@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/shared-ts/src/utils/exactRecord.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Rejects every field outside this record's exact shape.
+ *
+ * `knownOnOtherBranches` names fields that are legitimate public bindings
+ * somewhere else in the same union. Those are reported as the branch mismatch
+ * they are; only genuinely unknown fields are classified as leaks, so a public
+ * key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
+ * for plaintext custody material.
+ */
+export declare function rejectUnknownFields(record: Record<string, unknown>, allowed: readonly string[], label: string, knownOnOtherBranches?: readonly string[]): void;
+export declare function exactRecord(raw: unknown, fields: readonly string[], label: string): Record<string, unknown>;
+//# sourceMappingURL=exactRecord.d.ts.map

package/dist/types/shared-ts/src/utils/index.d.ts

@@ -11,13 +11,15 @@ export * from './theme';
 export * from './keccak';
 export * from './jsonRpc';
 export * from './nearRpcResults';
-export * from './recoveryDomain';
-export * from './paillier';
 export * from './signingSessionSeal';
 export * from './emailOtpRecoveryKey';
 export * from './addAuthMethodRegistration';
 export * from './addWalletAuthMethod';
 export * from './registrationIntent';
+export * from './walletAuthMethodRecord';
+export * from './registrationIds';
+export * from './registrationSignerPlan';
+export { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, type AddAuthMethodInput, type EmailOtpRegistrationAuthMethodInput, type EmailOtpRegistrationProof, type PasskeyRegistrationAuthMethodInput, type RegisterWalletInput, type RegistrationAuthMethodInput, type RegistrationAuthority, type WalletAddAuthMethodEmailOtpTargetV1, type WalletEmailOtpEnrollmentMaterialV1, } from './registrationAuthMethodInput';
 export * from './domainIds';
 export * from './webauthnDeviceInfo';
 export * from './walletCapabilityBindings';
@@ -27,6 +29,7 @@ export * from './secureRandomId';
 export * from './routerAbPublicKeyset';
 export * from './routerAbEcdsaDerivation';
 export * from './routerAbEd25519Yao';
+export { deriveRouterAbEd25519YaoApplicationBindingDigestV1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, deriveRouterAbEd25519YaoStableContextBindingV1, } from './routerAbEd25519YaoDigests';
 export * from './routerAbTraceContext';
 export * from './authenticatorOptions';
 export * from './canonicalPrimitives';

package/dist/types/shared-ts/src/utils/jsonRpc.d.ts

@@ -1,4 +1,4 @@
-export type JsonRpcId = string | number | null;
+type JsonRpcId = string | number | null;
 export type JsonRpcErrorDetails = {
     code?: number | string;
     name?: string;
@@ -17,7 +17,7 @@ export type JsonRpcEnvelope = {
     error: JsonRpcErrorDetails;
     result?: never;
 };
-export type JsonRpcEnvelopeDecodeResult = {
+type JsonRpcEnvelopeDecodeResult = {
     ok: true;
     value: JsonRpcEnvelope;
     error?: never;
@@ -27,4 +27,5 @@ export type JsonRpcEnvelopeDecodeResult = {
     value?: never;
 };
 export declare function decodeJsonRpcEnvelope(value: unknown): JsonRpcEnvelopeDecodeResult;
+export {};
 //# sourceMappingURL=jsonRpc.d.ts.map

package/dist/types/shared-ts/src/utils/near.d.ts

@@ -38,7 +38,7 @@ export declare function validateNearAccountId(nearAccountId: string, options?: N
  * - chars: lowercase letters, digits, `_`, `.`, `-`
  */
 export declare function isValidAccountId(accountId: unknown): accountId is string;
-export type NearAccountIdParseResult<T> = {
+type NearAccountIdParseResult<T> = {
     ok: true;
     value: T;
 } | {
@@ -78,4 +78,5 @@ export declare function formatNearRpcError(operationName: string, rpc: {
  * Falls back to undefined when structure is not recognized.
  */
 export declare function getNearShortErrorMessage(error: unknown): string | undefined;
+export {};
 //# sourceMappingURL=near.d.ts.map

