@seams/wallet-server 0.7.1 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/THIRD_PARTY_NOTICES.md +1 -113
- package/artifact-manifest.json +78 -33
- package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -1
- package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
- package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -1
- package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
- package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/local-tools/darwin-arm64/router_ab_local_init +0 -0
- package/cloudflare-router-ab/build/local-tools/darwin-x64/router_ab_local_init +0 -0
- package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
- package/cloudflare-router-ab/build/router/build-stamp.json +1 -1
- package/cloudflare-router-ab/build/router/index.js +2 -2
- package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -1
- package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
- package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -1
- package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
- package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
- package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs +0 -2
- package/cloudflare-router-ab/scripts/start-local-role-workers.mjs +77 -20
- package/dist/esm/authorization/lifecycleRouting.js +62 -0
- package/dist/esm/authorization/service.js +43 -12
- package/dist/esm/authorization/vaultProxyUse.js +2 -6
- package/dist/esm/cloud-host.js +23 -25
- package/dist/esm/core/EmailOtpRecords.js +1 -217
- package/dist/esm/core/EmailOtpStores.js +0 -859
- package/dist/esm/core/IdentityStore.js +2 -426
- package/dist/esm/core/SessionService.js +7 -30
- package/dist/esm/core/ThresholdService/config.js +1 -9
- package/dist/esm/core/ThresholdService/index.js +0 -4
- package/dist/esm/core/ThresholdService/kv.js +1 -66
- package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js +1 -13
- package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js +4 -21
- package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js +0 -617
- package/dist/esm/core/ThresholdService/validation.js +2 -346
- package/dist/esm/core/WalletAuthMethodStore.js +2 -123
- package/dist/esm/core/WalletStore.js +6 -214
- package/dist/esm/core/WebAuthnAuthenticatorStore.js +0 -202
- package/dist/esm/core/WebAuthnCredentialBindingStore.js +2 -182
- package/dist/esm/core/WebAuthnLoginChallengeStore.js +0 -52
- package/dist/esm/core/WebAuthnSyncChallengeStore.js +0 -54
- package/dist/esm/core/authService/emailOtpConfig.js +1 -195
- package/dist/esm/core/authService/emailOtpEnrollment.js +0 -141
- package/dist/esm/core/authService/emailOtpSeal.js +0 -78
- package/dist/esm/core/authService/nearTransactions.js +3 -98
- package/dist/esm/core/authService/rateLimits.js +0 -87
- package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js +2 -1
- package/dist/esm/core/authService/webauthn.js +14 -464
- package/dist/esm/core/authService/webauthnOidcHelpers.js +1 -24
- package/dist/esm/core/authService/webauthnVerificationOutcomes.js +5 -24
- package/dist/esm/core/authService/webauthnWalletBinding.js +0 -37
- package/dist/esm/core/config.js +1 -95
- package/dist/esm/core/d1EcdsaSignerRead.js +76 -0
- package/dist/esm/core/d1IdentityStore.js +17 -77
- package/dist/esm/core/d1TenantStore.js +1 -24
- package/dist/esm/core/d1WalletAuthMethodStore.js +2 -5
- package/dist/esm/core/d1WalletStore.js +15 -25
- package/dist/esm/core/deviceLinking/linkedDeviceBootstrap.js +13 -0
- package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js +1 -5
- package/dist/esm/core/deviceLinking/linkedDeviceSession.js +20 -14
- package/dist/esm/core/deviceLinking/linkedDeviceSessionApproval.js +1 -3
- package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js +2 -8
- package/dist/esm/core/deviceLinking/requestProof.js +22 -10
- package/dist/esm/core/ecdsaMaterialReadSnapshot.js +85 -0
- package/dist/esm/core/emailOtpD1Statements.js +107 -94
- package/dist/esm/core/keyMaterialBrands.js +2 -12
- package/dist/esm/core/nearKeys.js +0 -1
- package/dist/esm/core/nearRelayerAccountProvisioning.js +8 -14
- package/dist/esm/core/passkeyCredentialClaims.js +8 -0
- package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js +2 -6
- package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js +2 -30
- package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js +3 -6
- package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js +2 -5
- package/dist/esm/core/thresholdEcdsaChainTarget.js +2 -7
- package/dist/esm/hosted-wallet-gateway.js +68 -45
- package/dist/esm/index.js +6 -19
- package/dist/esm/localHostedWalletGatewayHandler.js +25 -0
- package/dist/esm/localIntendedMaterialAdmissionFault.js +176 -0
- package/dist/esm/localIntendedPresignCancellation.js +44 -0
- package/dist/esm/localRegistrationSetupAuthority.js +89 -0
- package/dist/esm/router/auth/authRequestValidation.js +8 -16
- package/dist/esm/router/auth/commonRouterUtils.js +24 -10
- package/dist/esm/router/auth/walletSessionFailure.js +2 -5
- package/dist/esm/router/auth/webAuthnCredentialCodecs.js +4 -16
- package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js +87 -0
- package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js +1 -0
- package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.js +2 -6
- package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthConfig.js +12 -2
- package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +37 -308
- package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js +76 -0
- package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js +52 -43
- package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js +217 -50
- package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js +8 -12
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js +62 -21
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js +6 -1
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js +12 -2
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js +4 -4
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +1 -1
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js +3 -9
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js +2 -1
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js +89 -7
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js +24 -15
- package/dist/esm/router/cloudflare/d1/deviceLinking/index.js +3 -3
- package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js +9 -6
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js +12 -56
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js +17 -81
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js +1 -1
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js +0 -1
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.js +6 -25
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js +1 -1
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js +1 -7
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js +19 -13
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js +12 -48
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +24 -86
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js +9 -32
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js +5 -21
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js +44 -12
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js +1 -49
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +37 -136
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.js +85 -0
- package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js +0 -1
- package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js +9 -88
- package/dist/esm/router/cloudflare/d1/near/d1SponsoredNearAccount.js +242 -0
- package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js +18 -92
- package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js +4 -55
- package/dist/esm/router/cloudflare/d1/oidc/googleOidcToken.js +41 -0
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js +9 -15
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js +36 -7
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js +9 -13
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js +11 -50
- package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js +5 -20
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +13 -10
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js +9 -14
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +25 -13
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js +7 -31
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js +74 -0
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +7 -1
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +101 -260
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js +12 -56
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js +155 -0
- package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js +1 -3
- package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js +1 -4
- package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js +131 -31
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js +68 -0
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +7 -54
