@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/walletCustody/walletRecoveryRotation.js

@@ -1,102 +0,0 @@
-import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { issueWalletRecoveryCodes, zeroizeIssuedWalletRecoveryCodes } from "../../../shared-ts/src/wallet-recovery/recoveryCodeIssuance.js";
-import "../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
-import { deriveRecoveryCodeLocatorV1FromBytes } from "../../../shared-ts/src/wallet-recovery/recoveryCodeLocator.js";
-import { joinCustodyWireFromEnvelopeRecord } from "./joinCustodyWire.js";
-import { walletRecoverySetRotationWireFromWorkerResultV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryRotation.js";
-import { readWalletRecoveryCodeStatus, rotateWalletRecoverySet } from "../../rpcClients/relayer/walletRecoveryRotate.js";
-//#region src/core/signingEngine/walletCustody/walletRecoveryRotation.ts
-/**
-* Performs one active-factor recovery-set rotation. The worker opens the
-* existing custody envelope and reseals the same seed under a fresh manifest
-* KEK; this coordinator only transports opaque ciphertext and returns the
-* plaintext codes after the server's atomic CAS succeeds.
-*/
-async function rotateWalletRecoverySetWithActiveFactorV1(input) {
-	let issued = issueWalletRecoveryCodes();
-	const factorSecret = new Uint8Array(input.factorSecret.slice(0));
-	try {
-		return await rotateWithIssuedCodes(input, issued, (codeBytes) => {
-			const custody = joinCustodyWireFromEnvelopeRecord(input.custodyEnvelope);
-			if (!custody.ok) throw new Error(custody.reason);
-			return input.worker.rotateRecoverySet({
-				custodyJson: custody.custodyJson,
-				factorSecret: factorSecret.buffer.slice(0),
-				recoveryCodesJson: recoveryCodesJson(codeBytes)
-			});
-		});
-	} finally {
-		factorSecret.fill(0);
-		if (issued) zeroizeIssuedWalletRecoveryCodes(issued);
-		issued = null;
-	}
-}
-async function rotateWalletRecoverySetWithEmailOtpV1(input) {
-	let issued = issueWalletRecoveryCodes();
-	try {
-		return await rotateWithIssuedCodes(input, issued, (codeBytes) => input.worker.rotateRecoverySet({ recoveryCodesJson: recoveryCodesJson(codeBytes) }));
-	} finally {
-		if (issued) zeroizeIssuedWalletRecoveryCodes(issued);
-		issued = null;
-	}
-}
-async function rotateWithIssuedCodes(input, issued, rotateInWorker) {
-	const current = await readWalletRecoveryCodeStatus({
-		relayUrl: input.relayUrl,
-		walletId: input.walletId,
-		...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-	});
-	if (current.kind !== "ready") return current.kind === "unauthorized" ? {
-		kind: "transport_failed",
-		message: current.message
-	} : current;
-	const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await rotateInWorker(issued.codeBytes));
-	if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
-	const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
-	const rotated = await rotateWalletRecoverySet({
-		relayUrl: input.relayUrl,
-		walletId: input.walletId,
-		factorProof: await input.factorProof({
-			operation: "recovery_rotate",
-			payload: {
-				walletId: input.walletId,
-				expectedStoreVersion: current.storeVersion,
-				manifestKekWraps: replacement.manifestKekWraps,
-				entries: [replacement.entry],
-				recoveryCodeLocators
-			}
-		}),
-		expectedStoreVersion: current.storeVersion,
-		replacement,
-		recoveryCodeLocators,
-		...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-	});
-	if (rotated.kind !== "rotated") return rotated;
-	return {
-		kind: "rotated",
-		walletId: input.walletId,
-		recoveryCodes: issued.codes,
-		issuedAtMs: rotated.issuedAtMs,
-		storeVersion: rotated.storeVersion
-	};
-}
-function recoveryCodesJson(codeBytes) {
