@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -0,0 +1,171 @@
+import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { json } from "../../../framework/http.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+//#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
+async function verifyEcdsaOperationStepUpFactor(input) {
+	const proof = input.proof;
+	switch (proof.kind) {
+		case "passkey": {
+			if (input.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "scope_mismatch",
+					message: "Passkey authority changed"
+				}, { status: 403 })
+			};
+			const credential = proof.webauthn_authentication;
+			if (String(credential.rawId || credential.id).trim() !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "unauthorized",
+					message: "Passkey credential changed"
+				}, { status: 401 })
+			};
+			const verified = await input.webAuthn.verifyWebAuthnAuthenticationLite({
+				userId: input.walletId,
+				rpId: proof.authority.verifier.rpId,
+				expectedChallenge: input.expectedChallenge,
+				expected_origin: input.requestOrigin,
+				webauthn_authentication: credential
+			});
+			if (!verified.success || !verified.verified) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: verified.code || "not_verified",
+					message: verified.message || "WebAuthn authentication verification failed"
+				}, { status: 401 })
+			};
+			const assertionDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential))));
+			const verifiedAtMs = Date.now();
+			if (input.expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`passkey:${input.authSource.credentialIdB64u}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationPasskeyFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					credentialIdB64u: proof.authority.factor.credentialIdB64u,
+					assertionDigest,
+					verifiedAtMs,
+					expiresAtMs: input.expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
+		case "email_otp": {
+			const isExport = input.operation.operation.operationKind === "evm.export_key";
+			const emailOtpOperation = isExport ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+			const operationBinding = await hashEmailOtpOperationBinding({
+				walletId: input.walletId,
+				providerUserId: proof.authority.factor.providerUserId,
+				orgId: input.operation.tenantId,
+				operation: emailOtpOperation,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				authorityRef: input.authorityRef,
+				...isExport ? {} : { operationFingerprintDigest: input.operation.digests.laneDigest }
+			});
+			const verified = await input.emailOtp.verifyEmailOtpChallenge({
+				userId: proof.authority.factor.providerUserId,
+				walletId: input.walletId,
+				orgId: input.operation.tenantId,
+				challengeId: proof.challenge_id,
+				otpCode: proof.otp_code,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: operationBinding,
+				operation: emailOtpOperation
+			});
+			if (!verified.ok) return {
+				ok: false,
+				response: json(verified, { status: verified.code === "invalid_body" ? 400 : 401 })
+			};
+			let verifiedChallengeId = verified.challengeId;
+			if (!isExport) {
+				const orgId = parseOrgId(input.operation.tenantId);
+				const providerSubject = parseProviderSubject(proof.authority.factor.providerUserId);
+				if (!orgId.ok) throw new Error(orgId.error.message);
+				if (!providerSubject.ok) throw new Error(providerSubject.error.message);
+				const consumed = await input.emailOtp.consumeEmailOtpGrant({
+					subject: {
+						kind: "provider_identity",
+						orgId: orgId.value,
+						providerSubject: providerSubject.value,
+						walletId: input.walletId
+					},
+					loginGrant: verified.loginGrant,
+					otpChannel: EMAIL_OTP_CHANNEL
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					response: json(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 })
+				};
+				verifiedChallengeId = consumed.challengeId;
+			}
+			const verificationReceiptDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				challengeId: verifiedChallengeId,
+				operationFingerprint: input.expectedChallenge
+			}))));
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.grantExpiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`);
+			const challengeId = parseEmailOtpChallengeId(verifiedChallengeId);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			if (!challengeId.ok) throw new Error(challengeId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationEmailOtpFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					challengeId: challengeId.value,
+					verificationReceiptDigest,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: isExport ? {
+					kind: "email_otp_grant",
+					grant: verified.loginGrant,
+					challenge_id: verified.challengeId
+				} : { kind: "not_requested" }
+			};
+		}
+		default: throw new Error("Unsupported ECDSA operation step-up proof");
+	}
+}
+function expiredStepUpFactor() {
+	return {
+		ok: false,
+		response: json({
+			ok: false,
+			code: "verified_step_up_rejected",
+			message: "Operation step-up authorization expired"
+		}, { status: 403 })
+	};
+}
+//#endregion
+export { verifyEcdsaOperationStepUpFactor };
+
+//# sourceMappingURL=ecdsaOperationStepUpFactor.js.map

