@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/SeamsWeb/operations/registration/pendingRegistrationRecovery.js

@@ -1,354 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
-import { assertPendingWalletRegistrationIdentity } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";
-import { activateWalletRegistration, completeWalletRegistrationNearProvisioning } from "../../../core/rpcClients/relayer/walletRegistration.js";
-import { parseEd25519YaoRecoveryCapabilityV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
-import { prepareWalletEd25519RegistrationProjectionPublication, prepareWalletEmailOtpEd25519RegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
-import { walletCustodyActiveClientMetadataV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
-import { requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches } from "./registrationEd25519Yao.js";
-import { isEcdsaRegistrationCommit, isMixedEcdsaRegistrationCommit } from "./pendingEcdsaRegistrationRecoveryValidation.js";
-import { resumePendingEcdsaRegistration as resumePendingEcdsaRegistration$1 } from "./pendingEcdsaRegistrationRecovery.js";
-import { unlockPendingEcdsaRegistration } from "./pendingEcdsaRegistrationRecoveryUnlock.js";
-//#region src/SeamsWeb/operations/registration/pendingRegistrationRecovery.ts
-const defaultPendingRegistrationRecoveryPorts = {
-	listPendingWalletRegistrationCommits,
-	completeWalletRegistrationNearProvisioning,
-	publishPendingWalletRegistrationCommit
-};
-async function listPendingWalletRegistrationCommits() {
-	await IndexedDBManager.initialize();
-	return await IndexedDBManager.listPendingWalletRegistrationCommits();
-}
-async function publishPendingWalletRegistrationCommit(input) {
-	return await IndexedDBManager.publishPendingWalletRegistrationCommit(input);
-}
-function asError(error) {
-	return error instanceof Error ? error : new Error(String(error || "pending registration replay failed"));
-}
-function isNearProvisioningEd25519Commit(pending) {
-	return pending.operation === "near_provisioning" && pending.phase === "joined";
-}
-function pendingCustodyMaterial(pending, finalized) {
-	const metadata = pending.localMaterial.ed25519.metadata;
-	const localMaterial = pending.localMaterial.ed25519.localMaterial;
-	return {
-		binding: {
-			kind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-			applicationBindingDigestB64u: localMaterial.applicationBindingDigestB64u,
-			registeredPublicKeyB64u: metadata.registeredPublicKeyB64u,
-			participantIds: metadata.participantIds,
-			stateEpoch: metadata.stateEpoch,
-			walletId: String(finalized.walletId),
-			nearAccountId: finalized.ed25519.nearAccountId,
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			signerSlot: finalized.ed25519.signerSlot,
-			signingWorkerId: metadata.signingWorkerId,
-			signingWorkerVerifyingShareB64u: metadata.signingWorkerVerifyingShareB64u
-		},
-		sealed: {
-			ciphertextB64u: localMaterial.b64u,
-			nonceB64u: localMaterial.nonceB64u
-		}
-	};
-}
-function registeredPublicKeyFromPending(pending) {
-	const publicKey = base64UrlDecode(pending.localMaterial.ed25519.metadata.registeredPublicKeyB64u);
-	if (publicKey.length !== 32) throw new Error("pending registration has an invalid Ed25519 registered public key");
-	return `ed25519:${base58Encode(publicKey)}`;
-}
-function assertFinalizedSignerMatchesPending(pending, finalized, clientPublicKey) {
-	const metadata = pending.localMaterial.ed25519.metadata;
-	const commit = pending.localMaterial.custodyCommit;
-	if (pending.auth.kind === "passkey") {
-		if (requireEd25519YaoRegistrationPublicResultMatches({
-			clientPublicKey,
-			finalized,
-			expectedRpId: pending.auth.rpId,
-			expectedWalletId: pending.walletId
-		}).credentialIdB64u !== pending.auth.credentialIdB64u) throw new Error("pending registration returned a different Passkey credential");
