@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/framework/http.js

@@ -67,9 +67,6 @@ function toResponse(out) {
 		headers: out.headers
 	});
 }
-function isObject(v) {
-	return typeof v === "object" && v !== null;
-}
 async function readJson(request) {
 	try {
 		return await request.json();
@@ -85,6 +82,6 @@ function headersToRecord(headers) {
 	return out;
 }
 //#endregion
-export { headersToRecord, isObject, json, readJson, toResponse, withCors };
+export { headersToRecord, json, readJson, toResponse, withCors };
 
 //# sourceMappingURL=http.js.map

package/dist/esm/router/framework/ror/normalize.js

@@ -52,6 +52,6 @@ function resolveWellKnownSigningSessionSealCapabilities(signingSessionSealOption
 	return normalizeWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw.capabilities) || { mode: "none" };
 }
 //#endregion
-export { normalizeCsv, normalizeRorHost, normalizeWellKnownSigningSessionSealCapabilities, resolveWellKnownSigningSessionSealCapabilities, sanitizeRorOrigins };
+export { normalizeCsv, normalizeRorHost, resolveWellKnownSigningSessionSealCapabilities, sanitizeRorOrigins };
 
 //# sourceMappingURL=normalize.js.map

package/dist/esm/router/framework/routerApiRouteSurface.js

@@ -49,6 +49,6 @@ function getRouterApiRouteSurface(target) {
 	};
 }
 //#endregion
-export { attachRouterApiRouteSurface, getRouterApiRouteSurface, resolveRouterApiRouteDefinitionOptions, resolveRouterApiRouteSurface };
+export { attachRouterApiRouteSurface, getRouterApiRouteSurface, resolveRouterApiRouteSurface };
 
 //# sourceMappingURL=routerApiRouteSurface.js.map

package/dist/esm/router/node/nodeHostedWalletGateway.js

@@ -0,0 +1,64 @@
+import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "../cloudflare/runtime/staticWalletConsoleBinding.js";
+import { handleSplitGatewayRequest } from "../../hosted-wallet-gateway.js";
+import { createSyncSqliteDatabase } from "../../storage/syncSqlite.js";
+import { NODE_HOP_BY_HOP_HEADERS_V1 } from "./nodeHttp.js";
+import { readFileSync } from "node:fs";
+//#region src/router/node/nodeHostedWalletGateway.ts
+function createNodeHostedWalletGatewayV1(options) {
+	const deploymentJson = options.vars.WALLET_LOCAL_DEPLOYMENT_JSON;
+	if (!deploymentJson) throw new Error("WALLET_LOCAL_DEPLOYMENT_JSON is required");
+	const env = {
+		...options.vars,
+		WALLET_LOCAL_DEPLOYMENT_JSON: deploymentJson,
+		ROUTER_AB_PREWARM_ENABLED: options.vars.ROUTER_AB_PREWARM_ENABLED ?? "false",
+		SIGNER_DB: createSyncSqliteDatabase(options.connection),
+		MPC_ROUTER: httpServiceBinding(options.routerUrl),
+		SIGNING_WORKER: httpServiceBinding(options.signingWorkerUrl),
+		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(parseStaticWalletConsoleBindingConfigV1(JSON.parse(deploymentJson)))
+	};
+	const signerWasmBytes = readFileSync(options.signerWasmPath);
+	const dependencies = { signerWasm: async () => await WebAssembly.compile(signerWasmBytes) };
+	const handler = options.handler ?? handleSplitGatewayRequest;
+	const pending = /* @__PURE__ */ new Set();
+	const ctx = {
+		waitUntil(promise) {
+			const tracked = promise.catch((error) => options.onBackgroundError?.(error));
+			pending.add(tracked);
+			tracked.finally(() => pending.delete(tracked));
+		},
+		passThroughOnException() {}
+	};
+	return {
+		handle: async (request) => await handler(request, env, ctx, dependencies),
+		drain: async () => {
+			await Promise.all([...pending]);
+		}
+	};
+}
+/**
+* A Cloudflare service binding delivers to one Worker whatever URL the
+* caller used; the Gateway sends both its fixed internal origins and
+* forwarded public requests through them. On a VM each binding forwards the
+* path and query to its one configured base URL, and nowhere else.
+*/
+function httpServiceBinding(baseUrl) {
+	const base = new URL(baseUrl);
+	return { async fetch(input, init) {
+		const request = new Request(input, init);
+		const url = new URL(request.url);
+		const target = new URL(`${url.pathname}${url.search}`, base);
+		const body = request.method === "GET" || request.method === "HEAD" ? void 0 : await request.arrayBuffer();
+		const headers = new Headers(request.headers);
+		for (const name of NODE_HOP_BY_HOP_HEADERS_V1) headers.delete(name);
+		return await fetch(target, {
+			method: request.method,
+			headers,
+			body,
+			redirect: "manual"
+		});
+	} };
+}
+//#endregion
+export { createNodeHostedWalletGatewayV1 };
+
+//# sourceMappingURL=nodeHostedWalletGateway.js.map

