@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/shared-ts/src/utils/registrationAuthMethodInput.js

@@ -0,0 +1,127 @@
+import { parseWebAuthnRpId } from "./domainIds.js";
+//#region ../shared-ts/src/utils/registrationAuthMethodInput.ts
+function inspectRawObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function normalizeRegistrationAuthMethodInput(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	const kind = trimString(record.kind);
+	if (kind === "passkey") {
+		const rpId = parseWebAuthnRpId("rpId" in record ? record.rpId : void 0);
+		if (!rpId.ok || Object.prototype.hasOwnProperty.call(record, "email") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId")) return null;
+		return {
+			kind: "passkey",
+			rpId: rpId.value,
+			..."authenticatorOptions" in record && record.authenticatorOptions !== void 0 ? { authenticatorOptions: record.authenticatorOptions } : {}
+		};
+	}
+	if (kind === "email_otp") {
+		const proofKind = trimString("proofKind" in record ? record.proofKind : void 0);
+		const email = trimString("email" in record ? record.email : void 0);
+		const providerSubject = trimString("providerSubject" in record ? record.providerSubject : void 0);
+		if (!email || !providerSubject || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		if (proofKind === "otp_challenge") {
+			const otpCode = trimString("otpCode" in record ? record.otpCode : void 0);
+			const challengeId = trimString("challengeId" in record ? record.challengeId : void 0);
+			if (!otpCode || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationAttemptId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationOfferId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationCandidateId")) return null;
+			return {
+				kind: "email_otp",
+				proofKind: "otp_challenge",
+				email,
+				providerSubject,
+				otpCode,
+				...challengeId ? { challengeId } : {}
+			};
+		}
+		if (proofKind === "google_sso_registration") {
+			const googleEmailOtpRegistrationAttemptId = trimString("googleEmailOtpRegistrationAttemptId" in record ? record.googleEmailOtpRegistrationAttemptId : void 0);
+			const googleEmailOtpRegistrationOfferId = trimString("googleEmailOtpRegistrationOfferId" in record ? record.googleEmailOtpRegistrationOfferId : void 0);
+			const googleEmailOtpRegistrationCandidateId = trimString("googleEmailOtpRegistrationCandidateId" in record ? record.googleEmailOtpRegistrationCandidateId : void 0);
+			if (!googleEmailOtpRegistrationAttemptId || !googleEmailOtpRegistrationOfferId || !googleEmailOtpRegistrationCandidateId || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId")) return null;
+			return {
+				kind: "email_otp",
+				proofKind: "google_sso_registration",
+				email,
+				providerSubject,
+				googleEmailOtpRegistrationAttemptId,
+				googleEmailOtpRegistrationOfferId,
+				googleEmailOtpRegistrationCandidateId
+			};
+		}
+		return null;
+	}
+	return null;
+}
+function normalizeAddAuthMethodInput(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	const kind = trimString(record.kind);
+	if (kind === "passkey") {
+		const rpId = parseWebAuthnRpId("rpId" in record ? record.rpId : void 0);
+		if (!rpId.ok || Object.prototype.hasOwnProperty.call(record, "email") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		return {
+			kind: "passkey",
+			rpId: rpId.value
+		};
+	}
+	if (kind === "email_otp") {
+		const email = trimString("email" in record ? record.email : void 0);
+		if (!email || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		return {
+			kind: "email_otp",
+			email
+		};
+	}
+	return null;
+}
+function normalizeEmailOtpRegistrationProof(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return null;