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -652,6 +652,7 @@ async function handleWalletRecoveryPrepare(ctx) {
 			case "refused": return toFetchRouteResponse(refusedSpend());
 			case "reserved":
 			case "consumed": return routeErrorResponse(401, "recovery_code_used", "that recovery code has already been used");
+			case "routing_unavailable": return routeErrorResponse(503, "wallet_home_unavailable", "Wallet recovery routing is temporarily unavailable");
 			case "manifest_unavailable":
 			case "registration_unavailable": return routeErrorResponse(409, "recovery_preparation_conflict", "wallet recovery could not be prepared");
 		}

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -13,7 +13,12 @@ import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";
 //#region src/router/transport/fetch/routes/syncAccount.ts
 function syncAccountResponseStatus(result) {
 	if (result.ok && result.verified) return 200;
-	switch (result.code) {
+	return syncAccountFailureStatus(result.code);
+}
+function syncAccountFailureStatus(code) {
+	switch (code) {
+		case "wallet_home_unavailable": return 503;
+		case "wallet_home_conflict": return 409;
 		case "internal": return 500;
 		case "ed25519_not_provisioned": return 409;
 		default: return 400;
@@ -43,7 +48,7 @@ async function handleSyncAccount(ctx) {
 		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
 		if (!parsed.ok) return json(parsed.body, { status: parsed.status });
 		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
-		return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		return json(result, { status: result.ok ? 200 : syncAccountFailureStatus(result.code) });
 	}
 	if (ctx.pathname === "/sync-account/verify") {
 		const parsed = parseSyncAccountVerifyRequest({

