@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletOperationStore.js

@@ -0,0 +1,53 @@
+import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
+import { D1WalletCeremonyActivity } from "../ed25519Yao/d1WalletCeremonyActivity.js";
+import { lifecycleWriteFenceStatements } from "../ed25519Yao/d1Ed25519YaoStateWriteFence.js";
+//#region src/router/cloudflare/d1/registration/d1WalletOperationStore.ts
+var D1WalletOperationStore = class {
+	constructor(options, walletId) {
+		this.options = options;
+		this.walletId = walletId;
+		this.records = createCloudflareD1VersionedJsonRecordStore(options);
+		this.activity = new D1WalletCeremonyActivity(options.database, options.scope);
+	}
+	read(key) {
+		return this.records.read(key);
+	}
+	prepareRead(key) {
+		return this.records.prepareRead(key);
+	}
+	parseReadResult(result) {
+		return this.records.parseReadResult(result);
+	}
+	listByKeyPrefix(key, options) {
+		return this.records.listByKeyPrefix(key, options);
+	}
+	put(key, value, expectedVersion) {
+		return this.commit(key, value, expectedVersion, []);
+	}
+	/** As `put`, with another store's write on this database in the same batch. */
+	putWithCompanion(key, value, expectedVersion, companionWrite) {
+		return this.commit(key, value, expectedVersion, companionWrite.statements);
+	}
+	async commit(key, value, expectedVersion, companionStatements) {
+		const walletId = this.walletId(value);
+		const result = await this.records.putManyWithAdditionalStatements([{
+			key,
+			value,
+			expectedVersion
+		}], [
+			...lifecycleWriteFenceStatements(this.options, new Set([walletId])),
+			this.activity.project(this.records.storageKey(key), walletId, value.kind !== "router_ab_ed25519_yao_registration_side_effect_claim_v1"),
+			...companionStatements
+		]);
+		if (result.kind === "version_mismatch") return { kind: "version_mismatch" };
+		for (const entry of result.versions) if (entry.key === key) return {
+			kind: "stored",
+			version: entry.version
+		};
+		throw new Error("Wallet operation commit omitted its record version");
+	}
+};
+//#endregion
+export { D1WalletOperationStore };
+
+//# sourceMappingURL=d1WalletOperationStore.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,16 +1,18 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
+import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";
 import { prepareD1WebAuthnCredentialBindingPutStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorPutStatement } from "../webauthn/d1WebAuthnStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 import { prepareD1WalletAuthorityExtensionCasGuard, prepareD1WalletAuthorityExtensionStatement, prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
+import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
+import { commitRouterAbEd25519YaoRegistrationCapability } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoCapabilityCommit.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.ts
 function requireScopeString(value, field) {
 	const normalized = normalizeOptionalTrimmedString(value);
@@ -25,8 +27,10 @@ function normalizeScope(input) {
 		envId: requireScopeString(input.envId, "envId")
 	};
 }
-function assertCommitWalletIdentity(input) {
-	if (input.authority.walletId !== input.wallet.walletId) throw new Error("Registration authority walletId does not match wallet record");
+function assertCommitWalletIdentity(input, authority) {
+	const expectedKind = authority.kind === "passkey" ? "passkey_wallet_registration_commit_v1" : "email_otp_wallet_registration_commit_v1";
+	if (input.kind !== expectedKind) throw new Error("Registration commit does not match its reserved authority");
+	if (authority.walletId !== input.wallet.walletId) throw new Error("Registration authority walletId does not match wallet record");
 	if (input.foundingAuthority) {
 		if (!input.foundingAuthMethod) throw new Error("Founding wallet authority is missing its auth method");
 		if (input.foundingAuthority.walletId !== input.wallet.walletId || input.foundingAuthMethod.walletId !== input.wallet.walletId || input.foundingAuthMethod.walletAuthorityId !== input.foundingAuthority.authorityId) throw new Error("Founding authority identities do not match wallet registration");
@@ -122,22 +126,29 @@ function canExtendFoundingAuthorityWithEd25519(existing, next) {
 async function prepareFoundingStatements(input) {
 	if (!input.foundingAuthority) return [];
 	const foundingAuthMethod = requireFoundingAuthMethod(input.foundingAuthMethod);
-	const authorityRow = await input.database.prepare(`SELECT record_json
+	const authorityRead = input.database.prepare(`SELECT record_json
          FROM wallet_authorities
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND authority_id = ?
-        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(input.foundingAuthority.authorityId)).first();
-	const authMethodRow = await input.database.prepare(`SELECT record_json
+        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(input.foundingAuthority.authorityId));
