@seams/wallet-server 0.26.0 → 0.28.0

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -1,21 +1,21 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildVaultOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildVaultOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { readJson } from "../../../framework/http.js";
+import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { readJson } from "../../../framework/http.js";
 import { parseWebAuthnAuthenticationCredential, unredactedWebAuthnExtensionField } from "../../../auth/webAuthnCredentialCodecs.js";
 import { parseCustodyOwnerProof, parseRecoveryBackupAcknowledgementRequest, parseRecoveryStatusRequest, requireExactObjectFields } from "./walletCustodyRequestBoundary.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -1,17 +1,17 @@
 import { parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
+import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, projectExactWalletSessionAuthorizationV1 } from "../../../../authorization/domain.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { json, readJson } from "../../../framework/http.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { routerApiEmailOtpRouteService } from "../../../framework/authServicePort.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -1,12 +1,12 @@
 import { parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parsePrincipalId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseAuthFactorId, parsePrincipalId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { json, jsonFailure, readJson } from "../../../framework/http.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest } from "../../../domains/syncAccount/syncAccountRequestValidation.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";

package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { projectActiveWalletSession } from "../../../../authorization/domain.js";

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -1,20 +1,20 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { json, readJson } from "../../../framework/http.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
-import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionAuthorizationV2Admission } from "../../../domains/signingOperations/walletExecutionAdmission.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
-import { json, readJson } from "../../../framework/http.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
 import { signingPrepareSessionResponse } from "../../../domains/signingOperations/signingPrepareSession.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -1,20 +1,20 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildAuthorizationGrantRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { buildAuthorizationGrantRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { authorizedOperationReplayBodyInit, parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
+import { json, readJson } from "../../../framework/http.js";
+import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
-import { json, readJson } from "../../../framework/http.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../../threshold/statusCodes.js";

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -1,10 +1,10 @@
 import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { json, readJson } from "../../../framework/http.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../../auth/commonRouterUtils.js";
-import { json, readJson } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
 const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
 function parsePreflightRequest(raw) {

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -1,9 +1,9 @@
-import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
 import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
-import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
-import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
 import "../../../../shared-ts/src/utils/walletManagementProtocol.js";
 import { jsonFailure, readJson } from "../../../framework/http.js";
+import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
+import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
+import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
 import { routerApiWalletRegistrationRouteService } from "../../../framework/authServicePort.js";
 //#region src/router/transport/fetch/routes/walletRegistration.ts
 const ROUTE_IDS = [

package/dist/esm/shared-ts/src/auth/externalAuth.js

@@ -0,0 +1,45 @@
+import { parseWalletId } from "../utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../utils/validation.js";
+import { parseUnixMs } from "../passkey-custody/primitives.js";
+//#region ../shared-ts/src/auth/externalAuth.ts
+const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+function parseExternalAuthConfiguration(raw) {
+	const value = requireRecord(raw, "external authentication configuration");
+	if (typeof value.revision !== "number" || !Number.isSafeInteger(value.revision) || value.revision < 0) throw new Error("Invalid external authentication revision");
+	if (value.kind === "disabled") return {
+		kind: "disabled",
+		revision: value.revision
+	};
+	if (value.kind === "google") return {
+		kind: "google",
+		revision: value.revision,
+		clientId: requireCanonicalString(value.clientId, "clientId")
+	};
+	throw new Error("Unsupported external authentication configuration");
+}
+function parseExternalWalletAuthentication(value) {
+	const record = requireRecord(value, "external authentication");
+	const walletId = parseWalletId(record.walletId);
+	if (!walletId.ok || record.kind !== "external_authenticated" || record.provider !== "google" || record.permission !== "wallet_settings_read" || "authMethod" in record) throw new Error("External authentication is invalid");
+	return {
+		kind: "external_authenticated",
+		walletId: walletId.value,
+		sessionId: requireCanonicalString(record.sessionId, "sessionId"),
+		associationId: requireCanonicalString(record.associationId, "associationId"),
+		environmentId: requireCanonicalString(record.environmentId, "environmentId"),
+		provider: "google",
+		permission: "wallet_settings_read",
+		expiresAtMs: parseUnixMs(record.expiresAtMs, "expiresAtMs")
+	};
+}
+function externalAuthFailure(code) {
+	return {
+		ok: false,
+		code,
+		message: "Wallet authentication could not be completed."
+	};
+}
+//#endregion
+export { EXTERNAL_AUTH_PATH, externalAuthFailure, parseExternalAuthConfiguration, parseExternalWalletAuthentication };
+
+//# sourceMappingURL=externalAuth.js.map

