@seams/wallet-server 0.7.3 → 0.8.0

package/migrations/d1-signer/0046_wallet_owned_signing_abuse.sql

@@ -0,0 +1,41 @@
+-- Require disposable-state cleanup before replacing unowned policy records.
+CREATE TABLE signing_admission_reset_guard (
+  record_count INTEGER NOT NULL CHECK (record_count = 0)
+);
+INSERT INTO signing_admission_reset_guard
+SELECT COUNT(*) FROM router_ab_normal_signing_admission_records;
+DROP TABLE signing_admission_reset_guard;
+DROP TABLE router_ab_normal_signing_admission_records;
+
+CREATE TABLE router_ab_normal_signing_admission_records (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  signing_root_version TEXT NOT NULL,
+  record_kind TEXT NOT NULL CHECK (record_kind IN ('project_policy', 'abuse')),
+  record_key TEXT NOT NULL,
+  wallet_id TEXT,
+  decision TEXT NOT NULL,
+  retry_after_ms INTEGER,
+  updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= 0),
+  PRIMARY KEY (
+    namespace, org_id, project_id, env_id, signing_root_version, record_kind, record_key
+  ),
+  CHECK (
+    (record_kind = 'project_policy' AND wallet_id IS NULL
+      AND decision IN ('allowed', 'rejected')
+      AND record_key = org_id || char(31) || project_id || char(31) || env_id || char(31) || signing_root_version)
+    OR
+    (record_kind = 'abuse' AND wallet_id IS NOT NULL AND length(wallet_id) > 0
+      AND decision IN ('allowed', 'rate_limited', 'rejected')
+      AND instr(record_key, org_id || char(31) || project_id || char(31) || env_id || char(31) ||
+        signing_root_version || char(31) || wallet_id || char(31)) = 1)
+  ),
+  CHECK (
+    (decision IN ('rejected', 'rate_limited') AND retry_after_ms IS NOT NULL AND retry_after_ms > 0)
+    OR (decision = 'allowed' AND retry_after_ms IS NULL)
+  )
+);
+CREATE INDEX signing_abuse_wallet ON router_ab_normal_signing_admission_records
+  (namespace, org_id, project_id, env_id, wallet_id) WHERE record_kind = 'abuse';

package/migrations/d1-signer/0047_remove_unused_near_public_keys.sql

@@ -0,0 +1,2 @@
+-- Wallet public key ownership is recorded by wallet_signers.
+DROP TABLE near_public_keys;

package/migrations/d1-signer/0048_operation_owner_scope.sql

@@ -0,0 +1,45 @@
+DROP TRIGGER authorized_operation_audit_claim;
+ALTER TABLE authorized_operations DROP COLUMN linked_wallet_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_enrollment_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_device_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_wallet_key_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_lane_id;
+ALTER TABLE authorized_operations DROP COLUMN linked_lane_share_epoch;
+ALTER TABLE authorized_operations DROP COLUMN linked_revocation_epoch;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_org_id TO owner_scope_org_id;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_project_id TO owner_scope_project_id;
+ALTER TABLE authorized_operations RENAME COLUMN linked_scope_env_id TO owner_scope_env_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_wallet_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_enrollment_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_device_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_wallet_key_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_lane_id;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_lane_share_epoch;
+ALTER TABLE authorized_operation_audit_events DROP COLUMN linked_revocation_epoch;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_org_id TO owner_scope_org_id;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_project_id TO owner_scope_project_id;
+ALTER TABLE authorized_operation_audit_events RENAME COLUMN linked_scope_env_id TO owner_scope_env_id;
+
+CREATE TRIGGER authorized_operation_audit_claim
+AFTER INSERT ON authorized_operations
+WHEN NEW.lifecycle_kind = 'claimed'
+BEGIN
+  INSERT INTO authorized_operation_audit_events (
+    namespace, tenant_id, audit_event_id, authorized_operation_id,
+    operation_fingerprint_digest, authorization_source_kind, authorization_id,
+    authorization_grant_kind, evidence_set_digest, quota_id, material_activation_id,
+    material_activation_capability, material_activation_owner,
+    material_activation_key_binding, material_activation_lifecycle_binding,
+    material_activation_signing_worker, owner_scope_org_id, owner_scope_project_id,
+    owner_scope_env_id, result_kind, claimed_at_ms, completed_at_ms
+  ) VALUES (
+    NEW.namespace, NEW.tenant_id, NEW.audit_event_id, NEW.authorized_operation_id,
+    NEW.operation_fingerprint_digest, NEW.authorization_source_kind, NEW.authorization_id,
+    NEW.authorization_grant_kind, NEW.evidence_set_digest, NEW.quota_id,
+    NEW.material_activation_id, NEW.material_activation_capability,
+    NEW.material_activation_owner, NEW.material_activation_key_binding,
+    NEW.material_activation_lifecycle_binding, NEW.material_activation_signing_worker,
+    NEW.owner_scope_org_id, NEW.owner_scope_project_id,
+    NEW.owner_scope_env_id, NEW.result_kind, NEW.claimed_at_ms, NEW.completed_at_ms
+  );
+END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -121,8 +121,7 @@
   "dependencies": {
     "@simplewebauthn/server": "^13.2.2",
     "bs58": "^6.0.0",
-    "express": "^4.21.2",
-    "tslib": "^2.8.1"
+    "express": "^4.21.2"
   },
   "devDependencies": {
     "@near-js/types": "^2.4.0",

