@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/sdk/sessionPolicy-DO-MkL65.js

@@ -0,0 +1,460 @@
+import { k as parseWalletKeyId, z as normalizeOptionalTrimmedString } from "./domainIds-lcrFg6Sa.js";
+import { _ as requireRecord } from "./validation-gat4LEKm.js";
+import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
+import { r as secureRandomId } from "./secureRandomId-BORsmdS4.js";
+import { f as alphabetizeStringify, m as sha256BytesUtf8 } from "./chains-BMh3btVo.js";
+import { r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
+//#region ../shared-ts/src/utils/exactRecord.ts
+const SECRET_BEARING_FIELD_SUBSTRINGS = [
+	"prf",
+	"kek",
+	"seed",
+	"scalar",
+	"secretkey",
+	"privatekey",
+	"plaintext",
+	"recoverycode",
+	"clientroot",
+	"holdershare"
+];
+/**
+* Rejects every field outside this record's exact shape.
+*
+* `knownOnOtherBranches` names fields that are legitimate public bindings
+* somewhere else in the same union. Those are reported as the branch mismatch
+* they are; only genuinely unknown fields are classified as leaks, so a public
+* key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
+* for plaintext custody material.
+*/
+function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
+	const allowedSet = new Set(allowed);
+	const knownSet = new Set(knownOnOtherBranches);
+	for (const field of Object.keys(record)) {
+		if (allowedSet.has(field)) continue;
+		if (knownSet.has(field)) throw new Error(`${label}.${field} is not part of ${label}`);
+		const normalized = field.toLowerCase().replace(/_/g, "");
+		if (!normalized.includes("publickey") && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) throw new Error(`${label}.${field} must never carry plaintext custody material`);
+		throw new Error(`${label}.${field} is not part of ${label}`);
+	}
+}
+function exactRecord(raw, fields, label) {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, fields, label);
+	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+//#endregion
+//#region ../shared-ts/src/authorization/delegatedAuthority.ts
+const FULL_OWNER_PERMISSIONS = Object.freeze([
+	"export_keys",
+	"link_devices",
+	"revoke_devices",
+	"sign"
+]);
+Object.freeze(["sign"]);
+const DELEGATED_WALLET_PERMISSION_VALUE_SET = new Set([
+	"export_keys",
+	"link_devices",
+	"revoke_devices",
+	"sign"
+]);
+const canonicalPermissionSetBrand = Symbol("canonicalPermissionSetBrand");
+var CanonicalDelegatedWalletPermissionSetProof = class CanonicalDelegatedWalletPermissionSetProof extends Array {
+	constructor(permissions) {
+		super(...permissions);
+		this[canonicalPermissionSetBrand] = true;
+		Object.freeze(this);
+	}
+	static create(permissions) {
+		return new CanonicalDelegatedWalletPermissionSetProof(permissions);
+	}
+	static get [Symbol.species]() {
+		return Array;
+	}
+};
+function isDelegatedWalletPermissionV1(value) {
+	return typeof value === "string" && DELEGATED_WALLET_PERMISSION_VALUE_SET.has(value);
+}
+function parseDelegatedWalletPermissionSetV1(raw) {
+	if (!Array.isArray(raw)) return invalidPermissionResult(raw == null ? "delegated wallet permissions are required" : "delegated wallet permissions must be an array");
+	if (raw.length === 0) return invalidPermissionResult("delegated wallet permissions must be non-empty");
+	const permissions = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const value of raw) {
+		if (!isDelegatedWalletPermissionV1(value)) return invalidPermissionResult("delegated wallet permission is unsupported");
+		if (seen.has(value)) return invalidPermissionResult(`delegated wallet permission ${value} is duplicated`);
+		seen.add(value);
+		permissions.push(value);
+	}
+	permissions.sort(compareDelegatedWalletPermissions);
+	return {
+		ok: true,
+		value: CanonicalDelegatedWalletPermissionSetProof.create(toNonEmptyPermissionTuple(permissions))
+	};
+}
+function buildDelegatedWalletAuthorityV1(input) {
+	return {
+		kind: "delegated_wallet_authority_v1",
