@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationSessions.js

@@ -0,0 +1,97 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationSessions.ts
+var WalletRelocationSessionSource = class WalletRelocationSessionSource {
+	#validated = true;
+	constructor(walletId, moveId, requestDigestHex, sourceGeneration) {
+		this.walletId = walletId;
+		this.moveId = moveId;
+		this.requestDigestHex = requestDigestHex;
+		this.sourceGeneration = sourceGeneration;
+		Object.freeze(this);
+	}
+	static parse(raw) {
+		if (!isPlainObject(raw) || Object.keys(raw).length !== 4) throw new Error("Invalid session relocation identity");
+		const wallet = parseWalletId(raw.walletId);
+		if (!wallet.ok || typeof raw.moveId !== "string" || !/^wmove_[A-Za-z0-9_-]{43}$/u.test(raw.moveId) || typeof raw.requestDigestHex !== "string" || !/^[a-f0-9]{64}$/u.test(raw.requestDigestHex) || typeof raw.sourceGeneration !== "number" || !Number.isSafeInteger(raw.sourceGeneration) || raw.sourceGeneration < 1 || raw.sourceGeneration >= Number.MAX_SAFE_INTEGER) throw new Error("Invalid session relocation identity");
+		return new WalletRelocationSessionSource(wallet.value, raw.moveId, raw.requestDigestHex, raw.sourceGeneration);
+	}
+	matches(row) {
+		return this.#validated && row.wallet_id === this.walletId && row.move_id === this.moveId && row.request_digest_hex === this.requestDigestHex && row.source_generation === this.sourceGeneration;
+	}
+};
+var D1WalletRelocationSessions = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async hasPendingOperations(walletId) {
+		return await prepareD1TenantStatement(this.database, this.scope, `SELECT 1 FROM wallet_pending_operations
+       WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+         AND wallet_id = ?5 LIMIT 1`, [walletId]).first() !== null;
+	}
+	async retire(source, nowMs) {
+		parseUnixMs(nowMs, "session relocation time");
+		const existing = await this.read(source);
+		if (existing !== null) return existing;
+		await this.database.batch(this.retirementStatements(source, nowMs));
+		const retiredAtMs = await this.read(source);
+		if (retiredAtMs === null) throw new Error("Session relocation retirement disappeared");
+		return retiredAtMs;
+	}
+	retirementStatements(source, nowMs) {
+		parseUnixMs(nowMs, "session relocation time");
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		return [
+			prepareD1TenantStatement(this.database, this.scope, `
+        INSERT INTO wallet_relocation_session_fences
+          (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, retired_at_ms)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+        ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id) DO NOTHING`, [...identity, nowMs]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_relocation_session_fences SET retired_at_ms = retired_at_ms
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE authorization_wallet_session_quotas AS quota SET remaining_uses = 0, lifecycle_kind = 'exhausted'
+        WHERE quota.lifecycle_kind = 'active' AND EXISTS (
+          SELECT 1 FROM wallet_session_authorizations_v2 AS session
+          WHERE session.namespace = ?1 AND session.org_id = ?2 AND session.project_id = ?3 AND session.env_id = ?4
+            AND session.wallet_id = ?5 AND session.retired_at_ms IS NULL
+            AND session.namespace = quota.namespace AND session.tenant_id = quota.tenant_id
+            AND session.quota_id = quota.quota_id AND session.wallet_session_id = quota.wallet_session_id
+        )`, [source.walletId]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_session_hosted_credentials_v2 SET lifecycle_kind = 'retired',
+          retired_at_ms = MAX(issued_at_ms, ?6)
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND lifecycle_kind = 'active' AND retired_at_ms IS NULL`, [source.walletId, nowMs]),
+			prepareD1TenantStatement(this.database, this.scope, `
+        UPDATE wallet_session_authorizations_v2 SET retired_at_ms = MAX(issued_at_ms, ?6)
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND wallet_id = ?5 AND retired_at_ms IS NULL`, [source.walletId, nowMs])
+		];
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT wallet_id, move_id, request_digest_hex, source_generation, retired_at_ms
+      FROM wallet_relocation_session_fences
+      WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5`, [source.walletId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Session relocation identity conflicts with its source fence");
+		return parseUnixMs(row.retired_at_ms, "stored session relocation time");
+	}
+};
+//#endregion
+export { D1WalletRelocationSessions, WalletRelocationSessionSource };
+
+//# sourceMappingURL=d1WalletRelocationSessions.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationWriteBlock.js

