@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/uiConfirm/handlers/flows/registration.js

@@ -1,235 +0,0 @@
-import { toError } from "../../../../../shared-ts/src/utils/errors.js";
-import { isSerializedRegistrationCredential, serializeRegistrationCredentialWithPRF } from "../../../webauthnAuth/credentials/helpers.js";
-import { getIntentDigest, getNearAccountId, getWalletId } from "./adapters/request.js";
-import { ERROR_MESSAGES, isUserCancelledUserConfirm } from "../../../stepUpConfirmation/channel/confirmCommon.js";
-import { sha256Base64UrlUtf8 } from "../../../../../utils/intentDigest.js";
-import { createConfirmSession, createConfirmTxFlowAdapters } from "./adapters/adapters.js";
-import { webAuthnPromptCoordinator } from "../../../stepUpConfirmation/passkeyPrompt/webauthnPromptCoordinator.js";
-//#region src/core/signingEngine/uiConfirm/handlers/flows/registration.ts
-function roundDurationMs(startedAt) {
-	return Math.max(0, Math.round(performance.now() - startedAt));
-}
-function buildPasskeyRegistrationConfirmDisplay(args) {
-	return {
-		kind: "passkey_registration_confirm_display_v1",
-		intendedUserName: args.walletId,
-		accountId: args.walletId,
-		rpId: args.rpId,
-		signerSlot: args.signerSlot
-	};
-}
-function buildPasskeyRegistrationCredentialArgs(args) {
-	const common = {
-		walletId: args.walletId,
-		intendedUserName: args.walletId,
-		prompt: args.prompt
-	};
-	if (args.recoveryRegistration) return {
-		...common,
-		kind: "wallet_recovery",
-		recoveryRegistration: args.recoveryRegistration
-	};
-	if (args.addAuthMethodRegistration) return {
-		...common,
-		kind: "wallet_add_auth_method",
-		registration: args.addAuthMethodRegistration
-	};
-	return {
-		...common,
-		kind: "wallet_registration",
-		challengeB64u: args.challengeB64u,
-		signerSlot: args.signerSlot
-	};
-}
-async function handleRegistrationFlow(ctx, request, worker, opts) {
-	const { confirmationConfig, transactionSummary, theme, surface } = opts;
-	const flowStartedAt = performance.now();
-	let requestSetupMs = 0;
-	let promptUserMs = 0;
-	let promptElementDefineMs = 0;
-	let promptMountMs = 0;
-	let promptHostFirstUpdateMs = 0;
-	let promptHostInteractiveMs = 0;
-	let promptConfirmEventMs = 0;
-	let promptDecisionWaitMs = 0;
-	let credentialCreateStartMs = 0;
-	let credentialCreateMs = 0;
-	let credentialSerializeMs = 0;
-	let duplicateRetryCount = 0;
-	let promptReservation = null;
-	const buildDiagnostics = () => ({
-		kind: "registration_confirmation_diagnostics_v1",
-		workerReadyMs: 0,
-		workerRequestRoundTripMs: 0,
-		workerResponseValidationMs: 0,
-		requestSetupMs,
-		promptUserMs,
-		promptElementDefineMs,
-		promptMountMs,
-		promptHostFirstUpdateMs,
-		promptHostInteractiveMs,
-		promptConfirmEventMs,
-		promptDecisionWaitMs,
-		credentialCreateStartMs,
-		credentialCreateMs,
-		credentialSerializeMs,
-		duplicateRetryCount,
-		mainThreadTotalMs: roundDurationMs(flowStartedAt)
-	});
-	const adapters = createConfirmTxFlowAdapters(ctx);
-	const session = createConfirmSession({
-		adapters,
-		worker,
-		request,
-		confirmationConfig,
-		transactionSummary,
-		theme,
-		surface
-	});
-	const walletId = getWalletId(request);
-	const nearAccountId = getNearAccountId(request);
-	try {
-		const requestSetupStartedAt = performance.now();
-		const recoveryRegistration = request.payload.walletRecoveryRegistration;
-		const addAuthMethodRegistration = request.payload.walletAddAuthMethodRegistration;
-		const requestedChallenge = request.payload.webauthnChallenge;
-		const explicitChallengeB64u = recoveryRegistration ? recoveryRegistration.challengeB64u : addAuthMethodRegistration ? addAuthMethodRegistration.challengeB64u : requestedChallenge?.kind === "intent_digest" ? String(requestedChallenge.challengeB64u || "").trim() : "";
-		const computeBoundIntentDigestB64u = async () => {
-			if (explicitChallengeB64u) return explicitChallengeB64u;
-			const uiIntentDigest = getIntentDigest(request);
-			if (!uiIntentDigest) throw new Error("Missing intentDigest for registration flow");
-			return sha256Base64UrlUtf8(uiIntentDigest);
-		};
-		const rpId = recoveryRegistration?.rpId ?? addAuthMethodRegistration?.rpId ?? adapters.security.getRpId();
-		if (!rpId) throw new Error("Missing rpId for registration challenge");
