@seams/wallet-server 0.26.0 → 0.28.0

package/dist/types/wallet-server/src/auth/externalAuthStore.d.ts

@@ -0,0 +1,61 @@
+import type { ExternalWalletAuthentication, ExternalAuthConfiguration } from '../../../shared-ts/src/auth/externalAuth';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
+import type { WalletId, WalletAuthorityId } from '../../../shared-ts/src/utils/domainIds';
+import { type D1TenantScope } from '../core/d1TenantStore';
+import type { D1DatabaseLike } from '../storage/tenantRoute';
+export type ExternalAuthTrust = Variant<ExternalAuthConfiguration, 'kind', 'google'>;
+type ExternalAuthPreparedAttempt = Readonly<{
+    attemptId: string;
+    walletId: WalletId;
+    originBinding: string;
+    bindingHash: string;
+    sessionTokenHash: string;
+    expiresAtMs: number;
+}>;
+export declare class ExternalAuthStore {
+    private readonly database;
+    readonly scope: D1TenantScope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    private prepare;
+    consumeAuthenticationAllowance(rateKey: string, nowMs: number): Promise<boolean>;
+    associate(input: {
+        walletId: WalletId;
+        subject: string;
+        authorityId: WalletAuthorityId;
+        authorityEpoch: number;
+    }): Promise<boolean>;
+    revokeAssociation(walletId: WalletId, associationId: string): Promise<void>;
+    prepareAttempt(input: ExternalAuthPreparedAttempt): Promise<void>;
+    verifyAttempt(input: {
+        attemptId: string;
+        walletId: WalletId;
+        subject: string;
+        trust: ExternalAuthTrust;
+        codeHash: string;
+        nowMs: number;
+        sessionExpiresAtMs: number;
+    }): Promise<boolean>;
+    redeem(input: {
+        attemptId: string;
+        walletId: WalletId;
+        originBinding: string;
+        bindingHash: string;
+        sessionTokenHash: string;
+        codeHash: string;
+        nowMs: number;
+        trustRevision: number;
+    }): Promise<ExternalWalletAuthentication | null>;
+    readSession(input: {
+        tokenHash: string;
+        originBinding: string;
+        nowMs: number;
+        trustRevision: number;
+    }): Promise<ExternalWalletAuthentication | null>;
+    revokeSession(tokenHash: string, originBinding: string): Promise<void>;
+    devices(walletId: WalletId): Promise<readonly {
+        id: string;
+    }[]>;
+    private authentication;
+}
+export {};
+//# sourceMappingURL=externalAuthStore.d.ts.map

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -1,3 +1,4 @@
+export { parseExternalAuthConfiguration, type ExternalAuthConfiguration, } from '../../shared-ts/src/auth/externalAuth';
 export * from './core/SessionService';
 export * from './core/ThresholdService/evmCryptoWasm';
 export * from './core/d1WalletStore';
@@ -121,5 +122,5 @@ export type { LinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDev
 export { computeLinkedDeviceSessionClaimDigestV1 } from '../../shared-ts/src/device-linking/digests';
 export { admitD1EstablishedWalletHome, resumeRegistrationDirectoryPublicationsV1, type RegistrationDirectoryPublicationDelivery, } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
 export { D1WalletObjectAddresses } from './router/cloudflare/d1/walletObjectAddresses';
-export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity } from './router/cloudflare/runtime/walletObjectAddresses';
+export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity, } from './router/cloudflare/runtime/walletObjectAddresses';
 //# sourceMappingURL=cloud-host.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcBoundary.d.ts

@@ -22,6 +22,11 @@ export type ParsedRs256JwtResult = {
 export type GoogleIdTokenClaims = {
     readonly ok: true;
     readonly sub: string;
+    readonly issuer: 'https://accounts.google.com';
+    readonly audience: string;
+    readonly expiresAtMs: number;
+    readonly authorizedParty: string | null;
+    readonly audienceCount: number;
     readonly email?: string;
     readonly name?: string;
     readonly givenName?: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/authorizationSnapshotLayout.d.ts

