@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -1,5 +1,6 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, isTenantRootIdentityFieldCanonicalV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/domains/tenantRoot/tenantRootIdentityResolution.ts
 const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1 = [
@@ -59,20 +60,13 @@ function ecdsaStableMaterialRootBinding(activeMaterial) {
 function assertNeverServerResolvedMaterial(value) {
 	throw new Error(`Unsupported server-resolved tenant-root material: ${String(value)}`);
 }
-function mismatch(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function findForbiddenTenantRootSelectorFieldV1(input) {
 	for (const field of FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1) if (Object.prototype.hasOwnProperty.call(input, field)) return field;
 	return null;
 }
 function resolveTenantRootIdentityV1(input) {
 	const forbiddenSelector = findForbiddenTenantRootSelectorFieldV1(input);
-	if (forbiddenSelector) return mismatch("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
+	if (forbiddenSelector) return failure("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
 	let runtimePolicyScope;
 	let materialRootBinding;
 	switch (input.kind) {
@@ -86,12 +80,12 @@ function resolveTenantRootIdentityV1(input) {
 			break;
 		default: return assertNeverServerResolvedMaterial(input);
 	}
-	if (!materialRootBinding.materialActivationMatches) return mismatch("material_activation_mismatch", "B5 material activation does not match its established material identity");
+	if (!materialRootBinding.materialActivationMatches) return failure("material_activation_mismatch", "B5 material activation does not match its established material identity");
 	const nonCanonicalScopeField = findNonCanonicalRuntimePolicyScopeFieldV1(runtimePolicyScope);
-	if (nonCanonicalScopeField) return mismatch("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
+	if (nonCanonicalScopeField) return failure("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
 	const expectedSigningRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
-	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return mismatch("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
-	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return mismatch("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return failure("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return failure("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
 	const identity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
@@ -99,7 +93,7 @@ function resolveTenantRootIdentityV1(input) {
 		signingRootId: expectedSigningRoot.signingRootId,
 		signingRootVersion: expectedSigningRoot.signingRootVersion
 	});
-	if (!identity.ok) return mismatch("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
+	if (!identity.ok) return failure("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
 	return {
 		ok: true,
 		identity: identity.value

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -0,0 +1,70 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
+//#region src/router/domains/walletRegistration/walletRegistrationReservation.ts
+function requireId(result) {
+	if (!result.ok) throw new Error(result.error.message);
+	return result.value;
+}
+function parseWalletRegistrationSetupReservation(raw) {
+	if (!isPlainObject(raw)) throw new Error("Registration reservation is invalid");
+	const ceremonyId = requireCanonicalString(raw.ceremonyId, "ceremonyId");
+	const preparationId = requireCanonicalString(raw.preparationId, "preparationId");
+	if (!/^wrc_[A-Za-z0-9_-]{43}$/u.test(ceremonyId) || !/^regprep_[A-Za-z0-9_-]{43}$/u.test(preparationId)) throw new Error("Registration reservation ceremony identity is invalid");
+	const reservedAtMs = raw.reservedAtMs;
+	if (typeof reservedAtMs !== "number" || !Number.isSafeInteger(reservedAtMs) || reservedAtMs <= 0) throw new Error("Registration reservation timestamp is invalid");
+	return {
+		walletId: requireId(parseWalletId(raw.walletId)),
+		ceremonyId,
+		preparationId,
+		walletAuthorityId: requireId(parseWalletAuthorityId(raw.walletAuthorityId)),
+		deviceId: requireId(parseDeviceId(raw.deviceId)),
+		walletAuthMethodId: requireId(parseWalletAuthMethodId(raw.walletAuthMethodId)),
+		reservedAtMs
+	};
+}
+function proposeWalletRegistrationSetup(input) {
+	return parseWalletRegistrationSetupReservation({
+		walletId: input.request.wallet?.kind === "provided" ? input.request.wallet.walletId : createServerAllocatedWalletId(),
+		ceremonyId: `wrc_${secureRandomBase64Url(32)}`,
+		preparationId: `regprep_${secureRandomBase64Url(32)}`,
+		walletAuthorityId: `wallet-authority:${secureRandomBase64Url(32)}`,
+		deviceId: `device:${secureRandomBase64Url(32)}`,
+		walletAuthMethodId: `wallet-auth-method:${secureRandomBase64Url(32)}`,
+		reservedAtMs: Date.now()
+	});
+}
+async function walletRegistrationSetupRequestDigest(namespace, input) {
+	if (!input.runtimePolicyScope || input.runtimePolicyScope.orgId !== input.orgId) throw new Error("Registration reservation requires an exact authenticated tenant scope");
+	return sha256HexUtf8(alphabetizeStringify({
+		namespace,
+		runtimePolicyScope: input.runtimePolicyScope,
+		expectedOrigin: input.expectedOrigin,
+		wallet: input.request.wallet ?? { kind: "server_allocated" },
+		authMethod: input.request.authMethod,
+		signerSelection: input.request.signerSelection
+	}));
+}
+async function completeRegistrationReservation(authority, input) {
+	if (!authority) return {
+		ok: false,
+		code: "registration_authority_unavailable",
+		message: "Registration reservation authority is required"
+	};
+	return authority.complete(input);
+}
+async function admitRegistrationReservationHome(authority, input) {
+	if (!authority) return {
+		ok: false,
+		code: "registration_authority_unavailable",
+		message: "Registration reservation authority is required"
+	};
+	return authority.admitHome(input);
+}
+//#endregion
+export { admitRegistrationReservationHome, completeRegistrationReservation, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
+
+//# sourceMappingURL=walletRegistrationReservation.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -4,7 +4,6 @@ import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
@@ -15,6 +14,7 @@ import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
@@ -24,6 +24,7 @@ import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passke
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
@@ -326,6 +327,12 @@ function parseWalletRegistrationSetupWallet(raw) {
 	};
 }
 function parseWalletRegistrationSetupRequest(body) {
+	const registrationOperationId = parseRegistrationSetupOperationId(body.registrationOperationId);
+	if (!registrationOperationId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationOperationId is required"
+	};
 	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
 	if (!signerSelection.ok) return signerSelection;
 	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
@@ -339,6 +346,7 @@ function parseWalletRegistrationSetupRequest(body) {
 	return {
 		ok: true,
 		value: {
+			registrationOperationId,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -1556,14 +1564,6 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point that
-* replaces the bootstrap grant, the intent, and start.
-*
-* Authentication is the same API-credential plane the intent route used, so
-* origin and environment binding are unchanged; what is gone is the stored
-* grant that used to sit between the check and its only reader.
-*/
 async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
@@ -1606,7 +1606,7 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
 	const request = parseWalletRegistrationSetupRequest(input.body);
 	if (!request.ok) return routeError(400, request.code, request.message);
-	const result = await input.services.walletRegistration.setupWalletRegistration({
+	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
@@ -1617,7 +1617,6 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 			signingRootVersion: runtimePolicyScope.signingRootVersion
 		} : {}
 	});
-	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
 * `POST /wallets/register/respond` — the authenticated leg.

package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js

@@ -2,14 +2,13 @@ import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
 /**
 * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
 *
-* Setup admits the application, allocates the wallet, and runs the Router
-* preparation in one request. Routes 2 and 3 then need to know that the
+* Setup admits the application, reserves the wallet, and persists the initial
+* preparation facts in one request. Routes 2 and 3 then need to know that the
 * ceremony they are being driven with is the one setup admitted, and with the
 * parameters setup admitted — without paying another storage round trip to
 * find out. The client carries this string and never parses it.