@seams/wallet 0.7.1 → 0.7.3

package/dist/public/sdk/workers/ecdsa-presign-client.worker.js

@@ -604,8 +604,7 @@ var opaqueMaterials = new Map;
 var pendingOpaqueAuthorities = new Map;
 var opaqueSessionPorts = new Map;
 var opaqueSessionBindings = new Map;
-var derivationPort = null;
-var linkedHolderPort = null;
+var authorityChannel = null;
 var onlinePort = null;
 var messageQueue = Promise.resolve();
 function randomHandle(prefix) {
@@ -692,14 +691,16 @@ async function initializeSession(payload) {
   if (materialExpiresAtMs < ceremonyExpiresAtMs) {
     throw new Error("ECDSA presign material expiry must cover the ceremony");
   }
+  const channel = authorityChannel;
+  const requestId = randomHandle("ecdsa-presign-init");
+  const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
+  let request;
   switch (payload.authority.kind) {
-    case "role_local_derivation_handle": {
-      if (!derivationPort) {
+    case "role_local_derivation_handle":
+      if (channel?.kind !== "role_local_derivation_handle") {
         throw new Error("ECDSA presign client has no derivation material channel");
       }
-      const requestId = randomHandle("ecdsa-role-local-presign");
-      const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
-      const result = await requestOpaqueAuthority(derivationPort, {
+      request = {
         kind: "opaque_ecdsa_presign_session_init_v1",
         requestId,
         sessionId,
@@ -712,33 +713,13 @@ async function initializeSession(payload) {
         groupPublicKey33: groupPublicKeyBuffer,
         ceremonyExpiresAtMs,
         materialExpiresAtMs
-      }, [groupPublicKeyBuffer]);
-      const progress = requireOpaqueProgress(result);
-      retainCompletedMaterial({
-        progress,
-        authorityPort: derivationPort,
-        poolIdentity,
-        groupPublicKey33,
-        expiresAtMs: materialExpiresAtMs
-      });
-      if (progress.event !== "presign_done") {
-        opaqueSessionPorts.set(sessionId, derivationPort);
-        opaqueSessionBindings.set(sessionId, {
-          poolIdentity,
-          groupPublicKey33: groupPublicKey33.slice(),
-          ceremonyExpiresAtMs,
-          materialExpiresAtMs
-        });
-      }
-      return { authority: { kind: "role_local_derivation_handle" }, progress };
-    }
-    case "linked_holder_signing_material": {
-      if (!linkedHolderPort) {
+      };
+      break;
+    case "linked_holder_signing_material":
+      if (channel?.kind !== "linked_holder_signing_material") {
         throw new Error("ECDSA presign client has no linked holder material channel");
       }
-      const requestId = randomHandle("linked-holder-ecdsa-presign");
-      const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
-      const result = await requestOpaqueAuthority(linkedHolderPort, {
+      request = {
         kind: "opaque_ecdsa_presign_session_init_v1",
         requestId,
         sessionId,
@@ -750,30 +731,39 @@ async function initializeSession(payload) {
         groupPublicKey33: groupPublicKeyBuffer,
         ceremonyExpiresAtMs,
         materialExpiresAtMs
-      }, [groupPublicKeyBuffer]);
-      const progress = requireOpaqueProgress(result);
-      retainCompletedMaterial({
-        progress,
-        authorityPort: linkedHolderPort,
-        poolIdentity,
-        groupPublicKey33,
-        expiresAtMs: materialExpiresAtMs
-      });
-      if (progress.event !== "presign_done") {
-        opaqueSessionPorts.set(sessionId, linkedHolderPort);
-        opaqueSessionBindings.set(sessionId, {
-          poolIdentity,
-          groupPublicKey33: groupPublicKey33.slice(),
-          ceremonyExpiresAtMs,
-          materialExpiresAtMs
-        });
-      }
-      return { authority: { kind: "linked_holder_signing_material" }, progress };
-    }
+      };
+      break;
     default:
       payload.authority;
       throw new Error("Unsupported ECDSA presign authority");