+	const version = trimString("version" in record ? record.version : void 0);
+	const proofKind = trimString("proofKind" in record ? record.proofKind : void 0);
+	const providerSubject = trimString("providerSubject" in record ? record.providerSubject : void 0);
+	const email = trimString("email" in record ? record.email : void 0).toLowerCase();
+	const registrationIntentDigestB64u = trimString("registrationIntentDigestB64u" in record ? record.registrationIntentDigestB64u : void 0);
+	if (version !== "email_otp_registration_proof_v1" || !providerSubject || !email || !registrationIntentDigestB64u) return null;
+	if (proofKind === "otp_challenge") {
+		const challengeId = trimString("challengeId" in record ? record.challengeId : void 0);
+		const otpCode = trimString("otpCode" in record ? record.otpCode : void 0);
+		const otpChannel = trimString("otpChannel" in record ? record.otpChannel : void 0);
+		if (!challengeId || !otpCode || otpChannel !== "email_otp" || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationAttemptId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationOfferId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationCandidateId")) return null;
+		return {
+			version: "email_otp_registration_proof_v1",
+			proofKind: "otp_challenge",
+			providerSubject,
+			email,
+			challengeId,
+			otpCode,
+			otpChannel: "email_otp",
+			registrationIntentDigestB64u
+		};
+	}
+	if (proofKind === "google_sso_registration") {
+		const googleEmailOtpRegistrationAttemptId = trimString("googleEmailOtpRegistrationAttemptId" in record ? record.googleEmailOtpRegistrationAttemptId : void 0);
+		const googleEmailOtpRegistrationOfferId = trimString("googleEmailOtpRegistrationOfferId" in record ? record.googleEmailOtpRegistrationOfferId : void 0);
+		const googleEmailOtpRegistrationCandidateId = trimString("googleEmailOtpRegistrationCandidateId" in record ? record.googleEmailOtpRegistrationCandidateId : void 0);
+		if (!googleEmailOtpRegistrationAttemptId || !googleEmailOtpRegistrationOfferId || !googleEmailOtpRegistrationCandidateId || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "otpChannel")) return null;
+		return {
+			version: "email_otp_registration_proof_v1",
+			proofKind: "google_sso_registration",
+			providerSubject,
+			email,
+			googleEmailOtpRegistrationAttemptId,
+			googleEmailOtpRegistrationOfferId,
+			googleEmailOtpRegistrationCandidateId,
+			registrationIntentDigestB64u
+		};
+	}
+	return null;
+}
+//#endregion
+export { inspectRawObject, normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, trimString };
+
+//# sourceMappingURL=registrationAuthMethodInput.js.map

package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "./domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { parseNearAccountId } from "./near.js";
-import { parseNearEd25519SigningKeyId } from "./registrationIntent.js";
+import { parseActiveWalletSessionV1 } from "../device-linking/activeWalletSession.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "./routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1 } from "./routerAbEcdsaDerivation.js";
-import { parseActiveWalletSessionV1 } from "../device-linking/parsers.js";
 import { parseRouterAbEd25519NormalSigningState } from "./signingSessionSeal.js";
+import { parseNearEd25519SigningKeyId } from "./registrationIds.js";
 import { parseThresholdEcdsaKeyHandle } from "./thresholdEcdsaKeyHandle.js";
 //#region ../shared-ts/src/utils/registrationEstablishedSession.ts
 function registrationSessionTokensMatchCapabilities(walletSession, tokens) {

package/dist/esm/shared-ts/src/utils/registrationIds.js

@@ -0,0 +1,280 @@
+import { parseEmailOtpProviderUserId, parseWalletId } from "./domainIds.js";
