@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.js

@@ -1,191 +0,0 @@
-import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { requestWalletCustodyCeremonyOperation } from "../../../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
-import { redactCredentialExtensionOutputs } from "../../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { toError } from "../../../../shared-ts/src/utils/errors.js";
-import { computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { copyWalletCustodyEcdsaContinuityToAuthMethod } from "../../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
-import { createWalletAddAuthMethodIntent, requestAddAuthMethodEmailOtpChallenge } from "../../../../core/rpcClients/relayer/walletRegistration.js";
-import { IndexedDBManager } from "../../../../core/indexedDB/index.js";
-import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../passkey/ecdsaBootstrap.js";
-import { resolveManagedRuntimeScopeBootstrap } from "../../../../core/config/managedRuntimeScope.js";
-import { collectEmailOtpRegistrationAuthority } from "./registrationAuthority.js";
-import { resolveAddAuthMethodSourceClaimV1 } from "../addAuthMethodSourceClaim.js";
-import { addAuthMethodSourcePasskeyAllowCredentials } from "../sourcePasskeyProof.js";
-import { linkWalletEmailOtpCustody } from "../../../../core/signingEngine/walletCustody/emailOtpLink.js";
-import { persistFinalizedEmailOtpAuthMethodV1 } from "./localEmailOtpProjection.js";
-//#region src/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.ts
-function walletCustodyWorkerTransport(context) {
-	const workerContext = context.signingEngine.getSignerWorkerContext();
-	return { requestOperation: requestWalletCustodyCeremonyOperation.bind(void 0, workerContext) };
-}
-/**
-* The provider identity an added Email OTP method enrols under.
-*
-* There is no external IdP on this branch — the address is verified by the
-* one-use code, so the address is the identity. Google-backed additions arrive
-* through their own proof kind and carry the Google subject instead.
-*/
-function providerSubjectForVerifiedAddress(emailAddress) {
-	return emailAddress;
-}
-function normalizedEmailAddress(value) {
-	const email = String(value || "").trim().toLowerCase();
-	if (!email || !email.includes("@")) throw new Error("registration.addEmailOtp requires an email address");
-	return email;
-}
-async function addEmailOtpWalletAuthMethodInternal(args) {
-	const relayerUrl = String(args.context.configs.network.relayer.url || "").trim();
-	if (!relayerUrl) throw new Error("registration.addEmailOtp requires relayer.url");
-	const managedRuntimeScope = resolveManagedRuntimeScopeBootstrap(args.context.configs);
-	if (!managedRuntimeScope) throw new Error("registration.addEmailOtp requires registration.publishableKey and registration.projectEnvironmentId");
-	const emailAddress = normalizedEmailAddress(args.emailAddress);
-	const providerSubject = providerSubjectForVerifiedAddress(emailAddress);
-	const parsedRpId = parseWebAuthnRpId(String(args.context.signingEngine.getRpId() || "").trim());
-	if (!parsedRpId.ok) throw new Error(`registration.addEmailOtp ${parsedRpId.error.message}`);
-	const rpId = parsedRpId.value;
-	const sourceClaim = await resolveAddAuthMethodSourceClaimV1(args.walletId);
-	if (sourceClaim.kind !== "resolved") throw new Error(`Wallet add-email-code requires a selected active source: ${sourceClaim.reason}`);
-	if (sourceClaim.sourceAuthMethod.kind !== "passkey") throw new Error("Wallet add-email-code requires a selected active passkey source");
-	const intentResponse = await createWalletAddAuthMethodIntent({
-		relayerUrl,
-		walletId: args.walletId,
-		request: {
-			walletId: args.walletId,
-			rpId: String(rpId),
-			authMethod: {
-				kind: "email_otp",
-				email: emailAddress
-			},
-			caller: {
-				caller: "same_device_addition",
-				source: sourceClaim.source
-			}
-		},
-		auth: {
-			publishableKey: managedRuntimeScope.publishableKey,
-			environmentId: managedRuntimeScope.projectEnvironmentId
-		}
-	});