package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts

@@ -1,19 +1,19 @@
 import { ExecutionStatusBasic, FinalExecutionStatusBasic, type ExecutionError, type TxExecutionStatus } from '@near-js/types';
 export type NearRpcResultDecoder<T> = (value: unknown) => T;
-export type DecodedNearFunctionCallPermission = {
+type DecodedNearFunctionCallPermission = {
     FunctionCall: {
         allowance: string;
         receiver_id: string;
         method_names: string[];
     };
 };
-export type DecodedNearAccessKeyView = {
+type DecodedNearAccessKeyView = {
     block_height: number;
     block_hash: string;
     nonce: bigint;
     permission: 'FullAccess' | DecodedNearFunctionCallPermission;
 };
-export type DecodedNearAccessKeyList = {
+type DecodedNearAccessKeyList = {
     block_height: number;
     block_hash: string;
     keys: Array<{
@@ -21,7 +21,7 @@ export type DecodedNearAccessKeyList = {
         access_key: DecodedNearAccessKeyView;
     }>;
 };
-export type DecodedNearAccountView = {
+type DecodedNearAccountView = {
     block_height: number;
     block_hash: string;
     amount: bigint;
@@ -36,7 +36,7 @@ export type DecodedNearBlockReference = {
         height: number;
     };
 };
-export type DecodedNearContractCallResult = {
+type DecodedNearContractCallResult = {
     block_height: number;
     block_hash: string;
     logs: string[];
@@ -46,14 +46,14 @@ type DecodedNearExecutionError = ExecutionError & {
     InvalidTxError?: unknown;
     ActionError?: unknown;
 };
-export type DecodedNearFinalExecutionStatus = {
+type DecodedNearFinalExecutionStatus = {
     SuccessValue: string;
     Failure?: never;
 } | {
     Failure: DecodedNearExecutionError;
     SuccessValue?: never;
 } | FinalExecutionStatusBasic;
-export type DecodedNearExecutionStatus = {
+type DecodedNearExecutionStatus = {
     SuccessValue: string;
     SuccessReceiptId?: never;
     Failure?: never;

package/dist/types/shared-ts/src/utils/normalize.d.ts

@@ -11,10 +11,6 @@ export declare function normalizeOptionalTrimmedString(value: unknown): string;
 export declare function normalizeTrimmedString(value: unknown): string;
 /** String coercion + trimming + lowercase. */
 export declare function normalizeLowercaseString(value: unknown): string;
-/** String coercion + trimming + uppercase. */
-export declare function normalizeUppercaseString(value: unknown): string;
-/** Normalize session kind into the canonical `'jwt' | 'cookie'` token. */
-export declare function normalizeJwtCookieSessionKind(value: unknown): 'jwt' | 'cookie';
 /** String coercion + trimming; empty => undefined. */
 export declare function normalizeOptionalNonEmptyString(value: unknown): string | undefined;
 /** Convert unknown to finite number; non-finite => null. */

