@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/device-linking/deviceManagement.js

@@ -0,0 +1,55 @@
+import { requireRecord } from "../utils/validation.js";
+import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { nullableToken, parseNonNegativeSafeInteger, parseUnixTime, walletAuthMethodId, walletAuthorityId, walletId } from "./wireFields.js";
+//#region ../shared-ts/src/device-linking/deviceManagement.ts
+function parseLinkedDeviceRevokeWalletAuthMethodId(raw, label) {
+	const value = walletAuthMethodId(raw, label);
+	if (value.startsWith("wallet-authority:") || value.startsWith("authority:")) throw new Error(`${label} must identify a WalletAuthMethodId`);
+	return value;
+}
+function parsePositiveSafeInteger(raw, label) {
+	const value = parseNonNegativeSafeInteger(raw, label);
+	if (value < 1) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function linkedDeviceListRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_list_request_v1"),
+		walletId,
+		limit: parsePositiveSafeInteger,
+		cursor: nullableToken
+	});
+}
+function parseLinkedDeviceListRequestV1(raw) {
+	return linkedDeviceListRequestV1()(raw, "LinkedDeviceListRequestV1");
+}
+function linkedDeviceRevokeRequestV1() {
+	return wireObject({
+		kind: wireLiteral("linked_device_revoke_request_v1"),
+		walletId,
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
+		requestedAtMs: parseUnixTime
+	});
+}
+function parseLinkedDeviceRevokeRequestV1(raw) {
+	return linkedDeviceRevokeRequestV1()(raw, "LinkedDeviceRevokeRequestV1");
+}
+function linkedDeviceRevokeFailureV1() {
+	return wireObject({ kind: wireLiteral("not_found", "conflict", "unauthorized") });
+}
+function linkedDeviceRevokedV1() {
+	return wireObject({
+		kind: wireLiteral("revoked"),
+		walletAuthMethodId: parseLinkedDeviceRevokeWalletAuthMethodId,
+		authorityId: walletAuthorityId,
+		revocationEpoch: parseNonNegativeSafeInteger
+	});
+}
+function parseLinkedDeviceRevokeResultV1(raw) {
+	const record = requireRecord(raw, "LinkedDeviceRevokeResultV1");
+	return (record.kind === "not_found" || record.kind === "conflict" || record.kind === "unauthorized" ? linkedDeviceRevokeFailureV1() : linkedDeviceRevokedV1())(record, "LinkedDeviceRevokeResultV1");
+}
+//#endregion
+export { parseLinkedDeviceListRequestV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 };
+
+//# sourceMappingURL=deviceManagement.js.map

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -1,7 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256Bytes, sha256BytesUtf8 } from "../utils/digests.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { sha256DigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
+import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/digests.ts
 const CLAIM_DOMAIN = "seams/linked-device/session-claim/v1";
@@ -15,7 +15,7 @@ const TEXT_ENCODER = new TextEncoder();
 * opaque token directly keeps the browser binding identical to that row.
 */
 async function computeWalletSessionOperationCredentialDigestB64u(credential) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(credential.token)));
+	return sha256Utf8DigestB64u(credential.token);
 }
 function encodeWalletSessionInstallationReceiptV1(receipt) {
 	return alphabetizeStringify({
@@ -24,67 +24,12 @@ function encodeWalletSessionInstallationReceiptV1(receipt) {
 	});
 }
 async function computeWalletSessionInstallationReceiptDigestB64u(receipt) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(encodeWalletSessionInstallationReceiptV1(receipt))));
-}
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return Uint8Array.from([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
+	return sha256Utf8DigestB64u(encodeWalletSessionInstallationReceiptV1(receipt));
 }
 function requirePresentString(value, label) {
 	if (value === void 0) throw new Error(`${label} is required`);
 	return value;
 }
-function rawDigest(value, label) {
-	try {
-		const decoded = base64UrlDecode(parseDigestB64u(value));
-		if (decoded.length !== 32) throw new Error("must decode to 32 bytes");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
-function rawPublicKey(value, label) {
-	try {
-		const decoded = base64UrlDecode(value);
-		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
 function encodeOwnerAuthorization(value) {
 	return concat([
 		text(value.kind, "ownerAuthorization.kind"),
@@ -153,7 +98,7 @@ function encodeLinkedDevicePasskeyTargetConfigurationV1(value) {
 	]);
 }
 async function computeLinkedDevicePasskeyTargetConfigurationDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLinkedDevicePasskeyTargetConfigurationV1(value))));
+	return sha256DigestB64u(encodeLinkedDevicePasskeyTargetConfigurationV1(value));
 }
 function encodeRecipientRequirement(value) {
 	return concat([
@@ -188,7 +133,7 @@ function encodeLinkedDeviceSessionClaimV1(value) {
 	]);
 }
 async function computeLinkedDeviceSessionClaimDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLinkedDeviceSessionClaimV1(value))));
+	return sha256DigestB64u(encodeLinkedDeviceSessionClaimV1(value));
 }
 function encodeLinkedDeviceApprovalV1(value) {
 	return concat([
@@ -209,7 +154,7 @@ function encodeLinkedDeviceApprovalV1(value) {
 	]);
 }
 async function computeLinkedDeviceApprovalDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLinkedDeviceApprovalV1(value))));
+	return sha256DigestB64u(encodeLinkedDeviceApprovalV1(value));
 }
 function encodeLinkedDeviceTargetPreparationV1(value) {
 	const requirements = value.ordinarySignerMaterialRecipientRequirements.map(encodeRecipientRequirement);
@@ -247,7 +192,7 @@ function isPasskeyTargetPreparationV1(value) {
 	return value.targetFactor.kind === "passkey_prf";
 }
 async function computeLinkedDeviceTargetPreparationDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLinkedDeviceTargetPreparationV1(value))));
+	return sha256DigestB64u(encodeLinkedDeviceTargetPreparationV1(value));
 }
 async function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1(input) {
 	const { preparation, registration } = input;
@@ -268,6 +213,6 @@ async function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV
 	}
 }
 //#endregion
-export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u, encodeLinkedDeviceApprovalV1, encodeLinkedDevicePasskeyTargetConfigurationV1, encodeLinkedDeviceSessionClaimV1, encodeLinkedDeviceTargetPreparationV1, encodeWalletSessionInstallationReceiptV1 };
+export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u };
 
 //# sourceMappingURL=digests.js.map

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -1,6 +1,8 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export

package/dist/esm/shared-ts/src/device-linking/index.js

@@ -1,9 +1,12 @@
 import "./contracts.js";
+import "./activeWalletSession.js";
 import "./ed25519ExportRoot.js";
 import "./delegatedActivationPlan.js";
-import "./walletSessionCredentialDelivery.js";
 import "./sourceContribution.js";
 import "./committedSignerPackages.js";
 import "./parsers.js";
+import "./deviceManagement.js";
+import "./walletSessionCredentialDelivery.js";
+import "./authorityActivation.js";
 import "./digests.js";
 import "./requestProof.js";