@tatchi-xyz/sdk 0.21.0 → 0.31.1

package/dist/cjs/server/core/AuthService.js

@@ -1,12 +1,17 @@
 const require_rolldown_runtime = require('../_virtual/rolldown_runtime.js');
+const require_validation = require('../sdk/src/utils/validation.js');
 const require_config = require('./config.js');
 const require_actions = require('../sdk/src/core/types/actions.js');
+const require_base64 = require('../sdk/src/utils/base64.js');
+const require_errors = require('../sdk/src/utils/errors.js');
 const require_NearClient = require('../sdk/src/core/NearClient.js');
-const require_nearCrypto = require('../sdk/src/core/nearCrypto.js');
+const require_nearKeys = require('./nearKeys.js');
 const require_utils = require('./utils.js');
-const require_errors = require('./errors.js');
+const require_errors$1 = require('./errors.js');
 const require_defaultConfigs = require('../sdk/src/core/defaultConfigs.js');
+const require_config$1 = require('./ThresholdService/config.js');
 const require_logger = require('./logger.js');
+const require_createThresholdSigningService = require('./ThresholdService/createThresholdSigningService.js');
 const require_index = require('../email-recovery/index.js');
 const require_ShamirService = require('./ShamirService.js');
 const require_index$1 = require('../delegateAction/index.js');
@@ -14,6 +19,53 @@ let src_wasm_signer_worker_pkg_wasm_signer_worker_js = require("../../wasm_signe
 src_wasm_signer_worker_pkg_wasm_signer_worker_js = require_rolldown_runtime.__toESM(src_wasm_signer_worker_pkg_wasm_signer_worker_js);
 
 //#region src/server/core/AuthService.ts
+function isObject(v) {
+	return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function normalizeU8ArrayLike(input, fieldName) {
+	if (input instanceof Uint8Array) return Array.from(input);
+	if (typeof input === "string") try {
+		return Array.from(require_base64.base64UrlDecode(input));
+	} catch (err) {
+		throw new Error(`Invalid ${fieldName}: expected base64url string (${require_errors.errorMessage(err) || "decode failed"})`);
+	}
+	if (Array.isArray(input)) {
+		const out = [];
+		for (const v of input) {
+			const n = Number(v);
+			if (!Number.isFinite(n) || n < 0 || n > 255) throw new Error(`Invalid ${fieldName}: expected byte array (0..255)`);
+			out.push(Math.floor(n));
+		}
+		return out;
+	}
+	throw new Error(`Invalid ${fieldName}: expected number[] or base64url string`);
+}
+function normalizeContractVrfDataForContract(input) {
+	if (!isObject(input)) throw new Error("Missing or invalid vrf_data");
+	const user_id = require_validation.toOptionalTrimmedString(input.user_id);
+	const rp_id = require_validation.toOptionalTrimmedString(input.rp_id);
+	const block_height_raw = input.block_height;
+	const block_height = typeof block_height_raw === "number" ? block_height_raw : Number(block_height_raw);
+	if (!user_id) throw new Error("Missing vrf_data.user_id");
+	if (!rp_id) throw new Error("Missing vrf_data.rp_id");
+	if (!Number.isFinite(block_height) || block_height <= 0) throw new Error("Invalid vrf_data.block_height");
+	const base = {
+		vrf_input_data: normalizeU8ArrayLike(input.vrf_input_data, "vrf_data.vrf_input_data"),
+		vrf_output: normalizeU8ArrayLike(input.vrf_output, "vrf_data.vrf_output"),
+		vrf_proof: normalizeU8ArrayLike(input.vrf_proof, "vrf_data.vrf_proof"),
+		public_key: normalizeU8ArrayLike(input.public_key, "vrf_data.public_key"),
+		user_id,
+		rp_id,
+		block_height,
+		block_hash: normalizeU8ArrayLike(input.block_hash, "vrf_data.block_hash"),
+		intent_digest_32: normalizeU8ArrayLike(input.intent_digest_32, "vrf_data.intent_digest_32")
+	};
+	if (Object.prototype.hasOwnProperty.call(input, "session_policy_digest_32")) {
+		const v = input.session_policy_digest_32;
+		if (v != null) base.session_policy_digest_32 = normalizeU8ArrayLike(v, "vrf_data.session_policy_digest_32");