-	return JSON.stringify(codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) })));
-}
-async function deriveRecoveryCodeLocators(codeBytes, wraps) {
-	if (codeBytes.length !== wraps.length) throw new Error("Recovery code locators do not match the replacement wraps");
-	const recoveryCodeLocators = await Promise.all(codeBytes.map(async (bytes, index) => {
-		const wrap = wraps[index];
-		if (!wrap) throw new Error("Recovery code locators do not match the replacement wraps");
-		return {
-			locatorB64u: await deriveRecoveryCodeLocatorV1FromBytes(bytes),
-			recoveryKeyId: wrap.recoveryKeyId
-		};
-	}));
-	if (new Set(recoveryCodeLocators.map((locator) => locator.locatorB64u)).size !== recoveryCodeLocators.length) throw new Error("Recovery code locators must be unique");
-	return recoveryCodeLocators;
-}
-//#endregion
-export { rotateWalletRecoverySetWithActiveFactorV1, rotateWalletRecoverySetWithEmailOtpV1 };
-
-//# sourceMappingURL=walletRecoveryRotation.js.map

package/dist/esm/core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u.js

@@ -1,154 +0,0 @@
-import { toAccountId } from "../../../types/accountIds.js";
-import { buildNearAccountRefs } from "../../../accountData/near/accountRefs.js";
-import { resolveProfileAccountContextFromCandidates } from "../../../indexedDB/profileAccountProjection.js";
-//#region src/core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u.ts
-async function listActiveWalletPasskeyAuthenticators(args) {
-	const [authenticators, methods] = await Promise.all([args.credentialStore.listWalletPasskeyAuthenticators(args.walletId), args.credentialStore.listWalletAuthMethodsV2ForWallet(args.walletId)]);
-	const activeCredentialIds = /* @__PURE__ */ new Set();
-	for (const method of methods) if (method.kind === "passkey" && method.status === "active" && String(method.walletId) === args.walletId) activeCredentialIds.add(method.credentialIdB64u);
-	return authenticators.filter((authenticator) => activeCredentialIds.has(authenticator.credentialId));
-}
-function authenticatorsToAllowCredentials(authenticators) {
-	return authenticators.map((auth) => ({
-		id: String(auth.credentialId || ""),
-		type: "public-key",
-		transports: Array.isArray(auth.transports) ? auth.transports : []
-	}));
-}
-function canonicalWalletIdFromPasskeySigner(signer) {
-	if (String(signer.signerAuthMethod || "") !== "passkey") return "";
-	const walletId = String(signer.metadata?.walletId || "").trim();
-	const credentialId = String(signer.metadata?.passkeyCredentialRawId || "").trim();
-	return walletId && credentialId ? walletId : "";
-}
-async function resolveCanonicalWalletPasskeyContext(args) {
-	const signers = await args.credentialStore.listAccountSigners({
-		chainIdKey: args.chainIdKey,
-		accountAddress: args.accountAddress,
-		status: "active"
-	});
-	const walletIds = Array.from(new Set(signers.map(canonicalWalletIdFromPasskeySigner).filter(Boolean)));
-	if (walletIds.length === 0) throw new Error(`[multichain] no passkey signer found for account ${args.accountLabel}`);
-	if (walletIds.length > 1) throw new Error(`[multichain] multiple wallet identities found for account ${args.accountLabel}`);
-	const walletId = walletIds[0];
-	return {
-		walletId,
-		authenticators: await listActiveWalletPasskeyAuthenticators({
-			credentialStore: args.credentialStore,
-			walletId
-		})
-	};
-}
-async function collectFromAuthenticators(args) {
-	if (args.authenticators.length === 0) throw new Error(`[multichain] no passkeys found for account ${String(args.accountLabel)}`);
-	const authenticatorsForPrompt = (await args.credentialStore.selectProfileAuthenticatorsForPrompt({
-		profileId: args.profileId,
-		authenticators: args.authenticators,
