@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -165,7 +165,7 @@ async function prepareOwnerWalletExecution(input) {
 	if (lane.walletKeyId !== input.evidence.walletKey.walletKeyId) return refused("wallet_key_mismatch");
 	if (!operationMatchesWalletKey(input.authorizedOperation, input.evidence.walletKey)) return refused("curve_mismatch");
 	if (String(claimedOperation.operation.capabilityId) !== String(input.evidence.materialActivation.capability)) return refused("capability_mismatch");
-	if (!sameMaterialActivation(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
+	if (!mpcMaterialActivationRefsEqual(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
 	if (lane.participantBindingDigestB64u !== input.evidence.verifiedLaneParticipantBindingDigestB64u || String(lane.ownerParticipantContinuity.signingWorkerId) !== String(input.evidence.materialActivation.signingWorker)) return refused("participant_binding_mismatch");
 	if (await computeOwnerLaneParticipantBindingDigestV1(lane.ownerParticipantContinuity) !== lane.participantBindingDigestB64u) return refused("participant_binding_mismatch");
 	if (lane.lifecycle.activationReceiptDigestB64u !== input.evidence.verifiedActivationReceiptDigestB64u) return refused("activation_receipt_mismatch");
@@ -213,9 +213,6 @@ function operationMatchesWalletKey(operation, walletKey) {
 		case "ecdsa_secp256k1": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
 	}
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function refused(reason) {
 	return {
 		kind: "refused",

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -1,5 +1,6 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, isTenantRootIdentityFieldCanonicalV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/domains/tenantRoot/tenantRootIdentityResolution.ts
 const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1 = [
@@ -59,20 +60,13 @@ function ecdsaStableMaterialRootBinding(activeMaterial) {
 function assertNeverServerResolvedMaterial(value) {
 	throw new Error(`Unsupported server-resolved tenant-root material: ${String(value)}`);
 }
-function mismatch(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function findForbiddenTenantRootSelectorFieldV1(input) {
 	for (const field of FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1) if (Object.prototype.hasOwnProperty.call(input, field)) return field;
 	return null;
 }
 function resolveTenantRootIdentityV1(input) {
 	const forbiddenSelector = findForbiddenTenantRootSelectorFieldV1(input);
-	if (forbiddenSelector) return mismatch("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
+	if (forbiddenSelector) return failure("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
 	let runtimePolicyScope;
 	let materialRootBinding;
 	switch (input.kind) {
@@ -86,12 +80,12 @@ function resolveTenantRootIdentityV1(input) {
 			break;
 		default: return assertNeverServerResolvedMaterial(input);
 	}
-	if (!materialRootBinding.materialActivationMatches) return mismatch("material_activation_mismatch", "B5 material activation does not match its established material identity");
+	if (!materialRootBinding.materialActivationMatches) return failure("material_activation_mismatch", "B5 material activation does not match its established material identity");
 	const nonCanonicalScopeField = findNonCanonicalRuntimePolicyScopeFieldV1(runtimePolicyScope);
-	if (nonCanonicalScopeField) return mismatch("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
+	if (nonCanonicalScopeField) return failure("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
 	const expectedSigningRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
-	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return mismatch("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
-	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return mismatch("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return failure("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return failure("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
 	const identity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
@@ -99,13 +93,13 @@ function resolveTenantRootIdentityV1(input) {
 		signingRootId: expectedSigningRoot.signingRootId,
 		signingRootVersion: expectedSigningRoot.signingRootVersion
 	});
-	if (!identity.ok) return mismatch("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
+	if (!identity.ok) return failure("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
 	return {
 		ok: true,
 		identity: identity.value
 	};
 }
 //#endregion
-export { findForbiddenTenantRootSelectorFieldV1, resolveTenantRootIdentityV1 };
+export { resolveTenantRootIdentityV1 };
 