-	} else requireEmailOtpEd25519YaoRegistrationPublicResultMatches({
-		clientPublicKey,
-		finalized,
-		expectedRegistrationAuthorityId: pending.auth.registrationAuthorityId,
-		expectedWalletId: pending.walletId
-	});
-	if (finalized.foundingAuthMethod.walletAuthMethodId !== pending.walletAuthMethodId || finalized.foundingAuthMethod.walletId !== pending.walletId || finalized.foundingAuthority.walletId !== pending.walletId || finalized.ed25519.signerSlot !== metadata.signerSlot || finalized.ed25519.nearEd25519SigningKeyId !== metadata.nearEd25519SigningKeyId || finalized.ed25519.participantIds[0] !== metadata.participantIds[0] || finalized.ed25519.participantIds[1] !== metadata.participantIds[1] || finalized.ed25519.routerAbNormalSigning.signingWorkerId !== metadata.signingWorkerId || finalized.ed25519.relayerKeyId !== finalized.ed25519.routerAbNormalSigning.signingWorkerId || finalized.custodyKeyManifestDigestB64u !== commit.keyManifestDigestB64u || commit.registeredPublicKeyB64u !== void 0 && commit.registeredPublicKeyB64u !== metadata.registeredPublicKeyB64u) throw new Error("pending registration does not match the committed NEAR projection");
-	assertPendingWalletRegistrationIdentity(pending, {
-		operation: pending.operation,
-		walletId: finalized.walletId,
-		walletAuthMethodId: finalized.foundingAuthMethod.walletAuthMethodId,
-		authority: finalized.authority
-	});
-}
-function assertEd25519SessionProjectionMatchesPending(pending, finalized) {
-	const session = finalized.registrationEstablishedSession.session;
-	const ed25519 = session.tokens.kind === "near_ed25519" || session.tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? session.tokens.ed25519 : null;
-	const metadata = pending.localMaterial.ed25519.metadata;
-	if (session.walletId !== pending.walletId || !ed25519 || ed25519.nearAccountId !== finalized.ed25519.nearAccountId || ed25519.nearEd25519SigningKeyId !== finalized.ed25519.nearEd25519SigningKeyId || ed25519.routerAbNormalSigning.signingWorkerId !== metadata.signingWorkerId || !mpcMaterialActivationRefsEqual(ed25519.materialActivation, metadata.materialActivation)) throw new Error("pending registration does not match the committed Wallet Session projection");
-}
-function assertNearRegistrationSessionMatchesPending(pending, finalized) {
-	assertEd25519SessionProjectionMatchesPending(pending, finalized);
-	const sessionResult = finalized.registrationEstablishedSession;
-	if (sessionResult.kind === "issued") {
-		if (sessionResult.session.walletSession.walletId !== pending.walletId || sessionResult.session.walletSession.authMethodId !== pending.walletAuthMethodId) throw new Error("pending registration issued a Wallet Session for another auth method");
-		return;
-	}
-	if (sessionResult.next !== "unlock_exact_method") throw new Error("pending registration replay has an invalid continuation");
-}
-function requireFinalizedEd25519Response(pending, response, expectedCustodyStatus) {
-	if (!response.ok || response.kind !== "near_ed25519") throw new Error(response.ok ? "pending registration replay returned a different signer branch" : `pending registration replay failed: ${response.code}`);
-	if (response.walletCustody?.status !== expectedCustodyStatus) throw new Error("pending registration replay did not commit the expected wallet custody");
-	assertFinalizedSignerMatchesPending(pending, response, registeredPublicKeyFromPending(pending));
-	return response;
-}
-function requireFinalizedNearProvisioningResponse(pending, response) {
-	const finalized = requireFinalizedEd25519Response(pending, response, pending.signerPlanKind === "near_ed25519" ? "committed" : "joined");