@@ -0,0 +1,133 @@
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { D1WalletCeremonyActivity } from "../ed25519Yao/d1WalletCeremonyActivity.js";
+import { D1WalletAuthorizationSnapshot } from "./d1WalletAuthorizationSnapshot.js";
+import { D1WalletRelocationSessions } from "./d1WalletRelocationSessions.js";
+import { D1WalletAuthorizationFreeze } from "./d1WalletAuthorizationFreeze.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletRelocationWriteBlock.ts
+const SCOPE = "namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND wallet_id = ?5";
+var D1WalletRelocationWriteBlock = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async check(source, nowMs) {
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		await prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_relocation_write_blocks
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+         source_generation, state, started_at_ms)
+      SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'draining', ?9
+      FROM wallet_execution_generations WHERE ${SCOPE} AND generation = ?8 AND state = 'active'
+      ON CONFLICT DO NOTHING`, [...identity, nowMs]).run();
+		const state = await this.read(source);
+		if (state === "checked") return "ready";
+		if (state !== "draining") throw new Error("Wallet write block is unavailable");
+		if (await new D1WalletRelocationSessions(this.database, this.scope).hasPendingOperations(source.walletId) || await new D1WalletCeremonyActivity(this.database, this.scope).hasPending(source.walletId)) return "draining";
+		await prepareD1TenantStatement(this.database, this.scope, `
+      INSERT INTO wallet_relocation_authorization_fences
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation, frozen_at_ms)
+      SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9 FROM wallet_relocation_write_blocks
+      WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8 AND state = 'draining'
+      ON CONFLICT DO NOTHING`, [...identity, nowMs]).run();
+		await new D1WalletAuthorizationSnapshot(this.database, this.scope).assertCapacity(source.walletId);
+		await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_relocation_write_blocks
+        SET state = 'checked' WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7
+          AND source_generation = ?8 AND state IN ('draining', 'checked')
+          AND EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences fence
+            WHERE fence.namespace = ?1 AND fence.org_id = ?2 AND fence.project_id = ?3
+              AND fence.env_id = ?4 AND fence.wallet_id = ?5 AND fence.move_id = ?6
+              AND fence.request_digest_hex = ?7 AND fence.source_generation = ?8)`, identity), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)]);
+		return "ready";
+	}
+	async release(source, nowMs) {
+		const identity = [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		];
+		await this.database.batch([
+			prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_relocation_write_blocks
+        (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex,
+         source_generation, state, started_at_ms)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 'released', ?9)
+        ON CONFLICT DO UPDATE SET state = 'released'
+        WHERE request_digest_hex = ?7 AND source_generation = ?8 AND state != 'frozen'`, [...identity, nowMs]),
+			this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+			prepareD1TenantStatement(this.database, this.scope, `DELETE FROM wallet_relocation_authorization_fences
+        WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity)
+		]);
+	}
+	async freeze(source, nowMs) {
+		const sessions = new D1WalletRelocationSessions(this.database, this.scope);
+		const freeze = new D1WalletAuthorizationFreeze(this.database, this.scope);
+		const completed = await prepareD1TenantStatement(this.database, this.scope, `
+      SELECT fence.frozen_at_ms, retired.retired_at_ms FROM wallet_relocation_authorization_fences fence
+      JOIN wallet_relocation_session_fences retired
+        USING (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation)
+      WHERE fence.namespace = ?1 AND fence.org_id = ?2 AND fence.project_id = ?3 AND fence.env_id = ?4
+        AND fence.wallet_id = ?5 AND fence.move_id = ?6 AND fence.request_digest_hex = ?7 AND fence.source_generation = ?8`, [
+			source.walletId,
+			source.moveId,
+			source.requestDigestHex,
+			source.sourceGeneration
+		]).first();
+		if (completed) return {
+			retiredAtMs: parseUnixMs(completed.retired_at_ms, "session retirement"),
+			frozenAtMs: parseUnixMs(completed.frozen_at_ms, "authorization freeze")
+		};
+		const state = await this.read(source);
+		if (state !== "checked" && state !== "frozen") throw new Error("Wallet capacity is not reserved");
+		if (state === "checked") {
+			const identity = [
+				source.walletId,
+				source.moveId,
+				source.requestDigestHex,
+				source.sourceGeneration
+			];
+			try {
+				await this.database.batch([
+					prepareD1TenantStatement(this.database, this.scope, `DELETE FROM wallet_relocation_authorization_fences
+          WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8`, identity),
+					this.database.prepare(D1_BATCH_CAS_GUARD_SQL),
+					...sessions.retirementStatements(source, nowMs),
+					...freeze.freezeStatements(source, nowMs),
+					prepareD1TenantStatement(this.database, this.scope, `UPDATE wallet_relocation_write_blocks SET state = 'frozen'
+          WHERE ${SCOPE} AND move_id = ?6 AND request_digest_hex = ?7 AND source_generation = ?8
+            AND state = 'checked'`, identity),
+					this.database.prepare(D1_BATCH_CAS_GUARD_SQL)
+				]);
+			} catch (error) {
+				if (await this.read(source) !== "frozen") throw error;
+			}
+		}
+		return {
+			retiredAtMs: await sessions.retire(source, nowMs),
+			frozenAtMs: await freeze.freeze(source, nowMs)
+		};
+	}
+	async read(source) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, `SELECT * FROM wallet_relocation_write_blocks
+      WHERE ${SCOPE} AND move_id = ?6`, [source.walletId, source.moveId]).first();
+		if (!row) return null;
+		if (!source.matches(row)) throw new Error("Wallet write block identity conflicts");
+		switch (row.state) {
+			case "draining":
+			case "checked":
+			case "released":
+			case "frozen": return row.state;
+			default: throw new Error("Wallet write block state is invalid");
+		}
+	}
+};
+//#endregion
+export { D1WalletRelocationWriteBlock };
+
+//# sourceMappingURL=d1WalletRelocationWriteBlock.js.map