+	}
+	return base;
+}
 const SIGNER_WASM_MAIN_PATH = "../../wasm_signer_worker/pkg/wasm_signer_worker_bg.wasm";
 const SIGNER_WASM_FALLBACK_PATH = "../../../workers/wasm_signer_worker_bg.wasm";
 function getSignerWasmUrls(logger) {
@@ -29,6 +81,34 @@ function getSignerWasmUrls(logger) {
 	if (!resolved.length) throw new Error("Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.");
 	return resolved;
 }
+function summarizeThresholdEd25519Config(cfg) {
+	if (!cfg) return "thresholdEd25519: not configured";
+	const nodeRole = require_config$1.coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);
+	const shareMode = require_config$1.coerceThresholdEd25519ShareMode(cfg.THRESHOLD_ED25519_SHARE_MODE);
+	const masterSecretSet = (() => {
+		if ("kind" in cfg) return false;
+		return Boolean(require_validation.toOptionalTrimmedString(cfg.THRESHOLD_ED25519_MASTER_SECRET_B64U));
+	})();
+	const store = (() => {
+		if ("kind" in cfg) {
+			if (cfg.kind === "upstash-redis-rest") return "upstash";
+			if (cfg.kind === "redis-tcp") return "redis";
+			return "in-memory";
+		}
+		const upstashUrl = require_validation.toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_URL);
+		const upstashToken = require_validation.toOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_TOKEN);
+		const redisUrl = require_validation.toOptionalTrimmedString(cfg.REDIS_URL);
+		return upstashUrl || upstashToken ? "upstash" : redisUrl ? "redis" : "in-memory";
+	})();
+	const parts = [
+		`thresholdEd25519: configured`,
+		`nodeRole=${nodeRole}`,
+		`shareMode=${shareMode}`,
+		`store=${store}`
+	];
+	if (masterSecretSet) parts.push("masterSecret=set");
+	return parts.join(" ");
+}
 /**
 * Framework-agnostic NEAR account service
 * Core business logic for account creation and registration operations
@@ -40,6 +120,8 @@ var AuthService = class {
 	relayerPublicKey = "";
 	signerWasmReady = false;
 	logger;
+	thresholdSigningServiceInitialized = false;
+	thresholdSigningService = null;
 	transactionQueue = Promise.resolve();
 	queueStats = {
 		pending: 0,
@@ -50,7 +132,7 @@ var AuthService = class {
 	emailRecovery = null;
 	constructor(config) {
 		this.config = require_config.createAuthServiceConfig(config);
-		this.logger = require_logger.normalizeLogger(this.config.logger);
+		this.logger = require_logger.coerceLogger(this.config.logger);
 		const graceFileCandidate = (this.config.shamir?.graceShamirKeysFile || "").trim();
 		this.shamirService = new require_ShamirService.ShamirService(this.config.shamir, graceFileCandidate || "grace-keys.json");
 		this.nearClient = new require_NearClient.MinimalNearClient(this.config.nearRpcUrl);
@@ -77,6 +159,7 @@ var AuthService = class {
     • accountInitialBalance: ${this.config.accountInitialBalance} (${require_utils.formatYoctoToNear(this.config.accountInitialBalance)} NEAR)
     • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${require_utils.formatGasToTGas(this.config.createAccountAndRegisterGas)})
     ${this.config.shamir ? `• shamir_p_b64u: ${this.config.shamir.shamir_p_b64u.slice(0, 10)}...\n    • shamir_e_s_b64u: ${this.config.shamir.shamir_e_s_b64u.slice(0, 10)}...\n    • shamir_d_s_b64u: ${this.config.shamir.shamir_d_s_b64u.slice(0, 10)}...` : "• shamir: not configured"}
+    • ${summarizeThresholdEd25519Config(this.config.thresholdEd25519KeyStore)}
     ${this.config.zkEmailProver?.baseUrl ? `• zkEmailProver: ${this.config.zkEmailProver.baseUrl}` : `• zkEmailProver: not configured`}
     `);
 	}
@@ -87,6 +170,36 @@ var AuthService = class {
 			publicKey: this.relayerPublicKey
 		};
 	}
+	async viewAccessKeyList(accountId) {
+		await this._ensureSignerAndRelayerAccount();
+		return this.nearClient.viewAccessKeyList(accountId);
+	}
+	/**
+	* Lazily constructs the threshold signing service when `thresholdEd25519KeyStore` is configured.