package/src/README.md

@@ -1,8 +1,8 @@
 # Server Package
 
-`AuthService` and the Router API implement wallet registration, built-in owner
-verification, opaque Wallet Sessions, signing admission, and recovery. Wallet
-application authentication is intentionally outside this package.
+The Router API implements wallet registration, built-in owner verification,
+opaque Wallet Sessions, signing admission, and recovery. Wallet application
+authentication is intentionally outside this package.
 
 ## Authorization model
 
@@ -22,6 +22,14 @@ application authentication is intentionally outside this package.
 
 ## Primary wallet routes
 
+Wallet-management routes (registration, signer setup/inventory, auth-method
+management and implicit NEAR funding) require `X-Seams-Wallet-Protocol: 2`.
+Missing or unsupported values return HTTP 409, `wallet_protocol_mismatch`, with
+reload/upgrade instructions before parsing the body or invoking route services.
+The current Wallet SDK sends this header automatically. Direct HTTP clients,
+including deployment registration canaries, must send it explicitly. The header
+declares the wire contract and does not replace authentication.
+
 - `POST /wallets/register/setup`
 - `POST /wallets/register/respond`
 - `POST /wallets/register/activate`

package/dist/esm/core/AuthService.js

@@ -1,2 +0,0 @@
-import { AuthService } from "./authService/AuthService.js";
-export { AuthService };