-		accountLabel: String(args.accountLabel)
-	})).authenticatorsForPrompt;
-	if (authenticatorsForPrompt.length === 0) throw new Error(`[multichain] no passkey credential selected for account ${String(args.accountLabel)}`);
-	args.onBeforePrompt?.({
-		authenticators: args.authenticators,
-		authenticatorsForPrompt,
-		challengeB64u: args.challengeB64u
-	});
-	const allowCredentials = authenticatorsToAllowCredentials(authenticatorsForPrompt);
-	const serialized = await args.touchIdPrompt.getAuthenticationCredentialsSerializedForChallengeB64u({
-		subjectId: String(args.accountLabel),
-		challengeB64u: args.challengeB64u,
-		allowCredentials,
-		cancellation: args.cancellation,
-		includeSecondPrfOutput: args.includeSecondPrfOutput
-	});
-	const selected = await args.credentialStore.selectProfileAuthenticatorsForPrompt({
-		profileId: args.profileId,
-		authenticators: args.authenticators,
-		selectedCredentialRawId: serialized.rawId,
-		accountLabel: String(args.accountLabel)
-	});
-	if (selected?.wrongPasskeyError) throw new Error(String(selected.wrongPasskeyError));
-	return serialized;
-}
-async function collectFromExactAuthenticator(args) {
-	const credentialIdB64u = String(args.credentialIdB64u || "").trim();
-	if (!credentialIdB64u) throw new Error("[webauthn] exact passkey credential is required");
-	const credential = await args.touchIdPrompt.getAuthenticationCredentialsSerializedForChallengeB64u({
-		subjectId: String(args.accountLabel),
-		challengeB64u: args.challengeB64u,
-		allowCredentials: [{
-			id: credentialIdB64u,
-			type: "public-key",
-			transports: []
-		}],
-		cancellation: args.cancellation,
-		includeSecondPrfOutput: args.includeSecondPrfOutput
-	});
-	if (credential.rawId !== credentialIdB64u) throw new Error("[webauthn] authentication returned a different passkey credential");
-	return credential;
-}
-async function collectAuthenticationCredentialForExactNearChallengeB64u(args) {
-	const nearAccountId = toAccountId(args.nearAccountId);
-	return await collectFromExactAuthenticator({
-		touchIdPrompt: args.touchIdPrompt,
-		accountLabel: nearAccountId,
-		challengeB64u: args.challengeB64u,
-		credentialIdB64u: args.credentialIdB64u,
-		cancellation: args.cancellation,
-		includeSecondPrfOutput: args.includeSecondPrfOutput
-	});
-}
-async function collectAuthenticationCredentialForExactWalletChallengeB64u(args) {
-	const walletId = String(args.walletId || "").trim();
-	return await collectFromExactAuthenticator({
-		touchIdPrompt: args.touchIdPrompt,
-		accountLabel: walletId,
-		challengeB64u: args.challengeB64u,
-		credentialIdB64u: args.credentialIdB64u,
-		cancellation: args.cancellation,
-		includeSecondPrfOutput: args.includeSecondPrfOutput
-	});
-}
-async function collectAuthenticationCredentialForChallengeB64u(args) {
-	const nearAccountId = toAccountId(args.nearAccountId);
-	const context = await resolveProfileAccountContextFromCandidates(args.credentialStore, buildNearAccountRefs(nearAccountId));
-	if (!context?.profileId) throw new Error(`[multichain] no profile/account mapping found for account ${nearAccountId}`);
-	const passkeyContext = await resolveCanonicalWalletPasskeyContext({
-		credentialStore: args.credentialStore,
-		chainIdKey: context.accountRef.chainIdKey,
-		accountAddress: context.accountRef.accountAddress,
-		accountLabel: nearAccountId
-	});
-	return await collectFromAuthenticators({
-		credentialStore: args.credentialStore,
-		touchIdPrompt: args.touchIdPrompt,
-		profileId: passkeyContext.walletId,
-		accountLabel: nearAccountId,
-		authenticators: passkeyContext.authenticators,
-		challengeB64u: args.challengeB64u,
-		cancellation: args.cancellation,
-		...args.onBeforePrompt ? { onBeforePrompt: args.onBeforePrompt } : {},