+	* Routers may call this to auto-enable `/threshold-ed25519/*` endpoints.
+	*/
+	getThresholdSigningService() {
+		if (this.thresholdSigningServiceInitialized) return this.thresholdSigningService;
+		this.thresholdSigningServiceInitialized = true;
+		if (!this.config.thresholdEd25519KeyStore) {
+			this.thresholdSigningService = null;
+			return null;
+		}
+		this.thresholdSigningService = require_createThresholdSigningService.createThresholdSigningService({
+			authService: this,
+			thresholdEd25519KeyStore: this.config.thresholdEd25519KeyStore,
+			logger: this.logger,
+			isNode: this.isNodeEnvironment()
+		});
+		return this.thresholdSigningService;
+	}
+	getWebAuthnContractId() {
+		return this.config.webAuthnContractId;
+	}
+	async txStatus(txHash, senderAccountId) {
+		await this._ensureSignerAndRelayerAccount();
+		return this.nearClient.txStatus(txHash, senderAccountId);
+	}
 	/**
 	* Configure Shamir WASM module override for serverless environments
 	* Required for Cloudflare Workers where import.meta.url doesn't work
@@ -103,8 +216,7 @@ var AuthService = class {
 			await this.shamirService.ensureReady();
 		}
 		try {
-			const { seed, pub } = require_nearCrypto.parseNearSecretKey(this.config.relayerPrivateKey);
-			this.relayerPublicKey = require_nearCrypto.toPublicKeyString(pub);
+			this.relayerPublicKey = require_nearKeys.toPublicKeyStringFromSecretKey(this.config.relayerPrivateKey);
 		} catch (e) {
 			this.logger.warn("Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format");
 			this.relayerPublicKey = "";
@@ -153,8 +265,11 @@ var AuthService = class {
 		}
 	}
 	isNodeEnvironment() {
-		const isNode = Boolean(globalThis.process?.versions?.node);
-		const isCloudflareWorker = typeof globalThis.WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent?.includes?.("Cloudflare-Workers");
+		const processObj = globalThis.process;
+		const isNode = Boolean(processObj?.versions?.node);
+		const webSocketPair = globalThis.WebSocketPair;
+		const nav = globalThis.navigator;
+		const isCloudflareWorker = typeof webSocketPair !== "undefined" || typeof nav?.userAgent === "string" && nav.userAgent.includes("Cloudflare-Workers");
 		return isNode && !isCloudflareWorker;
 	}
 	async resolveSignerWasmOverride(override) {
@@ -172,8 +287,8 @@ var AuthService = class {
 		for (const url of candidates) try {
 			const filePath = fileURLToPath(url);
 			const bytes = await readFile(filePath);
-			const u8 = bytes instanceof Uint8Array ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength) : new Uint8Array(bytes);
-			const ab = u8.buffer.slice(u8.byteOffset, u8.byteOffset + u8.byteLength);
+			const ab = new ArrayBuffer(bytes.byteLength);
+			new Uint8Array(ab).set(bytes);
 			const module$1 = await WebAssembly.compile(ab);
 			await (0, src_wasm_signer_worker_pkg_wasm_signer_worker_js.default)({ module_or_path: module$1 });
 			return;
@@ -198,7 +313,7 @@ var AuthService = class {
 		await this._ensureSignerAndRelayerAccount();
 		return this.queueTransaction(async () => {
 			try {
-				if (!this.isValidAccountId(request.accountId)) throw new Error(`Invalid account ID format: ${request.accountId}`);
+				if (!require_validation.isValidAccountId(request.accountId)) throw new Error(`Invalid account ID format: ${request.accountId}`);
 				this.logger.info(`Checking if account ${request.accountId} already exists...`);
 				const accountExists = await this.checkAccountExists(request.accountId);
 				if (accountExists) throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);
@@ -210,7 +325,7 @@ var AuthService = class {
 					{ action_type: require_actions.ActionType.CreateAccount },
 					{
 						action_type: require_actions.ActionType.Transfer,
