@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/threshold/ed25519/connectSession.js

@@ -1,137 +0,0 @@
-import { SigningSessionIds } from "../../session/operationState/types.js";
-import { buildEd25519SessionPolicy } from "../sessionPolicy.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { buildThresholdEd25519WebAuthnPrfSecretSource, localPrfFirstForEd25519WalletSessionMintAuthorization, mintEd25519WalletSession } from "./walletSession.js";
-import { collectAuthenticationCredentialForChallengeB64u } from "../../webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u.js";
-//#region src/core/signingEngine/threshold/ed25519/connectSession.ts
-function assertNeverWalletAuthFactorKind(kind) {
-	throw new Error(`[threshold-ed25519] unsupported wallet auth factor kind: ${String(kind)}`);
-}
-function passkeyAuthorityFromEd25519SessionPolicyAuthority(authority) {
-	if (isPasskeyWalletAuthAuthority(authority.authority)) return authority.authority;
-	if (isEmailOtpWalletAuthAuthority(authority.authority)) return null;
-	authority.authority;
-	return assertNeverWalletAuthFactorKind(authority.authority);
-}
-/**
-* Wallet-origin helper:
-* - build a threshold session policy (and digest)
-* - collect a WebAuthn assertion with challenge = `sessionPolicyDigest32`
-* - mint an exact Wallet Session operation credential or reuse an existing one
-*
-* Notes:
-* - This function is intentionally standard-WebAuthn (no contract verifier).
-* - The WebAuthn credential sent to the Router API is PRF-redacted in `mintEd25519WalletSession`.
-*/
-async function connectEd25519Session(args) {
-	const passkeyAuthority = passkeyAuthorityFromEd25519SessionPolicyAuthority(args.authority);
-	const passkeyRpId = passkeyAuthority ? String(passkeyAuthority.verifier.rpId || "").trim() : "";
-	if (passkeyAuthority && !passkeyRpId) return {
-		ok: false,
-		code: "invalid_args",
-		message: "Missing rpId for WebAuthn"
-	};
-	const { policy, sessionPolicyDigest32 } = await buildEd25519SessionPolicy({
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		authority: args.authority,
-		relayerKeyId: args.relayerKeyId,
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {},
-		routerAbNormalSigning: args.routerAbNormalSigning,
-		participantIds: args.participantIds,
-		thresholdSessionId: args.thresholdSessionId,
-		ttlMs: args.ttlMs,
-		remainingUses: args.remainingUses
-	});
-	let auth = args.auth;
-	if (!auth) {
-		if (!passkeyAuthority) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Email OTP Ed25519 session mint requires explicit route authorization"
-		};
-		auth = {
-			kind: "threshold_session_policy_webauthn",
-			policySecretSource: buildThresholdEd25519WebAuthnPrfSecretSource({
-				credential: await collectAuthenticationCredentialForChallengeB64u({
-					credentialStore: args.credentialStore,
-					touchIdPrompt: args.touchIdPrompt,
-					nearAccountId: args.nearAccountId,
-					challengeB64u: sessionPolicyDigest32
-				}),
-				rpId: passkeyRpId
-			})
-		};
-	}
-	const prfFirstB64u = localPrfFirstForEd25519WalletSessionMintAuthorization(auth);
-	if (!prfFirstB64u) return {
-		ok: false,
-		code: "unsupported",
-		message: "Missing PRF.first output from credential (requires a PRF-enabled passkey)"
-	};
-	const minted = await mintEd25519WalletSession({
-		relayerUrl: args.relayerUrl,
-		sessionKind: "opaque",
-		relayerKeyId: args.relayerKeyId,
-		sessionPolicy: policy,
-		auth,
-		projectEnvironmentId: args.runtimeScopeBootstrap?.projectEnvironmentId,
-		publishableKey: args.runtimeScopeBootstrap?.publishableKey,
-		...args.existingOperationCredential ? { existingOperationCredential: args.existingOperationCredential } : {}
-	});
-	if (!minted.ok) {
-		if (minted.code === "already_committed") return minted;
-		return {
-			ok: false,
-			code: minted.code,
-			message: minted.message
-		};
-	}
-	const requestedThresholdSessionId = policy.thresholdSessionId;
-	const resolvedThresholdSessionId = minted.thresholdSessionId || requestedThresholdSessionId;
-	const expiresAtMs = minted.expiresAtMs;
-	const remainingUses = minted.remainingUses;
-	const mintedRuntimePolicyScope = minted.runtimePolicyScope;
-	if (!resolvedThresholdSessionId || !minted.authorizationId || !minted.walletSessionId || !minted.quotaId || !mintedRuntimePolicyScope) return {
