@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js

@@ -27,6 +27,7 @@ var StrictRegistrationForwarder = class {
 			requestPolicy: input.requestPolicy,
 			request: input.request,
 			tenantRoot: input.tenantRoot,
+			projectEnvironmentId: input.tenantRoot.projectEnvironmentId,
 			traceContext: input.traceContext,
 			onServerTiming: input.onServerTiming,
 			onHeaderPresence: input.onHeaderPresence
@@ -42,6 +43,7 @@ var StrictRegistrationForwarder = class {
 			activationCorrelationId: input.activationCorrelationId,
 			requestPolicy: input.requestPolicy,
 			pendingActivation: input.pendingActivation,
+			projectEnvironmentId: pendingProjectEnvironmentId(input.pendingActivation),
 			clientActivation: input.clientActivation,
 			traceContext: input.traceContext,
 			onServerTiming: input.onServerTiming,
@@ -89,7 +91,7 @@ var StrictRegistrationForwarder = class {
 			retryable: false
 		};
 		const headers = {
-			authorization: `Bearer ${await this.config.tokenIssuer.issueRequest(ceremonyTokenClaimsForAuthority(input.authority, this.config.tokenScope), requestPolicy)}`,
+			authorization: `Bearer ${await this.config.tokenIssuer.issueRequest(ceremonyTokenClaimsForAuthority(input.authority, this.config.tokenScope, input.projectEnvironmentId), requestPolicy)}`,
 			"content-type": JSON_CONTENT_TYPE
 		};
 		if (input.traceContext) headers[ROUTER_AB_TRACE_ID_HEADER_V1] = input.traceContext.value;
@@ -184,7 +186,7 @@ var StrictPostRegistrationForwarder = class {
 	async forwardRaw(input) {
 		const authorityFailure = validatePostRegistrationAuthorityBinding(input);
 		if (authorityFailure) return authorityFailure;
-		const token = await this.config.tokenIssuer.issueRequest(ceremonyTokenClaimsForAuthority(input.authority, this.config.tokenScope), postRegistrationRequestPolicy(input.kind === "explicit_export" ? {
+		const token = await this.config.tokenIssuer.issueRequest(ceremonyTokenClaimsForAuthority(input.authority, this.config.tokenScope, input.tenantRoot.projectEnvironmentId), postRegistrationRequestPolicy(input.kind === "explicit_export" ? {
 			workKind: "key_export",
 			requestDigestB64u: input.requestDigestB64u
 		} : {
@@ -296,11 +298,18 @@ function canonicalPendingActivationJson(value) {
 	if (!exactObject(value, [
 		"registration",
 		"tenant_root_custody_binding_digest",
+		"wallet_scope",
+		"environment_key",
 		"activation_context",
 		"activation"
 	])) throw new Error("MPCRouter pending activation has an invalid envelope");
 	return canonicalJson(value);
 }
+function pendingProjectEnvironmentId(pending) {
+	const projectEnvironmentId = nonEmptyString(objectValue(objectValue(JSON.parse(pending.canonicalPayloadJson))?.wallet_scope)?.project_environment_id);
+	if (!projectEnvironmentId) throw new Error("Stored ECDSA pending activation has no canonical project environment");
+	return projectEnvironmentId;
+}
 function parseStoredRouterAbEcdsaPendingActivationV1(value) {
 	const record = exactObject(value, ["kind", "canonicalPayloadJson"]);
 	if (!record || record.kind !== "router_ab_ecdsa_pending_activation_v1" || typeof record.canonicalPayloadJson !== "string") throw new Error("Stored MPCRouter ECDSA pending activation is invalid");
@@ -371,13 +380,14 @@ function parseStrictRegistrationForwardingResult(raw) {
 		};
 	}
 }
-function ceremonyTokenClaimsForAuthority(authority, scope) {
+function ceremonyTokenClaimsForAuthority(authority, scope, projectEnvironmentId) {
 	return {
 		subjectId: authority.subjectId,
 		sessionId: authority.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
 		environment: scope.environment,
+		projectEnvironmentId,
 		accountId: authority.accountId,
 		expiresAtMs: authority.expiresAtMs
 	};
@@ -411,7 +421,7 @@ function validateRegistrationAuthorityBinding(input) {
 	return null;
 }
 function validateRegistrationTenantRoot(tenantRoot) {
-	if (!base64UrlString(tenantRoot.identityDigestB64u, 32) || !base64UrlString(tenantRoot.custodyLineageB64u, 16)) return {
+	if (!base64UrlString(tenantRoot.identityDigestB64u, 32) || !base64UrlString(tenantRoot.custodyLineageB64u, 16) || !nonEmptyString(tenantRoot.projectEnvironmentId)) return {
 		ok: false,
 		code: "strict_registration_tenant_root_invalid",
 		message: "Strict ECDSA registration tenant-root binding is invalid",
@@ -490,6 +500,7 @@ var Ed25519CeremonyTokenIssuer = class {
 			org_id: claims.orgId,
 			project_id: claims.projectId,
 			environment: claims.environment,
+			project_environment_id: claims.projectEnvironmentId,
 			account_id: claims.accountId,
 			...requestPolicy ? { routerAbRequestPolicy: requestPolicy } : {}
 		})}`;
@@ -648,7 +659,7 @@ function validateCeremonyTokenIssuerConfig(config) {
 	if (!nonEmptyString(config.issuer) || !nonEmptyString(config.audience) || !nonEmptyString(config.keyId) || config.privateJwk.kty !== "OKP" || config.privateJwk.crv !== "Ed25519" || !base64UrlString(config.privateJwk.x, 32) || !base64UrlString(config.privateJwk.d, 32)) throw new Error("Router A/B ECDSA ceremony token issuer requires an Ed25519 private JWK");
 }
 function validateCeremonyTokenClaims(claims) {
-	if (!nonEmptyString(claims.subjectId) || !nonEmptyString(claims.sessionId) || !nonEmptyString(claims.orgId) || !nonEmptyString(claims.projectId) || !nonEmptyString(claims.environment) || !nonEmptyString(claims.accountId) || !Number.isSafeInteger(claims.expiresAtMs) || claims.expiresAtMs <= Date.now()) throw new Error("Router A/B ECDSA ceremony token claims are invalid");
+	if (!nonEmptyString(claims.subjectId) || !nonEmptyString(claims.sessionId) || !nonEmptyString(claims.orgId) || !nonEmptyString(claims.projectId) || !nonEmptyString(claims.environment) || !nonEmptyString(claims.projectEnvironmentId) || !nonEmptyString(claims.accountId) || !Number.isSafeInteger(claims.expiresAtMs) || claims.expiresAtMs <= Date.now()) throw new Error("Router A/B ECDSA ceremony token claims are invalid");
 }
 function exactObject(raw, keys) {
 	const record = objectValue(raw);