-	if (pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && (finalized.registrationEstablishedSession.kind !== "already_committed" || finalized.registrationEstablishedSession.session.tokens.kind !== "near_ed25519_and_evm_family_ecdsa")) throw new Error("NEAR completion must extend the committed ECDSA session");
-	assertNearRegistrationSessionMatchesPending(pending, finalized);
-	return finalized;
-}
-async function registrationProjectionFromPending(pending, finalized) {
-	const clientPublicKey = registeredPublicKeyFromPending(pending);
-	const common = {
-		walletId: pending.walletId,
-		nearAccountId: toAccountId(finalized.ed25519.nearAccountId),
-		nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-		signerSlot: finalized.ed25519.signerSlot,
-		operationalPublicKey: clientPublicKey,
-		relayerKeyId: finalized.ed25519.relayerKeyId,
-		keyVersion: finalized.ed25519.keyVersion,
-		participantIds: finalized.ed25519.participantIds,
-		custodyMaterial: pendingCustodyMaterial(pending, finalized)
-	};
-	if (pending.auth.kind === "passkey") {
-		if (finalized.authMethod.kind !== "passkey") throw new Error("pending Passkey registration replay returned a non-Passkey auth method");
-		return prepareWalletEd25519RegistrationProjectionPublication({
-			...common,
-			rpId: pending.auth.rpId,
-			credentialIdB64u: pending.auth.credentialIdB64u,
-			credentialPublicKeyB64u: finalized.authMethod.credentialPublicKeyB64u,
-			transports: pending.auth.transports
-		});
-	}
-	if (finalized.authMethod.kind !== "email_otp") throw new Error("pending Email OTP registration replay returned a non-Email OTP auth method");
-	const authority = parseEmailOtpWalletAuthAuthority(finalized.authority);
-	if (!authority) throw new Error("pending Email OTP registration replay returned an invalid authority");
-	return await prepareWalletEmailOtpEd25519RegistrationPublication({
-		...common,
-		email: pending.auth.email,
-		registrationAuthorityId: pending.auth.registrationAuthorityId,
-		authority
-	});
-}
-function publicationInputFromPending(pending, finalized, registration) {
-	return {
-		pending,
-		authority: finalized.authority,
-		foundingAuthority: {
-			authority: finalized.foundingAuthority,
-			authMethod: finalized.foundingAuthMethod
-		},
-		request: {
-			operation: pending.operation,
-			registrationCeremonyId: pending.registrationCeremonyId,
-			idempotencyKey: pending.idempotencyKey,
-			walletId: pending.walletId,
-			walletAuthMethodId: pending.walletAuthMethodId
-		},
-		ecdsaContinuity: [],
-		walletSessionPublication: finalized.registrationEstablishedSession.kind === "issued" ? {
-			kind: "issued",
-			walletSession: finalized.registrationEstablishedSession.session.walletSession,
-			operationCredential: finalized.registrationEstablishedSession.session.operationCredential
-		} : {
-			kind: "credential_free_projection",
-			walletSession: finalized.registrationEstablishedSession.session.walletSession
-		},
-		registration
-	};
-}
-function pendingNearProvisioningAuth(pending) {
-	switch (pending.auth.kind) {
-		case "passkey": return { kind: "passkey" };
-		case "email_otp": return {
-			kind: "email_otp",
-			enrollment: pending.auth.enrollment
-		};
-		default:
-			pending.auth;
-			throw new Error("pending registration has an unsupported auth method");
-	}
-}
-function pendingNearProvisioningRequest(relayerUrl, pending) {
-	return {
-		relayerUrl,
-		registrationCeremonyId: pending.registrationCeremonyId,
-		signedSetup: pending.signedSetup,
-		idempotencyKey: pending.idempotencyKey,
-		ed25519: { activationReference: pending.localMaterial.ed25519.activationReference },
-		auth: pendingNearProvisioningAuth(pending),
-		walletCustodyCommit: pending.localMaterial.custodyCommit
-	};
-}
-async function completeCredentialFreePendingNearProvisioning(args) {
-	const request = pendingNearProvisioningRequest(args.relayerUrl, args.pending);