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -1,7 +1,6 @@
-import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
@@ -9,20 +8,18 @@ import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivati
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession } from "../../../../authorization/domain.js";
-import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
 import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
 import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
 import { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest } from "../../../domains/ecdsa/thresholdEcdsaRequestValidation.js";
+import { verifyEcdsaOperationStepUpFactor } from "./ecdsaOperationStepUpFactor.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
 //#region src/router/transport/fetch/routes/thresholdEcdsa.ts
@@ -582,7 +579,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		}, { status: 400 });
 	}
 	const expectedChallenge = await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation);
-	const nowMs = Date.now();
 	const requestId = operation.operation_id;
 	let freshMaterial;
 	if (v2Resolution.kind === "admitted") {
@@ -623,112 +619,24 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const evidenceSetId = requireAuthorizationValue(parseAuthorizationEvidenceSetId(`ecdsa-step-up-evidence-set:${requestId}`));
 	const expiresAtMs = operation.expires_at_ms;
 	const requestOrigin = authenticated.requestOrigin;
-	let emailOtpUnseal;
-	let factor;
-	switch (proof.kind) {
-		case "passkey": {
-			if (authenticated.session.laneAuthorization.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json({
-				ok: false,
-				code: "scope_mismatch",
-				message: "Passkey authority changed"
-			}, { status: 403 });
-			const credential = proof.webauthn_authentication;
-			if (String(credential.rawId || credential.id).trim() !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json({
-				ok: false,
-				code: "unauthorized",
-				message: "Passkey credential changed"
-			}, { status: 401 });
-			const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-				userId: authenticated.session.walletId,
-				rpId: proof.authority.verifier.rpId,
-				expectedChallenge,
-				expected_origin: requestOrigin,
-				webauthn_authentication: credential
-			});
-			if (!verified.success || !verified.verified) return json({
-				ok: false,
-				code: verified.code || "not_verified",
-				message: verified.message || "WebAuthn authentication verification failed"
-			}, { status: 401 });
-			factor = buildVerifiedWalletOperationPasskeyFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue(parseAuthFactorId(`passkey:${authenticated.session.laneAuthorization.authSource.credentialIdB64u}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				credentialIdB64u: proof.authority.factor.credentialIdB64u,
-				assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential)))),
-				verifiedAtMs: nowMs,
-				expiresAtMs
-			});
-			break;
-		}
-		case "email_otp": {
-			const operationBinding = await hashEmailOtpOperationBinding({
-				walletId: authenticated.session.walletId,
-				providerUserId: proof.authority.factor.providerUserId,
-				orgId: authenticated.session.tenantId,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-				requestOrigin,
-				audience: requestOrigin,
-				authorityRef: authenticated.authorityRef,
-				...operation.operation_kind === "evm.sign_transaction" ? { operationFingerprintDigest: envelope.digests.laneDigest } : {}
-			});
-			const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-				userId: proof.authority.factor.providerUserId,
-				walletId: authenticated.session.walletId,
-				orgId: authenticated.session.tenantId,
-				challengeId: proof.challenge_id,
-				otpCode: proof.otp_code,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest: operationBinding,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-			});
-			if (!verified.ok) return json(verified, { status: verified.code === "invalid_body" ? 400 : 401 });
-			const consumed = operation.operation_kind === "evm.export_key" ? null : await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-				subject: {
-					kind: "provider_identity",
-					orgId: requireAuthorizationValue(parseOrgId(authenticated.session.tenantId)),
-					providerSubject: requireAuthorizationValue(parseProviderSubject(proof.authority.factor.providerUserId)),
-					walletId: walletIdFromString(authenticated.session.walletId)
-				},
-				loginGrant: verified.loginGrant,
-				otpChannel: EMAIL_OTP_CHANNEL
-			});
-			if (consumed && !consumed.ok) return json(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 });
-			if (operation.operation_kind === "evm.export_key") emailOtpUnseal = {
-				grant: verified.loginGrant,
-				challengeId: verified.challengeId
-			};
-			const verifiedChallengeId = consumed?.ok ? consumed.challengeId : verified.challengeId;
-			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue(parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				challengeId: requireAuthorizationValue(parseEmailOtpChallengeId(verifiedChallengeId)),
-				verificationReceiptDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-					challengeId: verifiedChallengeId,
-					operationFingerprint: expectedChallenge
-				})))),
-				verifiedAtMs: nowMs,
-				expiresAtMs: Math.min(expiresAtMs, verified.grantExpiresAtMs)
-			});
-			break;
-		}
-	}
+	const verifiedFactor = await verifyEcdsaOperationStepUpFactor({
+		proof,
+		operation: envelope,
+		walletId: walletIdFromString(authenticated.session.walletId),
+		authorityRef: authenticated.authorityRef,
+		authSource: authenticated.session.laneAuthorization.authSource,
+		requestOrigin,
+		expectedChallenge,
+		expiresAtMs,
+		webAuthn: input.ctx.service.webAuthn,
+		emailOtp: input.ctx.service.emailOtp
+	});
+	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation: envelope,
 		evidenceId,
 		evidenceSetId,
-		factor
+		factor: verifiedFactor.factor
 	});
 	const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${operation.operation_id}`));
 	const atomicOperation = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({
@@ -742,7 +650,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 				evidenceSetDigest: evidenceSet.evidenceSetDigest
 			},
 			quota: { kind: "quota_neutral" },
-			claimedAtMs: nowMs
+			claimedAtMs: Date.now()
 		},
 		material: {
 			walletId: walletIdFromString(authenticated.session.walletId),
@@ -775,11 +683,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const responseAuthorization = {
 		kind: "operation_step_up",
 		evidence_set_digest: evidenceSet.evidenceSetDigest,
-		unseal: emailOtpUnseal ? {
-			kind: "email_otp_grant",
-			grant: emailOtpUnseal.grant,
-			challenge_id: emailOtpUnseal.challengeId
-		} : { kind: "not_requested" }
+		unseal: verifiedFactor.unseal
 	};
 	if (operation.operation_kind === "evm.export_key") {
 		const exportTopology = v2Resolution.kind === "admitted" && v2Resolution.operationKind === "evm.export_key" ? v2Resolution.exportTopology : await resolveStrictEcdsaExportTopology({

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -1,5 +1,6 @@
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { readJson } from "../../../framework/http.js";
+import "../../../../shared-ts/src/utils/walletManagementProtocol.js";
+import { jsonFailure, readJson } from "../../../framework/http.js";
 import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
@@ -43,6 +44,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "2") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),

package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js

@@ -1,5 +1,4 @@
 import "./capabilityKinds.js";
-import "../utils/validation.js";
 //#endregion
 
