@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -1,6 +1,6 @@
 import { parsePasskeyEnvelopeId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { parsePasskeyCustodySecretBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
 import { buildActiveEnvelopeLifecycle, buildPasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1 } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
@@ -165,6 +165,6 @@ async function commitWalletCustodyRegistration(input) {
 	}
 }
 //#endregion
-export { buildWalletCustodyRegistrationRecords, commitWalletCustodyRegistration };
+export { commitWalletCustodyRegistration };
 
 //# sourceMappingURL=walletCustodyRegistrationCommit.js.map

package/dist/esm/router/domains/passkeyCustody/walletRecoveryFinalization.js

@@ -1,9 +1,9 @@
 import { parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { buildFullOwnerPermissionsV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { buildActiveWalletAuthorityV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, replaceActiveWalletAuthorityEd25519MaterialActivationV1, walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { buildActiveWalletAuthorityV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, replaceActiveWalletAuthorityEd25519MaterialActivationV1, sameVerifiedActiveWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { sameWalletCustodyEnvelopeOwnership } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { consumeReservedRecoveryCode } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
@@ -16,10 +16,6 @@ function requireWalletId(value) {
 	if (!parsed.ok) throw new Error(parsed.error.message);
 	return parsed.value;
 }
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
 function sameWalletCustodyRecoveryReplacementEnvelopeV1(left, right) {
 	if (left.kind !== right.kind || left.envelopeId !== right.envelopeId || left.walletId !== right.walletId || !sameWalletCustodyEnvelopeOwnership(left.ownership, right.ownership) || left.binding.kind !== "wallet_custody_seed_v1" || right.binding.kind !== "wallet_custody_seed_v1" || left.binding.derivationScheme !== right.binding.derivationScheme || left.envelopeVersion !== right.envelopeVersion || left.envelopeRevision !== right.envelopeRevision || left.nonceB64u !== right.nonceB64u || left.sealedCustodySecretB64u !== right.sealedCustodySecretB64u || left.ciphertextDigestB64u !== right.ciphertextDigestB64u || left.aadHashB64u !== right.aadHashB64u || left.lifecycle.state !== "active" || right.lifecycle.state !== "active" || left.lifecycle.activatedAtMs !== right.lifecycle.activatedAtMs || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
 	switch (left.factor.kind) {
@@ -38,9 +34,6 @@ function requireActivePasskeyWalletAuthMethodRecordV2(method) {
 	if (!isActivePasskeyWalletAuthMethodRecordV2(method)) throw new Error("recovery target auth method must be active passkey V2");
 	return method;
 }
-function isActivePasskeyCustodyEnvelopeRecord(envelope) {
-	return envelope.lifecycle.state === "active";
-}
 function continuityEnvelopeLocator(anchor) {
 	switch (anchor.envelope.kind) {
 		case "passkey": return {
@@ -64,13 +57,13 @@ function continuityEnvelopeLocator(anchor) {
 	}
 }
 function continuityEnvelopeMatchesAnchor(envelope, anchor) {
-	if (!isActivePasskeyCustodyEnvelopeRecord(envelope) || envelope.walletId !== anchor.envelope.walletId || envelope.envelopeId !== anchor.envelope.envelopeId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== anchor.method.walletAuthMethodId || envelope.envelopeRevision !== anchor.envelope.envelopeRevision || envelope.updatedAtMs !== anchor.envelope.updatedAtMs) return false;
+	if (envelope.lifecycle.state !== "active" || envelope.walletId !== anchor.envelope.walletId || envelope.envelopeId !== anchor.envelope.envelopeId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== anchor.method.walletAuthMethodId || envelope.envelopeRevision !== anchor.envelope.envelopeRevision || envelope.updatedAtMs !== anchor.envelope.updatedAtMs) return false;
 	switch (anchor.envelope.kind) {
 		case "passkey": return envelope.factor.kind === "passkey" && envelope.factor.rpId === anchor.envelope.rpId && envelope.factor.credentialIdB64u === anchor.envelope.credentialIdB64u;
 		case "email_otp": return envelope.factor.kind === "email_otp" && envelope.factor.enrollmentId === anchor.envelope.enrollmentId && envelope.factor.enrollmentSealKeyVersion === anchor.envelope.enrollmentSealKeyVersion;
 	}
 }
-async function readContinuityAnchor(input) {
+async function readRecoveryContinuityAnchor(input) {
 	const authority = await input.walletAuthorityStore.readById(input.anchor.authority.authorityId);
 	const expectedAuthority = authority ? await recoveryContinuityAuthorityAfterActivation({