-	if (await computeAddAuthMethodIntentDigestB64u(intentResponse.intent) !== intentResponse.addAuthMethodIntentDigestB64u) throw new Error("Add-auth-method intent digest mismatch");
-	if (intentResponse.intent.walletId !== args.walletId || intentResponse.intent.authMethod.kind !== "email_otp" || intentResponse.intent.authMethod.email !== emailAddress) throw new Error("Add-auth-method intent identity changed");
-	const profile = await IndexedDBManager.getProfile(String(args.walletId));
-	if (!profile || !Number.isSafeInteger(profile.defaultSignerSlot) || profile.defaultSignerSlot < 1) throw new Error("Wallet add-email-code requires an initialized wallet profile");
-	const allowCredentials = addAuthMethodSourcePasskeyAllowCredentials(sourceClaim.sourceAuthMethod);
-	const credential = await args.context.signingEngine.getAuthenticationCredentialsSerialized({
-		subjectId: String(args.walletId),
-		challengeB64u: intentResponse.addAuthMethodIntentDigestB64u,
-		allowCredentials,
-		includeSecondPrfOutput: false
-	});
-	const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(credential);
-	if (!credentialIdB64u || !allowCredentials.some((allowed) => allowed.id === credentialIdB64u)) throw new Error("Wallet add-email-code selected a credential outside the authorized wallet");
-	const passkeyPrfFirstB64u = requirePasskeyPrfFirstB64u(credential, "Wallet add-email-code custody linking");
-	const sendEnrollmentCode = async () => await requestAddAuthMethodEmailOtpChallenge({
-		relayerUrl,
-		walletId: args.walletId,
-		addAuthMethodIntentGrant: intentResponse.addAuthMethodIntentGrant,
-		addAuthMethodIntentDigestB64u: intentResponse.addAuthMethodIntentDigestB64u
-	});
-	const sent = await sendEnrollmentCode();
-	const confirmed = await args.context.signingEngine.requestEmailOtpEnrollmentConfirmation({
-		walletId: String(args.walletId),
-		emailAddress,
-		challengeId: sent.challengeId,
-		...sent.emailHint ? { emailHint: sent.emailHint } : {},
-		...args.options?.confirmerText ? { confirmerText: args.options.confirmerText } : {},
-		...args.options?.confirmationConfig ? { confirmationConfigOverride: args.options.confirmationConfig } : {},
-		onResend: sendEnrollmentCode
-	});
-	const emailAuthority = await collectEmailOtpRegistrationAuthority({
-		authMethod: {
-			kind: "email_otp",
-			proofKind: "otp_challenge",
-			email: emailAddress,
-			providerSubject,
-			otpCode: confirmed.otpCode,
-			challengeId: confirmed.challengeId
-		},
-		relayUrl: relayerUrl,
-		walletId: String(args.walletId),
-		registrationIntentDigestB64u: intentResponse.addAuthMethodIntentDigestB64u
-	});
-	const existingFactorSecret = base64UrlDecode(passkeyPrfFirstB64u);
-	try {
-		const linked = await linkWalletEmailOtpCustody({
-			context: args.context,
-			relayerUrl,
-			walletId: args.walletId,
-			addAuthMethodIntentGrant: intentResponse.addAuthMethodIntentGrant,
-			addAuthMethodIntentDigestB64u: intentResponse.addAuthMethodIntentDigestB64u,
-			intent: intentResponse.intent,
-			auth: {
-				kind: "webauthn_assertion",
-				rpId,
-				credential: redactCredentialExtensionOutputs(credential),
-				expectedChallengeDigestB64u: intentResponse.addAuthMethodIntentDigestB64u
-			},
-			authority: {
-				kind: "email_otp",
-				emailOtpRegistrationProof: emailAuthority.proof
-			},
-			existingFactorSecret,
-			walletAuthMethodId: intentResponse.intent.targetWalletAuthMethodId,
-			providerSubject,
-			worker: walletCustodyWorkerTransport(args.context)
-		});
-		if (linked.finalized.walletId !== args.walletId || linked.finalized.authMethod.kind !== "email_otp" || linked.finalized.authMethod.status !== "active") throw new Error("Wallet add-email-code finalize returned a mismatched auth method");
-		await persistFinalizedEmailOtpAuthMethodV1({
-			walletId: args.walletId,
-			walletAuthMethodId: intentResponse.intent.targetWalletAuthMethodId,
-			walletAuthorityId: sourceClaim.source.walletAuthorityId,
-			emailAddress,
-			authority: linked.finalized.authority
-		});
-		await copyWalletCustodyEcdsaContinuityToAuthMethod({
-			walletId: args.walletId,
-			walletAuthorityId: sourceClaim.source.walletAuthorityId,
