@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/framework/http.js

@@ -1,13 +1,16 @@
 import { ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 } from "../../shared-ts/src/device-linking/requestProof.js";
 import "../../shared-ts/src/device-linking/index.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { buildCorsOrigins, normalizeCorsOrigin } from "../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbTraceContext.js";
+import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../shared-ts/src/utils/walletManagementProtocol.js";
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
 const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
+	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
@@ -30,6 +33,9 @@ function json(body, init, extraHeaders) {
 		headers
 	});
 }
+function jsonFailure(status, code, message) {
+	return json(failure(code, message), { status });
+}
 function withCors(headers, opts, request) {
 	const pathname = request ? new URL(request.url).pathname : "";
 	if (pathname === "/healthz" || pathname === "/readyz") {
@@ -82,6 +88,6 @@ function headersToRecord(headers) {
 	return out;
 }
 //#endregion
-export { headersToRecord, json, readJson, toResponse, withCors };
+export { headersToRecord, json, jsonFailure, readJson, toResponse, withCors };
 
 //# sourceMappingURL=http.js.map

package/dist/esm/router/framework/registrationSetupDispatch.js

@@ -0,0 +1,14 @@
+//#region src/router/framework/registrationSetupDispatch.ts
+async function dispatchWalletRegistrationSetup(context, input) {
+	const forwarded = await context.dispatcher?.dispatch(input);
+	if (forwarded) return forwarded;
+	const result = await context.local.setupWalletRegistration(input);
+	return {
+		status: result.ok ? 200 : 400,
+		body: result
+	};
+}
+//#endregion
+export { dispatchWalletRegistrationSetup };
+
+//# sourceMappingURL=registrationSetupDispatch.js.map

package/dist/esm/router/framework/ror/normalize.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString, toRorOriginOrNull } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 //#region src/router/framework/ror/normalize.ts
 function normalizeCsv(valuesRaw) {

package/dist/esm/router/framework/ror/options.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeCsv, sanitizeRorOrigins } from "./normalize.js";
 import { StaticRorOriginsProvider } from "./staticProvider.js";
 //#region src/router/framework/ror/options.ts

package/dist/esm/router/framework/ror/provider.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRorHost } from "./normalize.js";
 //#region src/router/framework/ror/provider.ts
 function validateRouterApiRorOptions(ror) {

package/dist/esm/router/framework/ror/staticProvider.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { sanitizeRorOrigins } from "./normalize.js";
 //#region src/router/framework/ror/staticProvider.ts
 var StaticRorOriginsProvider = class {

package/dist/esm/router/framework/routeDefinitions.js

@@ -37,7 +37,6 @@ const ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES = [
 	"session"
 ];
 const ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES = ["webAuthn", "session"];
-const ROUTER_API_NEAR_PUBLIC_KEY_SERVICES = ["nearFunding", "session"];
 const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 	"passkeyCustody",
 	"walletAuthMethods",
@@ -404,7 +403,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_ED25519_WALLET_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_prepare", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_finalize", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, "Finalize Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), publicRoute("router_ab_ecdsa_derivation_healthz", "GET", ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, "Router A/B ECDSA derivation health probe", {
 		plane: "public",
 		rationale: "Router A/B health probes are intentionally public diagnostics."
-	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), sessionPrincipalRoute("near_public_keys", "GET", "/near/public-keys", "List NEAR public keys for current session", ROUTER_API_NEAR_PUBLIC_KEY_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
+	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock challenge issuance is intentionally public."

package/dist/esm/router/framework/routerApiWebhooks.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 //#region src/router/framework/routerApiWebhooks.ts
 const DEFAULT_ORG_ID_CLAIM_KEYS = [
 	"orgId",