 		authority: input.anchor.authority,
@@ -96,18 +89,15 @@ async function readContinuityAnchor(input) {
 		kind: "rejected",
 		reason: "the recovery continuity authority changed"
 	};
-	const authorityRef = {
-		kind: "wallet_auth_authority_ref",
-		walletId: input.walletId,
-		authorityDigest: authorityDigest.value,
-		walletAuthMethodId: input.anchor.method.walletAuthMethodId
-	};
 	return {
 		kind: "ready",
 		authority,
-		method,
-		envelope: envelopeLookup.envelope,
-		authorityRef
+		authorityRef: {
+			kind: "wallet_auth_authority_ref",
+			walletId: input.walletId,
+			authorityDigest: authorityDigest.value,
+			walletAuthMethodId: input.anchor.method.walletAuthMethodId
+		}
 	};
 }
 async function recoveryContinuityAuthorityAfterActivation(input) {
@@ -135,15 +125,15 @@ async function buildRecoveredWalletAuthority(input) {
 	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
 	const draft = {
 		kind: "wallet_authority_v1",
-		authorityId: input.challenge.targetAuthorityId,
+		authorityId: input.target.targetAuthorityId,
 		walletId: input.walletId,
 		principal: {
 			kind: "owner_device",
-			deviceId: input.challenge.targetDeviceId
+			deviceId: input.target.targetDeviceId
 		},
 		provenance: {
 			kind: "wallet_recovery",
-			recoveryOperationId: input.challenge.recoveryOperationId,
+			recoveryOperationId: input.target.recoveryOperationId,
 			continuityAuthorityId: input.continuityAuthority.authorityId
 		},
 		permissions: buildFullOwnerPermissionsV1(),
@@ -242,20 +232,11 @@ function buildRecoveredCredentialBinding(input) {
 		updatedAtMs: input.nowMs
 	};
 	if (source) {
-		if (source.nearAccountId === void 0 || source.nearEd25519SigningKeyId === void 0 || source.publicKey === void 0 || source.signerSlot === void 0) return {
-			version: "webauthn_credential_binding_v1",
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			userId: input.userId,
-			...source.relayerKeyId ? { relayerKeyId: source.relayerKeyId } : {},
-			...source.keyVersion ? { keyVersion: source.keyVersion } : {},
-			...typeof source.recoveryExportCapable === "boolean" ? { recoveryExportCapable: source.recoveryExportCapable } : {},
-			...source.clientParticipantId !== void 0 ? { clientParticipantId: source.clientParticipantId } : {},
-			...source.relayerParticipantId !== void 0 ? { relayerParticipantId: source.relayerParticipantId } : {},
-			...source.participantIds ? { participantIds: [...source.participantIds] } : {},
-			...source.runtimePolicyScope ? { runtimePolicyScope: source.runtimePolicyScope } : {},
-			createdAtMs: input.nowMs,
-			updatedAtMs: input.nowMs
+		const ed25519 = source.nearAccountId === void 0 || source.nearEd25519SigningKeyId === void 0 || source.publicKey === void 0 || source.signerSlot === void 0 ? {} : {
+			nearAccountId: source.nearAccountId,
+			nearEd25519SigningKeyId: source.nearEd25519SigningKeyId,
+			publicKey: source.publicKey,
+			signerSlot: source.signerSlot
 		};
 		return {
 			version: "webauthn_credential_binding_v1",
@@ -269,10 +250,7 @@ function buildRecoveredCredentialBinding(input) {
 			...source.relayerParticipantId !== void 0 ? { relayerParticipantId: source.relayerParticipantId } : {},
 			...source.participantIds ? { participantIds: [...source.participantIds] } : {},
 			...source.runtimePolicyScope ? { runtimePolicyScope: source.runtimePolicyScope } : {},
-			nearAccountId: source.nearAccountId,
-			nearEd25519SigningKeyId: source.nearEd25519SigningKeyId,
-			publicKey: source.publicKey,
-			signerSlot: source.signerSlot,
+			...ed25519,
 			createdAtMs: input.nowMs,
 			updatedAtMs: input.nowMs
 		};
@@ -382,7 +360,7 @@ async function finalizeRecoveredWalletCredentialV1(input) {
 			reason: error instanceof Error ? error.message : "wallet recovery key manifest unavailable"
 		};
 	}
-	const continuity = await readContinuityAnchor({
+	const continuity = await readRecoveryContinuityAnchor({
 		walletId,
 		anchor: challenge.continuityAnchor,
 		manifest,
@@ -483,7 +461,7 @@ async function finalizeRecoveredWalletCredentialV1(input) {
 	});
 	const authority = await buildRecoveredWalletAuthority({
 		walletId,
-		challenge,
+		target: challenge,
 		continuityAuthority: continuity.authority,
 		manifest,
 		nowMs: input.nowMs
@@ -647,6 +625,6 @@ async function resolveCommittedRecoveryReplayV1(input) {
 	};
 }
 //#endregion
-export { finalizeRecoveredWalletCredentialV1, resolveCommittedRecoveryReplayV1 };
+export { buildConsumedRecoverySet, buildRecoveredWalletAuthority, finalizeRecoveredWalletCredentialV1, parseRecoveryAuthorityDigest, readRecoveryContinuityAnchor, resolveCommittedRecoveryReplayV1, sameWalletCustodyRecoveryReplacementEnvelopeV1 };
 