@@ -1,5 +1,5 @@
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
-declare const TABLES: readonly ['wallet_email_otp_rate_limits', 'email_otp_wallet_enrollments', 'email_otp_auth_states', 'wallets', 'wallet_signers', 'wallet_recovery_code_locators', 'wallet_authorities', 'wallet_auth_methods', 'wallet_relocation_approvals', 'webauthn_credential_bindings', 'webauthn_authenticators', 'router_ab_yao_versioned_json_records', 'authorization_wallet_session_quotas', 'wallet_session_authorizations_v2', 'wallet_session_hosted_credentials_v2', 'wallet_session_hosted_exchange_codes_v2', 'verified_wallet_operation_evidence_sets', 'authorized_operations', 'authorized_operation_audit_events', 'linked_device_sessions', 'linked_device_authority_allocations', 'linked_device_authority_installations', 'linked_device_target_credentials', 'linked_device_target_commit_reservations', 'linked_device_session_transcripts', 'linked_device_ed25519_export_root_transfers', 'linked_device_email_otp_grants', 'linked_device_request_proof_nonces', 'linked_device_bootstrap_imports', 'linked_device_wallet_session_credential_deliveries_v1'];
+declare const TABLES: readonly ['wallet_email_otp_rate_limits', 'email_otp_wallet_enrollments', 'email_otp_auth_states', 'wallets', 'wallet_signers', 'wallet_recovery_code_locators', 'wallet_authorities', 'wallet_auth_methods', 'external_auth_associations', 'wallet_relocation_approvals', 'webauthn_credential_bindings', 'webauthn_authenticators', 'router_ab_yao_versioned_json_records', 'authorization_wallet_session_quotas', 'wallet_session_authorizations_v2', 'wallet_session_hosted_credentials_v2', 'wallet_session_hosted_exchange_codes_v2', 'verified_wallet_operation_evidence_sets', 'authorized_operations', 'authorized_operation_audit_events', 'linked_device_sessions', 'linked_device_authority_allocations', 'linked_device_authority_installations', 'linked_device_target_credentials', 'linked_device_target_commit_reservations', 'linked_device_session_transcripts', 'linked_device_ed25519_export_root_transfers', 'linked_device_email_otp_grants', 'linked_device_request_proof_nonces', 'linked_device_bootstrap_imports', 'linked_device_wallet_session_credential_deliveries_v1'];
 type Table = (typeof TABLES)[number];
 export declare class AuthorizationSnapshotLayout {
     #private;

package/dist/types/wallet-server/src/router/cloudflare/runtime/staticWalletConsoleBinding.d.ts

@@ -1,4 +1,5 @@
 import { type RouterApiCredentialScope } from '../../framework/apiCredentialPorts';
+import { type ExternalAuthConfiguration } from '../../../../../shared-ts/src/auth/externalAuth';
 import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
 export interface StaticWalletConsoleBindingConfigV1 {
     readonly credential: {
@@ -9,6 +10,7 @@ export interface StaticWalletConsoleBindingConfigV1 {
         readonly scopes: readonly RouterApiCredentialScope[];
     };
     readonly deployment: {
+        readonly externalAuth?: ExternalAuthConfiguration;
         readonly orgId: string;
         readonly projectId: string;
         readonly environmentId: string;

package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts

@@ -88,6 +88,7 @@ export interface RouterApiUsageMeterAdapter {
     recordEvent(input: RouterApiUsageMeterEvent): Promise<void>;
 }
 export interface RouterApiProjectEnvironment {
+    externalAuth?: import('../../../../shared-ts/src/auth/externalAuth').ExternalAuthConfiguration;
     id: string;
     projectId: string;
     key: string;

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1298,6 +1298,7 @@ interface RouterApiRouterAccountService {
 export type { RouterApiPasskeyCustodyService } from '../cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService';
 import type { RouterApiPasskeyCustodyService } from '../cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService';
 export interface RouterApiServiceBag {
+    externalAuth?: import('../../auth/externalAuthService').ExternalAuthService;
     walletRegistration: RouterApiWalletRegistrationService;
     walletAuthMethods: RouterApiWalletAuthMethodService;
     walletUnlock: RouterApiWalletUnlockService;

package/dist/types/wallet-server/src/router/transport/fetch/routes/externalAuth.d.ts

@@ -0,0 +1,5 @@
+import type { FetchRouterApiContext } from '../fetchRouter.types';
+import type { RouteDefinition } from '../../../framework/routeDefinitions';
+export declare function externalAuthRoutes(): RouteDefinition[];
+export declare function handleExternalAuth(ctx: FetchRouterApiContext): Promise<Response | null>;
+//# sourceMappingURL=externalAuth.d.ts.map

