@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts

@@ -12,7 +12,7 @@ import type { WalletRecoveryEcdsaPossessionChallengeV1 } from '../../../../../sh
 import { type WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 export type { WalletRecoveryKeySetId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
-export type WalletRecoveryKeyManifestEntryV1 = {
+type WalletRecoveryKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
     readonly keySetId: `near_ed25519:${string}`;
     readonly signerId: string;
@@ -64,7 +64,7 @@ export type PreparedEd25519RecoveryAdmissionV1 = {
         readonly kind: 'near_ed25519';
     }>[];
 };
-export type WalletRecoveryPreparationKeyManifestEntryV1 = {
+type WalletRecoveryPreparationKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
     readonly keySetId: `near_ed25519:${string}`;
     readonly signerId: string;
@@ -79,7 +79,7 @@ export type WalletRecoveryPreparationKeyManifestEntryV1 = {
     readonly recordedKeyManifestDigestB64u: string;
     readonly recoveryBasis: WalletRecoveryPreparationEcdsaRecoveryBasisV1;
 };
-export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+type WalletRecoveryPreparationNearRecoveryBasisV1 = {
     readonly capabilityKind: 'registration' | 'recovery';
     readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
     readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
@@ -91,7 +91,7 @@ export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
     readonly activationStateEpoch: number;
     readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
 };
-export type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
+type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
     readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
     readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
     readonly serverGeneration: EcdsaServerGeneration;
@@ -104,7 +104,7 @@ export type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
     readonly participantIds: readonly [number, number];
     readonly possessionChallenge: WalletRecoveryEcdsaPossessionChallengeV1;
 };
-export type WalletUnlockKeyManifestEntryV1 = {
+type WalletUnlockKeyManifestEntryV1 = {
     readonly kind: 'near_ed25519';
     readonly keySetId: `near_ed25519:${string}`;
     readonly signerId: string;
@@ -134,7 +134,7 @@ export type WalletRecoveryPreparationKeyManifestV1 = {
     readonly walletId: WalletId;
     readonly entries: readonly WalletRecoveryPreparationKeyManifestEntryV1[];
 };
-export type WalletRecoveryActivationVerification = {
+type WalletRecoveryActivationVerification = {
     readonly kind: 'verified';
     readonly keySetIds: readonly WalletRecoveryKeySetId[];
 } | {
@@ -145,7 +145,7 @@ export type WalletRecoveryEcdsaMaterialPossessionProofInputV1 = {
     readonly keySetId: string;
     readonly proof: WalletRecoveryEcdsaPossessionProofV1;
 };
-export type WalletRecoveryEcdsaActivationReceiptInputV1 = {
+type WalletRecoveryEcdsaActivationReceiptInputV1 = {
     readonly keySetId: string;
     readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
 };

package/dist/types/wallet-server/src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.d.ts

@@ -23,10 +23,7 @@ export type Ed25519VerifiedStepUpAuthorizedOperationReceipt = {
     readonly display_digest_b64u: string;
     readonly operation_fingerprint_digest: string;
 };
-export type Ed25519AuthorizedOperationReceipt = Ed25519ReusableAuthorizedOperationReceipt | Ed25519VerifiedStepUpAuthorizedOperationReceipt;
 export declare function requireEd25519OperationKind(value: unknown): Ed25519OperationKind;
-export declare function requireAuthorizedOperationReceiptString(record: Record<string, unknown>, name: string): string;
-export declare function requireExactAuthorizedOperationReceiptFields(record: Record<string, unknown>, branchFields?: readonly string[]): void;
 export declare function parseEd25519ReusableAuthorizedOperationReceipt(value: unknown): Ed25519ReusableAuthorizedOperationReceipt;
 export declare function parseEd25519VerifiedStepUpAuthorizedOperationReceipt(value: unknown): Ed25519VerifiedStepUpAuthorizedOperationReceipt;