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +9 -8
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js +2 -142
- package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +55 -171
- package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js +10 -79
- package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js +23 -7
- package/dist/esm/router/cloudflare/runtime/routerAbPrewarm.js +2 -2
- package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js +6 -20
- package/dist/esm/router/cloudflare/runtime/tenantRootCreationGrant.js +2 -9
- package/dist/esm/router/cloudflare/runtime/walletConsoleOps.js +1 -0
- package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js +5 -0
- package/dist/esm/router/cloudflare/runtime/walletControlOps.js +2 -1
- package/dist/esm/router/cloudflare/runtime/walletGateway.js +1 -1
- package/dist/esm/router/cloudflare/runtime/walletRuntimeOps.js +16 -4
- package/dist/esm/router/cloudflare-adaptor.js +1 -2
- package/dist/esm/router/cloudflare.js +3390 -3437
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +11 -8
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js +3 -2
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js +6 -6
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js +5 -8
- package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js +6 -6
- package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js +3 -0
- package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js +8 -0
- package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js +3 -6
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js +6 -25
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js +39 -55
- package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js +0 -1
- package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js +15 -62
- package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js +2 -8
- package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js +2 -8
- package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js +83 -74
- package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js +1 -0
- package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js +1 -0
- package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js +5 -19
- package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js +3 -7
- package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js +7 -13
- package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js +70 -0
- package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js +10 -11
- package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js +2 -3
- package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js +55 -200
- package/dist/esm/router/express.js +858 -1145
- package/dist/esm/router/framework/http.js +7 -1
- package/dist/esm/router/framework/registrationSetupDispatch.js +14 -0
- package/dist/esm/router/framework/ror/normalize.js +0 -1
- package/dist/esm/router/framework/ror/options.js +0 -1
- package/dist/esm/router/framework/ror/provider.js +0 -1
- package/dist/esm/router/framework/ror/staticProvider.js +0 -1
- package/dist/esm/router/framework/routeDefinitions.js +1 -2
- package/dist/esm/router/framework/routerApiWebhooks.js +0 -1
- package/dist/esm/router/framework/runtimeSnapshotConsumer.js +8 -35
- package/dist/esm/router/ror.js +0 -1
- package/dist/esm/router/transport/fetch/createFetchRouter.js +3 -8
- package/dist/esm/router/transport/fetch/routes/auth.js +11 -41
- package/dist/esm/router/transport/fetch/routes/deviceLinking.js +36 -147
- package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js +7 -23
- package/dist/esm/router/transport/fetch/routes/deviceLinkingResponses.js +130 -0
- package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js +171 -0
- package/dist/esm/router/transport/fetch/routes/passkeyCustody.js +1 -0
- package/dist/esm/router/transport/fetch/routes/sessions.js +1 -0
- package/dist/esm/router/transport/fetch/routes/syncAccount.js +15 -38
- package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js +46 -194
- package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js +4 -1
- package/dist/esm/router/transport/fetch/routes/walletRegistration.js +3 -1
- package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js +4 -16
- package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js +0 -1
- package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js +12 -0
- package/dist/esm/shared-ts/src/device-linking/authorityActivation.js +0 -2
- package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js +2 -5
- package/dist/esm/shared-ts/src/device-linking/contracts.js +16 -1
- package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js +1 -5
- package/dist/esm/shared-ts/src/device-linking/digests.js +1 -8
- package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js +12 -16
- package/dist/esm/shared-ts/src/device-linking/sourceContribution.js +5 -8
- package/dist/esm/shared-ts/src/near/actions.js +0 -1
- package/dist/esm/shared-ts/src/near/nearClient.js +0 -2
- package/dist/esm/shared-ts/src/passkey-custody/primitives.js +5 -1
- package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js +1 -1
- package/dist/esm/shared-ts/src/signing-lanes/index.js +1 -6
- package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js +5 -9
- package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js +2 -81
- package/dist/esm/shared-ts/src/signing-lanes/participants.js +1 -219
- package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js +0 -3
- package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentifier.js +12 -0
- package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js +2 -9
- package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js +2 -6
- package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js +0 -1
- package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js +1 -22
- package/dist/esm/shared-ts/src/threshold/participants.js +0 -1
- package/dist/esm/shared-ts/src/threshold/signingRootScope.js +0 -1
- package/dist/esm/shared-ts/src/utils/addWalletAuthMethod.js +4 -13
- package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js +1 -7
- package/dist/esm/shared-ts/src/utils/domainIds.js +1 -16
- package/dist/esm/shared-ts/src/utils/ecdsaCapabilityActivation.js +1 -11
- package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js +2 -5
- package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js +0 -1
- package/dist/esm/shared-ts/src/utils/emailOtpDomain.js +3 -1
- package/dist/esm/shared-ts/src/utils/errors.js +1 -19
- package/dist/esm/shared-ts/src/utils/exactKeys.js +17 -0
- package/dist/esm/shared-ts/src/utils/failure.js +20 -0
- package/dist/esm/shared-ts/src/utils/near.js +1 -1
- package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js +1 -1
- package/dist/esm/shared-ts/src/utils/registrationIds.js +1 -5
- package/dist/esm/shared-ts/src/utils/registrationIntent.js +3 -13
- package/dist/esm/shared-ts/src/utils/registrationSetupOperation.js +8 -0
- package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js +3 -6
- package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js +1 -2
- package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js +1 -1
- package/dist/esm/shared-ts/src/utils/thresholdEcdsaChainTarget.js +9 -0
- package/dist/esm/shared-ts/src/utils/validation.js +1 -5
- package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js +0 -1
- package/dist/esm/shared-ts/src/utils/walletManagementProtocol.js +6 -0
- package/dist/esm/shared-ts/src/utils/wireSchema.js +2 -13
- package/dist/esm/shared-ts/src/wallet-recovery/backupAcknowledgement.js +6 -24
- package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js +0 -1
- package/dist/esm/shared-ts/src/wallet-recovery/recoveryKeyId.js +5 -6
- package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js +1 -4
- package/dist/esm/storage/d1Sql.js +1 -7
- package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js +10 -33
- package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js +1 -2
- package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js +3 -4
- package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js +3 -10
- package/dist/esm/threshold/session/signingSessionSeal/options.js +0 -1
- package/dist/esm/threshold/session/signingSessionSeal/service.js +8 -35
- package/dist/esm/threshold/session/signingSessionSeal/transport/express.js +18 -94
- package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js +6 -30
- package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js +5 -20
- package/dist/esm/wasm/evm_crypto/pkg/evm_crypto_bg.wasm +0 -0
- package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.js +0 -611
- package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker_bg.wasm +0 -0
- package/dist/esm/wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm +0 -0
- package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts +0 -4
- package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts +2 -1
- package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts +9 -2
- package/dist/types/shared-ts/src/authorization/walletSignerActivationEquality.d.ts +4 -0
