@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/SeamsWeb/operations/devices/walletHostComposition.js

@@ -1,130 +0,0 @@
-import { parseLinkedDeviceListRequestV1, parseLinkedDeviceListResultV1, parseLinkedDeviceRevokeRequestV1, parseLinkedDeviceRevokeResultV1 } from "../../../shared-ts/src/device-linking/deviceManagement.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { createDeviceLinkingFlowPortsV1 } from "./deviceLinkingComposition.js";
-import { WalletHostOwnerRequestTransportError } from "./walletHostOwnerAuthority.js";
-//#region src/SeamsWeb/operations/devices/walletHostComposition.ts
-const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
-const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
-var OwnerWalletSessionReauthRequiredError = class extends Error {
-	constructor() {
-		super("The owner Wallet Session must be renewed");
-		this.code = OWNER_WALLET_SESSION_REAUTH_REQUIRED;
-		this.name = "OwnerWalletSessionReauthRequiredError";
-	}
-};
-function createWalletHostCompositionV1(args) {
-	const deviceLinkingPorts = createDeviceLinkingFlowPortsV1(args);
-	return {
-		linkedDeviceManagement: createWalletHostLinkedDeviceManagementPortV1({ request: args.managementRequest }),
-		deviceLinkingPorts,
-		dispose: deviceLinkingPorts.dispose
-	};
-}
-function createWalletHostLinkedDeviceManagementPortV1(args) {
-	return {
-		listLinkedDevices: async ({ walletId, limit, cursor }) => {
-			const request = parseLinkedDeviceListRequestV1({
-				kind: "linked_device_list_request_v1",
-				walletId,
-				limit,
-				cursor
-			});
-			const path = `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}?walletId=${encodeURIComponent(String(request.walletId))}&limit=${encodeURIComponent(String(request.limit))}&cursor=${encodeURIComponent(request.cursor ?? "")}`;
-			const response = await args.request.request({
-				method: "GET",
-				canonicalPath: path,
-				walletId: request.walletId
-			});
-			assertManagementSuccess(response, "list linked devices");
-			return parseLinkedDeviceListResponseV1(response.body);
-		},
-		revokeLinkedDevice: async ({ walletId, walletAuthMethodId, requestedAtMs, sourceProof }) => {
-			const request = parseLinkedDeviceRevokeRequestV1({
-				kind: "linked_device_revoke_request_v1",
-				walletId,
-				walletAuthMethodId,
-				requestedAtMs
-			});
-			const send = async () => await args.request.request({
-				method: "POST",
-				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
-				body: {
-					...request,
-					sourceProof
-				},
-				walletId
-			});
-			let response;
-			try {
-				response = await send();
-			} catch (error) {
-				if (!(error instanceof WalletHostOwnerRequestTransportError)) throw error;
-				if (error.code !== "network_error") throw error;
-				response = await send();
-			}
-			return parseManagementRevokeResult(response);
-		}
-	};
-}
-function parseManagementRevokeResult(response) {
-	if (response.status === 404) return parseLinkedDeviceRevokeResultV1({ kind: "not_found" });
-	if (response.status === 409) return parseLinkedDeviceRevokeResultV1({ kind: "conflict" });
-	if (response.status === 401 || response.status === 403) return parseLinkedDeviceRevokeResultV1({ kind: "unauthorized" });
-	assertManagementSuccess(response, "revoke linked device");
-	return parseLinkedDeviceRevokeResponseV1(response.body);
-}
-function assertManagementSuccess(response, operation) {
-	if (response.status < 200 || response.status >= 300) {
-		if (response.status === 401 && isManagementUnauthorizedFailureRecordV1(response.body)) throw new OwnerWalletSessionReauthRequiredError();
-		const detail = managementFailureDetail(response.body);
-		throw new Error(detail ? `linked-device ${operation} failed with HTTP ${response.status}: ${detail}` : `linked-device ${operation} failed with HTTP ${response.status}`);
-	}
-}
-function managementFailureDetail(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (isManagementFailureWithMessageRecordV1(raw)) return raw.message;
-	if (isManagementUnauthorizedFailureRecordV1(raw)) return raw.message;
-	return null;
-}
-function parseLinkedDeviceListResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device list response must be an object");
-	if (!isLinkedDeviceListResponseRecordV1(raw)) throw new Error("linked-device list response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device list response is not successful");