package/dist/esm/router/node/nodeHostedWalletGatewayCheck.js

@@ -0,0 +1,163 @@
+import { parseStaticWalletConsoleBindingConfigV1 } from "../cloudflare/runtime/staticWalletConsoleBinding.js";
+import { nodeSqliteConnection } from "./nodeSqlite.js";
+import { inspectSignerSqlMigrationsV1 } from "./signerSqlMigrations.js";
+import { existsSync } from "node:fs";
+//#region src/router/node/nodeHostedWalletGatewayCheck.ts
+async function checkNodeHostedWalletGatewayV1(input) {
+	return [
+		configurationCheck(input),
+		signerWasmCheck(input.signerWasmPath),
+		storageCheck(input),
+		await peerCheck("router", input.routerUrl),
+		await peerCheck("signing_worker", input.signingWorkerUrl),
+		{
+			check: "peer_authentication",
+			status: "unverified",
+			detail: { reason: "the check sends no credential; a peer that refuses the Gateway's service credentials is found only by an authenticated call, such as the explicit smoke test" }
+		}
+	];
+}
+function configurationCheck(input) {
+	const missing = [
+		["WALLET_GATEWAY_VARS_FILE", input.varsPath],
+		["WALLET_GATEWAY_ROUTER_URL", input.routerUrl],
+		["WALLET_GATEWAY_SIGNING_WORKER_URL", input.signingWorkerUrl],
+		["WALLET_GATEWAY_SIGNER_WASM_PATH", input.signerWasmPath]
+	].filter(([, value]) => !value).map(([name]) => name);
+	if (missing.length > 0 || !input.varsPath) return {
+		check: "configuration",
+		status: "failed",
+		detail: { missing }
+	};
+	let vars;
+	try {
+		vars = input.readVars(input.varsPath);
+	} catch (error) {
+		return {
+			check: "configuration",
+			status: "failed",
+			detail: { error: error instanceof Error ? error.message : "the vars file cannot be read" }
+		};
+	}
+	const deploymentJson = vars.WALLET_LOCAL_DEPLOYMENT_JSON;
+	if (!deploymentJson) return {
+		check: "configuration",
+		status: "failed",
+		detail: { missing: ["WALLET_LOCAL_DEPLOYMENT_JSON"] }
+	};
+	try {
+		parseStaticWalletConsoleBindingConfigV1(JSON.parse(deploymentJson));
+	} catch {
+		return {
+			check: "configuration",
+			status: "failed",
+			detail: { error: "WALLET_LOCAL_DEPLOYMENT_JSON is not a valid deployment" }
+		};
+	}
+	return {
+		check: "configuration",
+		status: "passed",
+		detail: { keys: Object.keys(vars).length }
+	};
+}
+function signerWasmCheck(path) {
+	if (!path) return {
+		check: "artifact:signer_wasm",
+		status: "failed",
+		detail: { missing: true }
+	};
+	return existsSync(path) ? {
+		check: "artifact:signer_wasm",
+		status: "passed",
+		detail: { path }
+	} : {
+		check: "artifact:signer_wasm",
+		status: "failed",
+		detail: {
+			path,
+			state: "missing"
+		}
+	};
+}
+function storageCheck(input) {
+	const path = input.databasePath;
+	if (!existsSync(path)) return {
+		check: "storage:gateway_store",
+		status: "failed",
+		detail: {
+			path,
+			state: "missing",
+			action: "apply the schema with `migrate`"
+		}
+	};
+	const database = new input.DatabaseSync(path, { readOnly: true });
+	try {
+		const status = inspectSignerSqlMigrationsV1(nodeSqliteConnection(database), input.migrationsDir);
+		const current = status.pending.length === 0 && status.unknown.length === 0;
+		return {
+			check: "storage:gateway_store",
+			status: current ? "passed" : "failed",
+			detail: current ? {
+				path,
+				applied: status.applied.length
+			} : {
+				path,
+				applied: status.applied.length,
+				pending: status.pending,
+				unknown: status.unknown
+			}
+		};
+	} finally {
+		database.close();
+	}
+}
+/** The role a peer's health endpoint answers as. Sends no credential. */
+async function peerCheck(role, url) {
+	const check = `peer:${role}`;
+	if (!url) return {
+		check,
+		status: "failed",
+		detail: { missing: true }
+	};
+	let answered;
+	try {
+		const response = await fetch(new URL("/healthz", url), { signal: AbortSignal.timeout(5e3) });
+		if (response.status !== 200) return {
+			check,
+			status: "failed",
+			detail: {
+				url,
+				error: `answered HTTP ${response.status}`
+			}
+		};
+		const body = await response.json();
+		answered = body.role_label ?? body.role;
+	} catch (error) {
+		return {
+			check,
+			status: "failed",
+			detail: {
+				url,
+				state: "unreachable",
+				error: error instanceof Error ? error.message : "failed"
+			}
+		};
+	}
+	return answered === role ? {
+		check,
+		status: "passed",
+		detail: { url }
+	} : {
+		check,
+		status: "failed",
+		detail: {
+			url,
+			answered_as: answered ?? null,
+			action: "point this URL at the role it names"
+		}
+	};
+}
+//#endregion
+export { checkNodeHostedWalletGatewayV1 };
+
+//# sourceMappingURL=nodeHostedWalletGatewayCheck.js.map