- package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts +3 -4
- package/dist/types/shared-ts/src/device-linking/contracts.d.ts +6 -63
- package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts +2 -0
- package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts +5 -12
- package/dist/types/shared-ts/src/passkey-custody/primitives.d.ts +9 -0
- package/dist/types/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.d.ts +0 -2
- package/dist/types/shared-ts/src/signing-lanes/execution.d.ts +11 -12
- package/dist/types/shared-ts/src/signing-lanes/ids.d.ts +3 -17
- package/dist/types/shared-ts/src/signing-lanes/index.d.ts +0 -4
- package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts +0 -1
- package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts +0 -18
- package/dist/types/shared-ts/src/signing-lanes/participants.d.ts +6 -35
- package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts +6 -845
- package/dist/types/shared-ts/src/tenant-root/tenantRootIdentifier.d.ts +3 -0
- package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts +2 -1
- package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts +6 -0
- package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts +0 -10
- package/dist/types/shared-ts/src/threshold/participants.d.ts +1 -1
- package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts +1 -0
- package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts +1 -133
- package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts +4 -18
- package/dist/types/shared-ts/src/utils/domainIds.d.ts +0 -12
- package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts +2 -11
- package/dist/types/shared-ts/src/utils/eip1559TxWasmJson.d.ts +16 -0
- package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts +2 -0
- package/dist/types/shared-ts/src/utils/errors.d.ts +0 -4
- package/dist/types/shared-ts/src/utils/exactKeys.d.ts +11 -0
- package/dist/types/shared-ts/src/utils/failure.d.ts +12 -0
- package/dist/types/shared-ts/src/utils/jsonRpc.d.ts +3 -4
- package/dist/types/shared-ts/src/utils/near.d.ts +0 -20
- package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts +1 -0
- package/dist/types/shared-ts/src/utils/normalize.d.ts +0 -2
- package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts +3 -8
- package/dist/types/shared-ts/src/utils/registrationSetupOperation.d.ts +3 -0
- package/dist/types/shared-ts/src/utils/registrationSignerPlan.d.ts +7 -19
- package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts +3 -1
- package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts +1 -0
- package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts +3 -4
- package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts +30 -8
- package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts +2 -0
- package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts +10 -11
- package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts +25 -0
- package/dist/types/shared-ts/src/utils/validation.d.ts +1 -3
- package/dist/types/shared-ts/src/utils/variant.d.ts +18 -0
- package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts +3 -6
- package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts +0 -1
- package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts +3 -0
- package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts +4 -2
- package/dist/types/shared-ts/src/utils/wireSchema.d.ts +0 -2
- package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts +0 -1
- package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts +1 -10
- package/dist/types/shared-ts/src/wallet-recovery/recoveryCodes.d.ts +1 -3
- package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts +3 -16
- package/dist/types/shared-ts/src/wallet-recovery/recoveryKeyId.d.ts +5 -21
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts +15 -0
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts +3 -4
- package/dist/types/wallet-server/src/authorization/domain.d.ts +13 -2
- package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts +27 -3
- package/dist/types/wallet-server/src/authorization/lifecycleRouting.d.ts +32 -0
- package/dist/types/wallet-server/src/authorization/lifecycleRouting.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/authorization/recoveryRouting.d.ts +22 -0
- package/dist/types/wallet-server/src/authorization/recoveryRouting.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/authorization/service.d.ts +27 -1
- package/dist/types/wallet-server/src/authorization/sessionRouting.d.ts +20 -0
- package/dist/types/wallet-server/src/authorization/sessionRouting.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/cloud-host.d.ts +31 -9
- package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts +1 -22
- package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts +1 -79
- package/dist/types/wallet-server/src/core/IdentityStore.d.ts +0 -10
- package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts +0 -1
- package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts +0 -2
- package/dist/types/wallet-server/src/core/ThresholdService/index.d.ts +1 -3
- package/dist/types/wallet-server/src/core/ThresholdService/kv.d.ts +0 -7
- package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts +0 -3
- package/dist/types/wallet-server/src/core/ThresholdService/routerAbNormalSigningPolicy.d.ts +0 -1
- package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts +6 -18
- package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts +0 -127
- package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts +1 -5
- package/dist/types/wallet-server/src/core/WalletStore.d.ts +0 -3
- package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts +8 -20
- package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts +1 -27
- package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts +2 -16
- package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts +22 -14
- package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts +0 -24
- package/dist/types/wallet-server/src/core/authService/emailOtpEnrollment.d.ts +1 -70
- package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts +1 -14
- package/dist/types/wallet-server/src/core/authService/githubOAuth.d.ts +2 -1
- package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts +1 -39
- package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts +0 -17
- package/dist/types/wallet-server/src/core/authService/webauthn.d.ts +0 -125
- package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts +0 -3
- package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts +1 -1
- package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts +0 -12
- package/dist/types/wallet-server/src/core/config.d.ts +0 -10
- package/dist/types/wallet-server/src/core/d1EcdsaSignerRead.d.ts +39 -0
- package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts +0 -2
- package/dist/types/wallet-server/src/core/d1TenantStore.d.ts +0 -7
- package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts +0 -1
- package/dist/types/wallet-server/src/core/d1WalletStore.d.ts +10 -0
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceBootstrap.d.ts +19 -0
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts +8 -6
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts +3 -4
- package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts +2 -5
- package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts +19 -0
- package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts +10 -7
- package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts +1 -5
- package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts +0 -1
- package/dist/types/wallet-server/src/core/passkeyCredentialClaims.d.ts +9 -0
- package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.d.ts +0 -2
- package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts +3 -7
- package/dist/types/wallet-server/src/core/rpcClients/near/NearClient.d.ts +1 -2
- package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts +2 -11
- package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts +1 -92
- package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts +4 -52
- package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts +3 -12
- package/dist/types/wallet-server/src/core/types.d.ts +2 -305
- package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts +15 -3
- package/dist/types/wallet-server/src/index.d.ts +8 -13
- package/dist/types/wallet-server/src/localIntendedMaterialAdmissionFault.d.ts +38 -0
- package/dist/types/wallet-server/src/localIntendedPresignCancellation.d.ts +4 -0
- package/dist/types/wallet-server/src/localRegistrationSetupAuthority.d.ts +13 -0
- package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts +4 -9
- package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts +15 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizationAssembly.d.ts +23 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts +0 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts +25 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts +9 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts +4 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts +11 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts +22 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts +7 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.d.ts +1 -10