-						deposit: initialBalance
+						deposit: String(initialBalance)
 					},
 					{
 						action_type: require_actions.ActionType.AddKey,
@@ -242,10 +357,11 @@ var AuthService = class {
 				};
 			} catch (error) {
 				this.logger.error(`Account creation failed for ${request.accountId}:`, error);
+				const msg = require_errors.errorMessage(error) || "Unknown account creation error";
 				return {
 					success: false,
-					error: error.message || "Unknown account creation error",
-					message: `Failed to create account ${request.accountId}: ${error.message}`
+					error: msg,
+					message: `Failed to create account ${request.accountId}: ${msg}`
 				};
 			}
 		}, `create account ${request.accountId}`);
@@ -257,27 +373,25 @@ var AuthService = class {
 		await this._ensureSignerAndRelayerAccount();
 		return this.queueTransaction(async () => {
 			try {
-				if (!this.isValidAccountId(request.new_account_id)) throw new Error(`Invalid account ID format: ${request.new_account_id}`);
-				this.logger.info(`Checking if account ${request.new_account_id} already exists...`);
-				const accountExists = await this.checkAccountExists(request.new_account_id);
-				if (accountExists) throw new Error(`Account ${request.new_account_id} already exists. Cannot create duplicate account.`);
-				this.logger.info(`Account ${request.new_account_id} is available for atomic creation and registration`);
+				if (!require_validation.isValidAccountId(request.new_account_id)) throw new Error(`Invalid account ID format: ${request.new_account_id}`);
 				this.logger.info(`Registering account: ${request.new_account_id}`);
 				this.logger.info(`Contract: ${this.config.webAuthnContractId}`);
+				const vrf_data = normalizeContractVrfDataForContract(request.vrf_data);
+				const deterministic_vrf_public_key = normalizeU8ArrayLike(request.deterministic_vrf_public_key, "deterministic_vrf_public_key");
 				const contractArgs = {
 					new_account_id: request.new_account_id,
 					new_public_key: request.new_public_key,
-					vrf_data: request.vrf_data,
+					vrf_data,
 					webauthn_registration: request.webauthn_registration,
-					deterministic_vrf_public_key: request.deterministic_vrf_public_key,
+					deterministic_vrf_public_key,
 					authenticator_options: request.authenticator_options
 				};
 				const actions = [{
 					action_type: require_actions.ActionType.FunctionCall,
 					method_name: "create_account_and_register_user",
 					args: JSON.stringify(contractArgs),
-					gas: this.config.createAccountAndRegisterGas,
-					deposit: this.config.accountInitialBalance
+					gas: String(this.config.createAccountAndRegisterGas),
+					deposit: String(this.config.accountInitialBalance)
 				}];
 				actions.forEach(require_actions.validateActionArgsWasm);
 				const { nextNonce, blockHash } = await this.fetchTxContext(this.config.relayerAccountId, this.relayerPublicKey);
@@ -290,7 +404,7 @@ var AuthService = class {
 					actions
 				});
 				const result = await this.nearClient.sendTransaction(signed);
-				const contractError = require_errors.parseContractExecutionError(result, request.new_account_id);
+				const contractError = require_errors$1.parseContractExecutionError(result, request.new_account_id);
 				if (contractError) {
 					this.logger.error(`Contract execution failed for ${request.new_account_id}:`, contractError);
 					throw new Error(contractError);
@@ -304,10 +418,11 @@ var AuthService = class {
 				};
 			} catch (error) {
 				this.logger.error(`Atomic registration failed for ${request.new_account_id}:`, error);
+				const msg = require_errors.errorMessage(error) || "Unknown atomic registration error";
 				return {
 					success: false,
