@seams/wallet-server 0.27.0 → 0.28.0

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.27.0"
+    "version": "0.28.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "f4d14f9f1a23c8f98f5d12085061337aaf6e80fd79def737d2142527872d29dc",
+      "fingerprint": "9354a23aa130d53ead7ac72f4101910e46f52e992519f44bb50f1804c3563808",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "ed5b9ff7628a165828660dbff6765db796f0a6bd4ca3292805d08a2ade9c9365"
+          "sha256": "fb89fa2ce50c5af95cb5464754523d31cbc827d780e3cc5767f55df49170f171"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "3ec071d957795f9ff6d0f20a0c5b33e1e5713b777733a2beb68c0b2b1391bcab",
+      "fingerprint": "9aa8706dd8d77691a8afa8096f3295b1e94d6a92f67c4106d8edd950ff838bbd",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "e54fb17f4c621cef06421c00e4d46714210336eb8a740476704bcebeae36f325"
+          "sha256": "b61d9f995aa1e168b0d04ccc55e41ca2adc45aac5139ec5bbca8c097b340d3dd"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "b56cb2596e6673329b2fc4cbfa7386fc9f4620cc56c3ed6e2485de66ec2bee13",
+      "fingerprint": "ff8f66cca668aba7d4d2adf0f6183731098149012461d03880f43d2155fc04e5",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "37a251c69a161ada391e28bf6585b512f3074adfef3b160ea6e847bc9fb99b5c"
+          "sha256": "a0a83b79b96f30cc6b5c97f933d921a4c8842a2c138b1548971f1b09f8a58980"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "62f97b4156ded53b921aa1f7ff4406c89b08666bb3ba17bca90e2460f5333c87",
+      "fingerprint": "7970e31e74739d47eebd1ee17d5ddde2a43c12eca8f9682cf65acd491eb4823a",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "6a85061edaecf85c36190d0fdceac7e0674f74f6646924d21ecc839b23e51505"
+          "sha256": "ce676751103f5b0457884cecf38a1ecda5af7033e3c93e71d17bb8f7eecbbb7e"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "c4214e28c3296088b1150f3c56d1fe7536a32dd2e107dc32fe319236cd2cbad5",
+      "fingerprint": "70f00da01cea7d89aca4c051a85344fd72ec553bb92a63d0d54db2171a59c2c2",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "91362b12400759dc63b6893896e2fca6a9d2f3d3c3dad46fb71354119861119c"
+          "sha256": "9782d8c4537c51cbd99632eca61ead34f7137b7fd18ea4feafd4db6f27df5255"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -165,8 +165,8 @@
   "migrations": {
     "signer": {
       "directory": "migrations/d1-signer",
-      "head": "0084_voiceid_wallet_auth_methods.sql",
-      "fingerprint": "724414d2bc4d41dd761541a0dc465145957275303a1c49610f1fbdc1e60c0316",
+      "head": "0085_external_wallet_auth.sql",
+      "fingerprint": "a73558668541d4d00f06178f690a239cff675b118fe39c2e8ea2b5c5ec36cc86",
       "files": [
         {
           "path": "migrations/d1-signer/0001_signer_d1_initial.sql",
@@ -587,6 +587,11 @@
           "path": "migrations/d1-signer/0084_voiceid_wallet_auth_methods.sql",
           "bytes": 17185,
           "sha256": "01af96f95131fb6ce8e42301bfdc2bd99ead260c817833b6b03a501f836d34a9"
+        },
+        {
+          "path": "migrations/d1-signer/0085_external_wallet_auth.sql",
+          "bytes": 9757,
+          "sha256": "62e98c8200f18cc1d6bc399891f2fd7c57e5b0639f251d10ad6cf7d7b5e30461"
         }
       ]
     },

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793201442665}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793281741952}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793201567116}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793281927715}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793201683620}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793282099467}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793201252625}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793281450811}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793201821080}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793282301221}

