@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/core/config/chains.js

@@ -1,5 +1,6 @@
 import { normalizeTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+//#region src/core/config/chains.ts
 const SEAMS_CHAIN_NETWORK_SET = new Set([
 	"near-mainnet",
 	"near-testnet",

package/dist/esm/core/indexedDB/index.js

@@ -54,14 +54,8 @@ function configureIndexedDB(args) {
 	seamsWalletDB.setDisabled(next.disabled);
 	return { walletDbName: configured.walletDbName };
 }
-function getIndexedDBNames() {
-	return configured || { walletDbName: seamsWalletDB.getDbName() };
-}
-function isIndexedDBPersistenceDisabled() {
-	return Boolean(configured?.disabled);
-}
 const IndexedDBManager = new UnifiedIndexedDBManager({ seamsWalletDB });
 //#endregion
-export { IndexedDBManager, LaneSealedHolderMaterialRepository, SEAMS_WALLET_DB_NAME, SEAMS_WALLET_DB_VERSION, SEAMS_WALLET_INDEXES, SEAMS_WALLET_SCHEMA_MANIFEST, SEAMS_WALLET_STORES, SIGNER_MATERIAL_FINGERPRINT_METADATA_KEY, SeamsWalletDBManager, SeamsWalletRepositories, SignerLifecycleError, UnifiedIndexedDBManager, WALLET_SESSION_AUTHORIZATION_RECORD_VERSION_V6, WalletSessionAuthorizationRepository, WalletSessionAuthorizationUpgradeRequiredError, assertCanonicalIndexedDBName, assertPendingWalletRegistrationIdentity, buildActiveWalletSessionV1, buildPendingWalletRecoveryCommitV1, buildPendingWalletRegistrationCommitV1, configureIndexedDB, createIndexedDBNonceLaneCoordinationStore, createSeamsTestWalletDbName, getIndexedDBNames, isIndexedDBPersistenceDisabled, laneSealedHolderMaterialRepository, laneSealedHolderStoreKeyV1, parsePendingWalletRecoveryCommitAppStateRow, parsePendingWalletRecoveryCommitV1, parsePendingWalletRegistrationCommitAppStateRow, parsePendingWalletRegistrationCommitStorageRow, parsePendingWalletRegistrationCommitV1, parseStoredExactWalletSessionAuthorizationRowV6, pendingWalletRecoveryCommitAppStateKey, pendingWalletRecoveryCommitAppStateRowsMatch, pendingWalletRecoveryCommitIdentityMatches, pendingWalletRecoveryProjectionExpectation, pendingWalletRegistrationCommitAppStateKey, planAccountSignerActivation, retireWalletSessionV1, seamsWalletDB, toPendingWalletRecoveryCommitAppStateRow, toPendingWalletRegistrationCommitAppStateRow, toPendingWalletRegistrationCommitStorageRow, toStoredExactWalletSessionAuthorizationRowV6, upgradeSeamsWalletDBSchema, walletSessionAuthorizations };
+export { IndexedDBManager, LaneSealedHolderMaterialRepository, SEAMS_WALLET_DB_NAME, SEAMS_WALLET_DB_VERSION, SEAMS_WALLET_INDEXES, SEAMS_WALLET_SCHEMA_MANIFEST, SEAMS_WALLET_STORES, SIGNER_MATERIAL_FINGERPRINT_METADATA_KEY, SeamsWalletDBManager, SeamsWalletRepositories, SignerLifecycleError, UnifiedIndexedDBManager, WALLET_SESSION_AUTHORIZATION_RECORD_VERSION_V6, WalletSessionAuthorizationRepository, WalletSessionAuthorizationUpgradeRequiredError, assertCanonicalIndexedDBName, assertPendingWalletRegistrationIdentity, buildActiveWalletSessionV1, buildPendingWalletRecoveryCommitV1, buildPendingWalletRegistrationCommitV1, configureIndexedDB, createIndexedDBNonceLaneCoordinationStore, createSeamsTestWalletDbName, laneSealedHolderMaterialRepository, laneSealedHolderStoreKeyV1, parsePendingWalletRecoveryCommitAppStateRow, parsePendingWalletRecoveryCommitV1, parsePendingWalletRegistrationCommitAppStateRow, parsePendingWalletRegistrationCommitStorageRow, parsePendingWalletRegistrationCommitV1, parseStoredExactWalletSessionAuthorizationRowV6, pendingWalletRecoveryCommitAppStateKey, pendingWalletRecoveryCommitAppStateRowsMatch, pendingWalletRecoveryCommitIdentityMatches, pendingWalletRecoveryProjectionExpectation, pendingWalletRegistrationCommitAppStateKey, planAccountSignerActivation, retireWalletSessionV1, seamsWalletDB, toPendingWalletRecoveryCommitAppStateRow, toPendingWalletRegistrationCommitAppStateRow, toPendingWalletRegistrationCommitStorageRow, toStoredExactWalletSessionAuthorizationRowV6, upgradeSeamsWalletDBSchema, walletSessionAuthorizations };
 