   }
+  const result = await requestOpaqueAuthority(channel.port, request, [groupPublicKeyBuffer]);
+  const progress = requireOpaqueProgress(result);
+  retainCompletedMaterial({
+    progress,
+    authorityPort: channel.port,
+    poolIdentity,
+    groupPublicKey33,
+    expiresAtMs: materialExpiresAtMs
+  });
+  if (progress.event !== "presign_done") {
+    opaqueSessionPorts.set(sessionId, channel.port);
+    opaqueSessionBindings.set(sessionId, {
+      poolIdentity,
+      groupPublicKey33: groupPublicKey33.slice(),
+      ceremonyExpiresAtMs,
+      materialExpiresAtMs
+    });
+  }
+  switch (request.authority.kind) {
+    case "role_local_derivation_handle":
+      return { authority: { kind: "role_local_derivation_handle" }, progress };
+    case "linked_holder_signing_material":
+      return { authority: { kind: "linked_holder_signing_material" }, progress };
+    default:
+      request.authority;
+      throw new Error("Unsupported ECDSA presign authority");
+  }
 }
 async function stepSession(payload) {
   const sessionId = coerceNonNullishString(payload.sessionId, "sessionId");
@@ -1132,8 +1122,9 @@ async function listAvailablePresignatures(payload) {
       expiresAtMs: entry.expiresAtMs
     });
   }
-  if (derivationPort) {
-    const result = await requestOpaqueAuthority(derivationPort, {
+  const channel = authorityChannel;
+  if (channel?.kind === "role_local_derivation_handle") {
+    const result = await requestOpaqueAuthority(channel.port, {
       kind: "opaque_ecdsa_presign_material_list_v1",
       requestId: randomHandle("opaque-ecdsa-presign-list"),
       poolIdentity
@@ -1155,7 +1146,7 @@ async function listAvailablePresignatures(payload) {
         continue;
       }
       opaqueMaterials.set(materialHandle, {
-        authorityPort: derivationPort,
+        authorityPort: channel.port,
         poolIdentity,
         groupPublicKey33,
         bigR33: bigR33.buffer,
@@ -1177,29 +1168,23 @@ async function listAvailablePresignatures(payload) {
   }
   return refs.sort((left, right) => left.createdAtMs - right.createdAtMs);
 }
+function replaceAuthorityChannel(channel) {
+  if (authorityChannel) {
+    purgeAuthorityPort(authorityChannel.port, "ECDSA presign authority channel was replaced");
+    authorityChannel.port.close();
+  }
+  authorityChannel = channel;
+  channel.port.onmessage = handleOpaqueAuthorityResponse.bind(null, channel.port);
+  channel.port.onmessageerror = purgeAuthorityPort.bind(null, channel.port, "ECDSA presign authority channel failed");
+  channel.port.start();
+}
 function attachControlChannel(value) {
   if (isAttachEcdsaDerivationToPresignPort(value)) {
-    if (derivationPort) {
-      purgeAuthorityPort(derivationPort, "ECDSA derivation presign authority channel was replaced");
-    }
-    derivationPort?.close();
-    derivationPort = value.port;
-    derivationPort.onmessage = (event) => handleOpaqueAuthorityResponse(value.port, event);
-    derivationPort.onmessageerror = () => purgeAuthorityPort(value.port, "ECDSA derivation presign authority channel failed");
-    derivationPort.start();
+    replaceAuthorityChannel({ kind: "role_local_derivation_handle", port: value.port });
     return true;
   }
   if (isAttachLinkedHolderToPresignPort(value)) {
-    if (linkedHolderPort) {
-      purgeAuthorityPort(linkedHolderPort, "Linked holder ECDSA presign authority channel was replaced");
-    }
-    linkedHolderPort?.close();
-    linkedHolderPort = value.port;
-    linkedHolderPort.onmessage = (event) => handleOpaqueAuthorityResponse(value.port, event);
-    linkedHolderPort.onmessageerror = () => {
-      purgeAuthorityPort(value.port, "Linked holder ECDSA presign authority channel failed");
-    };
-    linkedHolderPort.start();
+    replaceAuthorityChannel({ kind: "linked_holder_signing_material", port: value.port });
     return true;
   }
   if (isAttachPresignToOnlinePort(value)) {

