@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/react/core/signingEngine/flows/signNear/shared/signatureOnlySigning.js

@@ -0,0 +1,343 @@
+import { SigningSessionIds, SigningSessionPlanKind } from "../../../session/operationState/types.js";
+import { nearEd25519SignerBindingFromBoundaryFields } from "../../../session/identity/exactSigningLaneIdentity.js";
+import { parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
+import { SigningOperationCommandKind, runSigningOperationCommand } from "../../shared/signingStateMachine.js";
+import { requireNearStepUpAuth, signingAuthPlanForNearMaterialRequirement } from "../requireNearStepUpAuth.js";
+import { buildSigningConfirmationAuthParams } from "../../../stepUpConfirmation/confirmOperation.js";
+import { confirmationConfigForSigningAuthPlan, runSigningConfirmationCommand } from "../../shared/signingConfirmation.js";
+import { emitNearSigningConfirmationProgress } from "./confirmationProgress.js";
+import { buildNearEd25519StepUpAuthorization } from "../stepUpAuthorization.js";
+import { clearNearOperationStepUpBuilder, consumePreparedNearOperationStepUp, registerNearOperationStepUpBuilder } from "./operationStepUpPreparation.js";
+import { buildNearEd25519OperationStepUpProof, prepareRouterAbEd25519SignatureOnlyOperationStepUp, requireIssuedNearEd25519OperationStepUpAuthorization, tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning } from "./ed25519YaoNormalSigning.js";
+import { nearOperationStepUpMaterialFacts, prepareNearOperationStepUpMaterial, resolveConfirmedNearEd25519YaoCapability, resolveNearOperationStepUpMaterial } from "./ed25519YaoCapabilityResolution.js";
+import { planSigningSession } from "../../../session/planning/planner.js";
+import { buildNearSigningSessionAuthPlan, resolveNearSigningSessionAuthContext } from "./signingSessionAuthMode.js";
+//#region src/core/signingEngine/flows/signNear/shared/signatureOnlySigning.ts
+const REQUIRED_SIGNATURE_USES = 1;
+function requireOperationStepUpPreparationRef(label, value) {
+	if (!value) throw new Error(`[SigningEngine][near] ${label} operation step-up preparation is missing`);
+	return value;
+}
+function requirePreparedSignatureOnlyStepUp(label, value) {
+	if (!value || value.kind !== "near_signature_only") throw new Error(`[SigningEngine][near] ${label} operation step-up preparation kind changed`);
+	return value;
+}
+function requireOperationStepUpMaterial(label, value) {
+	if (!value) throw new Error(`[SigningEngine][near] ${label} operation step-up material is missing`);
+	return value;
+}
+function requireSigningDigest(label, value) {
+	if (!value) throw new Error(`[SigningEngine][near] ${label} operation signing digest is missing`);
+	return value;
+}
+function requireAuthorizedWalletSessionState(value) {
+	if (!value) throw new Error("[SigningEngine][near] reusable Wallet Session authorization is unavailable");
+	return value;
+}
+async function resolveSignatureOnlyOperationStepUpCapability(args) {
+	if (args.authorization.kind === "passkey") {
+		if (args.material.kind !== "passkey_live" && args.material.kind !== "passkey_sealed") throw new Error(`[SigningEngine][near] passkey ${args.label} material changed factor`);
+		return await resolveNearOperationStepUpMaterial({
+			kind: "passkey",
+			material: args.material,
+			expectedActivation: args.prepared.materialActivation,
+			credential: args.authorization.credential
+		});
+	}
+	if (args.material.kind !== "email_otp_live" && args.material.kind !== "email_otp_sealed") throw new Error(`[SigningEngine][near] Email OTP ${args.label} material changed factor`);
+	if (!args.emailOtpProof) throw new Error(`[SigningEngine][near] Email OTP ${args.label} proof is missing`);
+	if (args.material.kind === "email_otp_live") return await resolveNearOperationStepUpMaterial({
+		kind: "email_otp_live",
+		material: args.material,
+		expectedActivation: args.prepared.materialActivation
+	});
+	return await resolveNearOperationStepUpMaterial({
+		kind: "email_otp_sealed",
+		material: args.material,
+		expectedActivation: args.prepared.materialActivation,
+		normalSigningRequest: args.prepared.prepare.request,
+		displayDigest: args.displayDigest,
+		proof: args.emailOtpProof
+	});
+}
+/**
+* Plans the signing session for the selected lane. A lane still awaiting authorization signs
+* once, through an operation step-up on its deferred material.