+		permissions: input.permissions
+	};
+}
+function parseDelegatedWalletAuthorityV1(raw) {
+	if (!isExactAuthorityRecord(raw)) return invalidAuthorityResult("delegated wallet authority must contain exactly kind and permissions");
+	if (raw.kind !== "delegated_wallet_authority_v1") return invalidAuthorityResult("delegated wallet authority kind is unsupported");
+	const permissions = parseDelegatedWalletPermissionSetV1(raw.permissions);
+	if (!permissions.ok) return permissions;
+	return {
+		ok: true,
+		value: buildDelegatedWalletAuthorityV1({ permissions: permissions.value })
+	};
+}
+function buildFullOwnerPermissionsV1() {
+	return buildPresetPermissionSet(FULL_OWNER_PERMISSIONS);
+}
+function buildFullOwnerDelegatedWalletAuthorityV1() {
+	return buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() });
+}
+function hasDelegatedWalletPermissionV1(authority, permission) {
+	return authority.permissions.includes(permission);
+}
+function delegatedWalletPermissionNamesV1(authority) {
+	return Object.freeze([...authority.permissions]);
+}
+function sameDelegatedWalletAuthorityV1(left, right) {
+	if (left.kind !== right.kind || left.permissions.length !== right.permissions.length) return false;
+	for (let index = 0; index < left.permissions.length; index += 1) if (left.permissions[index] !== right.permissions[index]) return false;
+	return true;
+}
+function buildPresetPermissionSet(permissions) {
+	const parsed = parseDelegatedWalletPermissionSetV1(permissions);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function compareDelegatedWalletPermissions(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function toNonEmptyPermissionTuple(permissions) {
+	const [first, ...remaining] = permissions;
+	if (!first) throw new Error("delegated wallet permissions must be non-empty");
+	return [first, ...remaining];
+}
+function isExactAuthorityRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 2 && keys.includes("kind") && keys.includes("permissions");
+}
+function invalidPermissionResult(message) {
+	return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message
+		}
+	};
+}
+function invalidAuthorityResult(message) {
+	return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message
+		}
+	};
+}
+//#endregion
+//#region ../shared-ts/src/passkey-custody/primitives.ts
+const UNPADDED_BASE64URL = /^[A-Za-z0-9_-]+$/;
+function requireCanonicalBase64Url(value, label) {
+	if (typeof value !== "string" || !UNPADDED_BASE64URL.test(value)) throw new Error(`${label} must be unpadded base64url`);
+	let decoded;
+	try {
+		decoded = base64UrlDecode(value);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
+	return decoded;
+}
+function requireParsed(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
+function parseDigestField(value, label) {
+	try {
+		return parseDigestB64u(value);
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is not a digest"}`);
+	}
+}
+const PASSKEY_CUSTODY_WRAP_NONCE_LENGTH = 12;
+const PASSKEY_CUSTODY_WRAP_TAG_LENGTH = 16;
+function parseEnvelopeNonceB64u(value, label = "nonceB64u") {
+	if (requireCanonicalBase64Url(value, label).length !== PASSKEY_CUSTODY_WRAP_NONCE_LENGTH) throw new Error(`${label} must decode to a 12-byte ChaCha20Poly1305 nonce`);
+	return value;
+}
+function parseEnvelopeCiphertextB64u(value, label = "ciphertextB64u") {
+	if (requireCanonicalBase64Url(value, label).length < PASSKEY_CUSTODY_WRAP_TAG_LENGTH + 1) throw new Error(`${label} must decode to sealed ciphertext with an authentication tag`);
+	return value;
+}
+function parseEd25519PublicKeyB64u(value, label = "registeredPublicKeyB64u") {
+	if (requireCanonicalBase64Url(value, label).length !== 32) throw new Error(`${label} must decode to a 32-byte Ed25519 public key`);
+	return value;
+}
+function parseSecp256k1CompressedPublicKeyB64u(value, label = "publicKey33B64u") {
+	const decoded = requireCanonicalBase64Url(value, label);