package/dist/public/sdk/workers/email-otp.worker.js

@@ -5,6 +5,7 @@ var WorkerControlMessage = {
 
 // ../shared-ts/src/utils/emailOtpDomain.ts
 var EMAIL_OTP_CHANNEL = "email_otp";
+var EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 var WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
   "wallet_unlock",
   "transaction_sign",
@@ -109,6 +110,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -5025,11 +5031,6 @@ function exactRecord2(raw, fields, label) {
   }
   return record;
 }
-function requireParsed(parsed, label) {
-  if (!parsed.ok)
-    throw new Error(`${label} ${parsed.error.message}`);
-  return parsed.value;
-}
 // ../shared-ts/src/utils/routerAbPublicKeyset.ts
 function requireRouterAbX25519PublicKey(value, label) {
   const publicKey = coerceNonEmptyString(value, label);
@@ -5086,6 +5087,9 @@ function normalizeRuntimePolicyScopeFields(input) {
     ...normalizeOptionalTrimmedString(scope.signingRootVersion) ? { signingRootVersion: normalizeOptionalTrimmedString(scope.signingRootVersion) } : {}
   };
 }
+function sameRuntimePolicyScope(left, right) {
+  return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
 function signingRootScopeFromRuntimePolicyScope(scope) {
   return {
     signingRootId: deriveSigningRootId(scope),
@@ -6889,9 +6893,6 @@ function readThresholdEd25519SessionId(value, label) {
   }
   return parsed.value;
 }
-function readEvmFamilySigningKeySlotId(value, label) {
-  return requireEvmFamilySigningKeySlotId(value, label);
-}
 function readNumber(value, label) {
   const normalized = Number(value);
   if (!Number.isFinite(normalized)) {
@@ -7097,7 +7098,7 @@ function parseOptionalWorkerEcdsaSessionHandleBinding(value) {
       throw new Error("Email OTP wallet-registration ECDSA handle binding requires evm-family keyScope");
     }
     return {
-      evmFamilySigningKeySlotId: String(readEvmFamilySigningKeySlotId(obj.evmFamilySigningKeySlotId, "ecdsaSessionHandleBinding.evmFamilySigningKeySlotId")),
+      evmFamilySigningKeySlotId: String(requireEvmFamilySigningKeySlotId(obj.evmFamilySigningKeySlotId, "ecdsaSessionHandleBinding.evmFamilySigningKeySlotId")),
       authSubjectId: readString(obj.authSubjectId, "ecdsaSessionHandleBinding.authSubjectId"),
       action: "wallet_registration_ecdsa_prepare",
       operation: "registration",
@@ -9731,7 +9732,6 @@ async function addClientSealFromBytes(args) {
     keyHandle: args.keyHandle
   }), "wrappedCiphertext");
 }
-var EMAIL_OTP_FACTOR_RELEASE_AAD_PREFIX = "seams/email-otp/factor-release/v1";
 async function generateEmailOtpFactorReleaseKeyPair(label) {
   const subtle = globalThis.crypto?.subtle;
   if (!subtle)
@@ -9755,7 +9755,7 @@ async function openEmailOtpFactorReleaseCiphertext(args) {
     const aesKey = await args.subtle.importKey("raw", sharedSecret, { name: "AES-GCM" }, false, [
       "decrypt"
     ]);
-    aad = new TextEncoder().encode(`${EMAIL_OTP_FACTOR_RELEASE_AAD_PREFIX}\x00${args.walletId}\x00${args.enrollmentId}\x00${args.enrollmentSealKeyVersion}\x00${args.challengeId}`);
+    aad = new TextEncoder().encode(`${EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1}\x00${args.walletId}\x00${args.enrollmentId}\x00${args.enrollmentSealKeyVersion}\x00${args.challengeId}`);
     factorSecret32 = new Uint8Array(await args.subtle.decrypt({ name: "AES-GCM", iv: args.nonce, additionalData: aad, tagLength: 128 }, aesKey, args.ciphertext));
     if (factorSecret32.length !== 32) {
       throw new Error("Email OTP factor release plaintext must contain exactly 32 bytes");
@@ -11746,9 +11746,6 @@ function bytesToLowerHex(bytes) {
     output += byte.toString(16).padStart(2, "0");
   return output;
 }
-function sameEmailOtpRuntimePolicyScope(left, right) {