-		const initialSignerSlot = request.payload?.signerSlot ?? 1;
-		let challengeB64u = await computeBoundIntentDigestB64u();
-		const securityContext = {
-			rpId,
-			passkeyRegistration: buildPasskeyRegistrationConfirmDisplay({
-				walletId,
-				nearAccountId,
-				rpId,
-				signerSlot: initialSignerSlot
-			})
-		};
-		requestSetupMs = roundDurationMs(requestSetupStartedAt);
-		const promptOwner = {
-			kind: "registration_modal",
-			requestId: request.requestId
-		};
-		promptReservation = await webAuthnPromptCoordinator.reserveRegistrationPrompt({
-			owner: promptOwner,
-			expiresAtMs: Date.now() + 300 * 1e3,
-			cancellation: { kind: "none" }
-		});
-		const promptUserStartedAt = performance.now();
-		const { confirmed, error: uiError, diagnostics: promptDiagnostics } = await session.promptUser({ securityContext });
-		promptUserMs = roundDurationMs(promptUserStartedAt);
-		promptElementDefineMs = promptDiagnostics.elementDefineMs;
-		promptMountMs = promptDiagnostics.mountMs;
-		promptHostFirstUpdateMs = promptDiagnostics.hostFirstUpdateMs;
-		promptHostInteractiveMs = promptDiagnostics.hostInteractiveMs;
-		promptConfirmEventMs = promptDiagnostics.confirmEventMs;
-		promptDecisionWaitMs = promptDiagnostics.decisionWaitMs;
-		if (!confirmed) return session.confirmAndCloseModal({
-			requestId: request.requestId,
-			intentDigest: getIntentDigest(request),
-			confirmed: false,
-			registrationDiagnostics: buildDiagnostics(),
-			error: uiError
-		});
-		let credential;
-		let signerSlot = request.payload?.signerSlot ?? 1;
-		credentialCreateStartMs = roundDurationMs(flowStartedAt);
-		const credentialCreateStartedAt = performance.now();
-		try {
-			try {
-				const prompt = {
-					kind: "reserved",
-					reservation: promptReservation,
-					owner: promptOwner,
-					cancellation: { kind: "none" }
-				};
-				credential = await adapters.webauthn.createRegistrationCredential(recoveryRegistration ? buildPasskeyRegistrationCredentialArgs({
-					walletId,
-					recoveryRegistration,
-					prompt
-				}) : addAuthMethodRegistration ? buildPasskeyRegistrationCredentialArgs({
-					walletId,
-					addAuthMethodRegistration,
-					prompt
-				}) : buildPasskeyRegistrationCredentialArgs({
-					walletId,
-					challengeB64u,
-					signerSlot,
-					prompt
-				}));
-			} catch (e) {
-				const err = toError(e);
-				const name = String(err?.name || "");
-				const msg = String(err?.message || "");
-				if (name === "InvalidStateError" || /excluded|already\s*registered/i.test(msg)) {
-					duplicateRetryCount += 1;
-					if (explicitChallengeB64u) throw new Error("Registration credential already exists for this wallet registration intent; create a fresh intent before retrying");
-					if (request.payload.walletRecoveryRegistration || addAuthMethodRegistration) throw new Error("Server-issued registration requires a fresh ceremony");
-					const nextSignerSlot = signerSlot !== void 0 && Number.isFinite(signerSlot) ? signerSlot + 1 : 2;
-					signerSlot = nextSignerSlot;
-					request.payload.signerSlot = nextSignerSlot;
-					request.intentDigest = request.type === "registerAccount" ? `register:${walletId}:${nextSignerSlot}` : `device2-register:${walletId}:${nextSignerSlot}`;
-					challengeB64u = await computeBoundIntentDigestB64u();
-					credential = await adapters.webauthn.createRegistrationCredential(buildPasskeyRegistrationCredentialArgs({
-						walletId,
-						challengeB64u,
-						signerSlot: nextSignerSlot,
-						prompt: {
-							kind: "immediate",
-							requestId: request.requestId,
-							cancellation: { kind: "none" }
-						}
-					}));
-				} else {
-					console.error("[RegistrationFlow] credentials.create failed (non-duplicate)", {
-						name,
-						msg
-					});
-					throw err;
-				}
-			}
-		} finally {
-			credentialCreateMs = roundDurationMs(credentialCreateStartedAt);
-		}
-		const credentialSerializeStartedAt = performance.now();
-		const serialized = isSerializedRegistrationCredential(credential) ? credential : serializeRegistrationCredentialWithPRF({
-			credential,
-			firstPrfOutput: true,
-			secondPrfOutput: true
-		});
-		credentialSerializeMs = roundDurationMs(credentialSerializeStartedAt);
-		session.confirmAndCloseModal({
-			requestId: request.requestId,
-			intentDigest: getIntentDigest(request),