-			sourceWalletAuthMethodId: sourceClaim.source.walletAuthMethodId,
-			targetAuthority: await walletAuthAuthorityRef({ authority: linked.finalized.authority })
-		});
-		return {
-			ok: true,
-			walletId: args.walletId,
-			emailAddress,
-			walletAuthMethodId: intentResponse.intent.targetWalletAuthMethodId,
-			authMethod: {
-				kind: "email_otp",
-				status: "active"
-			}
-		};
-	} finally {
-		existingFactorSecret.fill(0);
-	}
-}
-async function addEmailOtpWalletAuthMethod(args) {
-	const walletId = walletIdFromString(String(args.walletId || "").trim());
-	try {
-		const result = await addEmailOtpWalletAuthMethodInternal({
-			context: args.context,
-			walletId,
-			emailAddress: args.emailAddress,
-			options: args.options
-		});
-		await args.options?.afterCall?.(true, result);
-		return result;
-	} catch (error) {
-		const normalized = toError(error);
-		try {
-			args.options?.onError?.(normalized);
-		} finally {
-			await args.options?.afterCall?.(false);
-		}
-		throw normalized;
-	}
-}
-//#endregion
-export { addEmailOtpWalletAuthMethod };
-
-//# sourceMappingURL=addEmailOtp.js.map

package/dist/esm/SeamsWeb/operations/authMethods/emailOtp/challenge.js

@@ -1,247 +0,0 @@
-import { joinNormalizedUrl } from "../../../../shared-ts/src/utils/normalize.js";
-import { requireTrimmedString, toOptionalTrimmedNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseEmailOtpChallengeDelivery } from "../../../../core/signingEngine/session/emailOtp/challengeDelivery.js";
-import { buildEmailOtpRoutePlan } from "../../../../core/signingEngine/stepUpConfirmation/otpPrompt/authLane.js";
-import { parseEmailOtpUnlockEd25519Identity, parseEmailOtpUnlockEd25519Selection } from "../../../../core/signingEngine/session/emailOtp/publicTypes.js";
-//#region src/SeamsWeb/operations/authMethods/emailOtp/challenge.ts
-function parseEmailOtpUnlockSignerSelection(value) {
-	const record = requireObjectJson(value, "wallet/email-otp/challenge signerSelection");
-	if (record.kind === "ed25519_only") return {
-		kind: "ed25519_only",
-		...parseEmailOtpUnlockEd25519Identity(record)
-	};
-	if (record.kind !== "ecdsa") throw new Error("wallet/email-otp/challenge signerSelection kind is invalid");
-	return {
-		kind: "ecdsa",
-		keyHandle: readString(record.keyHandle, "wallet/email-otp/challenge keyHandle"),
-		runtimePolicyScope: normalizeRuntimePolicyScope(record.runtimePolicyScope),
-		ed25519: parseEmailOtpUnlockEd25519Selection(record.ed25519)
-	};
-}
-var EmailOtpRouteError = class extends Error {
-	constructor(input) {
-		super(input.message);
-		this.name = "EmailOtpRouteError";
-		const code = readOptionalString(input.code);
-		if (code) this.code = code;
-		this.status = input.status;
-		const retryAfterMs = Number(input.retryAfterMs);
-		if (Number.isFinite(retryAfterMs) && retryAfterMs >= 0) this.retryAfterMs = Math.floor(retryAfterMs);
-		const resetAtMs = Number(input.resetAtMs);
-		if (Number.isFinite(resetAtMs) && resetAtMs >= 0) this.resetAtMs = Math.floor(resetAtMs);
-	}
-};
-function requireFetchImpl(fetchImpl) {
-	const resolved = fetchImpl || globalThis.fetch;
-	if (typeof resolved !== "function") throw new Error("fetch is unavailable in this runtime");
-	return resolved;
-}
-function requireObjectJson(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} returned invalid JSON`);
-	return value;
-}
-function readString(value, label) {
-	return requireTrimmedString(value, label);
-}
-function readOptionalString(value) {
-	return toOptionalTrimmedNonEmptyString(value);
-}
-function buildAuthHeaders(args) {
-	const headers = { "Content-Type": "application/json" };
-	const token = String(args.publishableKey || "").trim();
-	if (token) headers.Authorization = `Bearer ${token}`;
-	return headers;
-}
-function buildWorkerEmailOtpRoutePlan(args) {
-	if (args.routeFamily === "registration") return buildEmailOtpRoutePlan({
-		routeFamily: "registration",
-		operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
-	});
-	return buildEmailOtpRoutePlan({
-		routeFamily: "login",
