			case "execution_interrupted": return state.executeFingerprint === executeFingerprint ? claimExecution(state, true) : {
+				kind: "failed",
+				failure: recoveryFailure({
+					status: 409,
+					code: "binding_mismatch",
+					message: "recovery execution retry does not match the committed payload"
+				})
+			};
+			case "executing": {
+				if (state.executeFingerprint === executeFingerprint && nowMs - state.claimedAtMs >= RECOVERY_EXECUTION_CLAIM_RESUME_AFTER_MS) return claimExecution(state, true);
+				const replay = executionReplayResult(state, executeFingerprint);
+				return replay.ok ? {
+					kind: "completed",
+					value: replay.value
+				} : {
+					kind: "failed",
+					failure: replay
 				};
 			}
-			case "executing":
 			case "execution_failed":
 			case "staged":
 			case "activating":
@@ -1012,6 +1130,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		});
 		const backendResult = input.outcome.result;
 		if (!backendResult.ok) {
+			if (isRecoverableRecoveryBackendFailure(backendResult)) return this.interruptExecution(state, `${backendResult.code}: ${backendResult.message}`);
 			const failure = backendFailure(backendResult, "execution_failed");
 			this.storeExecutionFailure(state, failure);
 			return failure;
@@ -1055,7 +1174,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.activateRecovery(request, traceContext)
+						result: await this.backend.activateRecovery(request, preparation.claim.dispatchRoot, traceContext)
 					};
 				} catch (error) {
 					return this.activationUncertainFailure(error);
@@ -1065,7 +1184,13 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 					claim: preparation.claim,
 					outcome
 				});
-				return committed.kind === "completed" ? committed.value : committed.failure;
+				switch (committed.kind) {
+					case "uncertain": return committed.failure;
+					case "completed": return committed.value;
+					case "promoted":
+						if (committed.write.statements.length > 0) throw new Error("In-memory Yao recovery cannot commit a capability replacement prepared for a database");
+						return committed.value;
+				}
 			}
 		}
 	}
@@ -1093,6 +1218,10 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			kind: "failed",
 			failure: recoveryAuthorizationMismatchFailure()
 		};
+		if (state.kind === "superseded") return {
+			kind: "failed",
+			failure: recoverySupersededFailure()
+		};
 		const admissionReceipt = admittedReceiptForState(state);
 		if (!admissionReceipt || !sameRouterAbEd25519YaoActivationBindingV1(activationRequest.binding, admissionReceipt.binding)) return {
 			kind: "failed",
@@ -1162,6 +1291,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			}
 			case "admitted":
 			case "executing":
+			case "execution_interrupted":
 			case "execution_failed": return {
 				kind: "failed",
 				failure: recoveryFailure({
@@ -1195,6 +1325,10 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		const backendResult = input.outcome.result;
 		if (!backendResult.ok) {
 			const failure = backendFailure(backendResult, "activation_failed");
+			if (isRecoverableRecoveryBackendFailure(backendResult)) return {
+				kind: "completed",
+				value: failure
+			};
 			this.storeActivationFailure(state, failure);
 			return {
 				kind: "completed",
@@ -1248,7 +1382,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				value: promoted.failure
 			};
 		}
-		const persisted = await this.capabilityPersistence.replaceActiveCapability({
+		const persisted = await this.capabilityPersistence.prepareActiveCapabilityReplacement({
 			operation: {
 				kind: "router_ab_ed25519_yao_capability_replacement_operation_v1",
 				operationId: input.claim.lifecycleId,
@@ -1287,13 +1421,18 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			activationFingerprint: input.claim.activationFingerprint,
 			activationReceipt: activationReceipt.value
 		});
-		return {
+		const promotedValue = {
+			ok: true,
+			status: 200,
+			value: activationReceipt.value
+		};
+		return persisted.disposition === "prepared" ? {
+			kind: "promoted",
+			value: promotedValue,
+			write: persisted.write
+		} : {
 			kind: "completed",
-			value: {
-				ok: true,
-				status: 200,
-				value: activationReceipt.value
-			}
+			value: promotedValue
 		};
 	}
 	activationClaim(state, authorityProjection, disposition) {
@@ -1304,7 +1443,8 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			sessionId: bytesToHex(state.admissionReceipt.binding.session_id),
 			activationFingerprint: state.activationFingerprint,
 			authorityProjection,