 //# sourceMappingURL=walletSessionIssuance.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -1,5 +1,3 @@
-import "../utils/validation.js";
-import "../utils/exactRecord.js";
 import { wireLiteral, wireObject } from "../utils/wireSchema.js";
 import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import "./activeWalletSession.js";

package/dist/esm/shared-ts/src/device-linking/contracts.js

@@ -1,8 +1,23 @@
 //#region ../shared-ts/src/device-linking/contracts.ts
+function isLinkSessionTerminalFailureV1(state) {
+	switch (state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return true;
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
 function assertNeverLinkSessionStateV1(value) {
 	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
 }
 //#endregion
-export { assertNeverLinkSessionStateV1 };
+export { assertNeverLinkSessionStateV1, isLinkSessionTerminalFailureV1 };
 
 //# sourceMappingURL=contracts.js.map

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -10,13 +10,6 @@ const TARGET_PREPARATION_DOMAIN = "seams/linked-device/target-preparation/v1";
 const TARGET_PASSKEY_CONFIGURATION_DOMAIN = "seams/linked-device/passkey-target-configuration/v1";
 const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN = "seams/linked-device/local-authority-installation-receipt/v1";
 const TEXT_ENCODER = new TextEncoder();
-/**
-* The server stores this digest alongside the authorization. Hashing the
-* opaque token directly keeps the browser binding identical to that row.
-*/
-async function computeWalletSessionOperationCredentialDigestB64u(credential) {
-	return sha256Utf8DigestB64u(credential.token);
-}
 function encodeWalletSessionInstallationReceiptV1(receipt) {
 	return alphabetizeStringify({
 		domain: LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN,
@@ -213,6 +206,6 @@ async function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV
 	}
 }
 //#endregion
-export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u };
+export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u };
 
 //# sourceMappingURL=digests.js.map

package/dist/esm/shared-ts/src/near/actions.js

@@ -1,4 +1,3 @@
-import "../utils/validation.js";
 //#region ../shared-ts/src/near/actions.ts
 let ActionType = /* @__PURE__ */ function(ActionType) {
 	ActionType["CreateAccount"] = "CreateAccount";

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -7,10 +7,8 @@ import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView
 //#region ../shared-ts/src/near/nearClient.ts
 var RpcCallType = /* @__PURE__ */ function(RpcCallType) {
 	RpcCallType["Query"] = "query";
-	RpcCallType["View"] = "view";
 	RpcCallType["Send"] = "send_tx";
 	RpcCallType["Block"] = "block";
-	RpcCallType["Call"] = "call_function";
 	return RpcCallType;
 }(RpcCallType || {});
 const DEFAULT_SEND_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";

package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js

@@ -44,6 +44,6 @@ function deriveEvmFamilySigningKeySlotId(input) {
 	].join(":"));
 }
 //#endregion
-export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
+export { deriveEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
 
 //# sourceMappingURL=evmFamilySigningKeySlotId.js.map

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -1,11 +1,6 @@
 import "../utils/domainIds.js";
 import "./evmFamilySigningKeySlotId.js";
 import "./participants.js";
-import "./rotationParsers.js";
-import "./rotation.js";
 import "./participantDigest.js";
-import "./ownerContinuity.js";
-import "./rotationDigests.js";
-import "./rotationProtocolParsers.js";
-import "./rotationLifecycle.js";
 import "./execution.js";
+import "./ownerContinuity.js";

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -75,6 +75,6 @@ async function computeOwnerLaneParticipantBindingDigestV1(input) {
 	return requireParsed(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
-export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, ownerLaneParticipantContinuityCanonicalBytesV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
+export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
 