 //# sourceMappingURL=walletRecoveryFinalization.js.map

package/dist/esm/router/domains/passkeyCustody/walletRecoveryKeyManifest.js

@@ -1,6 +1,6 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
@@ -19,8 +19,8 @@ async function buildWalletRecoveryEcdsaPossessionChallengesV1(input) {
 	const challenges = /* @__PURE__ */ new Map();
 	for (const entry of input.manifest.entries) {
 		if (entry.kind !== "evm_family_ecdsa") continue;
-		const publicCapabilityDigestB64u = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(entry.publicCapability))));
-		const serverNonceB64u = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`seams:wallet-recovery-ecdsa-server-nonce:v1|${input.challengeB64u}|${entry.keySetId}`)));
+		const publicCapabilityDigestB64u = await sha256Utf8DigestB64u(alphabetizeStringify(entry.publicCapability));
+		const serverNonceB64u = await sha256Utf8DigestB64u(`seams:wallet-recovery-ecdsa-server-nonce:v1|${input.challengeB64u}|${entry.keySetId}`);
 		challenges.set(entry.keySetId, {
 			kind: "wallet_recovery_ecdsa_possession_challenge_v1",
 			walletId: String(input.walletId),
@@ -351,7 +351,7 @@ async function verifyEcdsaMaterialPossessionActivation(input) {
 	if (!proof || input.proofs.filter((candidate) => candidate.keySetId === input.entry.keySetId).length !== 1) return `wallet recovery ECDSA possession proof is missing for ${input.entry.keySetId}`;
 	const activationReceipt = input.activationReceipts.find((candidate) => candidate.keySetId === input.entry.keySetId)?.activationReceipt;
 	if (!activationReceipt || input.activationReceipts.filter((candidate) => candidate.keySetId === input.entry.keySetId).length !== 1 || !sameRouterAbEcdsaRegistrationActivationReceiptV1(activationReceipt, input.entry.activationReceipt)) return `wallet recovery ECDSA activation receipt changed for ${input.entry.keySetId}`;
-	const expectedPublicCapabilityDigestB64u = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(input.entry.publicCapability))));
+	const expectedPublicCapabilityDigestB64u = await sha256Utf8DigestB64u(alphabetizeStringify(input.entry.publicCapability));
 	if (!sameWalletRecoveryEcdsaPossessionChallengeV1(parseWalletRecoveryEcdsaPossessionChallengeV1({
 		...challenge,
 		walletId: String(input.walletId),

package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js

@@ -84,6 +84,6 @@ function parseEd25519VerifiedStepUpAuthorizedOperationReceipt(value) {
 	};
 }
 //#endregion
-export { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireAuthorizedOperationReceiptString, requireEd25519OperationKind, requireExactAuthorizedOperationReceiptFields };
+export { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind };
 
 //# sourceMappingURL=ed25519AuthorizedOperationReceipt.js.map