@seams/wallet-server 0.26.0 → 0.28.0

package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js

@@ -1,7 +1,7 @@
 import { parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.ts
 const STRICT_ECDSA_REGISTRATION_PATH = "/router-ab/ecdsa-derivation/register";
 const STRICT_ECDSA_ADD_SIGNER_PATH = "/router-ab/ecdsa-derivation/add-signer";

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -1,21 +1,21 @@
 import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { parseWebAuthnAuthenticationCredential, webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { createRouterApiModule } from "../../../framework/modules.js";

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -2,10 +2,10 @@ import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
+import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 //#region src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.ts
 function requireThresholdEd25519SessionId(value, label) {

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js

@@ -1,6 +1,6 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { sameRouterAbEd25519YaoByteSequence } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js

@@ -1,8 +1,8 @@
 import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.ts
 const INTERNAL_AUTH_HEADER = "x-router-ab-internal-service-auth";

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js

@@ -1,8 +1,8 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.ts
 function resolveTraceContext(request) {

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -1,7 +1,7 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { computeAddSignerNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.ts

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -1,8 +1,8 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
+import "../../../shared-ts/src/utils/encoders.js";
 import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts

package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js

@@ -1,12 +1,12 @@
 import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, routerAbEcdsaDerivationActiveStateId, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { authorizedOperationReplayBodyInit } from "../../../authorization/domain.js";
-import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../auth/commonRouterUtils.js";
 import { signingPrepareSessionResponse } from "./signingPrepareSession.js";

package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { buildNearEd25519MpcOperationRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { validateRouterAbEd25519WalletSessionInputs } from "../../auth/commonRouterUtils.js";

package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js

@@ -1,7 +1,7 @@
 import { parseProviderSubject } from "../../../shared-ts/src/utils/domainIds.js";
-import { parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin } from "../../../authorization/domain.js";

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -1,6 +1,6 @@
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, isTenantRootIdentityFieldCanonicalV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/domains/tenantRoot/tenantRootIdentityResolution.ts
 const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1 = [

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -1,7 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
 import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
 //#region src/router/domains/walletRegistration/walletRegistrationReservation.ts

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1,22 +1,23 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../authorization/domain.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { recordRegistrationServerTiming, registrationServerTimingHeaders } from "../../framework/registrationTiming.js";
 import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
-import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveWalletRegistrationContext } from "../../auth/routerApiCredentialAuth.js";
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
@@ -28,7 +29,6 @@ import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../..
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -1,12 +1,12 @@
 import { parseEmailOtpChallengeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
+import { parseAuthFactorId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId, projectActiveWalletSession } from "../../../authorization/domain.js";
 import { buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
-import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../threshold/statusCodes.js";

package/dist/esm/router/framework/http.js

@@ -1,7 +1,7 @@
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 } from "../../shared-ts/src/device-linking/requestProof.js";
 import "../../shared-ts/src/device-linking/index.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
 import { buildCorsOrigins, normalizeCorsOrigin } from "../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbTraceContext.js";
 import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../shared-ts/src/utils/walletManagementProtocol.js";

package/dist/esm/router/framework/routeDefinitions.js

@@ -1,5 +1,6 @@
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH } from "../../shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH } from "../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { externalAuthRoutes } from "../transport/fetch/routes/externalAuth.js";
 import { ROUTER_AB_ED25519_HEALTH_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../shared-ts/src/utils/signingSessionSeal.js";
 import { buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, resolveSigningSessionSealBasePath } from "../../threshold/session/signingSessionSeal/transport/shared.js";
 import { API_CREDENTIAL_ROUTE_SCOPES, API_CREDENTIAL_TYPES, PUBLIC_PROOF_TYPES } from "./routeAuthPolicy.js";
@@ -222,7 +223,7 @@ function apiCredentialRoute(id, method, path, summary, auth, metering, requiredS
 }
 function createRouterApiRouteDefinitions(options = {}) {
 	const signingSessionSealBasePath = resolveSigningSessionSealBasePath(options.signingSessionSealBasePath);
-	const definitions = [];
+	const definitions = externalAuthRoutes();
 	if (options.enableHealthz) definitions.push(publicRoute("router_api_healthz", "GET", "/healthz", "Router API health probe", {
 		plane: "public",
 		rationale: "Health probes are intentionally public diagnostics."