-			confirmed: true,
-			credential: serialized,
-			registrationDiagnostics: buildDiagnostics()
-		});
-	} catch (err) {
-		const cancelled = isUserCancelledUserConfirm(err);
-		const msg = String(toError(err)?.message || err || "");
-		if (cancelled) window.parent?.postMessage({ type: "WALLET_UI_CLOSED" }, "*");
-		const isPrfBrowserUnsupported = /WebAuthn PRF output is missing from navigator\.credentials\.create\(\)/i.test(msg) || /does not fully support the WebAuthn PRF extension during registration/i.test(msg) || /roaming hardware authenticators .* not supported in this flow/i.test(msg);
-		return session.confirmAndCloseModal({
-			requestId: request.requestId,
-			intentDigest: getIntentDigest(request),
-			confirmed: false,
-			registrationDiagnostics: buildDiagnostics(),
-			error: cancelled ? ERROR_MESSAGES.cancelled : isPrfBrowserUnsupported ? msg : msg || ERROR_MESSAGES.collectCredentialsFailed
-		});
-	} finally {
-		if (promptReservation) webAuthnPromptCoordinator.releaseReservation(promptReservation);
-	}
-}
-//#endregion
-export { handleRegistrationFlow };
-
-//# sourceMappingURL=registration.js.map

package/dist/esm/core/signingEngine/uiConfirm/handlers/flows/requestRegistrationCredentialConfirmation.js

@@ -1,178 +0,0 @@
-import { isBoolean, isObject, isString } from "../../../../../shared-ts/src/utils/validation.js";
-import { secureRandomId } from "../../../../../shared-ts/src/utils/secureRandomId.js";
-import { errorMessage } from "../../../../../shared-ts/src/utils/errors.js";
-import { coerceThemeMode } from "../../../../../shared-ts/src/utils/theme.js";
-import { parseAndValidateRegistrationCredentialConfirmationPayload } from "../../../workerManager/validation.js";
-import { UserConfirmationType } from "../../../stepUpConfirmation/userConfirmationType.js";
-import { UserConfirmMessageType } from "../../../stepUpConfirmation/channel/confirmTypes.js";
-import { assertNoForbiddenMainThreadSigningSecrets, getIntentDigest } from "./adapters/request.js";
-import { determineConfirmationConfig } from "../determineConfirmationConfig.js";
-import { parseTransactionSummary } from "../../../stepUpConfirmation/channel/confirmCommon.js";
-import { handleRegistrationFlow } from "./registration.js";
-//#region src/core/signingEngine/uiConfirm/handlers/flows/requestRegistrationCredentialConfirmation.ts
-async function requestRegistrationCredentialConfirmationOnMainThread({ ctx, surface, walletId, nearAccountId, signerSlot, confirmerText, confirmationConfig, challengeB64u, registrationOptions }) {
-	const request = buildRegistrationCredentialConfirmationRequest({
-		walletId,
-		nearAccountId,
-		signerSlot,
-		confirmerText,
-		confirmationConfig,
-		challengeB64u,
-		registrationOptions
-	});
-	assertNoForbiddenMainThreadSigningSecrets(request);
-	const decision = await runRegistrationFlowOnMainThread({
-		ctx,
-		surface,
-		request,
-		confirmationConfig: determineConfirmationConfig(ctx, request),
-		transactionSummary: buildRegistrationTransactionSummary(request),
-		theme: coerceThemeMode(ctx.getTheme?.()) ?? "dark"
-	});
-	return parseRegistrationCredentialDecision({
-		requestId: request.requestId,
-		decision
-	});
-}
-function buildRegistrationCredentialConfirmationRequest({ walletId, nearAccountId, signerSlot, confirmerText, confirmationConfig, challengeB64u, registrationOptions }) {
-	const requestId = secureRandomId("register", 32, "registration credential confirmation IDs");
-	const title = confirmerText?.title;
-	const body = confirmerText?.body;
-	const normalizedWalletId = String(walletId || "").trim();
-	const normalizedNearAccountId = String(nearAccountId || "").trim();
-	if (!normalizedWalletId) throw new Error("Registration credential confirmation requires walletId");
-	if (registrationOptions) return {
-		requestId,
-		type: UserConfirmationType.REGISTER_ACCOUNT,
-		summary: {
-			walletId: normalizedWalletId,
-			signerSlot,
-			...title != null ? { title } : {},
-			...body != null ? { body } : {}
-		},
-		payload: {
-			walletId: normalizedWalletId,
-			walletAddAuthMethodRegistration: registrationOptions
-		},
-		confirmationConfig,
-		intentDigest: `register:${normalizedWalletId}:${registrationOptions.challengeId}`
-	};
-	return {
-		requestId,
-		type: UserConfirmationType.REGISTER_ACCOUNT,