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.d.ts +4 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts +8 -6
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts +5 -8
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts +1 -13
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.d.ts +2 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts +2 -8
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts +0 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts +20 -11
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts +5 -5
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts +4 -14
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts +29 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts +3 -16
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.d.ts +7 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.d.ts +23 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityService.d.ts +0 -12
- package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.d.ts +24 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcVerificationService.d.ts +0 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/googleOidcToken.d.ts +4 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts +5 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts +9 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts +3 -7
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts +10 -11
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts +3 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts +51 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts +3 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts +35 -50
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts +3 -30
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.d.ts +11 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts +14 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.d.ts +27 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts +1 -10
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts +2 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts +0 -4
- package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.d.ts +3 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts +8 -50
- package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts +23 -10
- package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/router/cloudflare/runtime/cloudflare.types.d.ts +0 -2
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts +9 -34
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOpsClient.d.ts +2 -0
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRuntimeOps.d.ts +3 -0
- package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts +0 -1
- package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts +3 -15
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts +1 -1
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts +2 -2
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts +2 -2
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.d.ts +2 -0
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts +2 -0
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts +9 -50
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts +0 -2
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts +0 -3
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts +1 -13
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts +8 -9
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts +13 -0
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts +3 -4
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts +7 -33
- package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts +1 -2
- package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts +2 -7
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts +1 -0
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts +51 -0
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts +2 -10
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts +2 -2
- package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts +3 -1
- package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts +39 -38
- package/dist/types/wallet-server/src/router/framework/googleLoginResolution.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/router/framework/http.d.ts +1 -0
- package/dist/types/wallet-server/src/router/framework/registrationSetupDispatch.d.ts +13 -0
- package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts +1 -9
- package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts +1 -1
- package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts +3 -6
- package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingResponses.d.ts +17 -0
- package/dist/types/wallet-server/src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.d.ts +37 -0
- package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts +3 -5
- package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts +0 -1
- package/dist/types/wallet-server/src/storage/d1Sql.d.ts +0 -1
- package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts +1 -2
- package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/signingSessionSeal.types.d.ts +6 -8
- package/migrations/d1-signer/0040_namespace_home_challenges.sql +16 -0
- package/migrations/d1-signer/0041_step_up_admission_expiry.sql +28 -0
- package/migrations/d1-signer/0042_deployment_resource_challenges.sql +4 -0
- package/migrations/d1-signer/0043_google_registration_candidate_claim.sql +2 -0
- package/migrations/d1-signer/0044_linked_device_bootstrap_imports.sql +6 -0
- package/migrations/d1-signer/0045_wallet_owned_capability_receipts.sql +29 -0
- package/migrations/d1-signer/0046_wallet_owned_signing_abuse.sql +41 -0
- package/migrations/d1-signer/0047_remove_unused_near_public_keys.sql +2 -0
- package/migrations/d1-signer/0048_operation_owner_scope.sql +45 -0
- package/package.json +2 -3
- package/src/README.md +11 -3
- package/dist/esm/core/AuthService.js +0 -2
- package/dist/esm/core/NearPublicKeyStore.js +0 -200
- package/dist/esm/core/ThresholdService/stores/CloudflareDurableObjectStore.js +0 -397
- package/dist/esm/core/ThresholdService/stores/KeyStore.js +0 -140
- package/dist/esm/core/ThresholdService/stores/SessionStore.js +0 -361
- package/dist/esm/core/ThresholdService/stores/StoreConfig.js +0 -13
- package/dist/esm/core/authService/AuthService.js +0 -594
- package/dist/esm/core/authService/bytes.js +0 -22
- package/dist/esm/core/authService/configValues.js +0 -15
- package/dist/esm/core/authService/emailOtpChallengeOperations.js +0 -126
- package/dist/esm/core/authService/emailOtpChallengeProof.js +0 -214
- package/dist/esm/core/authService/emailOtpChallengeVerification.js +0 -335
- package/dist/esm/core/authService/emailOtpChallenges.js +0 -260
- package/dist/esm/core/authService/emailOtpDelivery.js +0 -169
- package/dist/esm/core/authService/emailOtpGrant.js +0 -74
- package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js +0 -175
- package/dist/esm/core/authService/emailOtpUnlock.js +0 -264
- package/dist/esm/core/authService/googleEmailOtpOperations.js +0 -141
- package/dist/esm/core/authService/googleEmailOtpRegistration.js +0 -674
- package/dist/esm/core/authService/identity.js +0 -57
- package/dist/esm/core/authService/identityOperations.js +0 -32
- package/dist/esm/core/authService/nearAccountOperations.js +0 -229
- package/dist/esm/core/authService/nearPublicKeyMetadata.js +0 -127
- package/dist/esm/core/authService/oidcVerification.js +0 -261
- package/dist/esm/core/authService/registrationThresholdHelpers.js +0 -30
- package/dist/esm/core/authService/runtime.js +0 -45
- package/dist/esm/core/authService/storeRegistry.js +0 -102
- package/dist/esm/core/authService/thresholdStoreSummary.js +0 -32
- package/dist/esm/core/authService/webauthnAuthority.js +0 -17
- package/dist/esm/core/defaultConfigsServer.js +0 -9
- package/dist/esm/core/hostedAccountIds.js +0 -225
- package/dist/esm/core/routerAbSigning/createRouterAbSigningRuntimes.js +0 -84
- package/dist/esm/core/signingLanes/LaneAggregateRevocationApplicationService.js +0 -86
- package/dist/esm/core/signingLanes/LaneEnrollmentActivation.js +0 -324
- package/dist/esm/core/signingLanes/LaneEnrollmentRevocation.js +0 -173
- package/dist/esm/core/signingLanes/LaneLifecycleApplicationService.js +0 -198
- package/dist/esm/core/signingLanes/ecdsaServerRetirement.js +0 -73
- package/dist/esm/core/signingLanes/ed25519ServerRetirement.js +0 -68
- package/dist/esm/core/signingLanes/signingWorkerLaneMaterialIdentity.js +0 -0
- package/dist/esm/core/storeBackends.js +0 -208
- package/dist/esm/core/utils.js +0 -14
- package/dist/esm/core/webAuthnStoreBackends.js +0 -198
- package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js +0 -56
- package/dist/esm/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.js +0 -10