package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts

@@ -0,0 +1,184 @@
+import { type ChallengeSubjectId, type EmailOtpChallengeId, type OrgId, type ProviderSubject, type WalletId, type WebAuthnRpId } from './domainIds';
+import type { WebAuthnAuthenticatorDeviceInfo } from './webauthnDeviceInfo';
+export type RegisterWalletInput = {
+    kind: 'server_allocated';
+    walletId?: never;
+} | {
+    kind: 'provided';
+    walletId: WalletId;
+};
+export type PasskeyRegistrationAuthMethodInput = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    authenticatorOptions?: unknown;
+    email?: never;
+    otpCode?: never;
+    challengeId?: never;
+};
+export type EmailOtpRegistrationAuthMethodInput = {
+    kind: 'email_otp';
+    proofKind: 'otp_challenge';
+    email: string;
+    providerSubject: string;
+    otpCode: string;
+    challengeId?: string;
+    rpId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+    authenticatorOptions?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'google_sso_registration';
+    email: string;
+    providerSubject: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    rpId?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+};
+export type RegistrationAuthMethodInput = PasskeyRegistrationAuthMethodInput | EmailOtpRegistrationAuthMethodInput;
+export type AddAuthMethodInput = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    email?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+} | {
+    kind: 'email_otp';
+    email: string;
+    rpId?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+};
+export type RegistrationAuthority = {
+    kind: 'passkey';
+    walletId: WalletId;
+    rpId: WebAuthnRpId;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    /** Device metadata captured at registration verification (UA + attestation). */
+    device: WebAuthnAuthenticatorDeviceInfo;
+    registrationIntentDigestB64u: string;
+    providerSubject?: never;
+    challengeSubjectId?: never;
+    email?: never;
+    emailHashHex?: never;
+    registrationAuthorityId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    originalWalletId?: never;
+    finalWalletId?: never;
+    orgId?: never;
+    challengePurpose?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'otp_challenge';
+    walletId: WalletId;
+    /** OIDC provider subject verified for the OTP registration proof. */
+    providerSubject: ProviderSubject;
+    /** Challenge owner verified against the OTP challenge record. */
+    challengeSubjectId: ChallengeSubjectId;
+    /** Normalized email address that received and verified the OTP. */
+    email: string;
+    emailHashHex: string;
+    challengeId: EmailOtpChallengeId;
+    registrationAuthorityId: EmailOtpChallengeId;
+    /** Wallet id attached to the original OTP challenge before any name reroll. */
+    originalWalletId: WalletId;
+    /** Final wallet id selected for registration. */
+    finalWalletId: WalletId;
+    /** Tenant scope verified against the OTP challenge record. */
+    orgId: OrgId;
+    /** Operation-bound owner proof digest verified against the OTP challenge record. */
+    ownerProofBindingDigest: string;
+    challengePurpose: 'registration' | 'registration_reroll';
+    registrationIntentDigestB64u: string;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+    device?: never;
+    rpId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'google_sso_registration';
+    walletId: WalletId;
+    providerSubject: ProviderSubject;
+    email: string;
+    emailHashHex: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    registrationAuthorityId: string;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+    registrationIntentDigestB64u: string;
+    challengeSubjectId?: never;
+    challengeId?: never;
+    originalWalletId?: never;
+    challengePurpose?: never;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+    device?: never;
+    rpId?: never;
+};
+export type EmailOtpRegistrationProof = {
+    version: 'email_otp_registration_proof_v1';
+    proofKind: 'otp_challenge';
+    providerSubject: string;
+    /** Normalized email address that received the OTP. */
+    email: string;
+    challengeId: string;
+    otpCode: string;
+    otpChannel: 'email_otp';
+    /** Registration intent digest that binds the OTP proof to the wallet-registration request. */
+    registrationIntentDigestB64u: string;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    version: 'email_otp_registration_proof_v1';
+    proofKind: 'google_sso_registration';
+    providerSubject: string;
+    email: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    registrationIntentDigestB64u: string;
+    challengeId?: never;
+    otpCode?: never;
+    otpChannel?: never;
+};
+export declare function inspectRawObject(value: unknown): object | null;
+export declare function trimString(value: unknown): string;
+export declare function normalizeRegistrationAuthMethodInput(raw: unknown): RegistrationAuthMethodInput | null;
+export declare function normalizeAddAuthMethodInput(raw: unknown): AddAuthMethodInput | null;
+export declare function normalizeEmailOtpRegistrationProof(raw: unknown): EmailOtpRegistrationProof | null;
+/** What a client sends to create a wallet's shared Email OTP enrollment. */
+export type WalletEmailOtpEnrollmentMaterialV1 = {
+    enrollmentSealKeyVersion: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+};
+export type WalletAddAuthMethodEmailOtpTargetV1 = {
+    readonly kind: 'existing_enrollment';
+    readonly enrollment?: never;
+} | {
+    readonly kind: 'new_enrollment';
+    readonly enrollment: WalletEmailOtpEnrollmentMaterialV1;
+};
+//# sourceMappingURL=registrationAuthMethodInput.d.ts.map