-		summary: {
-			walletId: normalizedWalletId,
-			...normalizedNearAccountId ? { nearAccountId: normalizedNearAccountId } : {},
-			signerSlot,
-			...title != null ? { title } : {},
-			...body != null ? { body } : {}
-		},
-		payload: {
-			walletId: normalizedWalletId,
-			...normalizedNearAccountId ? { nearAccountId: normalizedNearAccountId } : {},
-			signerSlot,
-			...challengeB64u ? { webauthnChallenge: {
-				kind: "intent_digest",
-				challengeB64u
-			} } : {}
-		},
-		confirmationConfig,
-		intentDigest: `register:${normalizedWalletId}:${signerSlot}`
-	};
-}
-function buildRegistrationTransactionSummary(request) {
-	const parsedSummary = parseTransactionSummary(request.summary);
-	const intentDigest = getIntentDigest(request);
-	return {
-		...parsedSummary,
-		...intentDigest ? { intentDigest } : {}
-	};
-}
-async function runRegistrationFlowOnMainThread({ ctx, surface, request, confirmationConfig, transactionSummary, theme }) {
-	let resolveDecision;
-	let rejectDecision;
-	let decisionSettled = false;
-	const decisionPromise = new Promise((resolve, reject) => {
-		resolveDecision = resolve;
-		rejectDecision = reject;
-	});
-	const flowPromise = handleRegistrationFlow(ctx, request, { postMessage: (message) => {
-		const decision = parseDirectRegistrationDecisionMessage(message, request.requestId);
-		if (decision.ok) {
-			resolveDecision(decision.value);
-			return;
-		}
-		rejectDecision(new Error(decision.message));
-	} }, {
-		confirmationConfig,
-		transactionSummary,
-		theme,
-		surface
-	}).then(() => {
-		if (!decisionSettled) rejectDecision(/* @__PURE__ */ new Error("Registration confirmation completed without a decision"));
-	}, (error) => {
-		rejectDecision(new Error(errorMessage(error) || "Registration confirmation failed"));
-	});
-	const decision = await decisionPromise;
-	decisionSettled = true;
-	await flowPromise;
-	return decision;
-}
-function parseDirectRegistrationDecisionMessage(message, expectedRequestId) {
-	if (!isObject(message)) return {
-		ok: false,
-		message: "Registration confirmation returned a malformed response"
-	};
-	const envelope = message;
-	if (envelope.type !== UserConfirmMessageType.USER_PASSKEY_CONFIRM_RESPONSE) return {
-		ok: false,
-		message: "Registration confirmation returned an unexpected response type"
-	};
-	if ((isString(envelope.requestId) ? envelope.requestId.trim() : "") !== expectedRequestId) return {
-		ok: false,
-		message: "Registration confirmation response requestId mismatch"
-	};
-	if (!isObject(envelope.data)) return {
-		ok: false,
-		message: "Registration confirmation returned missing decision data"
-	};
-	const data = envelope.data;
-	const decisionRequestId = isString(data.requestId) ? data.requestId.trim() : "";
-	if (decisionRequestId !== expectedRequestId) return {
-		ok: false,
-		message: "Registration confirmation decision requestId mismatch"
-	};
-	if (!isBoolean(data.confirmed)) return {
-		ok: false,
-		message: "Registration confirmation returned invalid decision state"
-	};
-	return {
-		ok: true,
-		value: {
-			requestId: decisionRequestId,
-			confirmed: data.confirmed,
-			...isString(data.intentDigest) ? { intentDigest: data.intentDigest } : {},
-			...data.credential ? { credential: data.credential } : {},
-			...data.transactionContext ? { transactionContext: data.transactionContext } : {},
-			...data.registrationDiagnostics ? { registrationDiagnostics: data.registrationDiagnostics } : {},
-			...isString(data.error) ? { error: data.error } : {}
-		}
-	};
-}
-function parseRegistrationCredentialDecision({ requestId, decision }) {
-	if (!decision.confirmed) throw new Error(decision.error || "User rejected registration request");
-	if (!decision.credential) throw new Error("Missing credential from registration confirmation");
-	return parseAndValidateRegistrationCredentialConfirmationPayload({
-		confirmed: decision.confirmed,
-		requestId,
-		intentDigest: decision.intentDigest || "",
-		credential: decision.credential,
-		transactionContext: decision.transactionContext,
-		registrationDiagnostics: decision.registrationDiagnostics,
-		error: decision.error
-	});
-}
-//#endregion
-export { requestRegistrationCredentialConfirmationOnMainThread };
-
-//# sourceMappingURL=requestRegistrationCredentialConfirmation.js.map