package/dist/esm/router/node/nodeHostedWalletGatewayMain.js

@@ -0,0 +1,120 @@
+import { handleLocalHostedWalletGatewayRequestV1 } from "../../localHostedWalletGatewayHandler.js";
+import { listenNodeFetchHandler } from "./nodeHttp.js";
+import { createNodeHostedWalletGatewayV1 } from "./nodeHostedWalletGateway.js";
+import { loadNodeDatabaseSync, nodeSqliteConnection, openNodeSqliteFile } from "./nodeSqlite.js";
+import { applySignerSqlMigrationsV1, inspectSignerSqlMigrationsV1 } from "./signerSqlMigrations.js";
+import { checkNodeHostedWalletGatewayV1 } from "./nodeHostedWalletGatewayCheck.js";
+import { readFileSync } from "node:fs";
+//#region src/router/node/nodeHostedWalletGatewayMain.ts
+async function main(argv) {
+	const command = argv[0];
+	const databasePath = requireEnv("WALLET_GATEWAY_DATABASE_PATH");
+	const migrationsDir = requireEnv("WALLET_GATEWAY_MIGRATIONS_DIR");
+	const DatabaseSync = await loadNodeDatabaseSync();
+	if (command === "check") {
+		const checks = await checkNodeHostedWalletGatewayV1({
+			DatabaseSync,
+			databasePath,
+			migrationsDir,
+			varsPath: optionalEnv("WALLET_GATEWAY_VARS_FILE"),
+			readVars: readVarsFile,
+			routerUrl: optionalEnv("WALLET_GATEWAY_ROUTER_URL"),
+			signingWorkerUrl: optionalEnv("WALLET_GATEWAY_SIGNING_WORKER_URL"),
+			signerWasmPath: optionalEnv("WALLET_GATEWAY_SIGNER_WASM_PATH")
+		});
+		const ok = checks.every((check) => check.status !== "failed");
+		report({
+			kind: "wallet_gateway_check_v1",
+			ok,
+			checks
+		});
+		return ok ? 0 : 1;
+	}
+	const database = openNodeSqliteFile(DatabaseSync, databasePath);
+	const connection = nodeSqliteConnection(database);
+	if (command === "migrate") {
+		report({
+			kind: "wallet_gateway_migrate_v1",
+			...applySignerSqlMigrationsV1(connection, migrationsDir, Date.now())
+		});
+		database.close();
+		return 0;
+	}
+	if (command === "serve" || command === "serve-local") {
+		const status = inspectSignerSqlMigrationsV1(connection, migrationsDir);
+		if (status.pending.length > 0 || status.unknown.length > 0) throw new Error("shared store schema is not current; run `migrate` first");
+		const [host, port] = splitListen(requireEnv("WALLET_GATEWAY_LISTEN"));
+		const gateway = createNodeHostedWalletGatewayV1({
+			vars: readVarsFile(requireEnv("WALLET_GATEWAY_VARS_FILE")),
+			connection,
+			routerUrl: requireEnv("WALLET_GATEWAY_ROUTER_URL"),