+	const authMethodRead = input.database.prepare(`SELECT record_json
          FROM wallet_auth_methods
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND wallet_auth_method_id = ?
-        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(foundingAuthMethod.walletAuthMethodId)).first();
+        LIMIT 1`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(foundingAuthMethod.walletAuthMethodId));
+	const results = await input.database.batch([authorityRead, authMethodRead]);
+	assertBatchSucceeded({
+		expectedStatementCount: 2,
+		results
+	});
+	const authorityRow = results[0]?.results?.[0] ?? null;
+	const authMethodRow = results[1]?.results?.[0] ?? null;
 	let persistedAuthority = null;
 	if (authorityRow) {
 		const parsedAuthority = parseWalletAuthorityV1(parseD1JsonColumn(authorityRow.record_json));
@@ -192,47 +203,83 @@ function emailOtpCommitStatements(input) {
 }
 var CloudflareD1WalletRegistrationCommitStore = class {
 	constructor(input) {
+		this.credentialClaims = input.credentialClaims;
 		this.database = input.database;
 		this.scope = normalizeScope(input);
 	}
-	async commit(input) {
-		assertCommitWalletIdentity(input);
-		const foundingStatements = await prepareFoundingStatements({
-			database: this.database,
-			scope: this.scope,
-			foundingAuthority: input.foundingAuthority,
-			foundingAuthMethod: input.foundingAuthMethod,
-			now: input.now
+	async reserveAuthority(authority) {
+		if (authority.kind === "passkey") await reservePasskeyCredential(this.credentialClaims, {
+			walletId: authority.walletId,
+			rpId: authority.rpId,
+			credentialIdB64u: authority.credentialIdB64u
 		});
-		const statements = [prepareD1WalletPutSubjectStatement({
-			database: this.database,
-			scope: this.scope,
-			record: input.wallet
-		})];
-		for (const signer of input.walletSigners) statements.push(prepareD1WalletPutSignerStatement({
-			database: this.database,
-			scope: this.scope,
-			record: signer
-		}));
-		statements.push(...prepareAuthorityStatements({
-			database: this.database,
-			scope: this.scope,
-			authority: input.authority,
-			walletSigners: input.walletSigners,
-			foundingAuthority: input.foundingAuthority,
-			foundingAuthMethod: input.foundingAuthMethod,
-			foundingStatements,
-			now: input.now
-		}));
-		statements.push(...emailOtpCommitStatements(input));
-		statements.push(...input.decisionStatements);
-		const results = await this.database.batch(statements);
+		return this.commit.bind(this, authority);
+	}
+	async commit(authority, input, executeBatch) {
+		assertCommitWalletIdentity(input, authority);
+		const ed25519Signer = input.walletSigners.find(isEd25519Signer);
+		if (ed25519Signer) {
+			const capability = ed25519Signer.activeYaoCapability;
+			if (capability.version !== "wallet_ed25519_yao_registration_capability_v1") throw new Error("A registration commit requires its registration capability");
+			const installed = await commitRouterAbEd25519YaoRegistrationCapability(createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1({
+				database: this.database,
+				scope: this.scope
+			}), {
+				kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
+				activeCapabilityBinding: capability.activeCapabilityBinding,
+				nearAccountId: capability.nearAccountId,
+				registrationAdmissionRequest: capability.admissionRequest,
+				registrationAdmissionReceipt: capability.admissionReceipt,
+				registrationResult: capability.activationResult,
+				runtimePolicyScope: capability.runtimePolicyScope
+			}, prepareWalletWrite(this.database, this.scope, authority, input, executeBatch));
+			if (!installed.ok) throw new Error(installed.message);
+			return;
+		}
+		const { statements } = await prepareWalletWrite(this.database, this.scope, authority, input);
+		const results = executeBatch ? await executeBatch(statements) : await this.database.batch(statements);
 		assertBatchSucceeded({
 			expectedStatementCount: statements.length,
 			results
 		});
 	}
 };
+async function prepareWalletWrite(database, scope, authority, input, executeBatch) {
+	const foundingStatements = await prepareFoundingStatements({
+		database,
+		scope,
+		foundingAuthority: input.foundingAuthority,
+		foundingAuthMethod: input.foundingAuthMethod,
+		now: input.now
+	});
+	const statements = [prepareD1WalletPutSubjectStatement({
+		database,
+		scope,
+		record: input.wallet
+	})];
+	for (const signer of input.walletSigners) statements.push(prepareD1WalletPutSignerStatement({
+		database,
+		scope,
+		record: signer
+	}));
+	statements.push(...prepareAuthorityStatements({
+		database,
+		scope,
+		authority,
+		walletSigners: input.walletSigners,
+		foundingAuthority: input.foundingAuthority,
+		foundingAuthMethod: input.foundingAuthMethod,
+		foundingStatements,
+		now: input.now
+	}), ...emailOtpCommitStatements(input), ...input.decisionStatements);
+	return {
+		statements,
+		executeBatch
+	};
+}
+function isEd25519Signer(signer) {
+	return signer.version === "wallet_signer_ed25519_v1";
+}
 //#endregion
 export { CloudflareD1WalletRegistrationCommitStore };
 