package/dist/esm/router/framework/runtimeSnapshotConsumer.js

@@ -1,3 +1,4 @@
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/router/framework/runtimeSnapshotConsumer.ts
 function parseExpectation(raw) {
 	if (raw === void 0 || raw === null) return { parsed: null };
@@ -38,45 +39,17 @@ function parseExpectation(raw) {
 }
 async function validateRuntimeSnapshotExpectation(input) {
 	const expectationResult = parseExpectation(input.expectationRaw);
-	if (expectationResult.error) return {
-		ok: false,
-		code: "runtime_snapshot_invalid_expectation",
-		message: expectationResult.error
-	};
+	if (expectationResult.error) return failure("runtime_snapshot_invalid_expectation", expectationResult.error);
 	const expectation = expectationResult.parsed;
 	if (!expectation) return { ok: true };
 	const scope = input.scope;
-	if (!scope) return {
-		ok: false,
-		code: "runtime_snapshot_scope_missing",
-		message: "threshold session is missing runtimePolicyScope"
-	};
-	if (!input.runtimeSnapshots) return {
-		ok: false,
-		code: "runtime_snapshots_not_configured",
-		message: "Runtime snapshot consumer is not configured on this server"
-	};
+	if (!scope) return failure("runtime_snapshot_scope_missing", "threshold session is missing runtimePolicyScope");
+	if (!input.runtimeSnapshots) return failure("runtime_snapshots_not_configured", "Runtime snapshot consumer is not configured on this server");
 	const latest = await input.runtimeSnapshots.getLatestSnapshot(scope);
-	if (!latest) return {
-		ok: false,
-		code: "runtime_snapshot_not_found",
-		message: `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`
-	};
-	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return {
-		ok: false,
-		code: "runtime_snapshot_id_mismatch",
-		message: `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`
-	};
-	if (expectation.version !== void 0 && latest.version !== expectation.version) return {
-		ok: false,
-		code: "runtime_snapshot_version_mismatch",
-		message: `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`
-	};
-	if (expectation.checksum && latest.checksum !== expectation.checksum) return {
-		ok: false,
-		code: "runtime_snapshot_checksum_mismatch",
-		message: `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`
-	};
+	if (!latest) return failure("runtime_snapshot_not_found", `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`);
+	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return failure("runtime_snapshot_id_mismatch", `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`);
+	if (expectation.version !== void 0 && latest.version !== expectation.version) return failure("runtime_snapshot_version_mismatch", `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`);
+	if (expectation.checksum && latest.checksum !== expectation.checksum) return failure("runtime_snapshot_checksum_mismatch", `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`);
 	return { ok: true };
 }
 function makeScopeKey(scope) {

package/dist/esm/router/ror.js

@@ -1,4 +1,3 @@
-import "bs58";
 //#region ../shared-ts/src/utils/normalize.ts
 /**
 * Generic normalization helpers shared across client/server.

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -5,7 +5,7 @@ import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/uti
 import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
 import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
-import { json, withCors } from "../../framework/http.js";
+import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
@@ -18,7 +18,6 @@ import { handleThresholdEd25519 } from "./routes/thresholdEd25519.js";
 import { handleOwnerWalletExecutionLanePreflight } from "./routes/walletExecutionLanePreflight.js";
 import { handleWebAuthnAuthenticators } from "./routes/webauthnAuthenticators.js";
 import { handleAuth } from "./routes/auth.js";
-import { handleNearPublicKeys } from "./routes/nearPublicKeys.js";
 import { validateRouterApiRorOptions } from "../../framework/ror/provider.js";
 import { handleWellKnown } from "./routes/wellKnown.js";
 import { handleDeviceLinking } from "./routes/deviceLinking.js";
@@ -44,6 +43,7 @@ async function signingSessionSealRecordFromExactAdmission(input) {
 	switch (admission.curve) {
 		case "ecdsa": {
 			const active = await input.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId,
 				materialActivation
 			});
@@ -204,11 +204,7 @@ function createFetchRouter(service, opts, runtime) {
 		async (context) => {
 			if (!context.pathname.startsWith("/wallet/device-linking/v1/devices")) return null;
 			const service = context.service.deviceManagement;
-			if (!service) return json({
-				ok: false,
-				code: "not_supported",
-				message: "Linked-device management is not configured"
-			}, { status: 501 });
+			if (!service) return jsonFailure(501, "not_supported", "Linked-device management is not configured");
 			return await handleDeviceManagement(context, service);
 		},
 		handlePasskeyCustody,
@@ -233,7 +229,6 @@ function createFetchRouter(service, opts, runtime) {
 		handleThresholdEcdsa,
 		handleExactWalletSigningSessionSeal,
 		handleWebAuthnAuthenticators,
-		handleNearPublicKeys,
 		handleExactWalletSessionStatus,
 		handleHostedWalletSessionExchangeIssue,
 		handleHostedWalletSessionExchangeRedeem,