+			signingWorkerUrl: requireEnv("WALLET_GATEWAY_SIGNING_WORKER_URL"),
+			signerWasmPath: requireEnv("WALLET_GATEWAY_SIGNER_WASM_PATH"),
+			...command === "serve-local" ? { handler: handleLocalHostedWalletGatewayRequestV1 } : {},
+			onBackgroundError: (error) => process.stderr.write(`gateway background task failed: ${describe(error)}\n`)
+		});
+		const server = await listenNodeFetchHandler({
+			host,
+			port,
+			handle: gateway.handle
+		});
+		report({
+			kind: "wallet_gateway_listening_v1",
+			address: server.address()
+		});
+		const stop = () => server.close(() => {
+			gateway.drain().finally(() => {
+				database.close();
+				process.exit(0);
+			});
+		});
+		process.once("SIGTERM", stop);
+		process.once("SIGINT", stop);
+		return await new Promise(() => void 0);
+	}
+	process.stderr.write("usage: wallet-gateway <migrate|check|serve|serve-local>\n");
+	return 2;
+}
+/** Reads `KEY='value'` / `KEY=value` lines; values are never logged. */
+function readVarsFile(path) {
+	const vars = {};
+	for (const rawLine of readFileSync(path, "utf8").split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#")) continue;
+		const separator = line.indexOf("=");
+		if (separator <= 0) throw new Error(`invalid entry in ${path}`);
+		const key = line.slice(0, separator);
+		let value = line.slice(separator + 1);
+		if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+		if (key in vars) throw new Error(`duplicate ${key} in ${path}`);
+		vars[key] = value;
+	}
+	return vars;
+}
+function requireEnv(name) {
+	const value = process.env[name]?.trim();
+	if (!value) throw new Error(`${name} is required`);
+	return value;
+}
+function optionalEnv(name) {
+	return process.env[name]?.trim() || void 0;
+}
+function splitListen(value) {
+	const index = value.lastIndexOf(":");
+	const port = Number(value.slice(index + 1));
+	if (index <= 0 || !Number.isInteger(port)) throw new Error("WALLET_GATEWAY_LISTEN must be host:port");
+	return [value.slice(0, index), port];
+}
+function report(value) {
+	process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+function describe(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+main(process.argv.slice(2)).then((code) => process.exit(code), (error) => {
+	process.stderr.write(`${describe(error)}\n`);
+	process.exit(1);
+});
+//#endregion
+
+//# sourceMappingURL=nodeHostedWalletGatewayMain.js.map