-	const response = await args.ports.completeWalletRegistrationNearProvisioning(request);
-	return requireFinalizedNearProvisioningResponse(args.pending, response);
-}
-/** Converts persisted joined material into the current continuation input. */
-async function restorePendingNearRegistrationMaterial(args) {
-	const response = await completeWalletRegistrationNearProvisioning({
-		...pendingNearProvisioningRequest(args.relayerUrl, args.pending),
-		headers: { Authorization: `Bearer ${args.operationCredential.token}` }
-	});
-	const finalized = requireFinalizedNearProvisioningResponse(args.pending, response);
-	const session = finalized.registrationEstablishedSession.session;
-	if (session.tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("Persisted mixed registration has no NEAR session");
-	const ed25519 = session.tokens.ed25519;
-	const bootstrapRequest = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1({
-		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
-		walletId: args.pending.walletId,
-		nearAccountId: finalized.ed25519.nearAccountId,
-		nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-		signerSlot: finalized.ed25519.signerSlot,
-		thresholdSessionId: ed25519.thresholdSessionId,
-		signingWorkerId: finalized.ed25519.routerAbNormalSigning.signingWorkerId,
-		participantIds: finalized.ed25519.participantIds
-	});
-	if (!bootstrapRequest.ok) throw new Error(bootstrapRequest.message);
-	const bootstrap = await fetch(`${args.relayerUrl.replace(/\/$/, "")}${ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${args.operationCredential.token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(bootstrapRequest.value)
-	});
-	const raw = await bootstrap.json();
-	if (!bootstrap.ok || !raw || typeof raw !== "object") throw new Error("Persisted NEAR registration activation is unavailable");
-	const capability = parseEd25519YaoRecoveryCapabilityV1(Reflect.get(raw, "capability"));
-	const pendingMetadata = args.pending.localMaterial.ed25519.metadata;
-	if (capability.registrationContinuity.kind !== "registration" || capability.applicationBinding.wallet_id !== args.pending.walletId || capability.applicationBinding.near_ed25519_signing_key_id !== pendingMetadata.nearEd25519SigningKeyId || capability.lifecycle.lifecycleId !== args.pending.localMaterial.ed25519.activationReference.lifecycle_id || capability.lifecycle.thresholdSessionId !== ed25519.thresholdSessionId || capability.lifecycle.signingWorkerId !== pendingMetadata.signingWorkerId || capability.applicationBinding.key_creation_signer_slot !== pendingMetadata.signerSlot || base64UrlEncode(Uint8Array.from(capability.registeredPublicKey)) !== pendingMetadata.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, pendingMetadata.materialActivation)) throw new Error("Persisted NEAR registration activation changed identity");
-	const continuity = capability.registrationContinuity;
-	return {
-		joined: {
-			commitPayload: args.pending.localMaterial.custodyCommit,
-			activationReference: args.pending.localMaterial.ed25519.activationReference,
-			localMaterial: args.pending.localMaterial.ed25519.localMaterial,
-			metadata: walletCustodyActiveClientMetadataV1({
-				material: pendingCustodyMaterial(args.pending, finalized),
-				activation: {
-					materialActivation: capability.materialActivation,
-					lifecycleId: capability.lifecycle.lifecycleId,
-					signingRootVersion: capability.lifecycle.rootShareEpoch,
-					signingRootId: capability.applicationBinding.signing_root_id,
-					signerSetId: capability.lifecycle.signerSetId,
-					thresholdSessionId: capability.lifecycle.thresholdSessionId,
-					activationTranscriptB64u: base64UrlEncode(Uint8Array.from(continuity.activationTranscript)),
-					activationCapabilityBindingB64u: base64UrlEncode(Uint8Array.from(capability.activeCapabilityBinding))
-				}
-			})
-		},