-			disposition
+			disposition,
+			dispatchRoot: state.context.dispatchRoot
 		};
 	}
 	activationUncertainFailure(error) {
@@ -1416,9 +1556,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			code: "execution_in_progress",
 			message: "recovery execution claim is no longer current"
 		});
-		const failure = uncertainFailure(error, "execution_failed");
-		this.storeExecutionFailure(current, failure);
-		return failure;
+		return this.interruptExecution(current, error instanceof Error ? error.message : String(error));
 	}
 	storeAdmissionFailure(context, failure) {
 		this.recoveries.set(context.recoveryKey, {
@@ -1427,6 +1565,22 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			failure
 		});
 	}
+	/** Records an execution that ended without a definitive answer: it resumes. */
+	interruptExecution(state, message) {
+		const failure = recoveryFailure({
+			status: 503,
+			code: "execution_interrupted",
+			message
+		});
+		this.recoveries.set(state.context.recoveryKey, {
+			kind: "execution_interrupted",
+			context: state.context,
+			admissionReceipt: state.admissionReceipt,
+			executeFingerprint: state.executeFingerprint,
+			failure
+		});
+		return failure;
+	}
 	storeExecutionFailure(state, failure) {
 		this.recoveries.set(state.context.recoveryKey, {
 			kind: "execution_failed",
@@ -1604,6 +1758,6 @@ function createRouterAbEd25519YaoRecoveryModule(input) {
 	});
 }
 //#endregion
-export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding, warmBootstrapCapabilityMatchesStableIdentity };
+export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding };
 
 //# sourceMappingURL=routerAbEd25519YaoRecovery.js.map

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -19,7 +19,7 @@ var RecoveryAdmissionRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -55,6 +55,7 @@ var RecoveryAdmissionRequestRun = class {
 	}
 	async complete(state, claim, backend) {
 		return {
+			kind: "state",
 			state,
 			value: this.service(state).commitAdmitRecovery({
 				request: this.request,
@@ -85,7 +86,7 @@ var RecoveryExecutionRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		const prepared = this.service(state).prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), Date.now());
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -106,11 +107,11 @@ var RecoveryExecutionRequestRun = class {
 			};
 		}
 	}
-	async backend(_claim) {
+	async backend(claim) {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.executeRecovery(this.request, _claim.admissionRequest, this.context.trace)
+				value: await this.context.input.backend.executeRecovery(this.request, claim.admissionRequest, claim.dispatchRoot, claim.attempt, claim.replay, this.context.trace)
 			};
 		} catch (error) {
 			return {
@@ -121,6 +122,7 @@ var RecoveryExecutionRequestRun = class {
 	}
 	async complete(state, claim, backend) {
 		return {
+			kind: "state",
 			state,
 			value: this.service(state).commitExecuteRecovery({
 				request: this.request,
@@ -172,11 +174,11 @@ var RecoveryActivationRequestRun = class {
 			};
 		}
 	}
-	async backend(_claim) {
+	async backend(claim) {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.activateRecovery(this.request, this.context.trace)
+				value: await this.context.input.backend.activateRecovery(this.request, claim.dispatchRoot, this.context.trace)
 			};
 		} catch (error) {
 			return {
@@ -194,10 +196,24 @@ var RecoveryActivationRequestRun = class {
 				result: backend
 			}
 		});
-		return {
-			state,
-			value: committed.kind === "completed" ? committed.value : committed.failure
-		};
+		switch (committed.kind) {
+			case "uncertain": return {
+				kind: "state",
+				state,
+				value: committed.failure
+			};
+			case "completed": return {
+				kind: "state",
+				state,
+				value: committed.value
+			};
+			case "promoted": return {
+				kind: "state_with_write",
+				state,
+				value: committed.value,
+				write: committed.write
+			};
+		}
 	}
 	service(state) {
 		return new InMemoryRouterAbEd25519YaoRecoveryService(this.context.input.backend, state.recovery, this.context.input.capabilityPersistence);
@@ -254,12 +270,14 @@ function recoveryStatus(lifecycleId, recovery) {
 	};
 	switch (recovery.kind) {
 		case "admitting":
-		case "admission_failed": return {
+		case "admission_failed":
+		case "superseded": return {
 			stage: "missing",
 			lifecycle_id: lifecycleId
 		};
 		case "admitted":
 		case "executing":
+		case "execution_interrupted":
 		case "execution_failed": return {
 			stage: "admitted",
 			lifecycle_id: lifecycleId,