package/dist/esm/router/node/nodeHttp.js

@@ -0,0 +1,79 @@
+import { createServer } from "node:http";
+//#region src/router/node/nodeHttp.ts
+const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+/**
+* Headers that describe one connection or one message's framing. A Worker's
+* runtime sets them for the bytes it actually sends; on Node they are never
+* copied from a Request or Response that another hop produced.
+*/
+const NODE_HOP_BY_HOP_HEADERS_V1 = [
+	"connection",
+	"content-length",
+	"expect",
+	"host",
+	"keep-alive",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+];
+function listenNodeFetchHandler(input) {
+	const server = createServer((incoming, outgoing) => {
+		forward(incoming, outgoing, input.handle);
+	});
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(input.port, input.host, () => resolve(server));
+	});
+}
+async function forward(incoming, outgoing, handle) {
+	try {
+		if (Number(incoming.headers["content-length"]) > MAX_REQUEST_BODY_BYTES) {
+			rejectOversizedBody(incoming, outgoing);
+			return;
+		}
+		const chunks = [];
+		let bodyBytes = 0;
+		for await (const chunk of incoming.iterator({ destroyOnReturn: false })) {
+			bodyBytes += chunk.length;
+			if (bodyBytes > MAX_REQUEST_BODY_BYTES) {
+				rejectOversizedBody(incoming, outgoing);
+				return;
+			}
+			chunks.push(chunk);
+		}
+		const headers = new Headers();
+		for (const [name, value] of Object.entries(incoming.headers)) if (typeof value === "string") headers.set(name, value);
+		else if (Array.isArray(value)) for (const item of value) headers.append(name, item);
+		const method = incoming.method ?? "GET";
+		const response = await handle(new Request(`http://${incoming.headers.host ?? "localhost"}${incoming.url ?? "/"}`, {
+			method,
+			headers,
+			body: method === "GET" || method === "HEAD" ? void 0 : Buffer.concat(chunks)
+		}));
+		outgoing.statusCode = response.status;
+		response.headers.forEach((value, name) => {
+			if (name === "set-cookie" || NODE_HOP_BY_HOP_HEADERS_V1.includes(name)) return;
+			outgoing.setHeader(name, value);
+		});
+		const cookies = response.headers.getSetCookie();
+		if (cookies.length > 0) outgoing.setHeader("set-cookie", cookies);
+		outgoing.end(Buffer.from(await response.arrayBuffer()));
+	} catch {
+		outgoing.statusCode = 500;
+		outgoing.end("internal error");
+	}
+}
+function rejectOversizedBody(incoming, outgoing) {
+	incoming.pause();
+	outgoing.writeHead(413, {
+		connection: "close",
+		"content-type": "text/plain; charset=utf-8"
+	});
+	outgoing.end("request body too large");
+}
+//#endregion
+export { NODE_HOP_BY_HOP_HEADERS_V1, listenNodeFetchHandler };
+
+//# sourceMappingURL=nodeHttp.js.map

package/dist/esm/router/node/nodeSqlite.js

@@ -0,0 +1,43 @@
+//#region src/router/node/nodeSqlite.ts
+const BUSY_TIMEOUT_MS = 5e3;
+/** Loads `node:sqlite` at runtime so the package builds without its typings. */
+async function loadNodeDatabaseSync() {
+	const module = await import("node:sqlite");
+	if (typeof module.DatabaseSync !== "function") throw new Error("node:sqlite DatabaseSync is unavailable; use Node.js 22.13 or newer");
+	return module.DatabaseSync;
+}
+/**
+* Opens a SQLite file for one role-private store. Writers from separate
+* processes serialize on `BEGIN IMMEDIATE`; WAL lets readers proceed.
+*/
+function openNodeSqliteFile(DatabaseSync, path) {
+	const database = new DatabaseSync(path);
+	database.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}; PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;`);
+	return database;
+}
+function nodeSqliteConnection(database) {
+	let inTransaction = false;
+	return {
+		execute: (sql, params) => database.prepare(sql).all(...params),
+		executeScript: (sql) => database.exec(sql),
+		transaction: (body) => {
+			if (inTransaction) throw new Error("nested SQLite transactions are not supported");
+			database.exec("BEGIN IMMEDIATE");
+			inTransaction = true;
+			try {
+				const result = body();
+				database.exec("COMMIT");
+				return result;
+			} catch (error) {
+				database.exec("ROLLBACK");
+				throw error;
+			} finally {
+				inTransaction = false;
+			}
+		}
+	};
+}
+//#endregion
+export { loadNodeDatabaseSync, nodeSqliteConnection, openNodeSqliteFile };
+
+//# sourceMappingURL=nodeSqlite.js.map