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -1,13 +1,14 @@
-import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { json, jsonFailure, withCors } from "../../framework/http.js";
+import { handleExternalAuth } from "./routes/externalAuth.js";
+import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
 import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
-import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
 import { handleWalletRegistration } from "./routes/walletRegistration.js";
 import { handleWalletVoiceIdActivation } from "./routes/walletVoiceIdActivation.js";
@@ -224,6 +225,7 @@ function createFetchRouter(service, opts, runtime) {
 		handleWalletRecoveryRotate,
 		handleWalletRecoveryRead,
 		handleWalletRecoveryStatus,
+		handleExternalAuth,
 		handleAuth,
 		handleSyncAccount,
 		handleOwnerWalletExecutionLanePreflight,

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,7 +1,7 @@
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
-import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { json, jsonFailure, readJson } from "../../../framework/http.js";
+import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
 //#region src/router/transport/fetch/routes/auth.ts
 function assertNeverAuthProviderAction(route) {

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -11,11 +11,11 @@ import { parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDevic
 import { parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
-import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
-import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../../auth/routerApiKeyAuth.js";
-import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
+import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { json, readJson } from "../../../framework/http.js";
+import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
+import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
 import { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse } from "./deviceLinkingResponses.js";
 import { linkedDeviceBootstrapFailure } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { parseLinkedDeviceRequestProofV1 } from "../../../../core/deviceLinking/requestProof.js";

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,6 +1,6 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, buildVoiceIdWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -1,9 +1,9 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { json } from "../../../framework/http.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";