-		ok: false,
-		code: "invalid_response",
-		message: "Threshold Ed25519 session mint returned incomplete lifecycle metadata"
-	};
-	const successBase = {
-		ok: true,
-		thresholdSessionId: SigningSessionIds.thresholdEd25519Session(resolvedThresholdSessionId),
-		authorizationId: minted.authorizationId,
-		walletSessionId: minted.walletSessionId,
-		quotaId: minted.quotaId,
-		expiresAtMs,
-		remainingUses,
-		runtimePolicyScope: mintedRuntimePolicyScope,
-		routerAbNormalSigning: args.routerAbNormalSigning,
-		passkeyPrfFirstB64u: prfFirstB64u
-	};
-	switch (minted.sessionKind) {
-		case "issued_exact_wallet_session":
-			if (minted.operationCredential.walletSessionId !== minted.walletSessionId) return {
-				ok: false,
-				code: "invalid_response",
-				message: "Threshold Ed25519 session mint credential does not identify its session"
-			};
-			return {
-				...successBase,
-				sessionKind: minted.sessionKind,
-				operationCredential: minted.operationCredential
-			};
-		case "already_committed_exact_wallet_session": return {
-			...successBase,
-			sessionKind: minted.sessionKind
-		};
-		default: return assertNeverEd25519WalletSessionMintKind(minted);
-	}
-}
-function assertNeverEd25519WalletSessionMintKind(kind) {
-	throw new Error(`[threshold-ed25519] unsupported Wallet Session mint kind: ${String(kind)}`);
-}
-//#endregion
-export { connectEd25519Session };
-
-//# sourceMappingURL=connectSession.js.map

package/dist/esm/core/signingEngine/threshold/ed25519/yaoActiveClientRegistry.js

@@ -1,146 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS } from "../../../../shared-ts/src/threshold/participants.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { nearEd25519YaoMaterialActivationFromMetadata } from "../../session/material/nearEd25519YaoMaterialActivation.js";
-//#region src/core/signingEngine/threshold/ed25519/yaoActiveClientRegistry.ts
-const MAX_ACTIVE_ED25519_YAO_CLIENTS = 64;
-var VolatileOnlyPublicCapabilityReferenceStore = class {
-	async upsert(_reference) {}
-	async remove(_identity) {}
-	async list() {
-		return [];
-	}
-	async upsertLane(_reference) {}
-	async removeLane(_identity) {}
-	async listLanes() {
-		return [];
-	}
-};
-function requireNonEmpty(value, label) {
-	const parsed = String(value ?? "").trim();
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
-function identityKey(identity) {
-	const activation = identity.materialActivation;
-	return JSON.stringify([
-		requireNonEmpty(identity.walletId, "walletId"),
-		requireNonEmpty(identity.nearAccountId, "nearAccountId"),
-		requireNonEmpty(activation.activationId, "materialActivation.activationId"),
-		requireNonEmpty(activation.capability, "materialActivation.capability"),
-		requireNonEmpty(activation.materialOwner, "materialActivation.materialOwner"),
-		requireNonEmpty(activation.keyBinding, "materialActivation.keyBinding"),
-		requireNonEmpty(activation.lifecycleBinding, "materialActivation.lifecycleBinding"),
-		requireNonEmpty(activation.signingWorker, "materialActivation.signingWorker")
-	]);
-}
-function materialIdentity(material) {
-	if (material.activeClient.status().kind !== "active") throw new Error("Ed25519 Yao active Client registry rejects disposed state");
-	const metadata = material.activeClient.metadata();
-	const facts = material.facts;
-	const signer = facts.signer;
-	const walletId = signer.account.wallet.walletId;
-	const nearAccountId = signer.account.nearAccountId;
-	const thresholdSessionId = requireNonEmpty(facts.thresholdSessionId, "material.facts.thresholdSessionId");
-	const materialActivation = nearEd25519YaoMaterialActivationFromMetadata(metadata);
-	if (metadata.scope.threshold_session_id !== thresholdSessionId || !sameRouterAbMpcMaterialActivationRef(metadata.scope.material_activation, routerAbMpcMaterialActivationRefToWire(materialActivation)) || metadata.scope.account_id !== String(walletId) || metadata.applicationBinding.wallet_id !== String(walletId) || metadata.applicationBinding.near_ed25519_signing_key_id !== String(signer.nearEd25519SigningKeyId) || metadata.applicationBinding.signing_root_id !== facts.signingRootId || metadata.scope.root_share_epoch !== facts.signingRootVersion || metadata.applicationBinding.key_creation_signer_slot !== signer.signerSlot || metadata.scope.signing_worker_id !== facts.routerAbNormalSigning.signingWorkerId) throw new Error("Ed25519 Yao active Client registry subject identity mismatch");