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.js +0 -22
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js +0 -166
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEnrollmentGateway.js +0 -38
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleApplicationService.js +0 -20
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js +0 -1459
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLockStore.js +0 -114
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.js +0 -16
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js +0 -171
- package/dist/esm/router/cloudflare/d1/signingLanes/index.js +0 -10
- package/dist/esm/router/cloudflare/durableObjects/thresholdStore.js +0 -404
- package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js +0 -596
- package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js +0 -273
- package/dist/esm/router/cloudflare/signingLanes/index.js +0 -4
- package/dist/esm/router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding.js +0 -32
- package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js +0 -39
- package/dist/esm/shared-ts/src/signing-lanes/rotation.js +0 -8
- package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js +0 -358
- package/dist/esm/shared-ts/src/signing-lanes/rotationLifecycle.js +0 -313
- package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js +0 -532
- package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js +0 -323
- package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js +0 -59
- package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm +0 -0
- package/dist/types/shared-ts/src/signing-lanes/participantDigest.typecheck.d.ts +0 -2
- package/dist/types/shared-ts/src/signing-lanes/rotation.typecheck.d.ts +0 -2
- package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts +0 -13
- package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts +0 -78
- package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts +0 -27
- package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts +0 -6
- package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts +0 -20
- package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeAttempt.d.ts +0 -59
- package/dist/types/wallet-server/src/core/AuthService.d.ts +0 -3
- package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts +0 -48
- package/dist/types/wallet-server/src/core/ThresholdService/stores/CloudflareDurableObjectStore.d.ts +0 -21
- package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts +0 -40
- package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts +0 -98
- package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts +0 -4
- package/dist/types/wallet-server/src/core/ThresholdService/stores/ThresholdStoreConfig.typecheck.d.ts +0 -2
- package/dist/types/wallet-server/src/core/authService/AuthService.d.ts +0 -490
- package/dist/types/wallet-server/src/core/authService/bytes.d.ts +0 -4
- package/dist/types/wallet-server/src/core/authService/configValues.d.ts +0 -7
- package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts +0 -109
- package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts +0 -169
- package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts +0 -47
- package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts +0 -94
- package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts +0 -66
- package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts +0 -43
- package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts +0 -49
- package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts +0 -71
- package/dist/types/wallet-server/src/core/authService/googleEmailOtpOperations.d.ts +0 -126
- package/dist/types/wallet-server/src/core/authService/googleEmailOtpRegistration.d.ts +0 -169
- package/dist/types/wallet-server/src/core/authService/identity.d.ts +0 -25
- package/dist/types/wallet-server/src/core/authService/identityOperations.d.ts +0 -19
- package/dist/types/wallet-server/src/core/authService/nearAccountOperations.d.ts +0 -55
- package/dist/types/wallet-server/src/core/authService/nearPublicKeyMetadata.d.ts +0 -44
- package/dist/types/wallet-server/src/core/authService/oidcVerification.d.ts +0 -66
- package/dist/types/wallet-server/src/core/authService/registrationThresholdHelpers.d.ts +0 -11
- package/dist/types/wallet-server/src/core/authService/runtime.d.ts +0 -20
- package/dist/types/wallet-server/src/core/authService/storeRegistry.d.ts +0 -53
- package/dist/types/wallet-server/src/core/authService/thresholdStoreSummary.d.ts +0 -3
- package/dist/types/wallet-server/src/core/authService/webauthnAuthority.d.ts +0 -5
- package/dist/types/wallet-server/src/core/defaultConfigsServer.d.ts +0 -5
- package/dist/types/wallet-server/src/core/hostedAccountIds.d.ts +0 -16
- package/dist/types/wallet-server/src/core/routerAbSigning/createRouterAbSigningRuntimes.d.ts +0 -16
- package/dist/types/wallet-server/src/core/signingLanes/LaneAggregateRevocationApplicationService.d.ts +0 -36
- package/dist/types/wallet-server/src/core/signingLanes/LaneEffectJournalStore.d.ts +0 -62
- package/dist/types/wallet-server/src/core/signingLanes/LaneEnrollmentActivation.d.ts +0 -13
- package/dist/types/wallet-server/src/core/signingLanes/LaneEnrollmentRevocation.d.ts +0 -24
- package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleApplicationService.d.ts +0 -141
- package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleStore.d.ts +0 -228
- package/dist/types/wallet-server/src/core/signingLanes/ecdsaServerRetirement.d.ts +0 -58
- package/dist/types/wallet-server/src/core/signingLanes/ed25519ServerRetirement.d.ts +0 -30
- package/dist/types/wallet-server/src/core/signingLanes/signingWorkerLaneMaterialIdentity.d.ts +0 -21
- package/dist/types/wallet-server/src/core/storeBackends.d.ts +0 -83
- package/dist/types/wallet-server/src/core/utils.d.ts +0 -3
- package/dist/types/wallet-server/src/core/webAuthnStoreBackends.d.ts +0 -96
- package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts +0 -29
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.d.ts +0 -4
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.d.ts +0 -4
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts +0 -24
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEnrollmentGateway.d.ts +0 -20
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLifecycleApplicationService.d.ts +0 -13
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.d.ts +0 -51
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLockStore.d.ts +0 -28
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.d.ts +0 -5
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneRecords.d.ts +0 -107
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/index.d.ts +0 -10
- package/dist/types/wallet-server/src/router/cloudflare/durableObjects/thresholdStore.d.ts +0 -18
- package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.d.ts +0 -217
- package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.d.ts +0 -73
- package/dist/types/wallet-server/src/router/cloudflare/signingLanes/index.d.ts +0 -4
- package/dist/types/wallet-server/src/router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding.d.ts +0 -6
- package/dist/types/wallet-server/src/router/transport/fetch/routes/nearPublicKeys.d.ts +0 -3
- /package/dist/esm/{core/signingLanes/LaneEffectJournalStore.js → authorization/recoveryRouting.js} +0 -0
- /package/dist/esm/{core/signingLanes/LaneLifecycleStore.js → authorization/sessionRouting.js} +0 -0
|
@@ -1,324 +0,0 @@
|
|
|
1
|
-
import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
|
|
2
|
-
import { sha256Bytes, sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
|
|
3
|
-
import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
|
|
4
|
-
import { buildLaneProtocolRecordV1, parseLaneHolderDeliveryReceiptV1, parseLaneProtocolCommitReceiptV1, parseLaneServerActivationReceiptV1 } from "../../shared-ts/src/signing-lanes/rotationParsers.js";
|
|
5
|
-
import { computeLaneEnrollmentManifestDigestV1, encodeLaneHolderDeliveryReceiptV1, encodeLaneProtocolCommitReceiptV1, encodeLaneServerActivationReceiptV1 } from "../../shared-ts/src/signing-lanes/rotationDigests.js";
|
|
6
|
-
import { transitionLaneProtocolLifecycleV1 } from "../../shared-ts/src/signing-lanes/rotationLifecycle.js";
|
|
7
|
-
//#region src/core/signingLanes/LaneEnrollmentActivation.ts
|
|
8
|
-
var LaneEnrollmentActivation = class {
|
|
9
|
-
constructor(lifecycleStore) {
|
|
10
|
-
this.lifecycleStore = lifecycleStore;
|
|
11
|
-
}
|
|
12
|
-
async prepareLaneEnrollmentV1(input) {
|
|
13
|
-
const commandDigestB64u = await computeLaneEnrollmentManifestDigestV1(input.manifest);
|
|
14
|
-
const lifecycle = {
|
|
15
|
-
state: "preparing",
|
|
16
|
-
manifestDigestB64u: commandDigestB64u,
|
|
17
|
-
startedAtMs: input.manifest.createdAtMs
|
|
18
|
-
};
|
|
19
|
-
const admissionInput = {
|
|
20
|
-
manifest: input.manifest,
|
|
21
|
-
children: input.children.map((job) => buildLaneProtocolRecordV1({
|
|
22
|
-
job,
|
|
23
|
-
lifecycle: {
|
|
24
|
-
state: "awaiting_protocol_commitment",
|
|
25
|
-