 //# sourceMappingURL=ed25519AuthorizedOperationReceipt.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts

@@ -0,0 +1,165 @@
+import type { EcdsaWalletSessionAdmission } from '../../../authorization/ecdsaWalletSessionAdmission';
+import { type ThresholdEcdsaSessionInputs } from '../../auth/commonRouterUtils';
+import type { SessionAdapter } from '../../framework/routerApi';
+import { type RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire, type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import { type AuthorizedOperation, type AuthorizedOperationReplayResponse, type OwnerOperationAuthorizationDecision, type SessionOrigin } from '../../../authorization/domain';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type AcceptedEcdsaRouteAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteRuntime } from './routerAbNormalSigningAdmission';
+import { type ActiveEcdsaMaterialActivation, type RouterAbExactOperationStepUpWalletSession, type RouterAbOperationStepUpAuthenticationFailure, type RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import { type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaOperationStepUpRequest } from './routerAbPrivateSigningWorker';
+export declare function routerAbEcdsaAtomicAuthorizationConfigured(authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'admitAuthorizedOperation'>): boolean;
+export declare function routerAbEcdsaOperationInProgressResult(): RouterAbJsonRouteResult;
+export declare function buildRouterAbEcdsaOwnerOperationStepUpPreparation(input: {
+    readonly request: RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire;
+    readonly keyHandle: string;
+    readonly relayerKeyId: string;
+    readonly participantIds: readonly number[];
+}): RouterAbEcdsaOperationStepUpPreparationV1Wire | null;
+export declare function decideRouterAbEcdsaOwnerOperationAuthorization(input: {
+    readonly operation: AuthorizedOperation;
+}): OwnerOperationAuthorizationDecision<RouterAbEcdsaOperationStepUpPreparationV1Wire>;
+export declare function routerAbEcdsaOwnerOperationFailureResult(input: {
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+    readonly phase: 'prepare' | 'finalize';
+    readonly stepUp?: RouterAbEcdsaOperationStepUpPreparationV1Wire;
+}): RouterAbJsonRouteResult;
+export declare function routerAbEcdsaReplayUnavailableResult(): RouterAbJsonRouteResult;
+export declare function routerAbEcdsaRecordedResponse(operation: AuthorizedOperation): AuthorizedOperationReplayResponse | null;
+export declare function routerAbEcdsaReplayResult(operation: AuthorizedOperation): RouterAbJsonRouteResult;
+export declare function routerAbEcdsaReplayHttpResponse(operation: AuthorizedOperation): Response | null;
+type RouterAbEcdsaWalletSessionValidationSuccess = Extract<ThresholdEcdsaSessionInputs, {
+    readonly ok: true;
+}>;
+type RouterAbEcdsaV2WalletSessionValidationSuccess = Extract<RouterAbEcdsaWalletSessionValidationSuccess, {
+    readonly kind: 'wallet_session_operation_credential_v1';
+}>;
+export type RouterAbEcdsaNormalSigningAuthorizationResult = {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly validated: RouterAbEcdsaV2WalletSessionValidationSuccess;
+    readonly admission: AcceptedEcdsaRouteAdmission;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission: AcceptedEcdsaRouteAdmission;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'operation_step_up';
+    readonly phase: 'prepare' | 'finalize';
+    readonly operation: AuthorizedOperation;
+    readonly session: RouterAbOperationStepUpWalletSession;
+    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
+} | {
+    readonly ok: false;
+    readonly result: RouterAbJsonRouteResult;
+};
+/**
+ * Re-resolve the complete activation reference immediately before a claim or
+ * evidence write. The resolver is authoritative for capability identity and
+ * all owner/key/lifecycle/worker bindings; a stale or superseded reference
+ * must fail before any authorization side effect is attempted.