-		operation: args.operation ?? "wallet_unlock"
-	});
-}
-function requireEmailOtpChallengeAction(args) {
-	const action = readOptionalString(args.challenge.action);
-	if (action && action !== args.expectedAction) throw new Error(`${args.context} returned ${action}; expected ${args.expectedAction}`);
-}
-async function postJson(args) {
-	const response = await requireFetchImpl(args.fetchImpl)(args.url, {
-		method: "POST",
-		headers: buildAuthHeaders({ publishableKey: args.publishableKey }),
-		credentials: "include",
-		body: JSON.stringify(args.body)
-	});
-	const text = await response.text();
-	let json = null;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`${args.url} returned non-JSON response (HTTP ${response.status})`);
-	}
-	const objectJson = requireObjectJson(json, args.url);
-	if (!response.ok || objectJson.ok === false) throw new EmailOtpRouteError({
-		message: typeof objectJson.message === "string" && objectJson.message.trim() || `${args.url} failed (HTTP ${response.status})`,
-		status: response.status,
-		code: objectJson.code,
-		retryAfterMs: objectJson.retryAfterMs,
-		resetAtMs: objectJson.resetAtMs
-	});
-	return objectJson;
-}
-async function resolveGoogleEmailOtpProvider(args) {
-	if (args.restartRegistrationOffer === true && args.accountMode !== "register") throw new Error("restartRegistrationOffer is only valid with register account mode");
-	const response = await postJson({
-		url: joinNormalizedUrl(args.relayUrl, "/auth/google/verify"),
-		fetchImpl: args.fetchImpl,
-		publishableKey: readString(args.publishableKey, "publishableKey"),
-		body: {
-			id_token: readString(args.idToken, "idToken"),
-			account_mode: args.accountMode,
-			project_environment_id: readString(args.projectEnvironmentId, "projectEnvironmentId"),
-			...args.loginWalletId ? { wallet_id: readString(args.loginWalletId, "loginWalletId") } : {},
-			...args.restartRegistrationOffer === true ? { restart_registration_offer: true } : {}
-		}
-	});
-	const mode = readString(response.mode, "auth/google/verify mode");
-	const walletId = readString(response.walletId, "auth/google/verify walletId");
-	const providerSubject = readString(response.providerSubject, "auth/google/verify providerSubject");
-	const email = readOptionalString(response.email);
-	if (mode === "existing_wallet") {
-		if (response.hasEmailOtpEnrollment !== true) throw new Error("auth/google/verify existing wallet is missing Email OTP enrollment");
-		if (!email) throw new Error("auth/google/verify existing wallet is missing email");
-		return {
-			mode,
-			walletId,
-			providerSubject,
-			email,
-			hasEmailOtpEnrollment: true
-		};
-	}
-	if (mode !== "register_started") throw new Error(`auth/google/verify returned unsupported mode: ${mode}`);
-	if (!email) throw new Error("auth/google/verify registration is missing email");
-	const offer = requireObjectJson(response.offer, "auth/google/verify offer");
-	const candidates = (Array.isArray(offer.candidates) ? offer.candidates : []).map(parseGoogleEmailOtpProviderCandidate);
-	const firstCandidate = candidates[0];
-	if (!firstCandidate) throw new Error("auth/google/verify offer has no wallet candidates");
-	return {
-		mode,
-		walletId,
-		providerSubject,
-		email,
-		registrationAttemptId: readString(response.registrationAttemptId, "auth/google/verify registrationAttemptId"),
-		expiresAtMs: requireFutureTimestamp(response.expiresAtMs, "auth/google/verify expiresAtMs"),
-		offer: {
-			offerId: readString(offer.offerId, "auth/google/verify offer.offerId"),
-			selectedCandidateId: readString(offer.selectedCandidateId, "auth/google/verify offer.selectedCandidateId"),
-			candidates: [firstCandidate, ...candidates.slice(1)]
-		}
-	};
-}
-function parseGoogleEmailOtpProviderCandidate(value) {
-	const candidate = requireObjectJson(value, "auth/google/verify offer candidate");
-	return {
-		candidateId: readString(candidate.candidateId, "offer candidate candidateId"),
-		walletId: readString(candidate.walletId, "offer candidate walletId")
-	};
-}
-function requireFutureTimestamp(value, label) {
-	const timestamp = Number(value);