startedAtMs: input.manifest.createdAtMs
|
|
26
|
-
}
|
|
27
|
-
})),
|
|
28
|
-
commandDigestB64u,
|
|
29
|
-
lifecycle
|
|
30
|
-
};
|
|
31
|
-
const admitted = await this.lifecycleStore.putEnrollmentAdmission(admissionInput);
|
|
32
|
-
if (admitted.outcome === "conflict") return {
|
|
33
|
-
kind: "lane_enrollment_preparation_result_v1",
|
|
34
|
-
outcome: "conflict",
|
|
35
|
-
enrollmentId: input.manifest.enrollmentId,
|
|
36
|
-
expectedVersion: admitted.expectedVersion ?? 0,
|
|
37
|
-
actualVersion: admitted.actualVersion,
|
|
38
|
-
requestedCommandDigestB64u: parseDigestB64u(admitted.requestedCommandDigestB64u),
|
|
39
|
-
storedCommandDigestB64u: parseDigestB64u(admitted.storedCommandDigestB64u)
|
|
40
|
-
};
|
|
41
|
-
const orderedProtocols = await readOrderedProtocols(this.lifecycleStore, input.children);
|
|
42
|
-
return {
|
|
43
|
-
kind: "lane_enrollment_preparation_result_v1",
|
|
44
|
-
outcome: admitted.outcome,
|
|
45
|
-
enrollmentId: input.manifest.enrollmentId,
|
|
46
|
-
version: admitted.version,
|
|
47
|
-
commandDigestB64u: parseDigestB64u(admitted.commandDigestB64u),
|
|
48
|
-
lifecycle: admitted.value.lifecycle,
|
|
49
|
-
orderedProtocols
|
|
50
|
-
};
|
|
51
|
-
}
|
|
52
|
-
async recordLaneProtocolCommitV1(input) {
|
|
53
|
-
const receipt = parseLaneProtocolCommitReceiptV1(input.receipt);
|
|
54
|
-
const current = await this.lifecycleStore.getProtocol(receipt.operationId);
|
|
55
|
-
if (!current || String(current.value.job.enrollmentId) !== String(receipt.enrollmentId)) return {
|
|
56
|
-
outcome: "conflict",
|
|
57
|
-
expectedVersion: input.expectedVersion,
|
|
58
|
-
actualVersion: current?.version ?? 0,
|
|
59
|
-
requestedCommandDigestB64u: await digestReceipt(receipt),
|
|
60
|
-
storedCommandDigestB64u: current?.commandDigestB64u ?? ""
|
|
61
|
-
};
|
|
62
|
-
const receiptDigestB64u = await digestReceipt(receipt);
|
|
63
|
-
if (current.value.lifecycle.state !== "awaiting_protocol_commitment") {
|
|
64
|
-
if ((current.value.lifecycle.state === "committed_awaiting_holder_delivery" || current.value.lifecycle.state === "awaiting_server_activation" || current.value.lifecycle.state === "ready_for_parent_visibility" || current.value.lifecycle.state === "active") && current.value.lifecycle.protocolCommitReceiptDigestB64u === receiptDigestB64u) return {
|
|
65
|
-
outcome: "replayed",
|
|
66
|
-
version: current.version,
|
|
67
|
-
commandDigestB64u: current.commandDigestB64u,
|
|
68
|
-
record: current.value
|
|
69
|
-
};
|
|
70
|
-
return {
|
|
71
|
-
outcome: "conflict",
|
|
72
|
-
expectedVersion: input.expectedVersion,
|
|
73
|
-
actualVersion: current.version,
|
|
74
|
-
requestedCommandDigestB64u: receiptDigestB64u,
|
|
75
|
-
storedCommandDigestB64u: current.commandDigestB64u
|
|
76
|
-
};
|
|
77
|
-
}
|
|
78
|
-
const persistedReceipt = await this.lifecycleStore.putProtocolCommitReceipt(receipt, receiptDigestB64u);
|
|
79
|
-
if (persistedReceipt.outcome === "conflict") return {
|
|
80
|
-
outcome: "conflict",
|
|
81
|
-
expectedVersion: input.expectedVersion,
|
|
82
|
-
actualVersion: persistedReceipt.actualVersion,
|
|
83
|
-
requestedCommandDigestB64u: persistedReceipt.requestedCommandDigestB64u,
|
|
84
|
-
storedCommandDigestB64u: persistedReceipt.storedCommandDigestB64u
|
|
85
|
-
};
|
|
86
|
-
const lifecycle = transitionLaneProtocolLifecycleV1(current.value.lifecycle, {
|
|
87
|
-
action: "record_commit",
|
|
88
|
-
committedAtMs: receipt.committedAtMs,
|
|
89
|
-
transcriptHashB64u: receipt.transcriptHashB64u,
|
|
90
|
-
protocolCommitReceiptDigestB64u: receiptDigestB64u
|
|
91
|
-
});
|
|
92
|
-
if (lifecycle.state !== "committed_awaiting_holder_delivery") throw new Error("protocol commit transition did not produce holder-delivery state");
|
|
93
|
-
const cas = await this.lifecycleStore.compareAndSetProtocolLifecycle({
|
|
94
|
-
operationId: receipt.operationId,
|
|
95
|
-
expectedVersion: input.expectedVersion,
|
|
96
|
-
commandDigestB64u: receiptDigestB64u,
|
|
97
|
-
lifecycle
|
|
98
|
-
});
|
|
99
|
-
return cas.outcome === "conflict" ? await reconcileProtocolCas(this.lifecycleStore, receipt.operationId, cas, receiptDigestB64u, "protocol") : cas;
|
|
100
|
-
}
|
|
101
|
-
async resumeLaneProtocolOperationV1(input) {
|
|
102
|
-
const current = await this.lifecycleStore.getProtocol(input.operationId);
|
|
103
|
-
if (!current || String(current.value.job.enrollmentId) !== String(input.enrollmentId) || String(current.value.job.idempotencyKey) !== String(input.idempotencyKey)) return {
|
|
104
|
-
outcome: "conflict",
|
|
105
|
-
expectedVersion: input.expectedVersion,
|
|
106
|
-
actualVersion: current?.version ?? 0,
|
|
107
|
-
requestedCommandDigestB64u: await digestResumeCommand(input),
|
|
108
|
-
storedCommandDigestB64u: current?.commandDigestB64u ?? ""
|
|
109
|
-
};
|
|
110
|
-
if (current.value.lifecycle.state !== "preparing" && current.value.lifecycle.state !== "committed_completion_required") return {
|
|
111
|
-
outcome: "replayed",
|
|
112
|
-
version: current.version,
|
|
113
|
-
commandDigestB64u: current.commandDigestB64u,
|
|
114
|
-
record: current.value
|
|
115
|
-
};
|
|
116
|
-
const lifecycle = nextResumeLifecycle(current.value.lifecycle);
|
|
117
|
-
return await this.lifecycleStore.compareAndSetProtocolLifecycle({
|
|
118
|
-
operationId: input.operationId,
|
|
119
|
-
expectedVersion: input.expectedVersion,
|
|
120
|
-
commandDigestB64u: await digestResumeCommand(input),
|
|
121
|
-
lifecycle
|
|
122
|
-
});
|
|
123
|
-
}
|
|
124
|
-
async recordLaneHolderDeliveryV1(input) {
|
|
125
|
-
const receipt = parseLaneHolderDeliveryReceiptV1(input.receipt);
|
|
126
|
-
const current = await this.lifecycleStore.getProtocol(receipt.operationId);
|
|
127
|
-
if (!current || String(current.value.job.enrollmentId) !== String(receipt.enrollmentId)) return {
|
|
128
|
-
outcome: "conflict",
|
|
129
|
-
expectedVersion: input.expectedVersion,
|
|
130
|
-
actualVersion: current?.version ?? 0,
|
|
131
|
-
requestedCommandDigestB64u: await digestHolderReceipt(receipt),
|
|
132
|
-
storedCommandDigestB64u: current?.commandDigestB64u ?? ""
|
|
133
|
-
};
|
|
134
|
-
const receiptDigestB64u = await digestHolderReceipt(receipt);
|
|
135
|
-
if (current.value.lifecycle.state !== "committed_awaiting_holder_delivery") {
|
|
136
|
-
if ((current.value.lifecycle.state === "awaiting_server_activation" || current.value.lifecycle.state === "ready_for_parent_visibility" || current.value.lifecycle.state === "active") && current.value.lifecycle.holderDeliveryReceiptDigestB64u === receiptDigestB64u) return {
|
|
137
|
-
outcome: "replayed",
|
|
138
|
-
version: current.version,
|
|
139
|
-
commandDigestB64u: current.commandDigestB64u,
|
|
140
|
-
record: current.value
|
|
141
|
-
};
|
|
142
|
-
return {
|
|
143
|
-
outcome: "conflict",
|
|
144
|
-
expectedVersion: input.expectedVersion,
|
|
145
|
-
actualVersion: current.version,
|
|
146
|
-
requestedCommandDigestB64u: receiptDigestB64u,
|
|
147
|
-
storedCommandDigestB64u: current.commandDigestB64u
|
|
148
|
-
};
|
|
149
|
-
}
|
|
150
|
-
const persistedReceipt = await this.lifecycleStore.putHolderDeliveryReceipt(receipt, receiptDigestB64u);
|
|
151
|
-
if (persistedReceipt.outcome === "conflict") return {
|
|
152
|
-
outcome: "conflict",
|
|
153
|
-
expectedVersion: input.expectedVersion,
|
|
154
|
-
actualVersion: persistedReceipt.actualVersion,
|
|
155
|
-
requestedCommandDigestB64u: persistedReceipt.requestedCommandDigestB64u,
|
|
156
|
-
storedCommandDigestB64u: persistedReceipt.storedCommandDigestB64u
|
|
157
|
-
};
|
|
158
|
-
const lifecycle = transitionLaneProtocolLifecycleV1(current.value.lifecycle, {
|
|
159
|
-
action: "record_holder_delivery",
|
|
160
|
-
holderReceiptAtMs: receipt.acknowledgedAtMs,
|
|
161
|
-
holderDeliveryReceiptDigestB64u: receiptDigestB64u
|
|
162
|
-
});
|
|
163
|
-
if (lifecycle.state !== "awaiting_server_activation") throw new Error("holder delivery transition did not produce awaiting server activation");
|
|
164
|
-
const cas = await this.lifecycleStore.compareAndSetProtocolLifecycle({
|
|
165
|
-
operationId: receipt.operationId,
|
|
166
|
-
expectedVersion: input.expectedVersion,
|
|
167
|
-
commandDigestB64u: receiptDigestB64u,
|
|
168
|
-
lifecycle
|
|
169
|
-
});
|
|
170
|
-
return cas.outcome === "conflict" ? await reconcileProtocolCas(this.lifecycleStore, receipt.operationId, cas, receiptDigestB64u, "holder") : cas;
|
|
171
|
-
}
|
|
172
|
-
async activateLaneServerMaterialV1(input) {
|
|
173
|
-
const receipt = parseLaneServerActivationReceiptV1(input.receipt);
|
|
174
|
-
const current = await this.lifecycleStore.getProtocol(receipt.operationId);
|
|
175
|
-
if (!current || String(current.value.job.enrollmentId) !== String(receipt.enrollmentId)) return {
|
|
176
|
-
outcome: "conflict",
|
|
177
|
-
expectedVersion: input.expectedVersion,
|
|
178
|
-
actualVersion: current?.version ?? 0,
|
|
179
|
-
requestedCommandDigestB64u: await digestServerReceipt(receipt),
|
|
180
|
-
storedCommandDigestB64u: current?.commandDigestB64u ?? ""
|
|
181
|
-
};
|
|
182
|
-
const receiptDigestB64u = await digestServerReceipt(receipt);