-		...typeof args.includeSecondPrfOutput === "boolean" ? { includeSecondPrfOutput: args.includeSecondPrfOutput } : {}
-	});
-}
-async function collectAuthenticationCredentialForWalletChallengeB64u(args) {
-	const walletId = String(args.walletId || "").trim();
-	const authenticators = await listActiveWalletPasskeyAuthenticators({
-		credentialStore: args.credentialStore,
-		walletId
-	});
-	return await collectFromAuthenticators({
-		credentialStore: args.credentialStore,
-		touchIdPrompt: args.touchIdPrompt,
-		profileId: walletId,
-		accountLabel: walletId,
-		authenticators,
-		challengeB64u: args.challengeB64u,
-		cancellation: args.cancellation,
-		...args.onBeforePrompt ? { onBeforePrompt: args.onBeforePrompt } : {},
-		...typeof args.includeSecondPrfOutput === "boolean" ? { includeSecondPrfOutput: args.includeSecondPrfOutput } : {}
-	});
-}
-//#endregion
-export { collectAuthenticationCredentialForChallengeB64u, collectAuthenticationCredentialForExactNearChallengeB64u, collectAuthenticationCredentialForExactWalletChallengeB64u, collectAuthenticationCredentialForWalletChallengeB64u };
-
-//# sourceMappingURL=collectAuthenticationCredentialForChallengeB64u.js.map

package/dist/esm/core/signingEngine/webauthnAuth/device/signerSlot.js

@@ -1,25 +0,0 @@
-import { toAccountId } from "../../../types/accountIds.js";
-import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
-import { buildNearAccountRefs } from "../../../accountData/near/accountRefs.js";
-import { resolveProfileAccountContextFromCandidates } from "../../../indexedDB/profileAccountProjection.js";
-//#region src/core/signingEngine/webauthnAuth/device/signerSlot.ts
-/**
-* Return the active signer slot for the last logged-in user for the given
-* account. This uses the app-state "last user" pointer only; if it does not
-* match the requested account, an error is thrown instead of silently falling
-* back.
-*/
-async function getLastLoggedInSignerSlot(nearAccountId, clientDB) {
-	const accountId = toAccountId(nearAccountId);
-	const context = await resolveProfileAccountContextFromCandidates(clientDB, buildNearAccountRefs(accountId)).catch(() => null);
-	if (!context?.profileId) throw new Error(`No profile/account mapping for account ${accountId}`);
-	const lastProfile = await clientDB.getLastProfileState().catch(() => null);
-	if (!lastProfile?.profileId || lastProfile.profileId !== context.profileId) throw new Error(`No last user session for account ${accountId}`);
-	const signerSlot = parseSignerSlot(lastProfile.activeSignerSlot, { min: 1 });
-	if (signerSlot === null) throw new Error(`Invalid last-user signerSlot for account ${accountId}`);
-	return signerSlot;
-}
-//#endregion
-export { getLastLoggedInSignerSlot };
-
-//# sourceMappingURL=signerSlot.js.map

package/dist/esm/core/signingEngine/webauthnAuth/walletOriginWebAuthn.js

@@ -1,109 +0,0 @@
-//#region src/core/signingEngine/webauthnAuth/walletOriginWebAuthn.ts
-var WalletOriginWebAuthnUnavailableError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.code = "wallet_origin_webauthn_unavailable";
-		this.name = "WalletOriginWebAuthnUnavailableError";
-	}
-};
-async function executeWalletOriginWebAuthn(kind, publicKey, deps) {
-	const publicKeyForAttempt = clonePublicKeyOptions(kind, publicKey);
-	try {
-		if (kind === "create") return await navigator.credentials.create({
-			publicKey: publicKeyForAttempt,
-			...deps.abortSignal ? { signal: deps.abortSignal } : {}
-		});
-		return await navigator.credentials.get({
-			publicKey: publicKeyForAttempt,
-			...deps.abortSignal ? { signal: deps.abortSignal } : {}
-		});
-	} catch (error) {