package/dist/esm/router/cloudflare/d1/walletObjectAddresses.js

@@ -0,0 +1,47 @@
+import { prepareD1TenantStatement } from "../../../core/d1TenantStore.js";
+import { WalletObjectAddresses } from "../runtime/walletObjectAddresses.js";
+//#region src/router/cloudflare/d1/walletObjectAddresses.ts
+const READ = `SELECT router, deriver_a, deriver_b, signing_worker FROM wallet_object_addresses
+  WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+    AND wallet_id = ?5 AND ownership_generation = ?6`;
+var D1WalletObjectAddresses = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	async initialize(identity, router, credential) {
+		const existing = await this.read(identity);
+		if (existing !== null) return existing;
+		const response = await router.fetch("https://mpc-router.router-ab.internal/router-ab/router/wallet/allocate", {
+			method: "POST",
+			headers: { "x-router-ab-internal-service-auth": credential },
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!response.ok) throw new Error("Custody address allocation failed");
+		return this.insert(identity, WalletObjectAddresses.parse(await response.json()));
+	}
+	async read(identity) {
+		const row = await prepareD1TenantStatement(this.database, this.scope, READ, [identity.walletId, identity.ownershipGeneration]).first();
+		return row === null ? null : WalletObjectAddresses.parse(row);
+	}
+	/** Competing allocations return the same persisted winner before either starts work. */
+	async insert(identity, addresses) {
+		const identityValues = [identity.walletId, identity.ownershipGeneration];
+		const row = (await this.database.batch([prepareD1TenantStatement(this.database, this.scope, `INSERT INTO wallet_object_addresses
+        (namespace, org_id, project_id, env_id, wallet_id, ownership_generation,
+         router, deriver_a, deriver_b, signing_worker)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)
+        ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id, ownership_generation) DO NOTHING`, [
+			...identityValues,
+			addresses.router,
+			addresses.deriver_a,
+			addresses.deriver_b,
+			addresses.signing_worker
+		]), prepareD1TenantStatement(this.database, this.scope, READ, identityValues)]))[1]?.results?.[0];
+		return WalletObjectAddresses.parse(row);
+	}
+};
+//#endregion
+export { D1WalletObjectAddresses };
+
+//# sourceMappingURL=walletObjectAddresses.js.map