 //# sourceMappingURL=tenantRootIdentityResolution.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -5,14 +5,15 @@ import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitive
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../authorization/domain.js";
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
@@ -23,6 +24,8 @@ import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passke
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -1554,8 +1557,8 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
-* Refactor 94C. `POST /wallets/register/setup` — the single admitted entry
-* point that replaces the bootstrap grant, the intent, and start.
+* `POST /wallets/register/setup` — the single admitted entry point that
+* replaces the bootstrap grant, the intent, and start.
 *
 * Authentication is the same API-credential plane the intent route used, so
 * origin and environment binding are unchanged; what is gone is the stored
@@ -1617,7 +1620,7 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
-* Refactor 94C. `POST /wallets/register/respond` — the authenticated leg.
+* `POST /wallets/register/respond` — the authenticated leg.
 *
 * Bearing the proof, so it is a public-plane route authorized by the signed
 * setup payload plus the WebAuthn or Email OTP proof, exactly as the
@@ -1804,8 +1807,8 @@ async function projectActivatedWallet(input) {
 	}
 }
 /**
-* Refactor 94C. `POST /wallets/register/activate` — activation and
-* finalization behind one Gateway operation row.
+* `POST /wallets/register/activate` — activation and finalization behind
+* one Gateway operation row.
 */
 async function handleRouterApiWalletRegistrationActivate(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);
@@ -1872,9 +1875,9 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
-* Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
-* completion the client calls after activate, once its already-running Yao
-* computation produces an activation.
+* `POST /wallets/register/near-provisioning` — the non-blocking completion
+* the client calls after activate, once its already-running Yao computation
+* produces an activation.
 */
 async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -2246,25 +2249,18 @@ async function handleRouterApiWalletRevokeAuthMethod(input) {
 	if (parsedPathWalletAuthMethodId.value !== parsedBody.value.walletAuthMethodId) return routeError(400, "invalid_body", "walletAuthMethodId path and body values must agree");
 	const origin = requireWebAuthnExpectedOrigin(input);
 	if (!origin.ok) return origin.response;
-	const verified = await input.services.walletRegistration.verifyWalletAuthMethodRevokeProof({
-		walletId: parsedBody.value.walletId,
-		targetWalletAuthMethodId: parsedBody.value.walletAuthMethodId,
+	const revoked = await input.services.walletRegistration.revokeWalletAuthMethodWithFreshProof({
+		walletAuthMethodId: parsedBody.value.walletAuthMethodId,
 		requestedAtMs: parsedBody.value.requestedAtMs,
 		sourceProof: parsedBody.value.sourceProof,
-		expectedOrigin: origin.expectedOrigin
-	});
-	if (verified.kind === "denied") return routeError(401, "unauthorized", verified.message);
-	const result = await input.services.walletRegistration.revokeWalletAuthMethod({
-		...parsedBody.value,
 		subject: {
 			kind: "wallet_auth_method_management",
 			walletId: walletIdFromString(walletId)
 		},
-		verifiedSource: {
-			walletAuthMethodId: verified.walletAuthMethodId,
-			verifiedAtMs: verified.verifiedAtMs
-		}
+		expectedOrigin: origin.expectedOrigin
 	});
+	if (revoked.kind === "denied") return routeError(401, "unauthorized", revoked.message);
+	const result = revoked.response;
 	return routeJson(result.ok ? 200 : 400, result, { usage: result.ok ? { walletId: result.walletId } : void 0 });
 }
 async function handleRouterApiWalletEcdsaKeyFactsInventory(input) {

package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js

@@ -6,8 +6,7 @@ import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
 /**
-* Refactor 94C. The opaque payload `/wallets/register/setup` mints and routes
-* 2 and 3 verify.
+* The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
 *
 * Setup admits the application, allocates the wallet, and runs the Router
 * preparation in one request. Routes 2 and 3 then need to know that the
@@ -111,7 +110,7 @@ async function verifySignedWalletRegistrationSetup(signer, token, expected) {
 function parseWalletRegistrationSetupClaims(value) {
 	if (typeof value !== "object" || value === null) return null;
 	const record = value;
-	if (record.kind !== "wallet_registration_setup_v1") return null;
+	if (record.kind !== WALLET_REGISTRATION_SETUP_CLAIM_KIND) return null;
 	const registrationCeremonyId = normalizeOptionalTrimmedString(record.registrationCeremonyId);
 	const walletId = normalizeOptionalTrimmedString(record.walletId);
 	const orgId = normalizeOptionalTrimmedString(record.orgId);
@@ -150,6 +149,6 @@ function parseWalletRegistrationSetupPolicy(value) {
 	}
 }
 //#endregion
-export { WALLET_REGISTRATION_SETUP_CLAIM_KIND, computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims };
+export { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims };
 
 //# sourceMappingURL=walletRegistrationSetupPayload.js.map

package/dist/esm/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.js

@@ -67,7 +67,7 @@ function parseWalletUnlockRequestedCapabilitiesRequest(raw) {
 	if (!challengeId) return invalidWalletUnlockRequestedCapabilitiesRequest("challengeId is required");
 	const requestedCapabilities = parseWalletUnlockEmailOtpRequestedCapabilities(raw.requestedCapabilities);
 	if ("ok" in requestedCapabilities) return requestedCapabilities;
-	if (requestedCapabilities.kind === "wallet_session" && raw.ecdsaSessionPolicy !== void 0) return invalidWalletUnlockRequestedCapabilitiesRequest("requestedCapabilities.wallet_session cannot include ecdsaSessionPolicy");
+	if (requestedCapabilities.kind === EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND && raw.ecdsaSessionPolicy !== void 0) return invalidWalletUnlockRequestedCapabilitiesRequest("requestedCapabilities.wallet_session cannot include ecdsaSessionPolicy");
 	return {
 		ok: true,
 		request: {
@@ -79,6 +79,6 @@ function parseWalletUnlockRequestedCapabilitiesRequest(raw) {
 	};
 }
 //#endregion
-export { EMAIL_OTP_ED25519_YAO_REQUESTED_CAPABILITIES_KIND, EMAIL_OTP_NO_REQUESTED_CAPABILITIES_KIND, EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND, parseWalletUnlockRequestedCapabilitiesRequest };
+export { parseWalletUnlockRequestedCapabilitiesRequest };
 
 //# sourceMappingURL=walletUnlockRequestedCapabilitiesValidation.js.map