@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -1,27 +1,29 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { buildAuthorizationGrantRef, buildNearEd25519MpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { authorizedOperationReplayBodyInit, parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { json, readJson } from "../../../framework/http.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../../threshold/statusCodes.js";
-import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind } from "../../../domains/signingOperations/ed25519AuthorizedOperationReceipt.js";
-import { authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, decideRouterAbEd25519OwnerOperationAuthorization, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, routerAbEd25519OwnerOperationFailureResult } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
+import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
+import { buildRouterAbEd25519PrivateSigningWorkerBody } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
+import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind } from "../../../domains/signingOperations/ed25519AuthorizedOperationReceipt.js";
+import { authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEd25519OwnerOperationStepUpPreparation, decideRouterAbEd25519OwnerOperationAuthorization, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, routerAbEd25519OwnerOperationFailureResult } from "../../../domains/signingOperations/routerAbEd25519NormalSigningRoute.js";
 import { parseThresholdEd25519OperationStepUpGrantRequest, parseThresholdEd25519SessionRouteRequest } from "../../../domains/ed25519Yao/session/thresholdEd25519RequestValidation.js";
 //#region src/router/transport/fetch/routes/thresholdEd25519.ts
 async function resolveActiveEd25519OperationStepUpAuthority(walletAuthMethods, proof) {
@@ -54,7 +56,7 @@ function ed25519ReusableWalletSessionIdentity(authorization) {
 		quotaId: session.quotaId
 	};
 }
-function buildEd25519GatewayOwnerWalletSessionBinding(authorization) {
+function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvironmentId) {
 	const session = ed25519ReusableWalletSession(authorization);
 	const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
 	return {
@@ -68,10 +70,44 @@ function buildEd25519GatewayOwnerWalletSessionBinding(authorization) {
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
 		environment: runtimePolicyScope.envId,
+		projectEnvironmentId,
 		signingWorkerId: authorization.activeMaterial.signingWorkerId,
 		expiresAtMs: session.expiresAtMs
 	};
 }
+async function readPinnedEd25519WalletProjectEnvironmentId(ctx, authorization, operation) {
+	const session = ed25519ReusableWalletSession(authorization);
+	const scope = authorization.activeMaterial.runtimePolicyScope;
+	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
+		operation,
+		walletId: session.walletId
+	});
+	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Pinned owner Wallet Session scope differs from active material");
+	return pinned.projectEnvironmentId;
+}
+/**
+* The Router binding for a verified step-up: the wallet it signs for and the
+* Console project environment of the store that claimed the operation, so
+* the SigningWorker reaches the wallet's own storage.
+*/
+async function ed25519OperationStepUpBinding(ctx, session, operation) {
+	const scope = session.runtimePolicyScope;
+	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
+		operation,
+		walletId: requireAuthorizationValue(parseWalletId(session.walletId))
+	});
+	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
+	return {
+		kind: "operation_step_up",
+		authorizationSessionId: session.sessionId,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environment: scope.envId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		subjectId: session.principalId,
+		accountId: session.walletId
+	};
+}
 function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
@@ -116,6 +152,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
 					signing_worker_id: input.binding.signingWorkerId,
 					expires_at_ms: input.binding.expiresAtMs
 				},
@@ -133,7 +170,9 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
 				},
 				authorized_operation: {
 					kind: "verified_step_up_authorized_operation_v1",
@@ -1020,14 +1059,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					...input.body,
 					authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 						operation: execution.operation,
-						binding: {
-							kind: "operation_step_up",
-							authorizationSessionId: authorization.session.sessionId,
-							orgId: authorization.session.runtimePolicyScope.orgId,
-							projectId: authorization.session.runtimePolicyScope.projectId,
-							environment: authorization.session.runtimePolicyScope.envId,
-							subjectId: authorization.session.principalId
-						}
+						binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, execution.operation)
 					})
 				}
 			});
@@ -1077,14 +1109,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: validatedAuthorization.operation,
-					binding: {
-						kind: "operation_step_up",
-						authorizationSessionId: authorization.session.sessionId,
-						orgId: authorization.session.runtimePolicyScope.orgId,
-						projectId: authorization.session.runtimePolicyScope.projectId,
-						environment: authorization.session.runtimePolicyScope.envId,
-						subjectId: authorization.session.principalId
-					}
+					binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, validatedAuthorization.operation)
 				})
 			}
 		});
@@ -1138,7 +1163,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: execution.operation,
-					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization) }
+					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, execution.operation)) }
 				})
 			}
 		});
@@ -1187,7 +1212,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			...input.body,
 			authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 				operation: validatedAuthorization.operation,
-				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization) }
+				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, validatedAuthorization.operation)) }
 			})
 		}
 	});
@@ -1316,6 +1341,6 @@ function sameThresholdEd25519RuntimePolicyScopeV1(left, right) {
 	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
 }
 //#endregion
-export { buildEd25519ReplayResponse, decideEd25519NormalSigningExecution, decideEd25519OperationStepUpExecution, handleThresholdEd25519, isRouterAbEd25519OperationInProgressResponse, replayCompletedEd25519Operation, requireCompletedEd25519OperationResponse };
+export { handleThresholdEd25519 };
 