package/dist/esm/shared-ts/src/authorization/voiceIdDeviceAssertion.js

@@ -1,9 +1,9 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
-import { parseWalletSessionMintId } from "./capabilityKinds.js";
 import { isPlainObject } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseWalletSessionMintId } from "./capabilityKinds.js";
 //#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
 const CHALLENGE_DOMAIN = "seams:wallet-session:voiceid-device:v1";
 const MAXIMUM_CHALLENGE_MS = 6e4;

package/dist/esm/shared-ts/src/authorization/walletAuthority.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
-import { parseDeviceId } from "./capabilityKinds.js";
 import { requireRecord } from "../utils/validation.js";
-import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseDeviceId } from "./capabilityKinds.js";
+import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 //#region ../shared-ts/src/authorization/walletAuthority.ts

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,7 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -1,6 +1,6 @@
-import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { sha256DigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
+import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/digests.ts

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -1,9 +1,9 @@
 import { requireArray, requireRecord } from "../utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
 import { exactRecord } from "../utils/exactRecord.js";
 import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
 import "../authorization/delegatedAuthority.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
 import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
 import { requireRouterAbX25519PublicKey } from "../utils/routerAbPublicKeyset.js";

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { requireRecordCopy } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
+import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationBindingV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";

package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { parseLinkDevicePublicKeyB64u } from "./parsers.js";
 //#region ../shared-ts/src/device-linking/walletSessionCredentialDelivery.ts
 const DELIVERY_AAD_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-aad/v1";

package/dist/esm/shared-ts/src/device-linking/wireFields.js

@@ -1,9 +1,9 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseUnixMs } from "../passkey-custody/primitives.js";
 import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
 import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseUnixMs } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/wireFields.ts
 const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);
 const walletId = /* @__PURE__ */ wireResult(parseWalletId);

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -1,7 +1,7 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs } from "./primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
 //#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -1,7 +1,7 @@
 import { parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "./primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { requireEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
 import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
 //#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,9 +1,9 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
 import { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 } from "./participantDigest.js";

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,9 +1,9 @@
 import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
 import { requireRecord } from "./validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId } from "./canonicalPrimitives.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,9 +1,9 @@
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { requireRecord } from "./validation.js";
-import { rejectUnknownFields } from "./exactRecord.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseDigestB64u } from "./canonicalPrimitives.js";
+import { rejectUnknownFields } from "./exactRecord.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
 function buildVoiceIdWalletAuthAuthority(input) {

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -1,5 +1,5 @@
-import "../authorization/capabilityKinds.js";
 import { requireTrimmedString } from "../utils/validation.js";
+import "../authorization/capabilityKinds.js";
 import "../utils/walletAuthMethodRecord.js";
 import "../authorization/walletAuthority.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.ts

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js

@@ -1,7 +1,7 @@
 import { parseWalletId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import "../passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "./recoveryCodeReservation.js";
 import { parseDerivedWalletRecoveryKeyId } from "./recoveryKeyId.js";

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
 //#region src/threshold/session/signingSessionSeal/crypto/cipher.ts

package/dist/esm/threshold/session/signingSessionSeal/service.js

@@ -1,7 +1,7 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
+import "../../../shared-ts/src/utils/encoders.js";
 //#region src/threshold/session/signingSessionSeal/service.ts
 const SIGNING_SESSION_SEAL_LOG_LABEL = "[threshold-signing-session-seal]";
 const SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT = 9e4;

package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js

@@ -1,6 +1,6 @@
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
 import { headersToRecord, readJson } from "../../../../router/framework/http.js";
+import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
 function json(body, status = 200) {
 	return new Response(JSON.stringify(body), {

package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js

@@ -1,8 +1,8 @@
 import { parseThresholdSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { ensureLeadingSlash } from "../../../../shared-ts/src/utils/normalize.js";
 import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 //#region src/threshold/session/signingSessionSeal/transport/shared.ts
 const DEFAULT_BASE_PATH = WALLET_SESSION_SEAL_BASE_PATH;
 function readRequiredString(obj, key) {