package/dist/types/shared-ts/src/utils/registrationContracts.d.ts

@@ -0,0 +1,76 @@
+import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../authorization/capabilityKinds';
+import type { WalletSessionOperationCredentialV1 } from '../device-linking/contracts';
+import type { Ed25519AuthorityScope } from '../threshold/sessionPolicy';
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { WalletId } from './registrationIntent';
+import type { RegistrationSignerSetSelection } from './registrationSignerPlan';
+import type { RegisterWalletInput, RegistrationAuthMethodInput } from './registrationAuthMethodInput';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from './routerAbEd25519Yao';
+import type { WALLET_AUTH_METHODS } from './signerDomain';
+import type { RouterAbEd25519NormalSigningState } from './signingSessionSeal';
+import type { Variant } from './variant';
+export type CreateRegistrationIntentRequest = {
+    wallet: RegisterWalletInput;
+    authMethod: RegistrationAuthMethodInput;
+    signerSelection: RegistrationSignerSetSelection;
+};
+export type WalletRegistrationEd25519YaoStart = {
+    admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+};
+export type WalletRegistrationEd25519YaoActivationReference = {
+    kind: 'router_ab_ed25519_yao_activation_reference_v1';
+    lifecycle_id: string;
+    session_id: RouterAbEd25519YaoBytes32V1;
+};
+export type WalletRegistrationFinalizeAuthMethod = {
+    kind: typeof WALLET_AUTH_METHODS.passkey;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+} | {
+    kind: typeof WALLET_AUTH_METHODS.emailOtp;
+    registrationAuthorityId: string;
+};
+export type PasskeyWalletRegistrationFinalizeAuthMethod = Variant<WalletRegistrationFinalizeAuthMethod, 'kind', typeof WALLET_AUTH_METHODS.passkey>;
+export type EmailOtpWalletRegistrationFinalizeAuthMethod = Variant<WalletRegistrationFinalizeAuthMethod, 'kind', typeof WALLET_AUTH_METHODS.emailOtp>;
+export type WalletRegistrationEd25519YaoSignerRuntimeBootstrap = {
+    walletId: WalletId;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: Ed25519AuthorityScope;
+    thresholdSessionId: string;
+    authorizationId: WalletSessionAuthorizationId;
+    walletSessionId: WalletSessionId;
+    quotaId: MpcWalletSigningQuotaId;
+    expiresAtMs: number;
+    participantIds: readonly [number, number];
+    remainingUses: number;
+    signingRootId: string;
+    signingRootVersion: string;
+    runtimePolicyScope: RuntimePolicyScope;
+    routerAbNormalSigning: RouterAbEd25519NormalSigningState;
+};
+/**
+ * The Ed25519 Yao view of one exact Wallet Session. A session this response
+ * just issued carries its own primary operation credential; a session it
+ * reuses carries none, because the credential was delivered once by the
+ * issuing response and a committed digest cannot reproduce plaintext.
+ */
+export type WalletRegistrationEd25519YaoBootstrapSession = (WalletRegistrationEd25519YaoSignerRuntimeBootstrap & {
+    sessionKind: 'issued_exact_wallet_session';
+    operationCredential: WalletSessionOperationCredentialV1;
+}) | (WalletRegistrationEd25519YaoSignerRuntimeBootstrap & {
+    sessionKind: 'already_committed_exact_wallet_session';
+    operationCredential?: never;
+});
+export type WalletEd25519YaoSignerPublicResult = {
+    signerSlot: number;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    publicKey: string;
+    relayerKeyId: string;
+    keyVersion: string;
+    recoveryExportCapable: true;
+    participantIds: readonly [number, number];
+};
+//# sourceMappingURL=registrationContracts.d.ts.map