+import { base64UrlEncode } from "./base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import "./encoders.js";
+//#region ../shared-ts/src/utils/registrationIds.ts
+function walletIdFromString(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+const SERVER_ALLOCATED_WALLET_ADJECTIVES = [
+	"alpine",
+	"amber",
+	"azure",
+	"brisk",
+	"bright",
+	"calm",
+	"cedar",
+	"cobalt",
+	"copper",
+	"coral",
+	"crimson",
+	"crystal",
+	"dawn",
+	"deep",
+	"dusky",
+	"evergreen",
+	"fair",
+	"fern",
+	"frost",
+	"gentle",
+	"glacier",
+	"glowing",
+	"golden",
+	"harbor",
+	"humble",
+	"indigo",
+	"ivory",
+	"jade",
+	"keen",
+	"lunar",
+	"maple",
+	"misty",
+	"mossy",
+	"noble",
+	"ocean",
+	"opal",
+	"polar",
+	"quiet",
+	"rapid",
+	"redwood",
+	"river",
+	"royal",
+	"sage",
+	"scarlet",
+	"serene",
+	"silver",
+	"solar",
+	"steady",
+	"stone",
+	"swift",
+	"tranquil",
+	"twilight",
+	"umber",
+	"verdant",
+	"vibrant",
+	"violet",
+	"vivid",
+	"warm",
+	"wild",
+	"willow",
+	"winter",
+	"woodland",
+	"young",
+	"zephyr"
+];
+const SERVER_ALLOCATED_WALLET_NOUNS = [
+	"anchor",
+	"arbor",
+	"atlas",
+	"aurora",
+	"badger",
+	"beacon",
+	"bloom",
+	"brook",
+	"canyon",
+	"cascade",
+	"comet",
+	"cove",
+	"crane",
+	"delta",
+	"dune",
+	"eagle",
+	"ember",
+	"falcon",
+	"feather",
+	"fjord",
+	"forest",
+	"galaxy",
+	"garden",
+	"giant",
+	"grove",
+	"harvest",
+	"heron",
+	"horizon",
+	"island",
+	"lagoon",
+	"lantern",
+	"lark",
+	"meadow",
+	"meteor",
+	"monolith",
+	"nebula",
+	"oasis",
+	"orchid",
+	"otter",
+	"peak",
+	"pebble",
+	"phoenix",
+	"pine",
+	"prism",
+	"quartz",
+	"raven",
+	"reef",
+	"ridge",
+	"sable",
+	"sequoia",
+	"shore",
+	"solstice",
+	"sparrow",
+	"star",
+	"summit",
+	"tempo",
+	"thunder",
+	"tundra",
+	"valley",
+	"vermillion",
+	"voyage",
+	"wave",
+	"wren",
+	"zenith"
+];
+const SERVER_ALLOCATED_WALLET_SUFFIX_ALPHABET = "23456789abcdefghjkmnpqrstuvwxyz";
+const SERVER_ALLOCATED_WALLET_ID_PATTERN = /^([a-z]+)-([a-z]+)-([a-z0-9]{6})$/;
+const SERVER_ALLOCATED_WALLET_ADJECTIVE_SET = new Set(SERVER_ALLOCATED_WALLET_ADJECTIVES);
+const SERVER_ALLOCATED_WALLET_NOUN_SET = new Set(SERVER_ALLOCATED_WALLET_NOUNS);
+function createServerAllocatedWalletId() {
+	return requireServerAllocatedWalletId([
+		randomServerAllocatedWalletWord(SERVER_ALLOCATED_WALLET_ADJECTIVES),
+		randomServerAllocatedWalletWord(SERVER_ALLOCATED_WALLET_NOUNS),
+		randomServerAllocatedWalletSuffix(6)
+	].join("-"));
+}
+function parseServerAllocatedWalletId(raw) {
+	const parsed = parseWalletId(raw);
+	if (!parsed.ok) return parsed;
+	const value = String(parsed.value);
+	const match = SERVER_ALLOCATED_WALLET_ID_PATTERN.exec(value);
+	const adjective = match?.[1] || "";
+	const noun = match?.[2] || "";
+	const suffix = match?.[3] || "";
+	if (!match || !SERVER_ALLOCATED_WALLET_ADJECTIVE_SET.has(adjective) || !SERVER_ALLOCATED_WALLET_NOUN_SET.has(noun) || !serverAllocatedWalletSuffixIsValid(suffix)) return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "server-allocated walletId must match the approved readable word-word-suffix allocation format"
+		}
+	};
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function requireServerAllocatedWalletId(value) {
+	const parsed = parseServerAllocatedWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function serverAllocatedRandomIndex(maxExclusive) {
+	if (!Number.isSafeInteger(maxExclusive) || maxExclusive <= 0 || maxExclusive > 256) throw new Error("Invalid server-allocated wallet random bound");
+	const limit = 256 - 256 % maxExclusive;
+	const byte = new Uint8Array(1);
+	for (;;) {
+		crypto.getRandomValues(byte);
+		if (byte[0] < limit) return byte[0] % maxExclusive;
+	}
+}
+function randomServerAllocatedWalletWord(words) {