 //# sourceMappingURL=index.js.map

package/dist/esm/core/indexedDB/keyMaterialEnvelope.js

@@ -1,10 +1,6 @@
 import { normalizeTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
+import { asRecord } from "../../shared-ts/src/utils/validation.js";
 //#region src/core/indexedDB/keyMaterialEnvelope.ts
-function asRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	return value;
-}
 function sanitizePayload(value) {
 	const record = asRecord(value);
 	if (!record) return void 0;

package/dist/esm/core/indexedDB/linkedAuthoritySignerMaterial.js

@@ -1,11 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256Bytes } from "../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseEcdsaThresholdKeyId } from "../signingEngine/session/keyMaterialBrands.js";
+import { parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import "../../shared-ts/src/device-linking/index.js";
 //#region src/core/indexedDB/linkedAuthoritySignerMaterial.ts
 function linkedAuthorityMaterialSealAadV1(input) {
@@ -41,7 +42,7 @@ function parseWalletAuthorityLinkedSignerMaterialRecordV1(value) {
 	const authorityId = parseBoundaryValue(parseWalletAuthorityId(record.authorityId), "authorityId");
 	const walletAuthMethodId = parseBoundaryValue(parseWalletAuthMethodId(record.walletAuthMethodId), "walletAuthMethodId");
 	const materialActivation = parseBoundaryValue(parseMpcMaterialActivationRef(record.materialActivation), "materialActivation");
-	const activationId = requireNonEmptyString(record.activationId, "activationId");
+	const activationId = requireCanonicalString(record.activationId, "activationId", "must be a non-empty canonical string");
 	if (materialActivation.activationId !== activationId) throw new Error("linked signer material activationId does not match materialActivation");
 	const sealedMaterialB64u = parseCanonicalNonEmptyB64u(record.sealedMaterialB64u, "sealedMaterialB64u");
 	const sealedMaterialDigestB64u = parseDigestB64u(record.sealedMaterialDigestB64u);
@@ -116,7 +117,7 @@ async function openWalletAuthorityLinkedSignerMaterialV1(input) {
 			reason: "sealed_material_invalid"
 		};
 	}
-	if (parseDigestB64u(base64UrlEncode(await sha256Bytes(sealed))) !== record.sealedMaterialDigestB64u) {
+	if (await sha256DigestB64u(sealed) !== record.sealedMaterialDigestB64u) {
 		sealed.fill(0);
 		return {
 			kind: "wallet_authority_linked_signer_material_open_failed_v1",
@@ -201,14 +202,14 @@ function parseWalletAuthorityLinkedMaterialTargetFactorV1(value) {
 			"emailHashHex",
 			"registrationAuthorityId"
 		], "linked signer material email target factor");
-		const emailHashHex = requireNonEmptyString(record.emailHashHex, "targetFactor.emailHashHex");
+		const emailHashHex = requireCanonicalString(record.emailHashHex, "targetFactor.emailHashHex", "must be a non-empty canonical string");
 		if (!/^[0-9a-f]{64}$/.test(emailHashHex)) throw new Error("targetFactor.emailHashHex is invalid");
 		return {
 			kind: "email_otp",
 			walletAuthMethodId: parseBoundaryValue(parseWalletAuthMethodId(record.walletAuthMethodId), "targetFactor.walletAuthMethodId"),
 			verificationDigestB64u: parseDigestB64u(record.verificationDigestB64u),
 			emailHashHex,
-			registrationAuthorityId: requireNonEmptyString(record.registrationAuthorityId, "targetFactor.registrationAuthorityId")
+			registrationAuthorityId: requireCanonicalString(record.registrationAuthorityId, "targetFactor.registrationAuthorityId", "must be a non-empty canonical string")
 		};
 	}
 	throw new Error("linked signer material target factor kind is invalid");
@@ -265,14 +266,6 @@ function parseBoundaryValue(result, label) {
 	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
 	return result.value;
 }
-function requireNonEmptyString(value, label) {
-	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error(`${label} must be a non-empty canonical string`);
-	return value;
-}
-function requireRecord(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function exactKeys(record, keys, label) {
 	const actual = Object.keys(record);
 	if (actual.length !== keys.length || keys.some((key) => !actual.includes(key))) throw new Error(`${label} fields are invalid`);