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationInitialSession.js

@@ -0,0 +1,33 @@
+import { commitInitialEd25519RegistrationSession } from "./walletRegistrationEstablishedSessionIssuer.js";
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationInitialSession.ts
+async function commitWalletRegistration(commitWallet, input, session) {
+	switch (session.kind) {
+		case "separate":
+			await commitWallet(input);
+			return { kind: "uncommitted" };
+		case "initial_near":
+			if (!input.foundingAuthority) throw new Error("An initial registration session requires its founding authority");
+			return {
+				kind: "committed",
+				value: await commitInitialEd25519RegistrationSession({
+					authorizationService: session.request.authorizationService,
+					authorizationTenantId: session.request.authorizationTenantId,
+					registrationCeremonyId: session.request.registrationCeremonyId,
+					authority: session.request.authority,
+					foundingAuthority: input.foundingAuthority,
+					walletAuthMethodId: session.request.walletAuthMethodId,
+					expiresAtMs: session.request.expiresAtMs,
+					remainingUses: session.request.remainingUses,
+					proof: session.request.proof
+				}, session.store.commitRegistrationWalletSessionAuthorizationV2.bind(session.store, commitWallet.bind(void 0, input)))
+			};
+		default: return assertNeverSessionPlan(session);
+	}
+}
+function assertNeverSessionPlan(value) {
+	throw new Error(`Unsupported registration session plan: ${String(value)}`);
+}
+//#endregion
+export { commitWalletRegistration };
+
+//# sourceMappingURL=d1WalletRegistrationInitialSession.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationPreparation.js

@@ -0,0 +1,16 @@
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationPreparation.ts
+function walletRegistrationOperationPreparedFromCeremony(ceremony, allocated) {
+	if (String(ceremony.foundingWalletAuthMethodId) !== String(ceremony.intent.foundingWalletAuthMethodId)) throw new Error("registration ceremony and intent name different founding auth methods");
+	if (allocated && (allocated.walletId !== ceremony.intent.walletId || allocated.walletAuthorityId !== ceremony.foundingWalletAuthorityId || allocated.deviceId !== ceremony.foundingDeviceId || allocated.walletAuthMethodId !== ceremony.foundingWalletAuthMethodId)) throw new Error("registration operation identity does not match its ceremony");
+	return {
+		kind: "d1_wallet_registration_operation_prepared_v1",
+		walletId: ceremony.intent.walletId,
+		walletAuthorityId: ceremony.foundingWalletAuthorityId,
+		deviceId: ceremony.foundingDeviceId,
+		walletAuthMethodId: ceremony.foundingWalletAuthMethodId
+	};
+}
+//#endregion
+export { walletRegistrationOperationPreparedFromCeremony };
+
+//# sourceMappingURL=d1WalletRegistrationPreparation.js.map

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationRead.js

@@ -0,0 +1,58 @@
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationRead.ts
+/** Read admission and immutable finalization state from one D1 snapshot. */
+var D1WalletRegistrationRead = class {
+	constructor(database, authority, operations, getCeremonies, decisions) {
+		this.database = database;
+		this.authority = authority;
+		this.operations = operations;
+		this.getCeremonies = getCeremonies;
+		this.decisions = decisions;
+	}
+	async readRespond(home) {
+		if (!this.authority) return {
+			ok: false,
+			code: "registration_authority_unavailable",
+			message: "Registration reservation authority is required"
+		};
+		const ceremonies = this.getCeremonies();
+		const results = await this.database.batch([this.authority.prepareHomeRead(home), ceremonies.prepareCeremonyRead(home.ceremonyId)]);
+		const [homeRead, ceremonyRead] = results;
+		if (results.length !== 2 || !homeRead || !ceremonyRead) throw new Error("Registration respond D1 batch returned incomplete results");
+		const admission = await this.authority.admitHomeRead(home, homeRead);
+		if (!admission.ok) return admission;
+		return {
+			ok: true,
+			ownershipGeneration: admission.ownershipGeneration,
+			snapshot: await ceremonies.parseCeremonySnapshotRead(home.ceremonyId, ceremonyRead)
+		};
+	}
+	async readFinalization(home, operationKey) {
+		if (!this.authority) return {
+			ok: false,
+			code: "registration_authority_unavailable",
+			message: "Registration reservation authority is required"
+		};
+		const ceremonies = this.getCeremonies();
+		const results = await this.database.batch([
+			this.authority.prepareHomeRead(home),
+			this.operations.prepareRead(operationKey),
+			ceremonies.prepareCeremonyRead(home.ceremonyId),
+			this.decisions.prepareRead(home.ceremonyId)
+		]);
+		const [homeRead, operationRead, ceremonyRead, decisionRead] = results;
+		if (results.length !== 4 || !homeRead || !operationRead || !ceremonyRead || !decisionRead) throw new Error("Registration finalization D1 batch returned incomplete results");
+		const admission = await this.authority.admitHomeRead(home, homeRead);
+		if (!admission.ok) return admission;
+		if (!ceremonyRead.success) throw new Error("Registration ceremony D1 read failed");
+		return {
+			ok: true,
+			operation: this.operations.parseReadResult(operationRead),
+			decision: this.decisions.parseRead(home.ceremonyId, decisionRead),
+			readCeremony: ceremonies.parseCeremonyRead.bind(ceremonies, home.ceremonyId, ceremonyRead)
+		};
+	}
+};
+//#endregion
+export { D1WalletRegistrationRead };
+
+//# sourceMappingURL=d1WalletRegistrationRead.js.map