+	return words[serverAllocatedRandomIndex(words.length)];
+}
+function randomServerAllocatedWalletSuffix(length) {
+	let suffix = "";
+	for (let index = 0; index < length; index += 1) suffix += SERVER_ALLOCATED_WALLET_SUFFIX_ALPHABET[serverAllocatedRandomIndex(31)];
+	return suffix;
+}
+function serverAllocatedWalletSuffixIsValid(suffix) {
+	if (suffix.length !== 6) return false;
+	for (const character of suffix) if (!SERVER_ALLOCATED_WALLET_SUFFIX_ALPHABET.includes(character)) return false;
+	return true;
+}
+function nearEd25519SigningKeyIdFromString(value) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
+	return normalized;
+}
+function parseNearEd25519SigningKeyId(value) {
+	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
+	return nearEd25519SigningKeyIdFromString(value);
+}
+function nearEd25519SigningKeyIdFromWalletId(walletId) {
+	return nearEd25519SigningKeyIdFromString(String(walletId));
+}
+async function computeGeneratedImplicitNearEd25519SigningKeyId(input) {
+	return nearEd25519SigningKeyIdFromString(`ed25519ks_${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: input.kind,
+		walletId: String(input.walletId),
+		authorityScope: input.authorityScope,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		signerSlot: input.signerSlot,
+		participantIds: [...input.participantIds],
+		keyPurpose: input.keyPurpose,
+		keyVersion: input.keyVersion,
+		derivationVersion: input.derivationVersion
+	})))}`);
+}
+async function computeAddSignerNearEd25519SigningKeyId(input) {
+	return nearEd25519SigningKeyIdFromString(`ed25519ks_${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: input.kind,
+		walletId: String(input.walletId),
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		signerSlot: input.signerSlot,
+		participantIds: [...input.participantIds],
+		keyPurpose: input.keyPurpose,
+		keyVersion: input.keyVersion,
+		derivationVersion: input.derivationVersion
+	})))}`);
+}
+function emailOtpProviderUserIdFromRegistrationAuthority(authority) {
+	const parsed = parseEmailOtpProviderUserId(authority.providerSubject);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function registrationEd25519AuthorityScopeFromAuthority(authority) {
+	switch (authority.kind) {
+		case "passkey": return {
+			kind: "passkey",
+			rpId: authority.rpId
+		};
+		case "email_otp": return {
+			kind: "email_otp",
+			provider: authority.proofKind === "google_sso_registration" ? "google" : "email",
+			providerUserId: emailOtpProviderUserIdFromRegistrationAuthority(authority)
+		};
+		default: return authority;
+	}
+}
+async function computeRegistrationNearEd25519SigningKeyId(input) {
+	switch (input.ed25519.accountProvisioning.kind) {
+		case "implicit_account": return await computeGeneratedImplicitNearEd25519SigningKeyId({
+			kind: "generated_implicit_near_ed25519_signing_key_v1",
+			walletId: requireServerAllocatedWalletId(input.walletId),
+			authorityScope: input.authorityScope,
+			signingRootId: input.signingRootId,
+			signingRootVersion: input.signingRootVersion,
+			signerSlot: input.ed25519.signerSlot,
+			participantIds: input.ed25519.participantIds,
+			keyPurpose: input.ed25519.keyPurpose,
+			keyVersion: input.ed25519.keyVersion,
+			derivationVersion: input.ed25519.derivationVersion
+		});
+		case "sponsored_named_account": return nearEd25519SigningKeyIdFromWalletId(input.walletId);
+		default: return input.ed25519.accountProvisioning;
+	}
+}
+//#endregion
+export { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId, createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, parseNearEd25519SigningKeyId, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString };
+
+//# sourceMappingURL=registrationIds.js.map