+	if (decoded.length !== 33) throw new Error(`${label} must decode to a 33-byte compressed secp256k1 point`);
+	if (decoded[0] !== 2 && decoded[0] !== 3) throw new Error(`${label} must be a compressed secp256k1 public key`);
+	return value;
+}
+function parseKeyCreationSignerSlot(value, label = "keyCreationSignerSlot") {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > 4294967295) throw new Error(`${label} must be a positive u32`);
+	return value;
+}
+function parseEnvelopeRevision(value, label = "envelopeRevision") {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer revision`);
+	return value;
+}
+function parseUnixMs(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
+	return value;
+}
+//#endregion
+//#region ../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.ts
+function requiredPart(value, field) {
+	if (typeof value !== "string") throw new Error(`EVM-family signing key slot id requires ${field}`);
+	const normalized = value.trim();
+	if (!normalized) throw new Error(`EVM-family signing key slot id requires ${field}`);
+	return normalized;
+}
+function keyPart(value) {
+	return encodeURIComponent(requiredPart(value, "non-empty components"));
+}
+function isEvmFamilySigningKeySlotIdShape(value) {
+	const parts = value.split(":");
+	return parts.length === 5 && parts[0] === "wallet-key" && parts[1] === "evm-family" && parts.slice(2).every((part) => part.length > 0);
+}
+function parseEvmFamilySigningKeySlotId(raw) {
+	const parsed = parseWalletKeyId(raw);
+	if (!parsed.ok) return parsed;
+	if (!isEvmFamilySigningKeySlotIdShape(String(parsed.value))) return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "EVM-family signing key slot id must be wallet-key:evm-family:<walletId>:<signingRootId>:<signingRootVersion>"
+		}
+	};
+	return {
+		ok: true,
+		value: String(parsed.value)
+	};
+}
+function requireEvmFamilySigningKeySlotId(value, label = "evmFamilySigningKeySlotId") {
+	const parsed = parseEvmFamilySigningKeySlotId(value);
+	if (parsed.ok) return parsed.value;
+	if (parsed.error.code === "missing") throw new Error(`${label} is required`);
+	throw new Error(`${label} must be an EVM-family signing key slot id`);
+}
+function deriveEvmFamilySigningKeySlotId(input) {
+	return requireEvmFamilySigningKeySlotId([
+		"wallet-key",
+		"evm-family",
+		keyPart(input.walletId),
+		keyPart(input.signingRootId),
+		keyPart(input.signingRootVersion)
+	].join(":"));
+}
+//#endregion
+//#region ../shared-ts/src/threshold/signingRootScope.ts
+function requireScopeField(label, value) {
+	const normalized = normalizeOptionalTrimmedString(value);
+	if (!normalized) throw new Error(`${label} is required`);
+	return normalized;
+}
+function deriveSigningRootId(input) {
+	return `${requireScopeField("projectId", input.projectId)}:${requireScopeField("envId", input.envId)}`;
+}
+function normalizeRuntimePolicyScope(input) {
+	const scope = normalizeRuntimePolicyScopeFields(input);
+	return {
+		...scope,
+		signingRootVersion: requireScopeField("signingRootVersion", scope.signingRootVersion)
+	};
+}
+function normalizeRuntimePolicyScopeFields(input) {
+	if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("runtimePolicyScope must be an object");
+	const scope = input;
+	if (Object.prototype.hasOwnProperty.call(scope, "environmentId")) throw new Error("runtimePolicyScope.environmentId is stale; use envId");
+	if (Object.prototype.hasOwnProperty.call(scope, "runtimeSnapshotScope")) throw new Error("runtimePolicyScope.runtimeSnapshotScope is stale; use runtimePolicyScope");
+	return {
+		orgId: requireScopeField("orgId", scope.orgId),
+		projectId: requireScopeField("projectId", scope.projectId),
+		envId: requireScopeField("envId", scope.envId),
+		...normalizeOptionalTrimmedString(scope.signingRootVersion) ? { signingRootVersion: normalizeOptionalTrimmedString(scope.signingRootVersion) } : {}
+	};
+}
+function sameRuntimePolicyScope(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function signingRootScopeFromRuntimePolicyScope(scope) {