+ */
+export declare function resolveFreshRouterAbEcdsaMaterialActivation(input: {
+    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+    readonly walletId: string;
+    readonly expected: RouterAbMpcMaterialActivationRefWire;
+}): Promise<{
+    readonly ok: true;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly keyHandle: string;
+    readonly relayerKeyId: string;
+    readonly participantIds: readonly [number, number];
+    readonly runtimePolicyScope: RuntimePolicyScope;
+} | {
+    readonly ok: false;
+    readonly code: 'not_found' | 'internal';
+    readonly message: string;
+} | {
+    readonly ok: false;
+    readonly code: 'scope_mismatch';
+    readonly message: string;
+}>;
+type RouterAbEcdsaWalletSessionOperationBinding = {
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+} | {
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+};
+export declare function admitRouterAbEcdsaReusableWalletSessionOperation(input: {
+    request: RouterAbEcdsaOperationStepUpRequest;
+    materialActivation: RouterAbMpcMaterialActivationRefWire;
+    binding: RouterAbEcdsaWalletSessionOperationBinding;
+    authorizedOperations: Pick<RouterApiAuthorizedOperationService, 'tenantId' | 'admitEcdsaWalletSessionOperation'>;
+    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+}): Promise<{
+    readonly ok: true;
+    readonly admission: EcdsaWalletSessionAdmission;
+} | {
+    readonly ok: false;
+    readonly error: RouterAbJsonRouteResult;
+}>;
+export declare function completeRouterAbEcdsaOperation(input: {
+    authorizedOperations: RouterApiAuthorizedOperationService;
+    operation: AuthorizedOperation;
+    result: 'succeeded' | 'failed_before_side_effect' | 'failed_after_side_effect';
+    response: AuthorizedOperationReplayResponse;
+}): Promise<void>;
+type RouterAbEcdsaOperationStepUpAuthenticationRequest = RouterAbEcdsaOperationStepUpRequest | RouterAbEcdsaOperationStepUpPreparationV1Wire;
+type RouterAbEcdsaOperationStepUpAuthenticationResult = {
+    readonly ok: true;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService;
+    readonly activeMaterial: ActiveEcdsaMaterialActivation;
+    readonly session: RouterAbExactOperationStepUpWalletSession;
+    readonly requestOrigin: SessionOrigin;
+    readonly expiresAtMs: number;
+} | RouterAbOperationStepUpAuthenticationFailure;
+export declare function authenticateRouterAbEcdsaOperationStepUp(input: {
+    readonly headers: Record<string, string | string[] | undefined>;
+    readonly request: RouterAbEcdsaOperationStepUpAuthenticationRequest;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    readonly resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+}): Promise<RouterAbEcdsaOperationStepUpAuthenticationResult>;
+export declare function claimRouterAbEcdsaOperationStepUp(input: {
+    readonly operationKind: 'evm.sign_transaction' | 'evm.export_key';
+    readonly operation: Pick<RouterAbEcdsaOperationStepUpPreparationV1Wire, 'operation_id' | 'operation_digests' | 'material_activation'>;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly keyHandle: string;
+    readonly authenticated: Extract<Awaited<ReturnType<typeof authenticateRouterAbEcdsaOperationStepUp>>, {
+        readonly ok: true;
+    }>;
+}): Promise<RouterAbJsonRouteResult | RouterAbEcdsaOperationAdmission | null>;
+export declare function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input: {
+    body: Record<string, unknown>;
+    rawBody: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    session: SessionAdapter | null | undefined;
+    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+    phase: 'prepare' | 'finalize';
+}): Promise<RouterAbEcdsaNormalSigningAuthorizationResult>;
+export declare function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input: {
+    body: Record<string, unknown>;
+    rawBody: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    session: SessionAdapter | null | undefined;
+    runtime: RouterAbNormalSigningRouteRuntime | null | undefined;
+    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    resolveEcdsaMaterialActivation: RouterApiWalletRegistrationService['resolveEcdsaMaterialActivation'];
+    privatePath: RouterAbEcdsaDerivationPrivateSigningPath;
+    phase: 'prepare' | 'finalize';
+}): Promise<RouterAbJsonRouteResult>;
+export {};
+//# sourceMappingURL=routerAbEcdsaDerivationNormalSigningRoute.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.d.ts

@@ -0,0 +1,110 @@
+import { type ThresholdEd25519SessionInputs } from '../../auth/commonRouterUtils';
+import type { SessionAdapter } from '../../framework/routerApi';
+import { parseDigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RouterApiAuthorizedOperationService, RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext } from '../../framework/authServicePort';
+import { type CapabilityOperationId, type CapabilityOperationRef } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizedOperation, OwnerOperationAuthorizationDecision } from '../../../authorization/domain';
+import { type RouterAbEd25519OperationStepUpPreparationV1Wire } from '../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type Ed25519OperationKind } from './ed25519AuthorizedOperationReceipt';