-	if (!Number.isSafeInteger(timestamp) || timestamp <= Date.now()) throw new Error(`${label} must be a future timestamp`);
-	return timestamp;
-}
-async function requestEmailOtpChallenge(args) {
-	const operation = args.operation ?? "wallet_unlock";
-	if (!args.fetchImpl && args.workerCtx) return await args.workerCtx.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "requestEmailOtpChallenge",
-			payload: {
-				relayUrl: readString(args.relayUrl, "relayUrl"),
-				walletId: readString(args.walletId, "walletId"),
-				...args.walletAuthMethodId ? { walletAuthMethodId: readString(args.walletAuthMethodId, "walletAuthMethodId") } : {},
-				routePlan: buildWorkerEmailOtpRoutePlan({
-					routeFamily: "login",
-					operation
-				}),
-				otpChannel: EMAIL_OTP_CHANNEL,
-				...args.operationFingerprintDigest ? { operationFingerprintDigest: args.operationFingerprintDigest } : {}
-			}
-		}
-	});
-	const response = await postJson({
-		url: joinNormalizedUrl(args.relayUrl, "/wallet/email-otp/challenge"),
-		fetchImpl: args.fetchImpl,
-		body: {
-			walletId: readString(args.walletId, "walletId"),
-			...args.walletAuthMethodId ? { walletAuthMethodId: readString(args.walletAuthMethodId, "walletAuthMethodId") } : {},
-			otpChannel: args.otpChannel || "email_otp",
-			operation,
-			...args.operationFingerprintDigest ? { operationFingerprintDigest: args.operationFingerprintDigest } : {}
-		}
-	});
-	const challenge = requireObjectJson(response.challenge, "wallet/email-otp/challenge");
-	requireEmailOtpChallengeAction({
-		challenge,
-		expectedAction: WALLET_EMAIL_OTP_ACTIONS.login,
-		context: "wallet/email-otp/challenge"
-	});
-	const delivery = parseEmailOtpChallengeDelivery(response.delivery, "wallet/email-otp/challenge delivery");
-	const expiresAtMs = Number(challenge.expiresAtMs);
-	const result = {
-		challengeId: readString(challenge.challengeId, "wallet/email-otp/challenge challengeId"),
-		otpChannel: EMAIL_OTP_CHANNEL,
-		delivery,
-		emailHint: delivery.emailHint,
-		ownerProofBindingDigest: readString(challenge.ownerProofBindingDigest, "wallet/email-otp/challenge ownerProofBindingDigest"),
-		walletAuthMethodId: readString(response.walletAuthMethodId, "wallet/email-otp/challenge walletAuthMethodId"),
-		signerSelection: parseEmailOtpUnlockSignerSelection(response.signerSelection)
-	};
-	if (Number.isFinite(expiresAtMs)) result.expiresAtMs = expiresAtMs;
-	return result;
-}
-async function requestEmailOtpEnrollmentChallenge(args) {
-	if (!args.fetchImpl && args.workerCtx) return await args.workerCtx.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "requestEmailOtpEnrollmentChallenge",
-			payload: {
-				relayUrl: readString(args.relayUrl, "relayUrl"),
-				walletId: readString(args.walletId, "walletId"),
-				routePlan: buildWorkerEmailOtpRoutePlan({ routeFamily: "registration" }),
-				otpChannel: EMAIL_OTP_CHANNEL
-			}
-		}
-	});
-	const response = await postJson({
-		url: joinNormalizedUrl(args.relayUrl, "/wallet/email-otp/registration/challenge"),
-		fetchImpl: args.fetchImpl,
-		body: {
-			walletId: readString(args.walletId, "walletId"),
-			otpChannel: args.otpChannel || "email_otp"
-		}
-	});
-	const challenge = requireObjectJson(response.challenge, "wallet/email-otp/registration/challenge");
-	requireEmailOtpChallengeAction({
-		challenge,
-		expectedAction: WALLET_EMAIL_OTP_ACTIONS.registration,
-		context: "wallet/email-otp/registration/challenge"
-	});
-	const delivery = parseEmailOtpChallengeDelivery(response.delivery, "wallet/email-otp/registration/challenge delivery");
-	const expiresAtMs = Number(challenge.expiresAtMs);
-	const result = {
-		challengeId: readString(challenge.challengeId, "wallet/email-otp/registration/challenge challengeId"),
-		otpChannel: EMAIL_OTP_CHANNEL,
-		delivery,
-		emailHint: delivery.emailHint
-	};
-	if (Number.isFinite(expiresAtMs)) result.expiresAtMs = expiresAtMs;
-	return result;
-}
-//#endregion
-export { requestEmailOtpChallenge, requestEmailOtpEnrollmentChallenge, resolveGoogleEmailOtpProvider };
-
-//# sourceMappingURL=challenge.js.map