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,4 +1,4 @@
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
@@ -13,11 +13,7 @@ async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 })
+		response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 	};
 	try {
 		const context = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
@@ -27,11 +23,7 @@ async function requireExactWalletSession(ctx) {
 		});
 		if (!context) return {
 			ok: false,
-			response: json({
-				ok: false,
-				code: "unauthorized",
-				message: "No valid Wallet Session"
-			}, { status: 401 })
+			response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 		};
 		return {
 			ok: true,
@@ -40,11 +32,7 @@ async function requireExactWalletSession(ctx) {
 	} catch {
 		return {
 			ok: false,
-			response: json({
-				ok: false,
-				code: "wallet_session_unavailable",
-				message: "Wallet Session is unavailable"
-			}, { status: 503 })
+			response: jsonFailure(503, "wallet_session_unavailable", "Wallet Session is unavailable")
 		};
 	}
 }
@@ -57,19 +45,11 @@ async function requireExactPasskeyStepUp(input) {
 	const walletId = String(input.context.authorization.session.walletId);
 	if (String(result.userId).trim() !== walletId) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up user mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up user mismatch")
 	};
 	if (result.walletAuthMethodId !== input.context.authMethod.walletAuthMethodId || result.walletAuthorityId !== input.context.authority.authorityId) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up authority mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up authority mismatch")
 	};
 	return { ok: true };
 }
@@ -127,11 +107,7 @@ async function handleAuth(ctx) {
 			default: assertNeverAuthIdentityMutation(command);
 		}
 		const subject = command.request.subject;
-		if (subject.startsWith("near:")) return json({
-			ok: false,
-			code: "not_supported",
-			message: "near: subjects cannot be unlinked"
-		}, { status: 400 });
+		if (subject.startsWith("near:")) return jsonFailure(400, "not_supported", "near: subjects cannot be unlinked");
 		const out = await ctx.service.identity.unlinkIdentity({
 			userId: walletId,
 			subject
@@ -154,6 +130,8 @@ async function handleAuth(ctx) {
 			const parsed = parsePasskeyLoginOptionsRequest(await readJson(ctx.request));
 			if (!parsed.ok) return json(parsed.body, { status: parsed.status });
 			const result = await ctx.service.webAuthn.createWebAuthnLoginOptions(parsed.request);
+			if (result.code === "wallet_home_unavailable") return json(result, { status: 503 });
+			if (result.code === "wallet_home_conflict") return json(result, { status: 409 });
 			return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
 		}
 		case "passkey_verify": {
@@ -188,16 +166,8 @@ async function handleAuth(ctx) {
 				publishableKeyAuth: ctx.opts.publishableKeyAuth,
 				orgProjectEnv: ctx.opts.orgProjectEnv
 			});
-			if (!runtimePolicyScope.ok) return json({
-				ok: false,
-				code: runtimePolicyScope.code,
-				message: runtimePolicyScope.message
-			}, { status: runtimePolicyScope.status });
-			if (!runtimePolicyScope.scope) return json({
-				ok: false,
-				code: "runtime_policy_scope_unavailable",
-				message: "Google Email OTP requires an active managed runtime policy scope"
-			}, { status: 500 });
+			if (!runtimePolicyScope.ok) return jsonFailure(runtimePolicyScope.status, runtimePolicyScope.code, runtimePolicyScope.message);
+			if (!runtimePolicyScope.scope) return jsonFailure(500, "runtime_policy_scope_unavailable", "Google Email OTP requires an active managed runtime policy scope");
 			const result = await ctx.service.identity.verifyGoogleLogin(parsed.request);
 			if (!result.ok || !result.verified || !result.providerSubject) return json(result, { status: result.code === "internal" ? 500 : 400 });
 			const resolution = await ctx.service.identity.resolveGoogleEmailOtpSession({