+import { type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningRouteAdmission } from './routerAbNormalSigningAdmission';
+import { type ActiveEd25519MaterialActivation, type RouterAbExactOperationStepUpAuthenticationResult, type RouterAbOperationStepUpWalletSession } from './routerAbOperationStepUp';
+import { type RouterAbEd25519NormalSigningScopeV2 } from './routerAbPrivateSigningWorker';
+export type RouterAbEd25519NormalSigningRoutePhase = 'prepare' | 'finalize';
+export declare function buildRouterAbEd25519OwnerOperationStepUpPreparation(input: {
+    readonly scope: RouterAbEd25519NormalSigningScopeV2;
+    readonly body: Record<string, unknown>;
+    readonly material: {
+        readonly nearAccountId: string;
+        readonly signerSlot: number;
+        readonly signingWorkerId: string;
+        readonly participantIds: readonly [number, number];
+    };
+}): RouterAbEd25519OperationStepUpPreparationV1Wire | null;
+export declare function decideRouterAbEd25519OwnerOperationAuthorization(input: {
+    readonly operation: AuthorizedOperation;
+}): OwnerOperationAuthorizationDecision<RouterAbEd25519OperationStepUpPreparationV1Wire>;
+export declare function routerAbEd25519OwnerOperationFailureResult(input: {
+    readonly status: number;
+    readonly code: string;
+    readonly message: string;
+    readonly phase: RouterAbEd25519NormalSigningRoutePhase;
+    readonly stepUp?: RouterAbEd25519OperationStepUpPreparationV1Wire;
+}): RouterAbJsonRouteResult;
+type RouterAbEd25519WalletSessionValidationSuccess = Extract<ThresholdEd25519SessionInputs, {
+    readonly ok: true;
+}>;
+type RouterAbEd25519V2WalletSessionValidationSuccess = Extract<RouterAbEd25519WalletSessionValidationSuccess, {
+    readonly kind: 'wallet_session_operation_credential_v1';
+}>;
+export type RouterAbEd25519NormalSigningAuthorizationResult = {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly validated: RouterAbEd25519V2WalletSessionValidationSuccess;
+    readonly admission: Extract<RouterAbNormalSigningRouteAdmission, {
+        readonly ok: true;
+    }>;
+    readonly activeMaterial: ActiveEd25519MaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_exhausted_candidate_v1';
+    readonly candidate: RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext;
+    readonly admission: Extract<RouterAbNormalSigningRouteAdmission, {
+        readonly ok: true;
+    }>;
+    readonly activeMaterial: ActiveEd25519MaterialActivation;
+} | {
+    readonly ok: true;
+    readonly kind: 'operation_step_up';
+    readonly phase: 'prepare';
+    readonly session: RouterAbOperationStepUpWalletSession;
+    readonly operation: AuthorizedOperation;
+    readonly operationDigests: {
+        readonly laneDigest: ReturnType<typeof parseDigestB64u>;
+        readonly intentDigest: ReturnType<typeof parseDigestB64u>;
+        readonly displayDigest: ReturnType<typeof parseDigestB64u>;
+    };
+    readonly admissionKind: RouterAbEcdsaOperationAdmissionKind;
+} | {
+    readonly ok: true;
+    readonly kind: 'operation_step_up';
+    readonly phase: 'finalize';
+    readonly session: RouterAbOperationStepUpWalletSession;
+} | {
+    readonly ok: false;
+    readonly result: RouterAbJsonRouteResult;
+};
+export declare function authenticateRouterAbWalletOperationStepUp(input: {
+    readonly headers: Record<string, string | string[] | undefined>;
+    readonly scope: RouterAbEd25519NormalSigningScopeV2;
+    readonly operationKind: Ed25519OperationKind;
+    readonly requestExpiresAtMs: number;
+    readonly authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    readonly authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    readonly resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+}): Promise<RouterAbExactOperationStepUpAuthenticationResult>;
+export declare function parseRouterAbEd25519OperationStepUpScope(value: unknown): RouterAbEd25519NormalSigningScopeV2;
+export declare function parseRouterAbOperationStepUpOperation(value: unknown): {
+    readonly ok: true;
+    readonly operationId: CapabilityOperationId;
+    readonly operation: Extract<CapabilityOperationRef, {
+        readonly capabilityKind: 'near_ed25519_mpc_signing';
+    }> & {
+        readonly operationKind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
+    };
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+export declare function authorizeRouterAbEd25519NormalSigningRoute(input: {
+    body: Record<string, unknown>;
+    rawBody: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    session: SessionAdapter | null | undefined;
+    authorizedOperations: RouterApiAuthorizedOperationService | null | undefined;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    admissionAdapter: RouterAbNormalSigningAdmissionAdapter | null | undefined;
+    resolveEd25519MaterialActivation: RouterApiWalletRegistrationService['resolveEd25519MaterialActivation'];
+    phase: RouterAbEd25519NormalSigningRoutePhase;
+}): Promise<RouterAbEd25519NormalSigningAuthorizationResult>;
+export {};
+//# sourceMappingURL=routerAbEd25519NormalSigningRoute.d.ts.map