package/dist/esm/core/NearPublicKeyStore.js

@@ -1,200 +0,0 @@
-import { parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject } from "../shared-ts/src/utils/validation.js";
-import { parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import { D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema } from "./d1TenantStore.js";
-//#region src/core/NearPublicKeyStore.ts
-const NEAR_PUBLIC_KEY_D1_STORE = "NEAR public key store";
-const NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL = Object.freeze([`
-    CREATE TABLE IF NOT EXISTS near_public_keys (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      user_id TEXT NOT NULL,
-      public_key TEXT NOT NULL,
-      kind TEXT NOT NULL,
-      signer_slot INTEGER,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      removed_at_ms INTEGER,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, public_key),
-      CHECK (length(user_id) > 0),
-      CHECK (length(public_key) > 0),
-      CHECK (kind IN ('threshold', 'local', 'backup', 'ephemeral')),
-      CHECK (signer_slot IS NULL OR signer_slot >= 1),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (updated_at_ms > 0),
-      CHECK (removed_at_ms IS NULL OR removed_at_ms > 0)
-    )
-  `, `
-    CREATE INDEX IF NOT EXISTS near_public_keys_user_idx
-      ON near_public_keys (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        signer_slot,
-        created_at_ms
-      )
-  `]);
-async function ensureNearPublicKeyStoreD1Schema(options) {
-	await ensureD1Schema(options.database, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL);
-}
-function parseNearPublicKeyKind(input) {
-	const k = normalizeOptionalTrimmedString(input);
-	if (k === "threshold" || k === "local" || k === "backup" || k === "ephemeral") return k;
-	return null;
-}
-function parseNearPublicKeyAuthBinding(raw) {
-	if (Object.prototype.hasOwnProperty.call(raw, "rpId") || Object.prototype.hasOwnProperty.call(raw, "credentialIdB64u")) return null;
-	if (raw.authBinding === void 0) return void 0;
-	if (!isObject(raw.authBinding)) return null;
-	const kind = normalizeOptionalTrimmedString(raw.authBinding.kind);
-	const rpId = parseWebAuthnRpId(raw.authBinding.rpId);
-	const credentialIdB64u = normalizeOptionalTrimmedString(raw.authBinding.credentialIdB64u);
-	if (kind !== "passkey" || !rpId.ok || !credentialIdB64u) return null;
-	return {
-		kind: "passkey",
-		rpId: rpId.value,
-		credentialIdB64u
-	};
-}
-function parseNearPublicKeyRecord(raw) {
-	if (!isObject(raw)) return null;
-	if (normalizeOptionalTrimmedString(raw.version) !== "near_public_key_v1") return null;
-	const userId = normalizeOptionalTrimmedString(raw.userId);
-	const publicKey = normalizeOptionalTrimmedString(raw.publicKey);
-	const kind = parseNearPublicKeyKind(raw.kind);
-	const createdAtMsRaw = raw.createdAtMs;
-	const updatedAtMsRaw = raw.updatedAtMs;
-	const createdAtMs = typeof createdAtMsRaw === "number" ? createdAtMsRaw : Number(createdAtMsRaw);
-	const updatedAtMs = typeof updatedAtMsRaw === "number" ? updatedAtMsRaw : Number(updatedAtMsRaw);
-	if (!userId || !publicKey || !kind) return null;
-	if (!publicKey.startsWith("ed25519:")) return null;
-	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
-	if (!Number.isFinite(updatedAtMs) || updatedAtMs <= 0) return null;
-	const signerSlotRaw = raw.signerSlot;
-	const signerSlot = typeof signerSlotRaw === "number" ? signerSlotRaw : Number(signerSlotRaw);
-	const authBinding = parseNearPublicKeyAuthBinding(raw);
-	if (authBinding === null) return null;
-	const addedTxHash = normalizeOptionalTrimmedString(raw.addedTxHash);
-	const removedAtMsRaw = raw.removedAtMs;
-	const removedAtMs = typeof removedAtMsRaw === "number" ? removedAtMsRaw : Number(removedAtMsRaw);
-	return {
-		version: "near_public_key_v1",
-		userId,
-		publicKey,
-		kind,
-		...Number.isFinite(signerSlot) && signerSlot >= 1 ? { signerSlot: Math.floor(signerSlot) } : {},
-		...authBinding ? { authBinding } : {},
-		createdAtMs: Math.floor(createdAtMs),
-		updatedAtMs: Math.floor(updatedAtMs),
-		...addedTxHash ? { addedTxHash } : {},
-		...Number.isFinite(removedAtMs) && removedAtMs > 0 ? { removedAtMs: Math.floor(removedAtMs) } : {}
-	};
-}
-var InMemoryNearPublicKeyStore = class {
-	constructor() {
-		this.byUser = /* @__PURE__ */ new Map();
-	}
-	async put(record) {
-		const parsed = parseNearPublicKeyRecord(record);
-		if (!parsed) throw new Error("Invalid near public key record");
-		const key = parsed.userId;
-		const bucket = this.byUser.get(key) || /* @__PURE__ */ new Map();
-		bucket.set(parsed.publicKey, parsed);
-		this.byUser.set(key, bucket);
-	}
-	async listByUserId(userId) {
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) return [];
-		const bucket = this.byUser.get(uid);
-		if (!bucket) return [];
-		const out = Array.from(bucket.values()).map((r) => parseNearPublicKeyRecord(r)).filter(Boolean);
-		out.sort((a, b) => (a.signerSlot || 0) - (b.signerSlot || 0));
-		return out;
-	}
-};
-/** A user's NEAR public keys, in signer-slot order; binds the scope, then the user. */
-const NEAR_PUBLIC_KEYS_BY_USER_SQL = `SELECT record_json
-         FROM near_public_keys
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?
-        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC`;
-var D1NearPublicKeyStore = class {
-	constructor(input) {
-		this.adapterKind = "d1";
-		this.table = new D1TenantTable(input, NEAR_PUBLIC_KEY_D1_STORE, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL);
-	}
-	async put(record) {
-		await this.table.ensureSchema();
-		const parsed = parseNearPublicKeyRecord(record);
-		if (!parsed) throw new Error("Invalid near public key record");
-		await this.table.prepare(`INSERT INTO near_public_keys (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        public_key,
-        kind,
-        signer_slot,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        removed_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, user_id, public_key)
-      DO UPDATE SET
-        kind = EXCLUDED.kind,
-        signer_slot = EXCLUDED.signer_slot,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = MIN(near_public_keys.created_at_ms, EXCLUDED.created_at_ms),
-        updated_at_ms = MAX(near_public_keys.updated_at_ms, EXCLUDED.updated_at_ms),
-        removed_at_ms = EXCLUDED.removed_at_ms`, [
-			parsed.userId,
-			parsed.publicKey,
-			parsed.kind,
-			parsed.signerSlot ?? null,
-			JSON.stringify(parsed),
-			parsed.createdAtMs,
-			parsed.updatedAtMs,
-			parsed.removedAtMs ?? null
-		]).run();
-	}
-	async listByUserId(userId) {
-		await this.table.ensureSchema();
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) return [];
-		return ((await this.table.prepare(NEAR_PUBLIC_KEYS_BY_USER_SQL, [uid]).all()).results || []).map((row) => parseNearPublicKeyRecord(parseD1JsonColumn(row.record_json))).filter((record) => Boolean(record));
-	}
-};
-function createNearPublicKeyStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const namespace = normalizeOptionalTrimmedString(config.NEAR_PUBLIC_KEY_NAMESPACE) || normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "";
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[near-public-keys] D1 store selected but no D1 database was provided");
-		input.logger.info("[near-public-keys] Using D1 store for NEAR public key metadata");
-		return new D1NearPublicKeyStore({
-			database,
-			...d1TenantScopeFromConfig(config, namespace, NEAR_PUBLIC_KEY_D1_STORE)
-		});
-	}
-	if (kind) throw new Error(`[near-public-keys] Unknown NEAR public key store kind: ${kind}`);
-	input.logger.info("[near-public-keys] Using in-memory store for NEAR public key metadata");
-	return new InMemoryNearPublicKeyStore();
-}
-//#endregion
-export { D1NearPublicKeyStore, NEAR_PUBLIC_KEYS_BY_USER_SQL, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema };
-
-//# sourceMappingURL=NearPublicKeyStore.js.map