package/migrations/d1-signer/0085_external_wallet_auth.sql

@@ -0,0 +1,158 @@
+-- Reject unfinished transfers. Completed receipts remain immutable.
+CREATE TABLE external_auth_relocation_upgrade_guard (count INTEGER NOT NULL CHECK (count = 0));
+INSERT INTO external_auth_relocation_upgrade_guard
+SELECT (SELECT COUNT(*) FROM wallet_relocation_authorization_snapshots AS snapshot
+        WHERE NOT EXISTS (
+          SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+          WHERE cleanup.namespace = snapshot.namespace AND cleanup.org_id = snapshot.org_id
+            AND cleanup.project_id = snapshot.project_id AND cleanup.env_id = snapshot.env_id
+            AND cleanup.wallet_id = snapshot.wallet_id AND cleanup.move_id = snapshot.move_id
+            AND cleanup.request_digest_hex = snapshot.request_digest_hex
+            AND cleanup.source_generation = snapshot.source_generation
+            AND cleanup.state = 'cleaned'))
+     + (SELECT COUNT(*) FROM wallet_relocation_authorization_imports WHERE state != 'activated');
+DROP TABLE external_auth_relocation_upgrade_guard;
+
+
+-- External identity sessions grant settings reads only. Signing tables remain separate.
+CREATE TABLE external_auth_associations (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  association_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  provider_subject TEXT NOT NULL,
+  authority_id TEXT NOT NULL,
+  authority_epoch INTEGER NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('active', 'revoked')),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, association_id)
+);
+CREATE UNIQUE INDEX external_auth_active_association
+  ON external_auth_associations(namespace, org_id, project_id, env_id, wallet_id, provider_subject)
+  WHERE status = 'active';
+
+CREATE TABLE external_auth_attempts (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  -- Canonical JSON pair: wallet request origin and embedding application origin.
+  origin TEXT NOT NULL,
+  binding_hash TEXT NOT NULL,
+  session_token_hash TEXT NOT NULL,
+  expires_at_ms INTEGER NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('prepared', 'verified', 'consumed', 'revoked')),
+  association_id TEXT,
+  trust_revision INTEGER,
+  code_hash TEXT,
+  session_expires_at_ms INTEGER,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),
+  CHECK (status IN ('prepared', 'revoked') OR
+    (association_id IS NOT NULL AND trust_revision IS NOT NULL AND code_hash IS NOT NULL
+      AND session_expires_at_ms IS NOT NULL))
+);
+CREATE UNIQUE INDEX external_auth_session_token
+  ON external_auth_attempts(namespace, org_id, project_id, env_id, session_token_hash);
+CREATE INDEX external_auth_attempt_expiry ON external_auth_attempts(expires_at_ms);
+
+CREATE TABLE external_auth_rate_limits (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  rate_key TEXT NOT NULL, consumed_count INTEGER NOT NULL, reset_at_ms INTEGER NOT NULL,
+  PRIMARY KEY (namespace, org_id, project_id, env_id, rate_key)
+);
+CREATE INDEX external_auth_rate_expiry ON external_auth_rate_limits(reset_at_ms);
+
+CREATE TRIGGER external_auth_associations_capacity_insert BEFORE INSERT ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  JOIN wallet_relocation_write_blocks AS block USING (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation)
+  WHERE block.state IN ('draining', 'checked') AND fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_relocation_write_blocked'); END;
+
+CREATE TRIGGER external_auth_associations_capacity_update BEFORE UPDATE ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  JOIN wallet_relocation_write_blocks AS block USING (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation)
+  WHERE block.state IN ('draining', 'checked') AND fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_relocation_write_blocked'); END;
+
+CREATE TRIGGER external_auth_associations_capacity_delete BEFORE DELETE ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  JOIN wallet_relocation_write_blocks AS block USING (namespace, org_id, project_id, env_id, wallet_id, move_id, request_digest_hex, source_generation)
+  WHERE block.state IN ('draining', 'checked') AND fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_relocation_write_blocked'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_frozen_insert
+BEFORE INSERT ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+    AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+    AND fence.wallet_id = NEW.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_frozen_update
+BEFORE UPDATE ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id)
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_frozen_delete
+BEFORE DELETE ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+  WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+    AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+    AND fence.wallet_id = OLD.wallet_id
+    AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_cleanups AS cleanup
+      WHERE cleanup.namespace = fence.namespace AND cleanup.org_id = fence.org_id
+        AND cleanup.project_id = fence.project_id AND cleanup.env_id = fence.env_id
+        AND cleanup.wallet_id = fence.wallet_id AND cleanup.move_id = fence.move_id
+        AND cleanup.request_digest_hex = fence.request_digest_hex
+        AND cleanup.source_generation = fence.source_generation AND cleanup.state = 'cleaning'))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_history_frozen'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_inactive_insert
+BEFORE INSERT ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated')
+  AND NOT EXISTS (SELECT 1 FROM wallet_relocation_authorization_import_context AS context
+    JOIN wallet_relocation_authorization_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+    AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+    AND context.wallet_id = NEW.wallet_id
+      AND destination.state = 'importing' AND context.table_name = 'external_auth_associations'
+      AND context.record_key = json_array(NEW.association_id, NEW.env_id, NEW.namespace, NEW.org_id, NEW.project_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_inactive_update
+BEFORE UPDATE ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_inactive_delete
+BEFORE DELETE ON external_auth_associations
+WHEN EXISTS (SELECT 1 FROM wallet_relocation_authorization_imports AS destination
+  WHERE destination.namespace = OLD.namespace AND destination.org_id = OLD.org_id
+    AND destination.project_id = OLD.project_id AND destination.env_id = OLD.env_id
+    AND destination.wallet_id = OLD.wallet_id AND destination.state != 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_authorization_destination_inactive'); END;
+
+CREATE TRIGGER external_auth_associations_relocation_owner_immutable
+BEFORE UPDATE ON external_auth_associations
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id OR NEW.wallet_id IS NOT OLD.wallet_id
+BEGIN SELECT RAISE(ABORT, 'wallet_record_owner_changed'); END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",