-		if (kind === "create" && (isAncestorOriginError(error) || isDocumentNotFocusedError(error))) throw new WalletOriginWebAuthnUnavailableError(`Wallet-origin WebAuthn registration is unavailable: ${safeMessage(error)}`);
-		throw error;
-	}
-}
-function clonePublicKeyOptions(kind, publicKey) {
-	return kind === "create" ? cloneCreationOptions(publicKey) : cloneRequestOptions(publicKey);
-}
-function cloneCreationOptions(publicKey) {
-	return {
-		...publicKey,
-		challenge: cloneBufferSource(publicKey.challenge),
-		user: {
-			...publicKey.user,
-			id: cloneBufferSource(publicKey.user.id)
-		},
-		excludeCredentials: publicKey.excludeCredentials?.map(cloneCredentialDescriptor),
-		extensions: cloneCredentialExtensions(publicKey.extensions)
-	};
-}
-function cloneRequestOptions(publicKey) {
-	return {
-		...publicKey,
-		challenge: cloneBufferSource(publicKey.challenge),
-		allowCredentials: publicKey.allowCredentials?.map(cloneCredentialDescriptor),
-		extensions: cloneCredentialExtensions(publicKey.extensions)
-	};
-}
-function cloneCredentialDescriptor(descriptor) {
-	return {
-		...descriptor,
-		id: cloneBufferSource(descriptor.id)
-	};
-}
-function cloneCredentialExtensions(extensions) {
-	if (!extensions) return extensions;
-	const cloned = { ...extensions };
-	const prf = cloned.prf;
-	if (prf && typeof prf === "object") {
-		const prfRecord = { ...prf };
-		if (prfRecord.eval && typeof prfRecord.eval === "object") prfRecord.eval = clonePrfEval(prfRecord.eval);
-		if (prfRecord.evalByCredential && typeof prfRecord.evalByCredential === "object") {
-			const evalByCredential = {};
-			for (const [credentialId, evalValue] of Object.entries(prfRecord.evalByCredential)) evalByCredential[credentialId] = evalValue && typeof evalValue === "object" ? clonePrfEval(evalValue) : evalValue;
-			prfRecord.evalByCredential = evalByCredential;
-		}
-		cloned.prf = prfRecord;
-	}
-	return cloned;
-}
-function clonePrfEval(input) {
-	return {
-		...input,
-		...isBufferSource(input.first) ? { first: cloneBufferSource(input.first) } : {},
-		...isBufferSource(input.second) ? { second: cloneBufferSource(input.second) } : {}
-	};
-}
-function isBufferSource(value) {
-	return value instanceof ArrayBuffer || ArrayBuffer.isView(value);
-}
-function cloneBufferSource(value) {
-	if (value instanceof ArrayBuffer) return value.slice(0);
-	const view = value;
-	const clonedBytes = new Uint8Array(view.buffer, view.byteOffset, view.byteLength).slice();
-	if (value instanceof DataView) return new DataView(clonedBytes.buffer);
-	const ViewCtor = Object.getPrototypeOf(value).constructor;
-	return new ViewCtor(clonedBytes.buffer);
-}
-function isAncestorOriginError(err) {
-	const msg = safeMessage(err);
-	return /origin of the document is not the same as its ancestors/i.test(msg);
-}
-function isDocumentNotFocusedError(err) {
-	const name = safeName(err);
-	const msg = safeMessage(err);
-	const isNotAllowed = name === "NotAllowedError";
-	const mentionsFocus = /document is not focused|not focused|focus/i.test(msg);
-	return Boolean(isNotAllowed && mentionsFocus);
-}
-function safeMessage(err) {
-	return String(err?.message || "");
-}
-function safeName(err) {
-	const name = err?.name;
-	return typeof name === "string" ? name : "";
-}
-//#endregion
-export { executeWalletOriginWebAuthn };
-
-//# sourceMappingURL=walletOriginWebAuthn.js.map

package/dist/esm/core/signingEngine/workerManager/SignerWorkerManager.js

@@ -1,68 +0,0 @@
-//#region src/core/signingEngine/workerManager/SignerWorkerManager.ts
-/**
-* WebAuthnWorkers handles PRF, workers, and COSE operations
-*
-* Note: This stack is WebAuthn-only; challenges are either server-minted
-* (e.g. login) or derived from intent/session digests (e.g. threshold sessions).