 //# sourceMappingURL=ownerContinuity.js.map

package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js

@@ -1,19 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { sha256Bytes } from "../utils/digests.js";
+import { base64UrlDecode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { concat } from "../utils/digestEncoding.js";
-import { buildSigningWorkerParticipantRecordV1, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
-/** Domain tags are part of the wire contract and must never be shortened. */
-const LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-holder-participant/v1";
-const SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/signing-worker-participant/v1";
-/** The lane digest binds the fixed holder-then-SigningWorker participant set. */
-const LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-participant-set/v1";
-function placeholderParticipantDigest() {
-	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(new Uint8Array(32)));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function u32(value) {
 	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
 	return new Uint8Array([
@@ -42,74 +30,7 @@ function encodeLaneCanonicalU64V1(value) {
 	for (let shift = 56; shift >= 0; shift -= 8) output[7 - shift / 8] = Number(remaining >> BigInt(shift) & 255n);
 	return output;
 }
-/** Nonempty array count encoding used by enrollment and receipt records. */
-function encodeLaneCanonicalNonEmptyCountV1(count) {
-	if (!Number.isInteger(count) || count < 1 || count > 4294967295) throw new Error("canonical array count must be a nonempty u32");
-	return u32(count);
-}
-function laneHolderParticipantCanonicalBytesV1(input) {
-	const record = parseLaneHolderParticipantRecordV1(input);
-	return concat([
-		encodeLaneCanonicalTextV1(LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalTextV1(record.participantId),
-		encodeLaneCanonicalTextV1(record.custodyBindingId),
-		encodeLaneCanonicalDigestV1(record.custodyBindingDigestB64u),
-		encodeLaneCanonicalTextV1(record.hpkePublicKeyB64u),
-		encodeLaneCanonicalDigestV1(record.hpkePublicKeyDigestB64u)
-	]);
-}
-function signingWorkerParticipantCanonicalBytesV1(input) {
-	const record = parseSigningWorkerParticipantRecordV1(input);
-	return concat([
-		encodeLaneCanonicalTextV1(SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalTextV1(record.participantId),
-		encodeLaneCanonicalTextV1(record.recipientKeyId),
-		encodeLaneCanonicalTextV1(record.hpkePublicKeyB64u),
-		encodeLaneCanonicalDigestV1(record.hpkePublicKeyDigestB64u)
-	]);
-}
-function encodeCanonicalBytes(value) {
-	return concat([u32(value.length), value]);
-}
-/**
-* Canonical bytes for the lane's complete participant set. The order is part
-* of the protocol: holder first, SigningWorker second. Individual participant
-* binding digests are included after their canonical identity bytes so a
-* verified record cannot be substituted while retaining the same identities.
-*/
-function laneParticipantSetCanonicalBytesV1(input) {
-	const holderParticipant = parseLaneHolderParticipantRecordV1(input.holderParticipant);
-	const signingWorkerParticipant = parseSigningWorkerParticipantRecordV1(input.signingWorkerParticipant);
-	return concat([
-		encodeLaneCanonicalTextV1(LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalNonEmptyCountV1(2),
-		encodeLaneCanonicalTextV1("holder"),
-		encodeCanonicalBytes(laneHolderParticipantCanonicalBytesV1(holderParticipant)),
-		encodeLaneCanonicalDigestV1(holderParticipant.participantBindingDigestB64u),
-		encodeLaneCanonicalTextV1("signing_worker"),
-		encodeCanonicalBytes(signingWorkerParticipantCanonicalBytesV1(signingWorkerParticipant)),
-		encodeLaneCanonicalDigestV1(signingWorkerParticipant.participantBindingDigestB64u)
-	]);
-}
-async function digestCanonicalBytes(bytes) {
-	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-async function computeLaneParticipantSetBindingDigestV1(input) {
-	return await digestCanonicalBytes(laneParticipantSetCanonicalBytesV1(input));
-}
-async function buildSigningWorkerParticipantRecordWithDigestV1(input) {
-	const draft = buildSigningWorkerParticipantRecordV1({
-		...input,
-		participantBindingDigestB64u: placeholderParticipantDigest()
-	});
-	return buildSigningWorkerParticipantRecordV1({
-		...input,
-		participantBindingDigestB64u: await digestCanonicalBytes(signingWorkerParticipantCanonicalBytesV1(draft))
-	});
-}
 //#endregion
-export { buildSigningWorkerParticipantRecordWithDigestV1, computeLaneParticipantSetBindingDigestV1, encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
+export { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
 
 //# sourceMappingURL=participantDigest.js.map