+*/
+function resolveNearSignatureOnlySigningPlans(args) {
+	if (args.selection.kind === "authorized") {
+		const context = resolveNearSigningSessionAuthContext({
+			requiredSignatureUses: REQUIRED_SIGNATURE_USES,
+			commandSubject: args.commandSubject,
+			forceFreshAuth: args.forceFreshAuth,
+			selectedLane: args.selection.selectedLane,
+			preparation: args.preparation
+		});
+		const resolvedSigningSession = {
+			signingSessionPlan: planSigningSession({
+				lane: context.coordinatorInput.lane,
+				readiness: context.coordinatorInput.readiness,
+				forceFreshAuth: context.coordinatorInput.forceFreshAuth
+			}),
+			readiness: context.coordinatorInput.readiness,
+			expiresAtMs: context.coordinatorInput.expiresAtMs || 0,
+			remainingUses: context.coordinatorInput.remainingUses || 0
+		};
+		return {
+			signingAuthPlan: buildNearSigningSessionAuthPlan({
+				context,
+				resolvedSigningSession
+			}).signingAuthPlan,
+			signingSessionPlan: resolvedSigningSession.signingSessionPlan
+		};
+	}
+	const candidate = args.selection.candidate;
+	const signingAuthPlan = signingAuthPlanForNearMaterialRequirement(candidate.auth);
+	const deferredIdentity = {
+		kind: "deferred_ed25519_material_identity",
+		signer: nearEd25519SignerBindingFromBoundaryFields({
+			walletId: candidate.walletId,
+			nearAccountId: candidate.nearAccountId,
+			nearEd25519SigningKeyId: candidate.nearEd25519SigningKeyId,
+			signerSlot: candidate.signerSlot
+		}),
+		materialActivation: candidate.materialActivation,
+		thresholdSessionId: SigningSessionIds.thresholdEd25519Session(candidate.thresholdSessionId)
+	};
+	return {
+		signingAuthPlan,
+		signingSessionPlan: {
+			kind: SigningSessionPlanKind.OperationStepUp,
+			lane: {
+				identity: deferredIdentity,
+				auth: candidate.auth,
+				curve: "ed25519",
+				keyKind: "threshold_ed25519",
+				chainFamily: "near",
+				sessionOrigin: "per_operation",
+				storageSource: "sealed_restore",
+				retention: "single_use",
+				materialActivation: deferredIdentity.materialActivation,
+				thresholdSessionId: deferredIdentity.thresholdSessionId
+			}
+		}
+	};
+}
+/**
+* Prepares the step-up. Unless a warm session covers the operation, this also prepares the
+* operation material and registers the builder the confirmation calls to prepare the
+* Router A/B request.
+*/
+async function prepareNearSignatureOnlyStepUp(operation, args) {
+	const preparedStepUp = await requireNearStepUpAuth({
+		signingAuthPlan: args.signingAuthPlan,
+		signingLaneAuth: operation.auth,
+		requiredSignatureUses: REQUIRED_SIGNATURE_USES,
+		operationFingerprintDigest: parseSigningOperationFingerprintDigest(operation.signingOperation.operationFingerprint),
+		passkeyEd25519OperationStepUp: args.passkeyEd25519OperationStepUp,
+		emailOtpEd25519StepUp: args.emailOtpEd25519StepUp
+	});
+	if (preparedStepUp.kind === "warm_session") return {
+		preparedStepUp,
+		operationStepUp: null
+	};
+	const material = await prepareNearOperationStepUpMaterial({
+		method: preparedStepUp.kind,
+		preparation: operation.preparation,
+		executor: operation.executor
+	});
+	const materialFacts = nearOperationStepUpMaterialFacts(material);
+	const signingDigestB64u = await operation.computeSigningDigestB64u();
+	registerNearOperationStepUpBuilder({
+		requestId: String(operation.signingOperation.operationId),
+		build: async (preparation) => {
+			if (preparation.kind !== "near_signature_only") throw new Error(`[SigningEngine][near] ${operation.label} operation step-up preparation kind changed`);
+			return await prepareRouterAbEd25519SignatureOnlyOperationStepUp({
+				ctx: operation.ctx,
+				thresholdSessionId: materialFacts.thresholdSessionId,
+				materialFacts,
+				thresholdKeyMaterial: operation.thresholdKeyMaterial,
+				walletId: operation.walletId,
+				nearAccountId: operation.nearAccountId,
+				materialActivation: material.materialActivation,
+				operationId: operation.signingOperation.operationId,