+	return {
+		signingRootId: deriveSigningRootId(scope),
+		signingRootVersion: requireScopeField("signingRootVersion", scope.signingRootVersion)
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/theme.ts
+function coerceThemeMode(input) {
+	return input === "light" || input === "dark" ? input : void 0;
+}
+const THRESHOLD_ED25519_2P_PARTICIPANT_IDS = [1, 2];
+function normalizeThresholdEd25519ParticipantId(id) {
+	const n = Number(id);
+	if (!Number.isSafeInteger(n) || n < 1 || n > 65535) return null;
+	return n;
+}
+function normalizeThresholdEd25519ParticipantIds(input) {
+	if (!Array.isArray(input) || input.length === 0) return null;
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const v of input) {
+		const id = normalizeThresholdEd25519ParticipantId(v);
+		if (!id) return null;
+		if (!seen.has(id)) {
+			seen.add(id);
+			out.push(id);
+		}
+	}
+	out.sort((a, b) => a - b);
+	return out.length ? out : null;
+}
+function parseThresholdEd25519ParticipantsV1(input) {
+	if (!Array.isArray(input) || input.length === 0) return null;
+	const out = [];
+	for (const item of input) {
+		if (!item || typeof item !== "object" || Array.isArray(item)) return null;
+		const rec = item;
+		const id = normalizeThresholdEd25519ParticipantId(rec.id);
+		const role = normalizeOptionalTrimmedString(rec.role);
+		if (!id || role !== "client" && role !== "relayer") return null;
+		const participant = {
+			id,
+			role
+		};
+		const relayerUrl = normalizeOptionalTrimmedString(rec.relayerUrl);
+		if (relayerUrl) participant.relayerUrl = relayerUrl;
+		const relayerKeyId = normalizeOptionalTrimmedString(rec.relayerKeyId);
+		if (relayerKeyId) participant.relayerKeyId = relayerKeyId;
+		const shareDerivation = normalizeOptionalTrimmedString(rec.shareDerivation);
+		if (shareDerivation === "prf_first_v1" || shareDerivation === "derived_master_secret_v1" || shareDerivation === "kv_random_v1" || shareDerivation === "unknown") participant.shareDerivation = shareDerivation;
+		out.push(participant);
+	}
+	return out.length ? out : null;
+}
+function buildThresholdEd25519Participants2pV1(input) {
+	const relayerKeyId = normalizeOptionalTrimmedString(input.relayerKeyId);
+	const relayerUrl = normalizeOptionalTrimmedString(input.relayerUrl);
+	const clientParticipantId = normalizeThresholdEd25519ParticipantId(input.clientParticipantId) ?? 1;
+	const relayerParticipantId = normalizeThresholdEd25519ParticipantId(input.relayerParticipantId) ?? 2;
+	return [{
+		id: clientParticipantId,
+		role: "client",
+		shareDerivation: input.clientShareDerivation || "prf_first_v1"
+	}, {
+		id: relayerParticipantId,
+		role: "relayer",
+		...relayerUrl ? { relayerUrl } : {},
+		...relayerKeyId ? { relayerKeyId } : {},
+		...input.relayerShareDerivation ? { shareDerivation: input.relayerShareDerivation } : {}
+	}];
+}
+//#endregion
+//#region ../shared-ts/src/threshold/sessionPolicy.ts
+const DEFAULT_WALLET_SESSION_TTL_MS = 1440 * 6e4;
+const MAX_WALLET_SESSION_TTL_MS = 720 * 60 * 6e4;
+const MAX_WALLET_SESSION_REMAINING_USES = 1e6;
+//#endregion
+//#region src/core/signingEngine/threshold/sessionPolicy.ts
+const THRESHOLD_SESSION_POLICY_VERSION = "threshold_session_v1";
+function normalizeThresholdRuntimePolicyScope(value) {
+	try {
+		return normalizeRuntimePolicyScope(value);
+	} catch {
+		return;
+	}
+}
+const THRESHOLD_SESSION_POLICY_MAX_TTL_MS = MAX_WALLET_SESSION_TTL_MS;
+const THRESHOLD_SESSION_POLICY_MAX_USES = MAX_WALLET_SESSION_REMAINING_USES;
+const DEFAULT_THRESHOLD_SESSION_TTL_MS = DEFAULT_WALLET_SESSION_TTL_MS;
+const DEFAULT_THRESHOLD_SESSION_POLICY = {
+	ttlMs: DEFAULT_THRESHOLD_SESSION_TTL_MS,
+	remainingUses: 3
+};
+const DEFAULT_UNLOCK_REMAINING_USES = 3;
+function parsePositiveSessionUses(value, fieldName) {
+	const remainingUses = Math.floor(Number(value) || 0);