package/dist/types/shared-ts/src/auth/externalAuth.d.ts

@@ -0,0 +1,84 @@
+import { type WalletId } from '../utils/domainIds';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export declare const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+export type ExternalAuthConfiguration = ReadonlyExclusiveUnion<{
+    kind: 'disabled';
+    revision: number;
+} | {
+    kind: 'google';
+    revision: number;
+    clientId: string;
+}>;
+export declare function parseExternalAuthConfiguration(raw: unknown): ExternalAuthConfiguration;
+type ExternalAuthFailureCode = 'invalid_request' | 'invalid_credential' | 'access_denied' | 'expired' | 'superseded' | 'unavailable' | 'rate_limited';
+export type ExternalAuthResult<T> = ReadonlyExclusiveUnion<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: ExternalAuthFailureCode;
+    message: string;
+}>;
+export type ExternalAuthenticateInput = ReadonlyExclusiveUnion<{
+    method: 'google';
+    walletId: string;
+    idToken: string;
+} | {
+    method: 'handoff';
+    walletId: string;
+    attemptId: string;
+    code: string;
+}>;
+export type ExternalAuthAttempt = Readonly<{
+    attemptId: string;
+    walletId: WalletId;
+    expiresAtMs: number;
+}>;
+export type ExternalAuthCommand = ReadonlyExclusiveUnion<{
+    action: 'authenticate';
+    input: ExternalAuthenticateInput;
+} | {
+    action: 'prepare';
+    walletId: string;
+} | {
+    action: 'associate';
+    walletId: string;
+    idToken: string;
+} | {
+    action: 'unlink';
+    walletId: string;
+    associationId: string;
+}>;
+export declare function parseExternalAuthCommand(raw: unknown): ExternalAuthCommand;
+export type ExternalWalletAuthentication = Readonly<{
+    kind: 'external_authenticated';
+    walletId: WalletId;
+    sessionId: string;
+    associationId: string;
+    environmentId: string;
+    provider: 'google';
+    permission: 'wallet_settings_read';
+    expiresAtMs: number;
+    authMethod?: never;
+}>;
+export type ExternalWalletSettings = Readonly<{
+    authentication: ExternalWalletAuthentication;
+    accounts: readonly Readonly<{
+        family: 'ed25519' | 'ecdsa';
+        address: string;
+        publicKey: string;
+    }>[];
+    methods: readonly Readonly<{
+        id: string;
+        kind: 'passkey' | 'email_otp' | 'voiceid';
+    }>[];
+    devices: readonly Readonly<{
+        id: string;
+    }>[];
+}>;
+export declare function parseExternalWalletAuthentication(value: unknown): ExternalWalletAuthentication;
+export declare function externalAuthFailure(code: ExternalAuthFailureCode): ExternalAuthResult<never>;
+export declare function parseExternalAuthFailure(value: unknown): ExternalAuthResult<never>;
+export declare function parseExternalWalletSettings(value: unknown): ExternalWalletSettings;
+export {};
+//# sourceMappingURL=externalAuth.d.ts.map

package/dist/types/wallet-server/src/auth/externalAuthService.d.ts

@@ -0,0 +1,36 @@
+import type { ExternalAuthResult, ExternalWalletAuthentication, ExternalWalletSettings } from '../../../shared-ts/src/auth/externalAuth';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStore } from '../core/d1WalletStore';
+import type { WalletAuthMethodV2Store } from '../core/d1WalletAuthMethodStore';
+import { ExternalAuthStore, type ExternalAuthTrust } from './externalAuthStore';
+export declare class ExternalAuthService {
+    readonly store: ExternalAuthStore;
+    private readonly wallets;
+    private readonly methods;
+    constructor(store: ExternalAuthStore, wallets: D1WalletStore, methods: WalletAuthMethodV2Store);
+    verifyGoogle(trust: ExternalAuthTrust, idToken: string): Promise<ExternalAuthResult<{
+        subject: string;
+        expiresAtMs: number;
+        trust: ExternalAuthTrust;
+    }>>;
+    prepare(input: {
+        walletId: WalletId;
+        originBinding: string;
+        binding: string;
+        sessionToken: string;
+    }): Promise<ExternalAuthResult<{
+        attemptId: string;
+        walletId: WalletId;
+        expiresAtMs: number;
+    }>>;
+    exchange(input: {
+        walletId: WalletId;
+        attemptId: string;
+        idToken: string;
+        trust: ExternalAuthTrust;
+    }): Promise<ExternalAuthResult<{
+        code: string;
+    }>>;
+    settings(authentication: ExternalWalletAuthentication): Promise<ExternalWalletSettings>;
+}
+//# sourceMappingURL=externalAuthService.d.ts.map