+				operationFingerprint: operation.signingOperation.operationFingerprint,
+				displayDigest: preparation.displayDigest,
+				signingDigestB64u,
+				intent: operation.intent
+			});
+		}
+	});
+	return {
+		preparedStepUp,
+		operationStepUp: {
+			material,
+			signingDigestB64u
+		}
+	};
+}
+/** Shows the confirmation, then drops the step-up builder whether or not it was used. */
+async function confirmNearSignatureOnlyOperation(operation, args) {
+	const requestId = String(operation.signingOperation.operationId);
+	try {
+		return await runSigningConfirmationCommand({
+			signingSessionPlan: operation.signingSessionPlan,
+			signingOperation: operation.signingOperation,
+			runtime: args.touchConfirm,
+			request: {
+				ctx: { touchConfirm: args.touchConfirm },
+				sessionId: requestId,
+				chain: "near",
+				...args.request,
+				...buildSigningConfirmationAuthParams({ signingAuthPlan: args.signingAuthPlan }),
+				walletId: String(operation.walletId),
+				nearAccountId: operation.nearAccountId,
+				nearPublicKeyStr: args.nearPublicKeyStr,
+				title: args.title,
+				body: args.body,
+				confirmationConfigOverride: confirmationConfigForSigningAuthPlan({
+					signingAuthPlan: args.signingAuthPlan,
+					override: args.confirmationConfigOverride
+				}),
+				onProgress: emitNearSigningConfirmationProgress.bind(void 0, {
+					onEvent: args.onEvent,
+					nearAccountId: operation.nearAccountId,
+					signingAuthPlan: args.signingAuthPlan
+				})
+			}
+		});
+	} finally {
+		clearNearOperationStepUpBuilder(requestId);
+	}
+}
+/** Turns the confirmation into the authorization that the signing step presents. */
+function authorizeNearSignatureOnlyOperation(operation, stepUp, confirmation) {
+	const stepUpAuthorization = buildNearEd25519StepUpAuthorization({
+		prepared: stepUp.preparedStepUp,
+		confirmation
+	});
+	if (stepUpAuthorization.kind === "warm_session") return {
+		kind: "warm_session",
+		displayDigest: confirmation.intentDigest,
+		stepUpAuthorization
+	};
+	const proof = buildNearEd25519OperationStepUpProof({
+		authorization: stepUpAuthorization,
+		preparation: operation.preparation,
+		auth: operation.auth,
+		walletId: operation.walletId
+	});
+	const prepared = requirePreparedSignatureOnlyStepUp(operation.label, consumePreparedNearOperationStepUp({
+		requestId: String(operation.signingOperation.operationId),
+		ref: requireOperationStepUpPreparationRef(operation.label, confirmation.operationStepUpPreparation)
+	}));
+	return {
+		kind: "operation_step_up",
+		displayDigest: confirmation.intentDigest,
+		stepUpAuthorization,
+		proof,
+		prepared,
+		...requireOperationStepUpMaterial(operation.label, stepUp.operationStepUp)
+	};
+}
+async function resolveNearSignatureOnlySigningMaterial(operation, authorization) {
+	if (authorization.kind === "warm_session") {
+		const resolved = await resolveConfirmedNearEd25519YaoCapability({
+			authorization: authorization.stepUpAuthorization,
+			preparation: operation.preparation,
+			executor: operation.executor
+		});
+		return {
+			kind: "warm_session",
+			thresholdSessionId: resolved.thresholdSessionId,
+			displayDigest: authorization.displayDigest,
+			resolved
+		};
+	}
+	return {
+		kind: "operation_step_up",
+		thresholdSessionId: nearOperationStepUpMaterialFacts(authorization.material).thresholdSessionId,
+		displayDigest: authorization.displayDigest,
+		resolved: await resolveSignatureOnlyOperationStepUpCapability({
+			label: operation.label,
+			material: authorization.material,
+			prepared: authorization.prepared,
+			displayDigest: authorization.displayDigest,
+			authorization: authorization.stepUpAuthorization,
+			emailOtpProof: authorization.proof.kind === "email_otp" ? authorization.proof : null
+		}),
+		proof: authorization.proof,
+		prepared: authorization.prepared,
+		signingDigestB64u: authorization.signingDigestB64u
+	};
+}
+/** Signs through Router A/B with the reusable Wallet Session or the operation step-up. */