package/dist/esm/auth/externalAuthService.js

@@ -0,0 +1,98 @@
+import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { sha256HexUtf8 } from "../shared-ts/src/utils/digests.js";
+import { externalAuthFailure } from "../shared-ts/src/auth/externalAuth.js";
+import { verifyGoogleOidcToken } from "../router/cloudflare/d1/oidc/googleOidcToken.js";
+//#region src/auth/externalAuthService.ts
+var ExternalAuthService = class {
+	constructor(store, wallets, methods) {
+		this.store = store;
+		this.wallets = wallets;
+		this.methods = methods;
+	}
+	async verifyGoogle(trust, idToken) {
+		const proof = await verifyGoogleOidcToken(trust.clientId, idToken);
+		if (!proof.ok) return externalAuthFailure(proof.code === "expired" ? "expired" : "invalid_credential");
+		if (proof.audienceCount > 1 && proof.authorizedParty === null || proof.authorizedParty !== null && proof.authorizedParty !== trust.clientId) return externalAuthFailure("invalid_credential");
+		return {
+			ok: true,
+			value: {
+				subject: proof.sub,
+				expiresAtMs: proof.expiresAtMs,
+				trust
+			}
+		};
+	}
+	async prepare(input) {
+		const attemptId = crypto.randomUUID();
+		const expiresAtMs = Date.now() + 12e4;
+		await this.store.prepareAttempt({
+			attemptId,
+			walletId: input.walletId,
+			originBinding: input.originBinding,
+			bindingHash: await sha256HexUtf8(input.binding),
+			sessionTokenHash: await sha256HexUtf8(input.sessionToken),
+			expiresAtMs
+		});
+		return {
+			ok: true,
+			value: {
+				attemptId,
+				walletId: input.walletId,
+				expiresAtMs
+			}
+		};
+	}
+	async exchange(input) {
+		const verified = await this.verifyGoogle(input.trust, input.idToken);
+		if (!verified.ok) return verified;
+		const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+		const nowMs = Date.now();
+		return await this.store.verifyAttempt({
+			attemptId: input.attemptId,
+			walletId: input.walletId,
+			subject: verified.value.subject,
+			trust: verified.value.trust,
+			codeHash: await sha256HexUtf8(code),
+			nowMs,
+			sessionExpiresAtMs: Math.min(nowMs + 36e5, verified.value.expiresAtMs)
+		}) ? {
+			ok: true,
+			value: { code }
+		} : externalAuthFailure("access_denied");
+	}
+	async settings(authentication) {
+		const walletId = authentication.walletId;
+		const [ed25519, ecdsa, methods, devices] = await Promise.all([
+			this.wallets.listEd25519SignersForWallet({ walletId }),
+			this.wallets.listEcdsaSignersForWallet({ walletId }),
+			this.methods.listForWalletV2({ walletId }),
+			this.store.devices(walletId)
+		]);
+		const accounts = [];
+		for (const signer of ed25519) accounts.push({
+			family: "ed25519",
+			address: signer.nearAccountId,
+			publicKey: signer.publicKey
+		});
+		for (const signer of ecdsa) accounts.push({
+			family: "ecdsa",
+			address: signer.walletKey.thresholdOwnerAddress,
+			publicKey: signer.walletKey.thresholdEcdsaPublicKeyB64u
+		});
+		const summaries = [];
+		for (const method of methods) if (method.status === "active") summaries.push({
+			id: method.walletAuthMethodId,
+			kind: method.kind
+		});
+		return {
+			authentication,
+			accounts,
+			methods: summaries,
+			devices
+		};
+	}
+};
+//#endregion
+export { ExternalAuthService };
+
+//# sourceMappingURL=externalAuthService.js.map