-*/
-var SignerWorkerManager = class {
-	constructor(deps) {
-		this.resolveOperationStepUpCredential = deps.resolveOperationStepUpCredential;
-		this.nearKeyMaterialStore = deps.nearKeyMaterialStore;
-		this.touchIdPrompt = deps.touchIdPrompt;
-		this.touchConfirm = deps.touchConfirm;
-		this.passkeyMpcSession = deps.passkeyMpcSession;
-		this.nearClient = deps.nearClient;
-		this.userPreferencesManager = deps.userPreferencesManager;
-		this.nonceCoordinator = deps.nonceCoordinator;
-		this.relayerUrl = deps.relayerUrl;
-		this.chains = deps.chains;
-		this.nearExplorerUrl = deps.nearExplorerUrl;
-		this.tempoExplorerUrl = deps.tempoExplorerUrl;
-		this.evmExplorerUrl = deps.evmExplorerUrl;
-		this.getTheme = deps.getTheme;
-		this.workerTransport = deps.workerTransport;
-	}
-	setWorkerBaseOrigin(origin) {
-		this.workerTransport.setWorkerBaseOrigin(origin);
-	}
-	getContext() {
-		return {
-			resolveOperationStepUpCredential: this.resolveOperationStepUpCredential,
-			requestWorkerOperation: this.requestWorkerOperation.bind(this),
-			nearKeyMaterialStore: this.nearKeyMaterialStore,
-			touchIdPrompt: this.touchIdPrompt,
-			touchConfirm: this.touchConfirm,
-			passkeyMpcSession: this.passkeyMpcSession,
-			nearClient: this.nearClient,
-			userPreferencesManager: this.userPreferencesManager,
-			nonceCoordinator: this.nonceCoordinator,
-			chains: this.chains,
-			getTheme: this.getTheme,
-			rpIdOverride: this.touchIdPrompt.getRpId(),
-			nearExplorerUrl: this.nearExplorerUrl,
-			tempoExplorerUrl: this.tempoExplorerUrl,
-			evmExplorerUrl: this.evmExplorerUrl,
-			relayerUrl: this.relayerUrl
-		};
-	}
-	async prewarmWorkers() {
-		await this.workerTransport.prewarmWorkers();
-	}
-	async clearEcdsaClientWorkerState(target) {
-		await this.workerTransport.clearEcdsaClientWorkerState(target);
-	}
-	async prewarmEcdsaRegistrationCrypto() {
-		return await this.workerTransport.prewarmEcdsaRegistrationCrypto();
-	}
-	async prewarmEmailOtpYao(request) {
-		return await this.workerTransport.prewarmEmailOtpYao(request);
-	}
-	requestWorkerOperation(args) {
-		return this.workerTransport.requestOperation(args);
-	}
-};
-//#endregion
-export { SignerWorkerManager };
-
-//# sourceMappingURL=SignerWorkerManager.js.map