+	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error(`[ThresholdSessionPolicy] ${fieldName} must be a positive integer`);
+	return remainingUses;
+}
+function resolveWalletUnlockSessionUsesFromRequestedUses(args) {
+	const normalized = Math.floor(Number(args.requestedRemainingUses) || 0);
+	if (!Number.isFinite(normalized) || normalized <= 0) return null;
+	return Math.min(normalized, DEFAULT_UNLOCK_REMAINING_USES);
+}
+function clampThresholdSessionPolicy(input) {
+	const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
+	const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
+	return {
+		ttlMs: Math.min(ttlMs, THRESHOLD_SESSION_POLICY_MAX_TTL_MS),
+		remainingUses: Math.min(remainingUses, THRESHOLD_SESSION_POLICY_MAX_USES)
+	};
+}
+function generateThresholdSessionId() {
+	return secureRandomId("tsess", 32, "threshold session IDs");
+}
+async function computeEd25519SessionPolicyDigest32(policy) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(policy)));
+}
+async function buildEd25519SessionPolicy(params) {
+	return buildExactEd25519SessionPolicy({
+		nearAccountId: params.nearAccountId,
+		nearEd25519SigningKeyId: params.nearEd25519SigningKeyId,
+		authority: params.authority.authority,
+		relayerKeyId: params.relayerKeyId,
+		runtimePolicyScope: params.runtimePolicyScope,
+		routerAbNormalSigning: params.routerAbNormalSigning,
+		participantIds: params.participantIds,
+		thresholdSessionId: params.thresholdSessionId,
+		ttlMs: params.ttlMs,
+		remainingUses: params.remainingUses
+	});
+}
+async function buildExactEd25519SessionPolicy(params) {
+	const thresholdSessionId = params.thresholdSessionId || generateThresholdSessionId();
+	const { ttlMs, remainingUses } = clampThresholdSessionPolicy({
+		ttlMs: params.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
+		remainingUses: params.remainingUses ?? DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses
+	});
+	const participantIds = normalizeThresholdEd25519ParticipantIds(params.participantIds);
+	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(params.runtimePolicyScope);
+	const policy = {
+		version: THRESHOLD_SESSION_POLICY_VERSION,
+		nearAccountId: params.nearAccountId,
+		nearEd25519SigningKeyId: params.nearEd25519SigningKeyId,
+		authority: params.authority,
+		relayerKeyId: params.relayerKeyId,
+		thresholdSessionId,
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		routerAbNormalSigning: params.routerAbNormalSigning,
+		...participantIds ? { participantIds } : {},
+		ttlMs,
+		remainingUses
+	};
+	const sessionPolicyDigest32 = await computeEd25519SessionPolicyDigest32(policy);
+	return {
+		policy,
+		policyJson: JSON.stringify(policy),
+		sessionPolicyDigest32
+	};
+}
+//#endregion
+export { delegatedWalletPermissionNamesV1 as A, parseEnvelopeNonceB64u as C, parseUnixMs as D, parseSecp256k1CompressedPublicKeyB64u as E, exactRecord as F, rejectUnknownFields as I, parseDelegatedWalletAuthorityV1 as M, parseDelegatedWalletPermissionSetV1 as N, requireParsed as O, sameDelegatedWalletAuthorityV1 as P, parseEnvelopeCiphertextB64u as S, parseKeyCreationSignerSlot as T, signingRootScopeFromRuntimePolicyScope as _, clampThresholdSessionPolicy as a, parseDigestField as b, resolveWalletUnlockSessionUsesFromRequestedUses as c, normalizeThresholdEd25519ParticipantIds as d, parseThresholdEd25519ParticipantsV1 as f, sameRuntimePolicyScope as g, normalizeRuntimePolicyScope as h, buildEd25519SessionPolicy as i, hasDelegatedWalletPermissionV1 as j, buildFullOwnerDelegatedWalletAuthorityV1 as k, THRESHOLD_ED25519_2P_PARTICIPANT_IDS as l, deriveSigningRootId as m, DEFAULT_THRESHOLD_SESSION_TTL_MS as n, normalizeThresholdRuntimePolicyScope as o, coerceThemeMode as p, DEFAULT_UNLOCK_REMAINING_USES as r, parsePositiveSessionUses as s, DEFAULT_THRESHOLD_SESSION_POLICY as t, buildThresholdEd25519Participants2pV1 as u, deriveEvmFamilySigningKeySlotId as v, parseEnvelopeRevision as w, parseEd25519PublicKeyB64u as x, requireEvmFamilySigningKeySlotId as y };