package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts

@@ -3,7 +3,7 @@ import { type WalletId } from './domainIds';
 import type { MpcMaterialActivationRef, ThresholdEcdsaSessionId, ThresholdEd25519SessionId } from './domainIds';
 import { type ThresholdEcdsaKeyHandle } from './thresholdEcdsaKeyHandle';
 import { type NearAccountId } from './near';
-import { type NearEd25519SigningKeyId } from './registrationIntent';
+import { type NearEd25519SigningKeyId } from './registrationIds';
 import { type RuntimePolicyScope } from '../threshold/signingRootScope';
 import { type RouterAbEd25519NormalSigningState } from './signingSessionSeal';
 import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from './routerAbEcdsaDerivation';
@@ -80,6 +80,5 @@ export type RegistrationEstablishedSessionResultV2 = {
     readonly next: 'unlock_exact_method';
 };
 export declare function parseRegistrationEstablishedSessionResultV2(raw: unknown): RegistrationEstablishedSessionResultV2 | null;
-export declare function parseRegistrationEstablishedSessionV2(raw: unknown): RegistrationEstablishedSessionV2 | null;
 export declare function parseRegistrationEstablishedSessionProjectionV2(raw: unknown): RegistrationEstablishedSessionProjectionV2 | null;
 //# sourceMappingURL=registrationEstablishedSession.d.ts.map

package/dist/types/shared-ts/src/utils/registrationIds.d.ts

@@ -0,0 +1,56 @@
+import { type EmailOtpProviderUserId, type WalletId, type WebAuthnRpId } from './domainIds';
+import type { RegistrationAuthority } from './registrationAuthMethodInput';
+import type { ThresholdEd25519RegistrationSpec } from './registrationSignerPlan';
+import type { EmailOtpProvider } from './walletAuthAuthority';
+export type ServerAllocatedWalletId = WalletId & {
+    readonly __serverAllocatedWalletIdBrand: unique symbol;
+};
+export type NearEd25519SigningKeyId = string & {
+    readonly __nearEd25519SigningKeyIdBrand: unique symbol;
+};
+export declare function walletIdFromString(value: string): WalletId;
+export declare function createServerAllocatedWalletId(): ServerAllocatedWalletId;
+export declare function createReadableWalletId(): WalletId;
+export declare function nearEd25519SigningKeyIdFromString(value: string): NearEd25519SigningKeyId;
+export declare function parseNearEd25519SigningKeyId(value: unknown): NearEd25519SigningKeyId;
+export declare function computeAddSignerNearEd25519SigningKeyId(input: {
+    kind: 'wallet_add_signer_implicit_near_ed25519_key_v1';
+    walletId: WalletId;
+    signingRootId: string;
+    signingRootVersion: string;
+    signerSlot: number;
+    participantIds: readonly number[];
+    keyPurpose: string;
+    keyVersion: string;
+    derivationVersion: number;
+}): Promise<NearEd25519SigningKeyId>;
+export type RegistrationEd25519AuthorityScope = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    proofKind?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    provider: EmailOtpProvider;
+    providerUserId: EmailOtpProviderUserId;
+    proofKind?: never;
+    rpId?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+};
+export declare function registrationEd25519AuthorityScopeFromAuthority(authority: RegistrationAuthority): RegistrationEd25519AuthorityScope;
+export declare function computeRegistrationNearEd25519SigningKeyId(input: {
+    walletId: WalletId;
+    authorityScope: RegistrationEd25519AuthorityScope;
+    signingRootId: string;
+    signingRootVersion: string;
+    ed25519: ThresholdEd25519RegistrationSpec;
+}): Promise<NearEd25519SigningKeyId>;
+//# sourceMappingURL=registrationIds.d.ts.map