|
|
183
|
-
if (current.value.lifecycle.state === "ready_for_parent_visibility" || current.value.lifecycle.state === "active") {
|
|
184
|
-
if (current.value.lifecycle.serverActivationReceiptDigestB64u !== receiptDigestB64u) return {
|
|
185
|
-
outcome: "conflict",
|
|
186
|
-
expectedVersion: input.expectedVersion,
|
|
187
|
-
actualVersion: current.version,
|
|
188
|
-
requestedCommandDigestB64u: receiptDigestB64u,
|
|
189
|
-
storedCommandDigestB64u: current.commandDigestB64u
|
|
190
|
-
};
|
|
191
|
-
return {
|
|
192
|
-
outcome: "replayed",
|
|
193
|
-
version: current.version,
|
|
194
|
-
commandDigestB64u: current.commandDigestB64u,
|
|
195
|
-
record: current.value
|
|
196
|
-
};
|
|
197
|
-
}
|
|
198
|
-
if (current.value.lifecycle.state !== "awaiting_server_activation") return {
|
|
199
|
-
outcome: "conflict",
|
|
200
|
-
expectedVersion: input.expectedVersion,
|
|
201
|
-
actualVersion: current.version,
|
|
202
|
-
requestedCommandDigestB64u: receiptDigestB64u,
|
|
203
|
-
storedCommandDigestB64u: current.commandDigestB64u
|
|
204
|
-
};
|
|
205
|
-
const persistedReceipt = await this.lifecycleStore.putServerActivationReceipt(receipt, receiptDigestB64u);
|
|
206
|
-
if (persistedReceipt.outcome === "conflict") return {
|
|
207
|
-
outcome: "conflict",
|
|
208
|
-
expectedVersion: input.expectedVersion,
|
|
209
|
-
actualVersion: persistedReceipt.actualVersion,
|
|
210
|
-
requestedCommandDigestB64u: persistedReceipt.requestedCommandDigestB64u,
|
|
211
|
-
storedCommandDigestB64u: persistedReceipt.storedCommandDigestB64u
|
|
212
|
-
};
|
|
213
|
-
const lifecycle = transitionLaneProtocolLifecycleV1(current.value.lifecycle, {
|
|
214
|
-
action: "record_server_activation",
|
|
215
|
-
serverActivatedAtMs: receipt.activatedAtMs,
|
|
216
|
-
serverActivationReceiptDigestB64u: receiptDigestB64u
|
|
217
|
-
});
|
|
218
|
-
if (lifecycle.state !== "ready_for_parent_visibility") throw new Error("server activation transition did not produce ready-for-parent-visibility");
|
|
219
|
-
const cas = await this.lifecycleStore.compareAndSetProtocolLifecycle({
|
|
220
|
-
operationId: receipt.operationId,
|
|
221
|
-
expectedVersion: input.expectedVersion,
|
|
222
|
-
commandDigestB64u: receiptDigestB64u,
|
|
223
|
-
lifecycle
|
|
224
|
-
});
|
|
225
|
-
return cas.outcome === "conflict" ? await reconcileProtocolCas(this.lifecycleStore, receipt.operationId, cas, receiptDigestB64u, "server") : cas;
|
|
226
|
-
}
|
|
227
|
-
async commitLaneEnrollmentActivationV1(input) {
|
|
228
|
-
const result = await this.lifecycleStore.commitEnrollmentVisibility(input);
|
|
229
|
-
if (result.outcome === "conflict") return {
|
|
230
|
-
kind: "lane_enrollment_activation_result_v1",
|
|
231
|
-
...result
|
|
232
|
-
};
|
|
233
|
-
const productEpochs = requireActiveProductEpochs(result.productEpochs);
|
|
234
|
-
return {
|
|
235
|
-
kind: "lane_enrollment_activation_result_v1",
|
|
236
|
-
outcome: result.outcome,
|
|
237
|
-
enrollmentId: input.enrollmentId,
|
|
238
|
-
version: result.version,
|
|
239
|
-
commandDigestB64u: result.commandDigestB64u,
|
|
240
|
-
receipt: result.receipt,
|
|
241
|
-
lifecycle: result.lifecycle,
|
|
242
|
-
productEpochs
|
|
243
|
-
};
|
|
244
|
-
}
|
|
245
|
-
};
|
|
246
|
-
function nextResumeLifecycle(lifecycle) {
|
|
247
|
-
switch (lifecycle.state) {
|
|
248
|
-
case "preparing": return transitionLaneProtocolLifecycleV1(lifecycle, {
|
|
249
|
-
action: "await_protocol_commitment",
|
|
250
|
-
atMs: lifecycle.startedAtMs
|
|
251
|
-
});
|
|
252
|
-
case "awaiting_protocol_commitment":
|
|
253
|
-
case "committed_awaiting_holder_delivery":
|
|
254
|
-
case "awaiting_server_activation":
|
|
255
|
-
case "ready_for_parent_visibility":
|
|
256
|
-
case "active":
|
|
257
|
-
case "aborted_precommit": return lifecycle;
|
|
258
|
-
case "committed_completion_required": return transitionLaneProtocolLifecycleV1(lifecycle, {
|
|
259
|
-
action: "resume_completion",
|
|
260
|
-
atMs: lifecycle.committedAtMs
|
|
261
|
-
});
|
|
262
|
-
default: return assertNeverLifecycle(lifecycle);
|
|
263
|
-
}
|
|
264
|
-
}
|
|
265
|
-
function assertNeverLifecycle(value) {
|
|
266
|
-
throw new Error(`Unhandled lane protocol lifecycle ${JSON.stringify(value)}`);
|
|
267
|
-
}
|
|
268
|
-
async function digestResumeCommand(input) {
|
|
269
|
-
return base64UrlEncode(await sha256BytesUtf8([
|
|
270
|
-
"seams/rotatable-signing-lanes/resume-protocol-operation/v1",
|
|
271
|
-
String(input.operationId),
|
|
272
|
-
String(input.enrollmentId),
|
|
273
|
-
String(input.idempotencyKey),
|
|
274
|
-
String(input.expectedVersion)
|
|
275
|
-
].join("\0")));
|
|
276
|
-
}
|
|
277
|
-
async function encodedDigest(value, encode) {
|
|
278
|
-
return base64UrlEncode(await sha256Bytes(encode(value)));
|
|
279
|
-
}
|
|
280
|
-
async function digestReceipt(receipt) {
|
|
281
|
-
return encodedDigest(receipt, (value) => encodeLaneProtocolCommitReceiptV1(value));
|
|
282
|
-
}
|
|
283
|
-
async function digestHolderReceipt(receipt) {
|
|
284
|
-
return encodedDigest(receipt, (value) => encodeLaneHolderDeliveryReceiptV1(value));
|
|
285
|
-
}
|
|
286
|
-
async function digestServerReceipt(receipt) {
|
|
287
|
-
return encodedDigest(receipt, (value) => encodeLaneServerActivationReceiptV1(value));
|
|
288
|
-
}
|
|
289
|
-
async function readOrderedProtocols(store, children) {
|
|
290
|
-
const protocols = [];
|
|
291
|
-
for (const child of children) {
|
|
292
|
-
const protocol = await store.getProtocol(child.operationId);
|
|
293
|
-
if (!protocol) throw new Error(`lane protocol admission did not persist ${String(child.operationId)}`);
|
|
294
|
-
protocols.push({
|
|
295
|
-
version: protocol.version,
|
|
296
|
-
commandDigestB64u: parseDigestB64u(protocol.commandDigestB64u),
|
|
297
|
-
record: protocol.value
|
|
298
|
-
});
|
|
299
|
-
}
|
|
300
|
-
const first = protocols[0];
|
|
301
|
-
if (!first) throw new Error("lane enrollment requires at least one child");
|
|
302
|
-
return [first, ...protocols.slice(1)];
|
|
303
|
-
}
|
|
304
|
-
async function reconcileProtocolCas(store, operationId, conflict, digestB64u, stage) {
|
|
305
|
-
const raced = await store.getProtocol(operationId);
|
|
306
|
-
if (!raced) return conflict;
|
|
307
|
-
const lifecycle = raced.value.lifecycle;
|
|
308
|
-
return stage === "protocol" && (lifecycle.state === "committed_awaiting_holder_delivery" || lifecycle.state === "awaiting_server_activation" || lifecycle.state === "ready_for_parent_visibility" || lifecycle.state === "active") && lifecycle.protocolCommitReceiptDigestB64u === digestB64u || stage === "holder" && (lifecycle.state === "awaiting_server_activation" || lifecycle.state === "ready_for_parent_visibility" || lifecycle.state === "active") && lifecycle.holderDeliveryReceiptDigestB64u === digestB64u || stage === "server" && (lifecycle.state === "ready_for_parent_visibility" || lifecycle.state === "active") && lifecycle.serverActivationReceiptDigestB64u === digestB64u ? {
|
|
309
|
-
outcome: "replayed",
|
|
310
|
-
version: raced.version,
|
|
311
|
-
commandDigestB64u: raced.commandDigestB64u,
|
|
312
|
-
record: raced.value
|
|
313
|
-
} : conflict;
|
|
314
|
-
}
|
|
315
|
-
function requireActiveProductEpochs(values) {
|
|
316
|
-
const active = values.filter((value) => value.state === "active");
|
|
317
|
-
const first = active[0];
|
|
318
|
-
if (!first) throw new Error("lane activation returned no active product epochs");
|
|
319
|
-
return [first, ...active.slice(1)];
|
|
320
|
-
}
|
|
321
|
-
//#endregion
|
|
322
|
-
export { LaneEnrollmentActivation };
|
|
323
|
-
|
|
324
|
-
//# sourceMappingURL=LaneEnrollmentActivation.js.map
|
|
@@ -1,173 +0,0 @@
|
|
|
1
|
-
import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
|
|
2
|
-
import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
|
|
3
|
-
import { buildAggregateLaneRevocationReceiptV1, buildCommitLaneEnrollmentRevocationV1, parseRevokeLaneEnrollmentV1 } from "../../shared-ts/src/signing-lanes/rotationParsers.js";
|
|
4
|
-
import { computeLaneEnrollmentManifestDigestV1, computeRevokeSigningLaneDigestV1 } from "../../shared-ts/src/signing-lanes/rotationDigests.js";
|
|
5
|
-
//#region src/core/signingLanes/LaneEnrollmentRevocation.ts
|
|
6
|
-
/**
|
|
7
|
-
* Revocation is intentionally separate from activation. The fence write must
|
|
8
|
-
* land before any caller asks a participant to retire material; this class
|
|
9
|
-
* only owns the Gateway-side lifecycle boundary.
|
|
10
|
-
*/
|
|
11
|
-
var LaneEnrollmentRevocation = class {
|
|
12
|
-
constructor(lifecycleStore) {
|
|
13
|
-
this.lifecycleStore = lifecycleStore;
|
|
14
|
-
}
|
|
15
|
-
async fenceEnrollment(input) {
|
|
16
|
-
const result = await this.lifecycleStore.fenceEnrollmentRevocation(input);
|
|
17
|
-
if (result.outcome === "conflict") throw new Error(`lane enrollment revocation fence conflicted at version ${result.actualVersion}`);
|
|
18
|
-
}
|
|
19
|
-
async commitEnrollment(input) {
|
|
20
|
-
const result = await this.lifecycleStore.commitEnrollmentRevocation(input);
|
|
21
|
-
if (result.outcome === "conflict") return {
|