-					error: error.message || "Unknown atomic registration error",
-					message: `Failed to create and register account ${request.new_account_id}: ${error.message}`
+					error: msg,
+					message: `Failed to create and register account ${request.new_account_id}: ${msg}`
 				};
 			}
 		}, `atomic create and register ${request.new_account_id}`);
@@ -320,6 +435,22 @@ var AuthService = class {
 	async verifyAuthenticationResponse(request) {
 		try {
 			await this._ensureSignerAndRelayerAccount();
+			const intentDigest32 = request?.vrf_data?.intent_digest_32;
+			if (!Array.isArray(intentDigest32) || intentDigest32.length !== 32) return {
+				success: false,
+				verified: false,
+				code: "invalid_intent_digest",
+				message: "Missing or invalid vrf_data.intent_digest_32 (expected 32 bytes)"
+			};
+			const sessionPolicyDigest32 = (request?.vrf_data)?.session_policy_digest_32;
+			if (sessionPolicyDigest32 !== void 0) {
+				if (!Array.isArray(sessionPolicyDigest32) || sessionPolicyDigest32.length !== 32) return {
+					success: false,
+					verified: false,
+					code: "invalid_session_policy_digest",
+					message: "Invalid vrf_data.session_policy_digest_32 (expected 32 bytes when present)"
+				};
+			}
 			const args = {
 				vrf_data: request.vrf_data,
 				webauthn_authentication: request.webauthn_authentication
@@ -329,7 +460,7 @@ var AuthService = class {
 				method: "verify_authentication_response",
 				args
 			});
-			const verified = Boolean(contractResponse && contractResponse.verified === true);
+			const verified = isObject(contractResponse) && contractResponse.verified === true;
 			if (!verified) return {
 				success: false,
 				verified: false,
@@ -362,23 +493,9 @@ var AuthService = class {
 	* Returns a sanitized, deduplicated list of absolute origins.
 	*/
 	async getRorOrigins(opts) {
-		const contractId = (opts?.contractId || this.config.webAuthnContractId).trim();
-		const method = (opts?.method || "get_allowed_origins").trim();
+		const contractId = require_validation.toOptionalTrimmedString(opts?.contractId) || this.config.webAuthnContractId.trim();
+		const method = require_validation.toOptionalTrimmedString(opts?.method) || "get_allowed_origins";
 		const args = opts?.args ?? {};
-		const isValidOrigin = (s) => {
-			if (typeof s !== "string" || !s) return null;
-			try {
-				const u = new URL(s.trim());
-				const scheme = u.protocol;
-				const host = u.hostname.toLowerCase();
-				const port = u.port ? `:${u.port}` : "";
-				if (scheme !== "https:" && !(scheme === "http:" && host === "localhost")) return null;
-				if (u.pathname && u.pathname !== "/" || u.search || u.hash) return null;
-				return `${scheme}//${host}${port}`;
-			} catch {
-				return null;
-			}
-		};
 		try {
 			const result = await this.nearClient.view({
 				account: contractId,
@@ -387,10 +504,10 @@ var AuthService = class {
 			});
 			let list = [];
 			if (Array.isArray(result)) list = result;
-			else if (result && typeof result === "object" && Array.isArray(result.origins)) list = result.origins;
+			else if (isObject(result) && Array.isArray(result.origins)) list = result.origins;
 			const out = /* @__PURE__ */ new Set();
 			for (const item of list) {
-				const norm = isValidOrigin(item);
+				const norm = require_validation.toRorOriginOrNull(item);
 				if (norm) out.add(norm);
 			}
 			return Array.from(out);
@@ -399,11 +516,6 @@ var AuthService = class {
 			return [];
 		}
 	}
-	isValidAccountId(accountId) {
-		if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
-		const validPattern = /^[a-z0-9_.-]+$/;
-		return validPattern.test(accountId);
-	}
 	/**
 	* Account existence helper used by registration flows.