-  return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function walletSessionHasEcdsaActivation(args) {
   const materialActivation = routerAbMpcMaterialActivationRefFromWire(args.activation.public_capability.material_activation);
   let matchCount = 0;
@@ -12057,7 +12054,7 @@ async function restoreEmailOtpEcdsaMaterialFromCustody(args) {
       throw new Error("Email OTP ECDSA custody continuity does not match the requested key set");
     }
     for (const signer of args.continuity.signers) {
-      if (signer.walletKey.walletId !== args.projection.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameEmailOtpRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) {
+      if (signer.walletKey.walletId !== args.projection.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) {
         throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
       }
     }
@@ -12843,7 +12840,7 @@ function assertEmailOtpEd25519YaoExportCapabilityContinuity(args) {
   if (!signingRoot) {
     throw new Error("Email OTP Ed25519 Yao export runtime policy scope is invalid");
   }
-  if (capability.nearAccountId !== args.nearAccountId || capability.applicationBinding.wallet_id !== args.walletId || capability.applicationBinding.near_ed25519_signing_key_id !== args.nearEd25519SigningKeyId || capability.applicationBinding.key_creation_signer_slot !== args.signerSlot || capability.applicationBinding.signing_root_id !== signingRoot.signingRootId || capability.lifecycle.accountId !== args.walletId || capability.lifecycle.rootShareEpoch !== args.runtimePolicyScope.signingRootVersion || !sameEmailOtpRuntimePolicyScope(capability.runtimePolicyScope, args.runtimePolicyScope)) {
+  if (capability.nearAccountId !== args.nearAccountId || capability.applicationBinding.wallet_id !== args.walletId || capability.applicationBinding.near_ed25519_signing_key_id !== args.nearEd25519SigningKeyId || capability.applicationBinding.key_creation_signer_slot !== args.signerSlot || capability.applicationBinding.signing_root_id !== signingRoot.signingRootId || capability.lifecycle.accountId !== args.walletId || capability.lifecycle.rootShareEpoch !== args.runtimePolicyScope.signingRootVersion || !sameRuntimePolicyScope(capability.runtimePolicyScope, args.runtimePolicyScope)) {
     throw new Error("Email OTP Ed25519 Yao export capability changed the exact durable lane");
   }
   const nearAccountId = args.nearAccountId.trim().toLowerCase();

package/dist/public/sdk/workers/wallet-custody-ceremony.worker.js

@@ -3796,6 +3796,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -4771,11 +4776,6 @@ var OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
   "custodyKeyManifestDigestB64u",
   "sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-  if (result.ok)
-    return result.value;
-  throw new Error(`${label} ${result.error.message}`);
-}
 function parseWalletSignerId(raw, label = "walletSignerId") {
   if (typeof raw !== "string")
     throw new Error(`${label} must be a string`);
@@ -4809,7 +4809,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
     kind: "owner_lane_participant_continuity_v1",
     signerId: parseWalletSignerId(args.signerId),
     participantIds,
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
     custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
     sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
   };
@@ -4823,7 +4823,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
   return buildOwnerLaneParticipantContinuityV1({
     signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
     participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
     custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
     sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
   });