-	return parseLinkedDeviceListResultV1({
-		devices: raw.devices,
-		ownerDevices: raw.ownerDevices,
-		nextCursor: raw.nextCursor
-	});
-}
-function isLinkedDeviceListResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "devices|nextCursor|ok|ownerDevices";
-}
-function parseLinkedDeviceRevokeResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device revoke response must be an object");
-	if (!isLinkedDeviceRevokeResponseRecordV1(raw)) throw new Error("linked-device revoke response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device revoke response is not successful");
-	return parseLinkedDeviceRevokeResultV1({
-		kind: raw.kind,
-		walletAuthMethodId: raw.walletAuthMethodId,
-		authorityId: raw.authorityId,
-		revocationEpoch: raw.revocationEpoch
-	});
-}
-function isLinkedDeviceRevokeResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "authorityId|kind|ok|revocationEpoch|walletAuthMethodId";
-}
-function isManagementFailureWithMessageRecordV1(value) {
-	if (Object.keys(value).sort().join("|") !== "kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("message" in value)) return false;
-	return value.ok === false && (value.kind === "invalid_input" || value.kind === "internal") && typeof value.message === "string" && value.message.trim().length > 0;
-}
-function isManagementUnauthorizedFailureRecordV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	if (Object.keys(value).sort().join("|") !== "code|kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("code" in value) || !("message" in value)) return false;
-	return value.ok === false && value.kind === "unauthorized" && typeof value.code === "string" && typeof value.message === "string" && value.message.trim().length > 0;
-}
-//#endregion
-export { createWalletHostCompositionV1 };
-
-//# sourceMappingURL=walletHostComposition.js.map

package/dist/esm/react/SeamsWeb/operations/devices/walletHostOwnerAuthority.js

@@ -1,191 +0,0 @@
-import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { hasDelegatedWalletPermissionV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { parseExactAdministeredSignerManifestV1 } from "../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
-import { parseLinkedDeviceOwnerAuthorizationRequestV1, parseLinkedDeviceOwnerAuthorizationSourceV1 } from "../../../shared-ts/src/device-linking/parsers.js";
-import { awaitNearProvisioningInFlight } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
-import { WalletSessionAuthorizationUpgradeRequiredError } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { DeviceLinkingError, DeviceLinkingErrorCode } from "../../../core/types/linkDevice.js";
-//#region src/SeamsWeb/operations/devices/walletHostOwnerAuthority.ts
-const OWNER_AUTHORIZATION_PATH = "/wallet/device-linking/v1/owner-authorization";
-/** An owner request that received no answer: the network failed, or it timed out. */
-var WalletHostOwnerRequestTransportError = class extends Error {
-	constructor(code, message) {
-		super(`Owner Router request failed: ${message}`);
-		this.code = code;
-		this.name = "WalletHostOwnerRequestTransportError";
-	}
-};
-function createWalletHostOwnerAuthoritiesV1(input) {
-	const context = normalizeContext(input);
-	return {
-		ownerAuthorization: { authenticateOwnerForLinkingV1: async (request) => await authorizeOwnerForLinkingV1(context, request) },
-		ownerRequest: { requestOwnerV1: async (request) => await requestAsAuthorizedOwnerV1(context, request) },
-		managementRequest: { request: async (request) => await requestManagementAsOwnerV1(context, request) }
-	};
-}
-function normalizeContext(input) {
-	const baseUrl = String(input.relayerUrl || "").trim().replace(/\/+$/, "");
-	if (!baseUrl) throw new Error("Wallet-host device linking requires a Router URL");
-	return {
-		...input,
-		baseUrl
-	};
-}
-/**
-* The fail-closed preflight, exact result `wallet_unlock_required`.
-*
-* The locked and missing-session arms run before any network I/O. The
-* export-root arm runs after the stateless owner-authorization read, because
-* whether Ed25519 export access is needed comes from the server-derived
-* source signer manifest - but still before the QR claim and everything after
-* it: the flow creates no claim, approval, credential, recipient package, or
-* authenticator prompt. Unlocking is the user's explicit act on the wallet
-* surface — never a side effect of scanning a QR.