-		admissionRequest: continuity.admissionRequest,
-		admissionReceipt: continuity.admissionReceipt
-	};
-}
-async function replayPendingNearProvisioning(args) {
-	const finalized = await completeCredentialFreePendingNearProvisioning(args);
-	const registration = await registrationProjectionFromPending(args.pending, finalized);
-	await args.ports.publishPendingWalletRegistrationCommit(publicationInputFromPending(args.pending, finalized, registration));
-	return {
-		kind: "published",
-		registrationCeremonyId: args.pending.registrationCeremonyId
-	};
-}
-async function resumePendingNearRegistrations(args) {
-	const ports = args.ports || defaultPendingRegistrationRecoveryPorts;
-	const pendingRows = await ports.listPendingWalletRegistrationCommits();
-	const results = [];
-	for (const pending of pendingRows) {
-		if (isEcdsaRegistrationCommit(pending) || isMixedEcdsaRegistrationCommit(pending)) {
-			results.push({
-				kind: "unlock_required",
-				registrationCeremonyId: pending.registrationCeremonyId,
-				keyFamilies: pending.localMaterial.keyFamilies,
-				next: "unlock_exact_method",
-				reason: "ecdsa_local_finalization"
-			});
-			continue;
-		}
-		if (pending.operation === "near_provisioning" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa") {
-			results.push({
-				kind: "unlock_required",
-				reason: "near_provisioning",
-				registrationCeremonyId: pending.registrationCeremonyId,
-				next: "unlock_exact_method"
-			});
-			continue;
-		}
-		if (!isNearProvisioningEd25519Commit(pending)) continue;
-		try {
-			results.push(await replayPendingNearProvisioning({
-				relayerUrl: args.relayerUrl,
-				pending,
-				ports
-			}));
-		} catch (error) {
-			results.push({
-				kind: "failed",
-				registrationCeremonyId: pending.registrationCeremonyId,
-				error: asError(error)
-			});
-		}
-	}
-	return results;
-}
-const defaultPendingEcdsaRegistrationRecoveryPorts = {
-	activateWalletRegistration,
-	publishPendingWalletRegistrationCommit,
-	unlockPendingEcdsaRegistration
-};
-async function resumePendingEcdsaRegistration(args) {
-	const ports = args.ports ?? defaultPendingEcdsaRegistrationRecoveryPorts;
-	switch (args.exactMethod.kind) {
-		case "passkey": return await resumePendingEcdsaRegistration$1({
-			relayerUrl: args.relayerUrl,
-			pending: args.pending,
-			signingSurface: args.signingSurface,
-			exactMethod: args.exactMethod,
-			ports
-		});
-		case "email_otp": return await resumePendingEcdsaRegistration$1({
-			relayerUrl: args.relayerUrl,
-			pending: args.pending,
-			signingSurface: args.signingSurface,
-			exactMethod: args.exactMethod,
-			ports
-		});
-		default:
-			args.exactMethod;
-			throw new Error("pending ECDSA registration has an unsupported exact method");
-	}
-}
-async function resumePendingEcdsaRegistrationFromStoredCommit(args) {
-	await IndexedDBManager.initialize();
-	const pending = (await IndexedDBManager.listPendingWalletRegistrationCommits()).find((candidate) => candidate.operation === "registration_activate" && String(candidate.walletId) === String(args.request.walletId) && candidate.registrationCeremonyId === args.request.registrationCeremonyId);
-	if (!pending) throw new Error("pending ECDSA registration commit was not found");
-	if (!isEcdsaRegistrationCommit(pending) && !isMixedEcdsaRegistrationCommit(pending)) throw new Error("pending registration commit is not ECDSA-enabled");
-	return await resumePendingEcdsaRegistration({
-		relayerUrl: args.relayerUrl,
-		pending,
-		exactMethod: args.request.exactMethod,
-		signingSurface: args.signingSurface
-	});
-}
-//#endregion
-export { registrationProjectionFromPending, restorePendingNearRegistrationMaterial, resumePendingEcdsaRegistrationFromStoredCommit, resumePendingNearRegistrations };
-
-//# sourceMappingURL=pendingRegistrationRecovery.js.map