package/dist/esm/router/domains/ecdsa/thresholdEcdsaRequestValidation.js

@@ -1,5 +1,5 @@
-import { parseRouterAbNormalSigningAuthorization } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { parseRouterAbNormalSigningAuthorization } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaOperationStepUpPreparationV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 //#region src/router/domains/ecdsa/thresholdEcdsaRequestValidation.ts
 const POOL_FILL_INIT_KEYS = [
@@ -136,13 +136,7 @@ function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw) {
 		}
 	};
 }
-function thresholdEcdsaRouteDiagnosticMetadata(raw, fields) {
-	if (!isPlainObject(raw)) return {};
-	const metadata = {};
-	for (const field of fields) metadata[field] = optionalStringField(raw, field);
-	return metadata;
-}
 //#endregion
-export { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest, thresholdEcdsaRouteDiagnosticMetadata };
+export { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest };
 
 //# sourceMappingURL=thresholdEcdsaRequestValidation.js.map

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js

@@ -0,0 +1,33 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+//#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.ts
+/** The decision one finalization would record. */
+async function routerAbEd25519YaoLifecycleDecisionV1(input) {
+	const decisionId = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		version: "router_ab_ed25519_yao_lifecycle_decision_v1",
+		kind: input.kind,
+		lifecycleId: input.lifecycleId,
+		walletId: input.walletId,
+		consumerBinding: input.consumerBinding,
+		capability: input.capability
+	})));
+	return {
+		lifecycleId: input.lifecycleId,
+		kind: input.kind,
+		decisionId,
+		walletId: input.walletId
+	};
+}
+function routerAbEd25519YaoLifecycleDecisionLookupV1(wanted, stored) {
+	if (stored === null) return { kind: "undecided" };
+	if (stored.lifecycleId === wanted.lifecycleId && stored.kind === wanted.kind && stored.decisionId === wanted.decisionId && stored.walletId === wanted.walletId) return { kind: "decided" };
+	return {
+		kind: "decided_otherwise",
+		decision: stored
+	};
+}
+//#endregion
+export { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 };
+
+//# sourceMappingURL=routerAbEd25519YaoLifecycleDecision.js.map