-	if (metadata.participantIds[0] !== THRESHOLD_ED25519_2P_PARTICIPANT_IDS[0] || metadata.participantIds[1] !== THRESHOLD_ED25519_2P_PARTICIPANT_IDS[1]) throw new Error("Ed25519 Yao active Client registry participant identity mismatch");
-	return {
-		walletId,
-		nearAccountId,
-		materialActivation
-	};
-}
-function sameIdentity(left, right) {
-	return String(left.walletId) === String(right.walletId) && String(left.nearAccountId) === String(right.nearAccountId) && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
-}
-var Ed25519YaoActiveClientRegistry = class {
-	constructor(publicReferences = new VolatileOnlyPublicCapabilityReferenceStore()) {
-		this.publicReferences = publicReferences;
-		this.entries = /* @__PURE__ */ new Map();
-		this.lifecycleGeneration = 0;
-	}
-	async activate(material) {
-		const identity = materialIdentity(material);
-		const key = identityKey(identity);
-		const lifecycleGeneration = this.lifecycleGeneration;
-		for (const entry of this.entries.values()) if (entry.material.activeClient === material.activeClient && !sameIdentity(entry.identity, identity)) throw new Error("Ed25519 Yao active Client state is already bound to another identity");
-		const current = this.entries.get(key);
-		if (!current && this.entries.size >= MAX_ACTIVE_ED25519_YAO_CLIENTS) throw new Error("Ed25519 Yao active Client registry capacity is exhausted");
-		await this.publicReferences.upsert({
-			walletId: identity.walletId,
-			nearAccountId: identity.nearAccountId,
-			thresholdSessionId: material.facts.thresholdSessionId,
-			runtimePolicyScope: material.facts.runtimePolicyScope,
-			materialActivation: identity.materialActivation
-		});
-		if (lifecycleGeneration !== this.lifecycleGeneration || material.activeClient.status().kind !== "active") {
-			material.activeClient.dispose();
-			await this.publicReferences.remove(identity);
-			await this.publicReferences.removeLane(identity);
-			throw new Error("Ed25519 Yao active Client activation was interrupted");
-		}
-		if (current && current.material.activeClient !== material.activeClient) current.material.activeClient.dispose();
-		this.entries.set(key, {
-			identity,
-			material
-		});
-		return identity;
-	}
-	resolve(identity) {
-		const key = identityKey(identity);
-		const entry = this.entries.get(key);
-		if (!entry) return null;
-		if (entry.material.activeClient.status().kind === "disposed") {
-			this.entries.delete(key);
-			return null;
-		}
-		return entry.material;
-	}
-	resolveExact(identity) {
-		return this.resolve(identity);
-	}
-	resolveForWalletAccount(scope) {
-		let match = null;
-		for (const entry of this.entries.values()) {
-			if (String(entry.identity.walletId) !== String(scope.walletId) || String(entry.identity.nearAccountId) !== String(scope.nearAccountId)) continue;
-			if (entry.material.activeClient.status().kind === "disposed") continue;
-			if (match) throw new Error("Ed25519 Yao active Client lookup scope is ambiguous");
-			match = entry.material;
-		}
-		return match;
-	}
-	async rollbackActivation(identity) {
-		this.lifecycleGeneration += 1;
-		const key = identityKey(identity);
-		const entry = this.entries.get(key);
-		if (entry) {
-			this.entries.delete(key);
-			entry.material.activeClient.dispose();
-		}
-		await this.publicReferences.remove(identity);
-		await this.publicReferences.removeLane(identity);
-		return entry !== void 0;
-	}
-	disposeWallet(walletId) {
-		this.lifecycleGeneration += 1;
-		const expectedWalletId = requireNonEmpty(walletId, "walletId");
-		let removed = 0;
-		for (const [key, entry] of this.entries) {
-			if (String(entry.identity.walletId) !== expectedWalletId) continue;
-			this.entries.delete(key);
-			entry.material.activeClient.dispose();
-			removed += 1;
-		}
-		return removed;
-	}
-	dispose() {
-		this.lifecycleGeneration += 1;
-		for (const entry of this.entries.values()) entry.material.activeClient.dispose();
-		this.entries.clear();
-	}
-};
-//#endregion
-export { Ed25519YaoActiveClientRegistry };
-
-//# sourceMappingURL=yaoActiveClientRegistry.js.map