package/dist/esm/core/indexedDB/pendingWalletRecoveryCommit.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
-import { isActiveRecoveredWalletAuthorityV1, parseWalletAuthorityV1 } from "../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../shared-ts/src/utils/registrationIntent.js";
 import { parseRecoveryCodeReservationId } from "../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
+import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { isActiveRecoveredWalletAuthorityV1, parseWalletAuthorityV1 } from "../../shared-ts/src/authorization/walletAuthority.js";
 import { parseWalletRecoveryCommittedProjectionV1 } from "../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js";
 //#region src/core/indexedDB/pendingWalletRecoveryCommit.ts
 const RECORD_KIND = "pending_wallet_recovery_commit_v1";

package/dist/esm/core/indexedDB/pendingWalletRegistrationCommit.js

@@ -1,6 +1,6 @@
 import { hasWhitespaceOrControlCharacters, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-import { parseCorrelationId, parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256HexUtf8 } from "../../shared-ts/src/utils/digests.js";
+import { parseCorrelationId, parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../shared-ts/src/utils/routerAbEcdsaDerivation.js";

package/dist/esm/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestLookups.js

@@ -0,0 +1,209 @@
+import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { parseCorrelationId, parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { SEAMS_WALLET_INDEXES } from "../schemaNames.js";
+import { JOURNAL_STORE, MANIFEST_STORE, MATERIAL_STORE, POINTER_STORE, SEALING_KEY_STORE, assertNever, ciphertextDigestB64u, materialMatchesManifest, parseManifestRow, parseMaterialRow, parsePointerRow, parseSealingKeyRow, selectorColumns, selectorKey, selectorsMatch } from "./ecdsaCapabilityManifestRecords.js";
+//#region src/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestLookups.ts
+async function persistenceDigest(category, selector, detail) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		category,
+		...selectorColumns(selector),
+		detail
+	}))));
+}
+async function journalConstraintConflict(selector, error) {
+	return {
+		kind: "exact_record_conflict",
+		conflictDigest: await persistenceDigest("journal_constraint_conflict", selector, ecdsaManifestErrorMessage(error))
+	};
+}
+function retryCorrelation() {
+	return parseCorrelationId(secureRandomId("ecdsa-persistence-retry", 16, "ECDSA persistence retry correlations"));
+}
+function ecdsaManifestErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function isConstraintError(error) {
+	return error instanceof DOMException && error.name === "ConstraintError";
+}
+async function readPointerRowsForWallet(context, walletId) {
+	return await context.store(POINTER_STORE).index(SEAMS_WALLET_INDEXES.walletId).getAll(walletId);
+}
+async function readActivationJournalRows(context) {
+	return await context.store(JOURNAL_STORE).getAll();
+}
+async function readActiveManifestRows(context, selector) {
+	return await context.store(MANIFEST_STORE).index(SEAMS_WALLET_INDEXES.capabilityWalletAuthorityState).getAll([...selectorKey(selector), "active"]);