 //# sourceMappingURL=thresholdEd25519.js.map

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -1,9 +1,10 @@
 import { parseMpcMaterialActivationRef, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
-import { walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
+import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs } from "../../../auth/commonRouterUtils.js";
 //#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
 const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
@@ -177,11 +178,13 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		};
 	} else {
 		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
 			headers,
 			authorizationSessions: ctx.service.authorizationSessions,
 			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 		});
 		if (!validated.ok) return validationFailure(validated);
+		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
 		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
 		authorization = {
 			kind: "wallet_auth_method",

package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js

@@ -1,4 +1,4 @@
-import { json } from "../../../framework/http.js";
+import { json, jsonFailure } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/webauthnAuthenticators.ts
 async function handleWebAuthnAuthenticators(ctx) {
@@ -6,22 +6,14 @@ async function handleWebAuthnAuthenticators(ctx) {
 	if (ctx.pathname !== "/webauthn/authenticators") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const rpIdFromQuery = String(ctx.url.searchParams.get("rpId") || ctx.url.searchParams.get("rp_id") || "").trim();
 		const result = await ctx.service.webAuthn.listWebAuthnAuthenticatorsForUser({
 			userId: String(exact.authorization.session.walletId),
@@ -30,11 +22,7 @@ async function handleWebAuthnAuthenticators(ctx) {
 		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json(result, { status: 200 });
 	} catch (e) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion

package/dist/esm/shared-ts/src/authorization/capabilityKinds.js

@@ -219,6 +219,6 @@ function invalidResult(message) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_EVIDENCE_KINDS, AUTHORIZATION_GRANT_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildAuthorizationEvidenceRequirement, buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, isAuthorizationEvidenceKind, isCapabilityKind, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseDeviceId, parseEcdsaAuthorizationSessionId, parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
+export { AUTHORIZATION_EVIDENCE_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildAuthorizationEvidenceRequirement, buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, isAuthorizationEvidenceKind, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseDeviceId, parseEcdsaAuthorizationSessionId, parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
 
 //# sourceMappingURL=capabilityKinds.js.map

package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js

@@ -129,6 +129,6 @@ function invalidAuthorityResult(message) {
 	};
 }
 //#endregion
-export { FULL_OWNER_PERMISSIONS, buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, isDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 };
+export { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 };
 
 //# sourceMappingURL=delegatedAuthority.js.map

package/dist/esm/shared-ts/src/authorization/operationFingerprint.js

@@ -1,7 +1,6 @@
-import "./capabilityKinds.js";
 import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
 var CapabilityOperationEnvelopeProof = class {