-*/
-function walletUnlockRequiredV1() {
-	return new DeviceLinkingError("wallet_unlock_required", DeviceLinkingErrorCode.WALLET_UNLOCK_REQUIRED, "authorization");
-}
-async function authorizeOwnerForLinkingV1(context, input) {
-	const state = context.readWalletAuthenticationState();
-	if (state.kind !== "authenticated") throw walletUnlockRequiredV1();
-	await awaitNearProvisioningInFlight(state.walletId);
-	const session = await requireActiveWalletSessionForSelectedMethodV1(context, state.walletId);
-	const response = await requestWithExactSessionV1(context, session, {
-		method: "POST",
-		canonicalPath: OWNER_AUTHORIZATION_PATH,
-		body: parseLinkedDeviceOwnerAuthorizationRequestV1({
-			payload: input.payload,
-			requestedAtMs: input.requestedAtMs
-		})
-	});
-	if (response.status < 200 || response.status >= 300) throw new Error(ownerRequestFailureMessage(response));
-	const parsed = parseOwnerAuthorizationResponseV1(response.body, session);
-	const exportRootRequired = hasDelegatedWalletPermissionV1(input.payload.requestedPermission, "export_keys") && parsed.sourceSignerManifest.keyFamilies.some((family) => family === "ed25519");
-	const ed25519ExportRootCapability = exportRootRequired ? context.readUnlockedEd25519ExportRootCapabilityV1(state.walletId) : void 0;
-	if (exportRootRequired && (!ed25519ExportRootCapability || ed25519ExportRootCapability.walletId !== String(state.walletId) || ed25519ExportRootCapability.walletSessionId !== String(session.operationCredential.walletSessionId) || ed25519ExportRootCapability.expiresAtMs <= Date.now())) throw walletUnlockRequiredV1();
-	if (exportRootRequired) {
-		if (!ed25519ExportRootCapability) throw walletUnlockRequiredV1();
-		return {
-			...parsed,
-			exportRootRequirement: "required",
-			ed25519ExportRootCapability
-		};
-	}
-	return {
-		...parsed,
-		exportRootRequirement: "not_required"
-	};
-}
-async function requestAsAuthorizedOwnerV1(context, input) {
-	if (input.authentication.source.kind !== "wallet_session") throw new Error("Wallet-host device linking requires a reusable owner Wallet Session");
-	const state = context.readWalletAuthenticationState();
-	if (state.kind !== "authenticated") throw walletUnlockRequiredV1();
-	const session = await requireActiveWalletSessionForSelectedMethodV1(context, state.walletId);
-	if (input.authentication.source.walletSessionId !== session.operationCredential.walletSessionId || input.authentication.source.authorizationId !== session.record.authorizationId) throw new Error("Owner Wallet Session identity changed after authorization");
-	return await requestWithExactSessionV1(context, session, input);
-}
-async function requestManagementAsOwnerV1(context, input) {
-	return await requestWithExactSessionV1(context, await requireActiveWalletSessionForSelectedMethodV1(context, input.walletId), input);
-}
-async function requireActiveWalletSessionForSelectedMethodV1(context, walletId) {
-	const selected = await context.resolveSelectedWalletAuthority(walletId);
-	if (selected.kind !== "resolved") throw walletUnlockRequiredV1();
-	const { selection, authMethod, authority } = selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== walletId || authMethod.walletAuthorityId !== authority.authorityId || authMethod.status !== "active" || authority.walletId !== walletId || authority.state !== "active") throw walletUnlockRequiredV1();
-	const read = await context.walletSessions.readExactWithOperationCredential({
-		walletId,
-		authorityId: authority.authorityId,
-		authMethodId: authMethod.walletAuthMethodId
-	});
-	switch (read.kind) {
-		case "found": break;
-		case "missing": throw walletUnlockRequiredV1();
-		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError("Stored owner Wallet Session requires a newer client");
-		default: throw new Error("Unsupported owner Wallet Session read result");
-	}
-	if (read.record.authorityDigestB64u !== authority.authorityDigestB64u || read.record.authorityRevocationEpoch !== authority.revocationEpoch || read.record.expiresAtMs <= Date.now()) throw walletUnlockRequiredV1();
-	return read;
-}
-async function requestWithExactSessionV1(context, session, input) {
-	return await requestWithCredentialV1(context, session.operationCredential.token, input);
-}
-async function requestWithCredentialV1(context, walletSessionToken, input) {
-	const response = await context.http.request({
-		method: input.method,
-		url: `${context.baseUrl}${input.canonicalPath}`,
-		headers: { authorization: `Bearer ${walletSessionToken}` },
-		...input.body === void 0 ? {} : { body: input.body }
-	});
-	if (!response.ok) throw new WalletHostOwnerRequestTransportError(response.code, response.message);
-	return response.value;
-}
-function parseOwnerAuthorizationResponseV1(raw, session) {
-	const record = parseWalletHostOwnerAuthorizationResponseRecordV1(raw);
-	const authenticationRecord = parseWalletHostOwnerAuthorizationAuthenticationRecordV1(record.authentication);
-	if (authenticationRecord.kind !== "link_session_authenticated_request_v1") throw new Error("Owner authorization authentication kind is invalid");