package/dist/esm/router/node/signerSqlMigrations.js

@@ -0,0 +1,48 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+//#region src/router/node/signerSqlMigrations.ts
+const LEDGER_TABLE = "seams_signer_sql_migrations";
+function migrationNames(directory) {
+	return readdirSync(directory).filter((name) => name.endsWith(".sql")).sort();
+}
+function appliedNames(connection) {
+	if (connection.execute("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?1", [LEDGER_TABLE]).length === 0) return [];
+	return connection.execute(`SELECT name FROM ${LEDGER_TABLE} ORDER BY name`, []).map((row) => String(row.name));
+}
+/** Read-only: compares the database ledger with the shipped migration chain. */
+function inspectSignerSqlMigrationsV1(connection, directory) {
+	const shipped = migrationNames(directory);
+	const applied = appliedNames(connection);
+	return {
+		applied,
+		pending: shipped.filter((name) => !applied.includes(name)),
+		unknown: applied.filter((name) => !shipped.includes(name))
+	};
+}
+/**
+* Applies pending migrations in order, each in one transaction together
+* with its ledger row, so an interrupted run resumes at the first missing
+* migration. Refuses a database that already carries migrations this
+* package does not know, or whose applied set is not a prefix of the chain.
+*/
+function applySignerSqlMigrationsV1(connection, directory, nowMs) {
+	const status = inspectSignerSqlMigrationsV1(connection, directory);
+	if (status.unknown.length > 0) throw new Error(`database has migrations this package does not ship: ${status.unknown.join(", ")}`);
+	const shipped = migrationNames(directory);
+	if (status.applied.some((name, index) => shipped[index] !== name)) throw new Error("applied migrations are not a prefix of the shipped migration chain");
+	connection.executeScript(`CREATE TABLE IF NOT EXISTS ${LEDGER_TABLE} (name TEXT PRIMARY KEY, applied_at_ms INTEGER NOT NULL)`);
+	const applied = [];
+	for (const name of status.pending) {
+		const sql = readFileSync(join(directory, name), "utf8");
+		connection.transaction(() => {
+			connection.executeScript(sql);
+			connection.execute(`INSERT INTO ${LEDGER_TABLE} (name, applied_at_ms) VALUES (?1, ?2)`, [name, nowMs]);
+		});
+		applied.push(name);
+	}
+	return { applied };
+}
+//#endregion
+export { applySignerSqlMigrationsV1, inspectSignerSqlMigrationsV1 };
+
+//# sourceMappingURL=signerSqlMigrations.js.map

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -304,6 +304,6 @@ function createFetchRouter(service, opts, runtime) {
 	}, routeSurface);
 }
 //#endregion
-export { authorizeSigningSessionSealWithExactWalletSession, createFetchRouter };
+export { createFetchRouter };
 
 //# sourceMappingURL=createFetchRouter.js.map

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -1,12 +1,15 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
+import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { parseActiveWalletSessionV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
-import { parseActiveWalletSessionV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
 import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
@@ -260,26 +263,25 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 		nowMs,
 		ed25519ExportRootPackage
 	});
-	if (committed.kind === "invalid_input") return sessionResultResponse(await service.sessionService.failBeforeCommitV1({
+	if (committed.kind === "invalid_input" || committed.kind === "conflict") return sessionResultResponse(await service.sessionService.failBeforeCommitV1({
 		linkSessionId,
 		expectedRevision: recorded.record.revision,
 		error: {
 			kind: "package_preparation_failed",
-			reason: committed.message
-		},
-		nowMs
-	}));
-	if (committed.kind === "conflict") return sessionResultResponse(await service.sessionService.failBeforeCommitV1({
-		linkSessionId,
-		expectedRevision: recorded.record.revision,
-		error: {
-			kind: "package_preparation_failed",
-			reason: committed.message
+			reason: precommitFailureReasonV1(committed.message)
 		},
 		nowMs
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
+/**
+* A precommit failure's reason is a single token. The installer's message
+* keeps its words, joined, so the session still says what failed.
+*/
+function precommitFailureReasonV1(message) {
+	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
+	return token.length > 0 ? token : "authority_commit_failed";
+}
 async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
@@ -1163,10 +1165,6 @@ function parseBoundary(parse) {
 		throw new DeviceLinkingInputError(errorMessage(error));
 	}
 }
-function requireRecord(raw, field) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object`);
-	return raw;
-}
 function requireExactKeys(record, keys) {
 	const actual = Object.keys(record).sort();
 	const expected = [...keys].sort();
@@ -1191,6 +1189,6 @@ var DeviceLinkingInputError = class extends Error {
 	}
 };
 //#endregion
-export { DEVICE_LINKING_REQUEST_PROOF_HEADER_V1, handleDeviceLinking, targetCredentialResultResponse };
+export { handleDeviceLinking };
 
 //# sourceMappingURL=deviceLinking.js.map

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,14 +1,12 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
 /**
@@ -253,7 +251,7 @@ async function readClonedJson(request) {
 	}
 }
 async function requestBodyDigest(request) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(new Uint8Array(await request.clone().arrayBuffer()))));
+	return sha256DigestB64u(new Uint8Array(await request.clone().arrayBuffer()));
 }
 function denied(code, message) {
 	return {