 	*/
@@ -417,17 +529,16 @@ var AuthService = class {
 			const view = await this.nearClient.viewAccount(accountId);
 			return !!view;
 		} catch (error) {
-			lastErr = error;
-			const msg = String(error?.message || "");
-			const detailsBlob = (() => {
-				try {
-					const d = error && typeof error === "object" && "details" in error ? error.details : void 0;
-					if (!d) return "";
-					return typeof d === "string" ? d : JSON.stringify(d);
-				} catch {
-					return "";
-				}
-			})();
+			const err = require_errors.toError(error);
+			lastErr = err;
+			const msg = err.message;
+			const details = err.details;
+			let detailsBlob = "";
+			if (details) try {
+				detailsBlob = typeof details === "string" ? details : JSON.stringify(details);
+			} catch {
+				detailsBlob = "";
+			}
 			const combined = `${msg}\n${detailsBlob}`;
 			if (isNotFound(combined)) return false;
 			if (isRetryable(msg) && i < attempts) {
@@ -439,10 +550,10 @@ var AuthService = class {
 				this.logger.warn(`[AuthService] Assuming account '${accountId}' not found after retryable RPC errors:`, msg);
 				return false;
 			}
-			this.logger.error(`Error checking account existence for ${accountId}:`, error);
-			throw error;
+			this.logger.error(`Error checking account existence for ${accountId}:`, err);
+			throw err;
 		}
-		throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+		throw lastErr || /* @__PURE__ */ new Error("Unknown error");
 	}
 	/**
 	* ===== Delegate actions & transaction execution =====
@@ -508,7 +619,18 @@ var AuthService = class {
 				actions: input.actions
 			}
 		};
-		const response = await (0, src_wasm_signer_worker_pkg_wasm_signer_worker_js.handle_signer_message)(message);
+		let response;
+		try {
+			response = await (0, src_wasm_signer_worker_pkg_wasm_signer_worker_js.handle_signer_message)(message);
+		} catch (e) {
+			const msg = require_errors.errorMessage(e);
+			this.logger.error("Signer WASM rejected message:", {
+				error: msg,
+				payload: JSON.stringify(message, (key, value) => key === "nearPrivateKey" ? "[REDACTED]" : value)
+			});
+			if (msg.includes("Invalid payload for SIGN_TRANSACTION_WITH_KEYPAIR")) throw new Error(`Signer WASM rejected SIGN_TRANSACTION_WITH_KEYPAIR payload: ${msg}. Rebuild + redeploy the relayer so the bundled \`wasm_signer_worker.js\` and \`wasm_signer_worker_bg.wasm\` come from the same build.`);
+			throw e instanceof Error ? e : new Error(msg || "Signing failed");
+		}
 		const { transaction, signature, borshBytes } = extractFirstSignedTransactionFromWorkerResponse(response);
 		return new require_NearClient.SignedTransaction({
 			transaction,
@@ -586,7 +708,7 @@ var AuthService = class {
 			} catch (error) {
 				this.queueStats.failed++;
 				this.queueStats.pending--;
-				this.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, error?.message);
+				this.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, require_errors.errorMessage(error) || "unknown error");
 				throw error;
 			}
 		}).catch((error) => {