-	const source = parseLinkedDeviceOwnerAuthorizationSourceV1(authenticationRecord.source);
-	const ownerAuthorization = parseLinkedDeviceOwnerAuthorizationSourceV1(record.ownerAuthorization);
-	assertWalletSessionSourceMatchesExactSession(source, session);
-	assertSameOwnerAuthorization(source, ownerAuthorization);
-	const authentication = {
-		kind: "link_session_authenticated_request_v1",
-		source,
-		proofDigestB64u: parseDigestB64u(authenticationRecord.proofDigestB64u)
-	};
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok || walletId.value !== session.record.walletId) throw new Error("Owner authorization wallet identity changed");
-	return {
-		authentication,
-		walletId: walletId.value,
-		ownerAuthorization,
-		sourceSignerManifest: parseExactAdministeredSignerManifestV1(record.sourceSignerManifest),
-		expiresAtMs: positiveSafeInteger(record.expiresAtMs, "expiresAtMs")
-	};
-}
-function assertWalletSessionSourceMatchesExactSession(source, session) {
-	if (source.kind !== "wallet_session") throw new Error("Owner authorization did not return a Wallet Session source");
-	if (source.walletSessionId !== session.operationCredential.walletSessionId) throw new Error("Owner authorization Wallet Session id changed");
-	if (source.authorizationId !== session.record.authorizationId) throw new Error("Owner authorization id changed");
-}
-function assertSameOwnerAuthorization(left, right) {
-	if (left.kind !== "wallet_session" || right.kind !== "wallet_session" || left.walletSessionId !== right.walletSessionId || left.authorizationId !== right.authorizationId) throw new Error("Owner authorization source changed");
-}
-function parseWalletHostOwnerAuthorizationResponseRecordV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Owner authorization response must be an object");
-	if (!isWalletHostOwnerAuthorizationResponseRecordV1(raw)) throw new Error("Owner authorization response has unexpected fields");
-	return raw;
-}
-function isWalletHostOwnerAuthorizationResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "authentication|expiresAtMs|ownerAuthorization|sourceSignerManifest|walletId";
-}
-function parseWalletHostOwnerAuthorizationAuthenticationRecordV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("Owner authorization response must be an object");
-	if (!isWalletHostOwnerAuthorizationAuthenticationRecordV1(raw)) throw new Error("Owner authorization response has unexpected fields");
-	return raw;
-}
-function isWalletHostOwnerAuthorizationAuthenticationRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "kind|proofDigestB64u|source";
-}
-function ownerRequestFailureMessage(response) {
-	const message = parseOwnerRequestFailureMessage(response.body);
-	if (message) return `Owner authorization failed: ${message}`;
-	return `Owner authorization failed with HTTP ${response.status}`;
-}
-function parseOwnerRequestFailureMessage(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (!isOwnerRequestFailureRecordV1(raw)) return null;
-	if (raw.ok !== false || typeof raw.code !== "string") return null;
-	return typeof raw.message === "string" && raw.message.trim() ? raw.message : null;
-}
-function isOwnerRequestFailureRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "code|message|ok";
-}
-function positiveSafeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return Number(raw);
-}
-//#endregion
-export { WalletHostOwnerRequestTransportError, createWalletHostOwnerAuthoritiesV1 };
-
-//# sourceMappingURL=walletHostOwnerAuthority.js.map

package/dist/esm/react/SeamsWeb/operations/evm/index.js

@@ -1,35 +0,0 @@
-//#region src/SeamsWeb/operations/evm/index.ts
-function buildEvmWalletRegistrationArgs(args) {
-	if (!args.chainTargets.length) throw new Error("[SeamsWeb][evm] registerEvmWallet requires at least one chain target");
-	if (!args.participantIds.length) throw new Error("[SeamsWeb][evm] registerEvmWallet requires participant ids");
-	if (!args.authMethod) throw new Error("[SeamsWeb][evm] registerEvmWallet requires an explicit authMethod");
-	return {
-		wallet: { kind: "server_allocated" },
-		authMethod: args.authMethod,
-		signerSelection: {
-			kind: "signer_set",
-			signers: [{
-				kind: "evm_family_ecdsa",
-				chainTargets: [...args.chainTargets],
-				participantIds: [...args.participantIds]
-			}]
-		},
-		options: args.options || {}
-	};
-}
-function buildEvmBootstrapArgs(configs, args) {
-	const managedRegistration = configs.registration.mode === "managed" ? configs.registration : null;
-	const runtimeScopeBootstrap = args.runtimeScopeBootstrap || (managedRegistration ? {
-		projectEnvironmentId: managedRegistration.projectEnvironmentId,
-		publishableKey: managedRegistration.publishableKey
-	} : void 0);
-	if (args.chainTarget.kind !== "evm") throw new Error("[SeamsWeb][evm] bootstrapEcdsaSession requires an EVM chainTarget");
-	return {
-		...args,
-		...runtimeScopeBootstrap ? { runtimeScopeBootstrap } : {}
-	};
-}
-//#endregion
-export { buildEvmBootstrapArgs, buildEvmWalletRegistrationArgs };
-
-//# sourceMappingURL=index.js.map