+}
+function activeLookupUsesMaterialActivation(lookup, materialActivation) {
+	return mpcMaterialActivationRefsEqual(lookup.manifest.activation.materialActivation, materialActivation) && mpcMaterialActivationRefsEqual(lookup.manifest.durableMaterial.materialActivation, materialActivation) && mpcMaterialActivationRefsEqual(lookup.material.binding.materialActivation, materialActivation);
+}
+function materialRefOpenFailure(failure) {
+	switch (failure.kind) {
+		case "missing":
+		case "retired": return { kind: "missing" };
+		case "exact_binding_mismatch": return { kind: "binding_mismatch" };
+		case "exact_record_conflict":
+		case "corrupt": return { kind: "corrupt" };
+		case "persistence_unavailable": return { kind: "persistence_unavailable" };
+	}
+	return assertNever(failure);
+}
+async function lookupInTransaction(context, selector) {
+	const pointerRaw = await context.store(POINTER_STORE).get(selectorKey(selector));
+	if (pointerRaw === void 0) return await lookupWithoutPointer(context, selector);
+	let pointer;
+	try {
+		pointer = parsePointerRow(pointerRaw);
+	} catch (error) {
+		return {
+			kind: "corrupt",
+			detail: ecdsaManifestErrorMessage(error)
+		};
+	}
+	if (!selectorsMatch(pointer.selector, selector)) return {
+		kind: "exact_binding_mismatch",
+		detail: "current ECDSA pointer belongs to a different exact authority"
+	};
+	const manifestRaw = await context.store(MANIFEST_STORE).get(pointer.manifestId);
+	if (manifestRaw === void 0) return {
+		kind: "exact_record_conflict",
+		detail: "current ECDSA pointer references a missing manifest"
+	};
+	let parsedManifest;
+	try {
+		parsedManifest = parseManifestRow(manifestRaw);
+	} catch (error) {
+		return {
+			kind: "corrupt",
+			detail: ecdsaManifestErrorMessage(error)
+		};
+	}
+	if (!selectorsMatch(parsedManifest.selector, selector)) return {
+		kind: "exact_binding_mismatch",
+		detail: "current ECDSA manifest belongs to a different exact authority"
+	};
+	if (parsedManifest.manifest.identity.manifestId !== pointer.manifestId || parsedManifest.manifest.identity.manifestRevision !== pointer.manifestRevision) return {
+		kind: "exact_record_conflict",
+		detail: "current ECDSA pointer does not match its manifest identity"
+	};
+	if (parsedManifest.state === "replaced") return {
+		kind: "retired",
+		manifest: parsedManifest.manifest
+	};
+	const activeRows = await readActiveManifestRows(context, selector);
+	if (activeRows.length !== 1) return {
+		kind: "exact_record_conflict",
+		detail: "exact ECDSA authority has multiple current manifests"
+	};
+	let indexedActive;
+	try {
+		indexedActive = parseManifestRow(activeRows[0]);
+	} catch (error) {
+		return {
+			kind: "corrupt",
+			detail: ecdsaManifestErrorMessage(error)
+		};
+	}
+	if (indexedActive.state !== "active" || indexedActive.manifest.identity.manifestId !== pointer.manifestId) return {
+		kind: "exact_record_conflict",
+		detail: "exact ECDSA current index disagrees with its pointer"
+	};
+	const materialRaw = await context.store(MATERIAL_STORE).get(parsedManifest.manifest.durableMaterial.durableMaterialRef);
+	if (materialRaw === void 0) return {
+		kind: "missing",
+		subject: "material",