package/dist/esm/router/transport/fetch/routes/externalAuth.js

@@ -0,0 +1,244 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { EXTERNAL_AUTH_PATH, externalAuthFailure, parseExternalAuthConfiguration } from "../../../../shared-ts/src/auth/externalAuth.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { json, readJson } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/externalAuth.ts
+const ACTIONS = [
+	"associate",
+	"unlink",
+	"prepare",
+	"exchange",
+	"backend-exchange",
+	"redeem",
+	"settings",
+	"logout"
+];
+function parseCommand(action, body) {
+	const wallet = parseWalletId(body.walletId);
+	if (!wallet.ok) throw new Error("Wallet ID is invalid");
+	const walletId = wallet.value;
+	if (action === "backend-exchange") return {
+		action,
+		walletId,
+		attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+		idToken: requireCanonicalString(body.idToken, "idToken")
+	};
+	const appOrigin = requireCanonicalString(body.appOrigin, "appOrigin");
+	if (new URL(appOrigin).origin !== appOrigin) throw new Error("Application origin is invalid");
+	switch (action) {
+		case "associate": return {
+			action,
+			walletId,
+			appOrigin,
+			ownerCredential: requireCanonicalString(body.ownerCredential, "ownerCredential"),
+			idToken: requireCanonicalString(body.idToken, "idToken")
+		};
+		case "unlink": return {
+			action,
+			walletId,
+			appOrigin,
+			ownerCredential: requireCanonicalString(body.ownerCredential, "ownerCredential"),
+			associationId: requireCanonicalString(body.associationId, "associationId")
+		};
+		case "prepare": return {
+			action,
+			walletId,
+			appOrigin,
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		case "exchange": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			idToken: requireCanonicalString(body.idToken, "idToken")
+		};
+		case "redeem": return {
+			action,
+			walletId,
+			appOrigin,
+			attemptId: requireCanonicalString(body.attemptId, "attemptId"),
+			binding: secret(body.binding, "binding"),
+			sessionToken: secret(body.sessionToken, "sessionToken"),
+			code: secret(body.code, "code")
+		};
+		case "settings":
+		case "logout": return {
+			action,
+			walletId,
+			appOrigin,
+			sessionToken: secret(body.sessionToken, "sessionToken")
+		};
+		default: return assertNever(action);
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unsupported external authentication action: ${String(value)}`);
+}
+function externalAuthRoutes() {
+	return ACTIONS.map(externalAuthRoute);
+}
+function externalAuthRoute(action) {
+	return {
+		id: `external_auth_${action}`,
+		surface: "relay",
+		method: "POST",
+		path: `${EXTERNAL_AUTH_PATH}/${action}`,
+		auth: {
+			plane: "public",
+			proof: "challenge_exchange",
+			rationale: "Application credentials and scoped external identity evidence are verified by the handler."
+		},
+		metering: { kind: "none" },
+		summary: "External authentication for wallet settings"
+	};
+}
+function parseAction(pathname) {
+	for (const action of ACTIONS) if (pathname === `/wallet/external-auth/${action}`) return action;
+	return null;
+}
+function secret(value, label) {
+	const text = requireCanonicalString(value, label);
+	if (!/^[A-Za-z0-9_-]{43}$/.test(text)) throw new Error(`${label} must contain 32 random bytes`);
+	return text;
+}
+function failure(status, code) {
+	return json(externalAuthFailure(code), {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+async function resolveApplicationTrust(ctx, service, command) {
+	const credential = extractBearerCredential(ctx.request.headers);
+	if (!credential) return null;
+	const scope = service.store.scope;
+	if (ctx.request.headers.get("x-seams-environment-id") !== scope.envId) return null;
+	const result = command.action === "backend-exchange" ? await ctx.opts.apiKeyAuth?.authenticate({
+		secret: credential,
+		endpoint: ctx.pathname,
+		requiredScopes: ["wallets.read"],
+		environmentId: scope.envId
+	}) : await ctx.opts.publishableKeyAuth?.authenticate({
+		secret: credential,
+		origin: ctx.request.headers.get("origin") || "",
+		environmentId: scope.envId
+	});
+	if (!result?.ok || result.principal.orgId !== scope.orgId || result.principal.projectId !== scope.projectId || result.principal.environmentId !== scope.envId) return null;
+	if (command.action !== "backend-exchange") {
+		const parent = await ctx.opts.publishableKeyAuth?.authenticate({
+			secret: credential,
+			origin: command.appOrigin,
+			environmentId: scope.envId
+		});
+		if (!parent?.ok || parent.principal.apiKeyId !== result.principal.apiKeyId) return null;
+	}
+	const environment = (await ctx.opts.orgProjectEnv?.listEnvironments({
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environmentId: scope.envId,
+		actorUserId: result.principal.apiKeyId,
+		roles: []
+	}, { status: "ACTIVE" }))?.find(matchesEnvironment.bind(null, scope.envId));
+	const configuration = parseExternalAuthConfiguration(environment?.externalAuth ?? {
+		kind: "disabled",
+		revision: 0
+	});
+	return configuration.kind === "google" ? configuration : null;
+}
+function matchesEnvironment(environmentId, environment) {
+	return environment.id === environmentId;
+}
+async function handleExternalAuth(ctx) {
+	const action = parseAction(ctx.pathname);
+	if (!action) return null;
+	if (ctx.method !== "POST") return failure(405, "invalid_request");
+	const service = ctx.service.externalAuth;
+	if (!service) return failure(503, "unavailable");
+	let command;
+	try {
+		command = parseCommand(action, requireRecord(await readJson(ctx.request), "external authentication request"));
+	} catch {
+		return failure(400, "invalid_request");
+	}
+	try {
+		const trust = await resolveApplicationTrust(ctx, service, command);
+		if (!trust) return failure(403, "access_denied");
+		return await dispatch(ctx, service, trust, command);
+	} catch {
+		return failure(503, "unavailable");
+	}
+}
+async function dispatch(ctx, service, trust, command) {
+	const walletId = command.walletId;
+	const originBinding = JSON.stringify([ctx.request.headers.get("origin") || "", command.appOrigin]);
+	if (command.action === "prepare" || command.action === "exchange" || command.action === "backend-exchange" || command.action === "associate") {
+		const rateKey = await sha256HexUtf8(resolveSourceIpFromFetchHeaders(ctx.request.headers) || "unknown");
+		if (!await service.store.consumeAuthenticationAllowance(rateKey, Date.now())) return failure(429, "rate_limited");
+	}
+	if (command.action === "associate" || command.action === "unlink") {
+		const token = command.ownerCredential;
+		const owner = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: ctx.service.authorizationSessions.tenantId,
+			token,
+			nowMs: Date.now()
+		});
+		if (!owner || owner.authorization.session.walletId !== walletId || !sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: owner.authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }))) return failure(403, "access_denied");
+		if (command.action === "unlink") {
+			await service.store.revokeAssociation(walletId, command.associationId);
+			return json({ ok: true });
+		}
+		const proof = await service.verifyGoogle(trust, command.idToken);
+		if (!proof.ok) return json(proof, { status: 403 });
+		return await service.store.associate({
+			walletId,
+			subject: proof.value.subject,
+			authorityId: owner.authority.authorityId,
+			authorityEpoch: owner.authority.revocationEpoch
+		}) ? json({ ok: true }) : failure(409, "access_denied");
+	}
+	if (command.action === "prepare") return json(await service.prepare({
+		walletId,
+		originBinding,
+		binding: command.binding,
+		sessionToken: command.sessionToken
+	}));
+	if (command.action === "exchange" || command.action === "backend-exchange") return json(await service.exchange({
+		trust,
+		walletId,
+		attemptId: command.attemptId,
+		idToken: command.idToken
+	}));
+	const tokenHash = await sha256HexUtf8(command.sessionToken);
+	if (command.action === "logout") {
+		await service.store.revokeSession(tokenHash, originBinding);
+		return json({ ok: true });
+	}
+	const authentication = command.action === "redeem" ? await service.store.redeem({
+		walletId,
+		originBinding,
+		attemptId: command.attemptId,
+		bindingHash: await sha256HexUtf8(command.binding),
+		codeHash: await sha256HexUtf8(command.code),
+		sessionTokenHash: tokenHash,
+		nowMs: Date.now(),
+		trustRevision: trust.revision
+	}) : await service.store.readSession({
+		tokenHash,
+		originBinding,
+		nowMs: Date.now(),
+		trustRevision: trust.revision
+	});
+	if (!authentication || authentication.walletId !== walletId) return failure(403, "access_denied");
+	return json({
+		ok: true,
+		value: await service.settings(authentication)
+	}, { headers: { "Cache-Control": "no-store" } });
+}
+//#endregion
+export { externalAuthRoutes, handleExternalAuth };
+
+//# sourceMappingURL=externalAuth.js.map

package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js

@@ -1,9 +1,9 @@
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { json } from "../../../framework/http.js";
 import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret } from "../../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { prepareOwnerWalletExecution } from "../../../domains/signingOperations/walletExecutionAdmission.js";
-import { json } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;