+async function signNearSignatureOnlyOperation(operation, material, signingSessionCoordinator) {
+	const signingDigestB64u = material.kind === "warm_session" ? await operation.computeSigningDigestB64u() : requireSigningDigest(operation.label, material.signingDigestB64u);
+	const result = material.kind === "warm_session" ? await tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning({
+		ctx: operation.ctx,
+		thresholdSessionId: material.thresholdSessionId,
+		activeClient: material.resolved.material.activeClient,
+		walletSessionState: requireAuthorizedWalletSessionState(await signingSessionCoordinator.resolveActiveAuthorizedRouterAbEd25519WalletSessionState({
+			state: material.resolved.walletSessionState,
+			nowMs: Date.now()
+		})),
+		walletId: operation.walletId,
+		thresholdKeyMaterial: operation.thresholdKeyMaterial,
+		nearAccountId: operation.nearAccountId,
+		operationId: operation.signingOperation.operationId,
+		operationFingerprint: operation.signingOperation.operationFingerprint,
+		displayDigest: material.displayDigest,
+		signingDigestB64u,
+		intent: operation.intent,
+		authorization: { kind: "reusable_wallet_session" }
+	}) : await tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning({
+		ctx: operation.ctx,
+		thresholdSessionId: material.thresholdSessionId,
+		activeClient: material.resolved.material.activeClient,
+		materialFacts: material.resolved.material.facts,
+		walletId: operation.walletId,
+		thresholdKeyMaterial: operation.thresholdKeyMaterial,
+		nearAccountId: operation.nearAccountId,
+		operationId: operation.signingOperation.operationId,
+		operationFingerprint: operation.signingOperation.operationFingerprint,
+		displayDigest: material.displayDigest,
+		signingDigestB64u,
+		intent: operation.intent,
+		authorization: {
+			kind: "operation_step_up",
+			prepared: material.prepared,
+			proof: material.proof,
+			issuedAuthorization: material.resolved.issuedAuthorization
+		}
+	});
+	if (!result) throw new Error(`[SigningEngine][near] Router A/B Ed25519 ${operation.label} signing is unavailable`);
+	if (material.kind === "operation_step_up" && result.authorization === "operation_step_up") requireIssuedNearEd25519OperationStepUpAuthorization({
+		prepared: material.prepared,
+		issuedAuthorization: result.issuedAuthorization
+	});
+	return {
+		signingDigestB64u,
+		signatureB64u: result.signatureB64u,
+		signerPublicKey: result.signerPublicKey
+	};
+}
+/** Runs the Sign command, rethrowing a thrown non-Error value as an Error. */
+async function runNearSignatureOnlySignCommand(operation, execute) {
+	return await runSigningOperationCommand({
+		signingSessionPlan: operation.signingSessionPlan,
+		signingOperation: operation.signingOperation,
+		commandKind: SigningOperationCommandKind.Sign,
+		execute: async () => {
+			try {
+				return await execute();
+			} catch (e) {
+				throw e instanceof Error ? e : new Error(String(e));
+			}
+		}
+	});
+}
+//#endregion
+export { authorizeNearSignatureOnlyOperation, confirmNearSignatureOnlyOperation, prepareNearSignatureOnlyStepUp, resolveNearSignatureOnlySigningMaterial, resolveNearSignatureOnlySigningPlans, runNearSignatureOnlySignCommand, signNearSignatureOnlyOperation };
+
+//# sourceMappingURL=signatureOnlySigning.js.map

package/dist/esm/react/core/signingEngine/flows/signNear/shared/signingSessionAuthMode.js

@@ -1,5 +1,5 @@
-import { toWalletId } from "../../../interfaces/ecdsaChainTarget.js";
 import { SigningOperationIntent, SigningSessionIds, SigningSessionPlanKind } from "../../../session/operationState/types.js";
+import { toWalletId } from "../../../interfaces/ecdsaChainTarget.js";
 import { buildNearTransactionSigningLane } from "../../../session/operationState/lanes.js";
 import { emitSigningLaneResolutionTrace } from "../../../session/operationState/trace.js";
 import { signingAuthPlanFromSigningSessionPlan } from "../../shared/signingConfirmation.js";