|
22
|
-
kind: "lane_enrollment_revocation_result_v1",
|
|
23
|
-
...result
|
|
24
|
-
};
|
|
25
|
-
const productEpochs = result.productEpochs.filter((epoch) => epoch.state === "revoked");
|
|
26
|
-
const first = productEpochs[0];
|
|
27
|
-
if (!first) throw new Error("lane revocation returned no revoked product epochs");
|
|
28
|
-
return {
|
|
29
|
-
kind: "lane_enrollment_revocation_result_v1",
|
|
30
|
-
outcome: result.outcome,
|
|
31
|
-
enrollmentId: input.command.enrollmentId,
|
|
32
|
-
version: result.version,
|
|
33
|
-
commandDigestB64u: result.commandDigestB64u,
|
|
34
|
-
receipt: result.receipt,
|
|
35
|
-
lifecycle: result.lifecycle,
|
|
36
|
-
productEpochs: [first, ...productEpochs.slice(1)]
|
|
37
|
-
};
|
|
38
|
-
}
|
|
39
|
-
async completeLaneEnrollmentRevocationV1(input) {
|
|
40
|
-
const command = parseRevokeLaneEnrollmentV1(input.command);
|
|
41
|
-
const admission = await this.lifecycleStore.getEnrollment(command.enrollmentId);
|
|
42
|
-
if (!admission) throw new Error("lane enrollment is not admitted");
|
|
43
|
-
if (String(admission.value.manifest.walletId) !== String(command.walletId)) throw new Error("lane enrollment revocation wallet differs from its manifest");
|
|
44
|
-
if (await computeLaneEnrollmentManifestDigestV1(admission.value.manifest) !== command.manifestDigestB64u) throw new Error("lane enrollment revocation manifest differs from its admission");
|
|
45
|
-
const productEpochs = await this.lifecycleStore.listEnrollmentProductEpochs(command.enrollmentId);
|
|
46
|
-
if (productEpochs.length !== admission.value.manifest.orderedChildren.length) throw new Error("lane enrollment revocation product count differs from its manifest");
|
|
47
|
-
const productsByOperation = new Map(productEpochs.map((product) => [String(product.operationId), product]));
|
|
48
|
-
const orderedProducts = admission.value.manifest.orderedChildren.map((child) => {
|
|
49
|
-
const product = productsByOperation.get(String(child.operationId));
|
|
50
|
-
if (!product) throw new Error(`lane enrollment product is missing ${String(child.operationId)}`);
|
|
51
|
-
return product;
|
|
52
|
-
});
|
|
53
|
-
if (productsByOperation.size !== productEpochs.length) throw new Error("lane enrollment revocation product operation ids are duplicated");
|
|
54
|
-
const first = orderedProducts[0];
|
|
55
|
-
if (!first) throw new Error("lane enrollment revocation requires product epochs");
|
|
56
|
-
const revokedAtMs = first.state === "revoked" ? first.revokedAtMs : void 0;
|
|
57
|
-
if (revokedAtMs === void 0 || revokedAtMs !== command.requestedAtMs) throw new Error("lane enrollment revocation timestamp differs from its product epochs");
|
|
58
|
-
const orderedChildReceipts = orderedProducts.map((product, index) => {
|
|
59
|
-
const child = admission.value.manifest.orderedChildren[index];
|
|
60
|
-
if (product.state !== "revoked") throw new Error(`lane enrollment product ${String(child.operationId)} is not durably revoked`);
|
|
61
|
-
assertRevokedProductMatchesManifest(product, child, command.walletId, command.enrollmentId);
|
|
62
|
-
if (product.revokedAtMs !== revokedAtMs) throw new Error("lane enrollment product revocation timestamps differ");
|
|
63
|
-
return {
|
|
64
|
-
operationId: product.operationId,
|
|
65
|
-
walletKeyId: product.walletKeyId,
|
|
66
|
-
targetLaneId: product.laneId,
|
|
67
|
-
targetLaneShareEpoch: product.laneShareEpoch,
|
|
68
|
-
targetMaterialActivation: product.materialActivation,
|
|
69
|
-
revocationEpoch: product.revocationEpoch,
|
|
70
|
-
retirementReceiptDigestB64u: product.revocationReceiptDigestB64u
|
|
71
|
-
};
|
|
72
|
-
});
|
|
73
|
-
const firstChildReceipt = orderedChildReceipts[0];
|
|
74
|
-
if (!firstChildReceipt) throw new Error("lane enrollment revocation requires child receipts");
|
|
75
|
-
const receipt = buildAggregateLaneRevocationReceiptV1({
|
|
76
|
-
enrollmentId: command.enrollmentId,
|
|
77
|
-
walletId: command.walletId,
|
|
78
|
-
manifestDigestB64u: command.manifestDigestB64u,
|
|
79
|
-
orderedChildReceipts: [firstChildReceipt, ...orderedChildReceipts.slice(1)],
|
|
80
|
-
revokedAtMs
|
|
81
|
-
});
|
|
82
|
-
const commit = buildCommitLaneEnrollmentRevocationV1({
|
|
83
|
-
enrollmentId: command.enrollmentId,
|
|
84
|
-
walletId: command.walletId,
|
|
85
|
-
manifestDigestB64u: command.manifestDigestB64u,
|
|
86
|
-
receipt,
|
|
87
|
-
revokedAtMs
|
|
88
|
-
});
|
|
89
|
-
return await this.commitEnrollment({
|
|
90
|
-
command: commit,
|
|
91
|
-
expectedVersion: input.expectedVersion,
|
|
92
|
-
commandDigestB64u: await digestLaneEnrollmentRevocationCommand(command)
|
|
93
|
-
});
|
|
94
|
-
}
|
|
95
|
-
async fenceSigningLaneRevocationV1(input) {
|
|
96
|
-
const commandDigestB64u = await computeRevokeSigningLaneDigestV1(input);
|
|
97
|
-
const result = await this.lifecycleStore.fenceLaneRevocation(input);
|
|
98
|
-
if (result.outcome === "conflict") return {
|
|
99
|
-
kind: "lane_signing_lane_revocation_fence_result_v1",
|
|
100
|
-
outcome: "conflict",
|
|
101
|
-
walletKeyId: input.walletKeyId,
|
|
102
|
-
laneId: input.laneId,
|
|
103
|
-
laneShareEpoch: input.laneShareEpoch,
|
|
104
|
-
expectedVersion: result.expectedVersion,
|
|
105
|
-
actualVersion: result.actualVersion,
|
|
106
|
-
requestedCommandDigestB64u: result.requestedCommandDigestB64u,
|
|
107
|
-
storedCommandDigestB64u: result.storedCommandDigestB64u
|
|
108
|
-
};
|
|
109
|
-
if (result.outcome === "already_completed") return {
|
|
110
|
-
kind: "lane_signing_lane_revocation_fence_result_v1",
|
|
111
|
-
outcome: "already_completed",
|
|
112
|
-
walletKeyId: input.walletKeyId,
|
|
113
|
-
laneId: input.laneId,
|
|
114
|
-
laneShareEpoch: input.laneShareEpoch,
|
|
115
|
-
version: result.version,
|
|
116
|
-
commandDigestB64u,
|
|
117
|
-
productEpoch: result.productEpoch,
|
|
118
|
-
retirementReceipt: result.retirementReceipt
|
|
119
|
-
};
|
|
120
|
-
return {
|
|
121
|
-
kind: "lane_signing_lane_revocation_fence_result_v1",
|
|
122
|
-
outcome: result.outcome,
|
|
123
|
-
walletKeyId: input.walletKeyId,
|
|
124
|
-
laneId: input.laneId,
|
|
125
|
-
laneShareEpoch: input.laneShareEpoch,
|
|
126
|
-
version: result.version,
|
|
127
|
-
commandDigestB64u,
|
|
128
|
-
productEpoch: result.productEpoch
|
|
129
|
-
};
|
|
130
|
-
}
|
|
131
|
-
async completeSigningLaneRevocationV1(input) {
|
|
132
|
-
const result = await this.lifecycleStore.commitLaneRevocation({ completion: input });
|
|
133
|
-
if (result.outcome === "conflict") return {
|
|
134
|
-
kind: "lane_signing_lane_revocation_result_v1",
|
|
135
|
-
outcome: "conflict",
|
|
136
|
-
walletKeyId: input.command.walletKeyId,
|
|
137
|
-
laneId: input.command.laneId,
|
|
138
|
-
laneShareEpoch: input.command.laneShareEpoch,
|
|
139
|
-
expectedVersion: result.expectedVersion,
|
|
140
|
-
actualVersion: result.actualVersion,
|
|
141
|
-
requestedCommandDigestB64u: result.requestedCommandDigestB64u,
|
|
142
|
-
storedCommandDigestB64u: result.storedCommandDigestB64u
|
|
143
|
-
};
|
|
144
|
-
return {
|
|
145
|
-
kind: "lane_signing_lane_revocation_result_v1",
|
|
146
|
-
outcome: result.outcome,
|
|
147
|
-
walletKeyId: input.command.walletKeyId,
|
|
148
|
-
laneId: input.command.laneId,
|
|
149
|
-
laneShareEpoch: input.command.laneShareEpoch,
|
|
150
|
-
version: result.version,
|
|
151
|
-
commandDigestB64u: result.commandDigestB64u,
|
|
152
|
-
productEpoch: result.productEpoch,
|
|
153
|
-
retirementReceipt: result.retirementReceipt
|
|
154
|
-
};
|
|
155
|
-
}
|
|
156
|
-
};
|
|
157
|
-
function assertRevokedProductMatchesManifest(product, child, walletId, enrollmentId) {
|
|
158
|
-
if (String(product.walletId) !== String(walletId) || String(product.enrollmentId) !== String(enrollmentId) || String(product.operationId) !== String(child.operationId) || String(product.walletKeyId) !== String(child.walletKeyId) || product.keyFamily !== child.keyFamily || String(product.laneId) !== String(child.targetLaneId) || String(product.laneShareEpoch) !== String(child.targetLaneShareEpoch) || String(product.targetMaterialActivationId) !== String(child.targetMaterialActivationId) || String(product.materialActivation.activationId) !== String(child.targetMaterialActivationId) || product.holderParticipant.participantBindingDigestB64u !== child.holderParticipantBindingDigestB64u || product.signingWorkerParticipant.participantBindingDigestB64u !== child.signingWorkerParticipantBindingDigestB64u) throw new Error("lane enrollment product differs from its admitted manifest child");
|
|
159
|
-
}
|
|
160
|
-
async function digestLaneEnrollmentRevocationCommand(input) {
|
|
161
|
-
return base64UrlEncode(await sha256BytesUtf8([
|
|
162
|
-
"seams/rotatable-signing-lanes/revoke-enrollment/v1",
|
|
163
|
-
String(input.enrollmentId),
|
|
164
|
-
String(input.walletId),
|
|
165
|
-
input.manifestDigestB64u,
|
|
166
|
-
input.reason,
|
|
167
|
-
String(input.requestedAtMs)
|
|
168
|
-
].join("\0")));
|
|
169
|
-
}
|
|
170
|
-
//#endregion
|
|
171
|
-
export { LaneEnrollmentRevocation };
|
|
172
|
-
|
|
173
|
-
//# sourceMappingURL=LaneEnrollmentRevocation.js.map
|