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -1,17 +1,19 @@
-import { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId, registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 import { InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule } from "../registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
 import { InMemoryRouterAbEd25519YaoRecoveryStateV1, createRouterAbEd25519YaoRecoveryModule } from "../recovery/routerAbEd25519YaoRecovery.js";
 import { InMemoryRouterAbEd25519YaoExportStateV1, createRouterAbEd25519YaoExportModule } from "../export/routerAbEd25519YaoExport.js";
+import { parseRouterAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.ts
 function createRouterAbEd25519YaoProductRegistrationStateV1() {
 	return {
@@ -49,15 +51,15 @@ const RECOVERY_STATE_KINDS = new Set([
 	"admission_failed",
 	"admitted",
 	"executing",
+	"execution_interrupted",
 	"execution_failed",
 	"staged",
 	"activating",
 	"activation_failed",
-	"promoted"
+	"promoted",
+	"superseded"
 ]);
 const EXPORT_STATE_KINDS = new Set([
-	"authorizing",
-	"authorization_failed",
 	"authorized",
 	"admitting",
 	"admission_failed",
@@ -76,6 +78,11 @@ function isStringMap(input) {
 	for (const [key, value] of input) if (typeof key !== "string" || typeof value !== "string") return false;
 	return true;
 }
+function isDispatchRootMap(input) {
+	if (!(input instanceof Map)) return false;
+	for (const [key, value] of input) if (typeof key !== "string" || parseRouterAbEd25519YaoTenantRootWireV1(value) === null) return false;
+	return true;
+}
 function isStringSet(input) {
 	if (!(input instanceof Set)) return false;
 	for (const value of input) if (typeof value !== "string") return false;
@@ -89,7 +96,7 @@ function hasProductStateCollections(input) {
 	const recovery = input.recovery;
 	const exportState = input.export;
 	if (!isPlainObject(registration) || !isPlainObject(authorization) || !isPlainObject(recovery) || !isPlainObject(exportState)) return false;
-	return isStringMapWithStateKinds(registration.states, REGISTRATION_STATE_KINDS) && isStringMap(registration.lifecycleSessions) && (registration.admissionClaims === void 0 || isStringMapWithStateKinds(registration.admissionClaims, REGISTRATION_ADMISSION_CLAIM_KINDS)) && Array.isArray(authorization.authorities) && authorization.authorities.every((authority) => isPlainObject(authority) && INTENT_AUTHORITY_KINDS.has(String(authority.kind))) && isStringMapWithStateKinds(recovery.capabilities, CAPABILITY_STATE_KINDS) && isStringMap(recovery.identityCapabilities) && isStringMapWithStateKinds(recovery.recoveries, RECOVERY_STATE_KINDS) && isStringMap(recovery.recoverySessions) && isStringMapWithStateKinds(exportState.exports, EXPORT_STATE_KINDS) && isStringSet(exportState.authorizationNonces) && (exportState.authorizationUncertain === void 0 || isStringSet(exportState.authorizationUncertain));
+	return isStringMapWithStateKinds(registration.states, REGISTRATION_STATE_KINDS) && isStringMap(registration.lifecycleSessions) && (registration.admissionClaims === void 0 || isStringMapWithStateKinds(registration.admissionClaims, REGISTRATION_ADMISSION_CLAIM_KINDS)) && isDispatchRootMap(registration.dispatchRoots) && Array.isArray(authorization.authorities) && authorization.authorities.every((authority) => isPlainObject(authority) && INTENT_AUTHORITY_KINDS.has(String(authority.kind))) && isStringMapWithStateKinds(recovery.capabilities, CAPABILITY_STATE_KINDS) && isStringMap(recovery.identityCapabilities) && isStringMapWithStateKinds(recovery.recoveries, RECOVERY_STATE_KINDS) && isStringMap(recovery.recoverySessions) && isStringMapWithStateKinds(exportState.exports, EXPORT_STATE_KINDS) && isStringSet(exportState.authorizationNonces) && (exportState.authorizationUncertain === void 0 || isStringSet(exportState.authorizationUncertain));
 }
 function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 	if (!hasProductStateCollections(input)) return {
@@ -106,7 +113,8 @@ function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 			registration: {
 				states: registration.states,
 				lifecycleSessions: registration.lifecycleSessions,
-				admissionClaims
+				admissionClaims,
+				dispatchRoots: registration.dispatchRoots
 			},
 			authorization: input.authorization,
 			recovery: input.recovery,
@@ -278,7 +286,7 @@ function createRouterAbEd25519YaoMaterialActivationRefV1(input) {
 }
 /**
 * Takes the authority *scope* rather than the authority because setup admits
-* before the proof exists (Refactor 94C). Callers holding a verified authority
+* before the proof exists. Callers holding a verified authority
 * pass `registrationEd25519AuthorityScopeFromAuthority(authority)`; setup
 * passes the scope derived from the requested auth method, and only when that
 * derivation is complete without a proof.