+		detail: "active ECDSA manifest is missing its ready material"
+	};
+	let material;
+	try {
+		material = parseMaterialRow(materialRaw, parsedManifest.activeProof);
+	} catch (error) {
+		return {
+			kind: "corrupt",
+			detail: ecdsaManifestErrorMessage(error)
+		};
+	}
+	if (!materialMatchesManifest(material, parsedManifest.manifest)) return {
+		kind: "exact_binding_mismatch",
+		detail: "active ECDSA material does not match its manifest"
+	};
+	const sealingKeyRaw = await context.store(SEALING_KEY_STORE).get(material.sealingKeyId);
+	if (sealingKeyRaw === void 0) return {
+		kind: "missing",
+		subject: "material",
+		detail: "active ECDSA material is missing its sealing key"
+	};
+	try {
+		if (parseSealingKeyRow(sealingKeyRaw).keyId !== material.sealingKeyId) return {
+			kind: "exact_binding_mismatch",
+			detail: "active ECDSA material sealing key id does not match"
+		};
+	} catch (error) {
+		return {
+			kind: "corrupt",
+			detail: ecdsaManifestErrorMessage(error)
+		};
+	}
+	if (await ciphertextDigestB64u(material.ciphertextB64u) !== material.binding.ciphertextDigest) return {
+		kind: "corrupt",
+		detail: "active ECDSA material ciphertext digest is invalid"
+	};
+	return {
+		kind: "active",
+		manifest: parsedManifest.manifest,
+		material
+	};
+}
+async function lookupWithoutPointer(context, selector) {
+	const rows = await context.store(MANIFEST_STORE).index(SEAMS_WALLET_INDEXES.capabilityWallet).getAll([String(selector.capability), String(selector.authority.walletId)]);
+	if (rows.length === 0) return {
+		kind: "missing",
+		subject: "capability",
+		detail: "no ECDSA capability manifest exists"
+	};
+	let hasDifferentAuthority = false;
+	let hasExactAuthority = false;
+	let hasSameMethodUnderAnotherDigest = false;
+	for (const raw of rows) {
+		let parsed;
+		try {
+			parsed = parseManifestRow(raw);
+		} catch (error) {
+			return {
+				kind: "corrupt",
+				detail: ecdsaManifestErrorMessage(error)
+			};
+		}
+		if (selectorsMatch(parsed.selector, selector)) {
+			hasExactAuthority = true;
+			continue;
+		}
+		hasDifferentAuthority = true;
+		if (parsed.selector.authority.walletAuthMethodId === selector.authority.walletAuthMethodId) hasSameMethodUnderAnotherDigest = true;
+	}
+	if (hasExactAuthority) return {
+		kind: "exact_record_conflict",
+		detail: "exact ECDSA authority has manifest history without a current pointer"
+	};
+	if (hasSameMethodUnderAnotherDigest) return {
+		kind: "exact_binding_mismatch",
+		detail: "ECDSA capability exists for this method under a different authority digest"
+	};
+	if (hasDifferentAuthority) return {
+		kind: "missing",
+		subject: "capability",
+		detail: "no ECDSA capability manifest exists for this exact authority"
+	};
+	return {
+		kind: "missing",
+		subject: "capability",
+		detail: "no exact ECDSA capability manifest exists"
+	};
+}
+//#endregion
+export { activeLookupUsesMaterialActivation, ecdsaManifestErrorMessage, isConstraintError, journalConstraintConflict, lookupInTransaction, materialRefOpenFailure, persistenceDigest, readActivationJournalRows, readActiveManifestRows, readPointerRowsForWallet, retryCorrelation };
+
+//# sourceMappingURL=ecdsaCapabilityManifestLookups.js.map