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -1,6 +1,6 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";

package/dist/esm/router/cloudflare/runtime/routerAbServiceBindings.js

@@ -1,4 +1,35 @@
+import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, readWalletObjectIdentityHeader } from "./walletObjectAddresses.js";
+import { D1WalletObjectAddresses } from "../d1/walletObjectAddresses.js";
 //#region src/router/cloudflare/runtime/routerAbServiceBindings.ts
+/** Apply only after the host admits this request to the wallet's fixed home. */
+var WalletHomeCustodyBinding = class {
+	constructor(binding, home, database, namespace, initialAddresses) {
+		this.binding = binding;
+		this.home = home;
+		this.database = database;
+		this.namespace = namespace;
+		this.initialAddresses = initialAddresses;
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		request.headers.set("x-seams-wallet-home-region", this.home);
+		request.headers.delete(WALLET_OBJECT_ADDRESSES_HEADER);
+		const identity = readWalletObjectIdentityHeader(request.headers);
+		request.headers.delete(WALLET_OBJECT_IDENTITY_HEADER);
+		if (identity !== null) {
+			const store = new D1WalletObjectAddresses(this.database, {
+				namespace: this.namespace,
+				orgId: identity.orgId,
+				projectId: identity.projectId,
+				envId: identity.envId
+			});
+			const addresses = this.initialAddresses?.resolve(this.namespace, identity) ?? await store.read(identity);
+			if (addresses === null) throw new Error("Wallet object addresses are not initialized");
+			request.headers.set(WALLET_OBJECT_ADDRESSES_HEADER, JSON.stringify(addresses));
+		}
+		return this.binding.fetch(request);
+	}
+};
 const ROUTER_AB_MPC_ROUTER_ORIGIN = "https://mpc-router.router-ab.internal";
 const ROUTER_AB_SIGNING_WORKER_ORIGIN = "https://signing-worker.router-ab.internal";
 var RouterAbServiceBindingDispatcher = class {
@@ -28,6 +59,6 @@ function createRouterAbServiceBindingFetch(env) {
 	return dispatcher.fetch.bind(dispatcher);
 }
 //#endregion
-export { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch };
+export { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, WalletHomeCustodyBinding, createRouterAbServiceBindingFetch };
 
 //# sourceMappingURL=routerAbServiceBindings.js.map

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -65,10 +65,10 @@ async function handleStaticWalletConsoleRequestV1(config, input, init) {
 	const body = await request.json().catch(() => null);
 	switch (new URL(request.url).pathname) {
 		case WALLET_CONSOLE_OP_PATHS_V1.publishableKeyAuth: return publishableKeyResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.registrationContext: return registrationContextResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.secretKeyAuth: return secretKeyResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.projectEnvironments: return projectEnvironmentsResponse(config, body);
 		case WALLET_CONSOLE_OP_PATHS_V1.tenantRootActiveLineage: return activeLineageResponse(config, body);
-		case WALLET_CONSOLE_OP_PATHS_V1.walletProjection:
 		case WALLET_CONSOLE_OP_PATHS_V1.usageEvents: return json({ ok: true });
 		default: return json({
 			ok: false,
@@ -86,6 +86,24 @@ function publishableKeyResponse(config, value) {
 		principal: principal(config)
 	});
 }
+function registrationContextResponse(config, value) {
+	const auth = publishableKeyResponse(config, value);
+	if (!auth.ok) return auth;
+	return json({
+		ok: true,
+		principal: principal(config),
+		environment: projectEnvironment(config)
+	});
+}
+function projectEnvironment(config) {
+	return {
+		id: config.deployment.environmentId,
+		projectId: config.deployment.projectId,
+		key: config.deployment.environmentKey,
+		signingRootVersion: config.deployment.signingRootVersion,
+		status: "ACTIVE"
+	};
+}
 function secretKeyResponse(config, value) {
 	const body = record(value);
 	if (!config.credential.secretKey || !body || body.secret !== config.credential.secretKey) return authFailure("secret_key_invalid", "Secret key is invalid");
@@ -106,13 +124,7 @@ function projectEnvironmentsResponse(config, value) {
 	if (!context || context.orgId !== config.deployment.orgId) return json(failure("environment_not_found", "Environment not found"), 404);
 	return json({
 		ok: true,
-		environments: [{
-			id: config.deployment.environmentId,
-			projectId: config.deployment.projectId,
-			key: config.deployment.environmentKey,
-			signingRootVersion: config.deployment.signingRootVersion,
-			status: "ACTIVE"
-		}]
+		environments: [projectEnvironment(config)]
 	});
 }
 function activeLineageResponse(config, value) {