package/dist/esm/auth/externalAuthStore.js

@@ -0,0 +1,217 @@
+import { requireCanonicalString } from "../shared-ts/src/utils/validation.js";
+import { parseUnixMs } from "../shared-ts/src/passkey-custody/primitives.js";
+import { parseExternalWalletAuthentication } from "../shared-ts/src/auth/externalAuth.js";
+import { d1ChangedRows } from "../storage/d1Sql.js";
+import { prepareD1TenantStatement } from "../core/d1TenantStore.js";
+//#region src/auth/externalAuthStore.ts
+const SCOPE = "namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4";
+const ACTIVE_HOME = `EXISTS (SELECT 1 FROM wallet_execution_generations home
+  WHERE home.namespace = a.namespace AND home.org_id = a.org_id
+    AND home.project_id = a.project_id AND home.env_id = a.env_id
+    AND home.wallet_id = a.wallet_id AND home.state = 'active'
+    AND NOT EXISTS (SELECT 1 FROM wallet_relocation_write_blocks block
+      WHERE block.namespace = home.namespace AND block.org_id = home.org_id
+        AND block.project_id = home.project_id AND block.env_id = home.env_id
+        AND block.wallet_id = home.wallet_id AND block.source_generation = home.generation
+        AND block.state != 'released'))`;
+const LIVE_ASSOCIATION = `EXISTS (
+  SELECT 1 FROM external_auth_associations a
+  JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
+    AND w.project_id = a.project_id AND w.env_id = a.env_id
+    AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
+  WHERE a.namespace = external_auth_attempts.namespace
+    AND a.org_id = external_auth_attempts.org_id
+    AND a.project_id = external_auth_attempts.project_id
+    AND a.env_id = external_auth_attempts.env_id
+    AND a.association_id = external_auth_attempts.association_id
+    AND a.wallet_id = external_auth_attempts.wallet_id AND a.status = 'active'
+    AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
+    AND ${ACTIVE_HOME}
+)`;
+var ExternalAuthStore = class {
+	constructor(database, scope) {
+		this.database = database;
+		this.scope = scope;
+	}
+	prepare(sql, values = []) {
+		return prepareD1TenantStatement(this.database, this.scope, sql, values);
+	}
+	async consumeAuthenticationAllowance(rateKey, nowMs) {
+		return d1ChangedRows(await this.prepare(`INSERT INTO external_auth_rate_limits
+       (namespace, org_id, project_id, env_id, rate_key, consumed_count, reset_at_ms)
+       VALUES (?1, ?2, ?3, ?4, ?5, 1, ?7)
+       ON CONFLICT(namespace, org_id, project_id, env_id, rate_key) DO UPDATE SET
+         consumed_count = CASE WHEN reset_at_ms <= ?6 THEN 1 ELSE consumed_count + 1 END,
+         reset_at_ms = CASE WHEN reset_at_ms <= ?6 THEN ?7 ELSE reset_at_ms END
+       WHERE reset_at_ms <= ?6 OR consumed_count < 120`, [
+			rateKey,
+			nowMs,
+			nowMs + 6e4
+		]).run()) === 1;
+	}
+	async associate(input) {
+		const revokePriorAuthority = this.prepare(`UPDATE external_auth_associations SET status = 'revoked'
+       WHERE ${SCOPE} AND wallet_id = ?5 AND provider_subject = ?6 AND status = 'active'
+         AND (authority_id != ?7 OR authority_epoch != ?8)
+         AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+           AND wallet_id = ?5 AND authority_id = ?7 AND lifecycle_state = 'active'
+           AND revocation_epoch = ?8)`, [
+			input.walletId,
+			input.subject,
+			input.authorityId,
+			input.authorityEpoch
+		]);
+		const createAssociation = this.prepare(`INSERT INTO external_auth_associations
+        (namespace, org_id, project_id, env_id, association_id, wallet_id,
+         provider_subject, authority_id, authority_epoch, status)
+       SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, 'active'
+       WHERE EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+         AND authority_id = ?8 AND wallet_id = ?6 AND lifecycle_state = 'active'
+         AND revocation_epoch = ?9)
+       ON CONFLICT(namespace, org_id, project_id, env_id, wallet_id, provider_subject)
+         WHERE status = 'active' DO NOTHING`, [
+			crypto.randomUUID(),
+			input.walletId,
+			input.subject,
+			input.authorityId,
+			input.authorityEpoch
+		]);
+		const [revoked, inserted] = await this.database.batch([revokePriorAuthority, createAssociation]);
+		if (!revoked?.success || !inserted?.success) throw new Error("Association update failed");
+		if (d1ChangedRows(inserted) === 1) return true;
+		return await this.prepare(`SELECT association_id FROM external_auth_associations WHERE ${SCOPE}
+       AND wallet_id = ?5 AND provider_subject = ?6 AND authority_id = ?7
+       AND authority_epoch = ?8 AND status = 'active'
+       AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+         AND wallet_id = ?5 AND authority_id = ?7 AND lifecycle_state = 'active'
+         AND revocation_epoch = ?8)`, [
+			input.walletId,
+			input.subject,
+			input.authorityId,
+			input.authorityEpoch
+		]).first() !== null;
+	}
+	async revokeAssociation(walletId, associationId) {
+		await this.prepare(`UPDATE external_auth_associations SET status = 'revoked'
+       WHERE ${SCOPE} AND wallet_id = ?5 AND association_id = ?6`, [walletId, associationId]).run();
+	}
+	async prepareAttempt(input) {
+		const nowMs = Date.now();
+		await this.database.batch([this.database.prepare(`DELETE FROM external_auth_attempts WHERE rowid IN (
+        SELECT rowid FROM external_auth_attempts
+        WHERE expires_at_ms <= ? AND (session_expires_at_ms IS NULL OR session_expires_at_ms <= ?) LIMIT 100
+      )`).bind(nowMs, nowMs), this.database.prepare(`DELETE FROM external_auth_rate_limits WHERE rowid IN (
+        SELECT rowid FROM external_auth_rate_limits WHERE reset_at_ms <= ? LIMIT 100
+      )`).bind(nowMs)]);
+		await this.prepare(`INSERT INTO external_auth_attempts
+        (namespace, org_id, project_id, env_id, attempt_id, wallet_id, origin,
+         binding_hash, session_token_hash, expires_at_ms, status)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'prepared')`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.expiresAtMs
+		]).run();
+	}
+	async verifyAttempt(input) {
+		return d1ChangedRows(await this.prepare(`UPDATE external_auth_attempts SET status = 'verified',
+         association_id = (SELECT a.association_id FROM external_auth_associations a
+           JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
+             AND w.project_id = a.project_id AND w.env_id = a.env_id
+             AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
+           WHERE a.namespace = ?1 AND a.org_id = ?2 AND a.project_id = ?3 AND a.env_id = ?4
+             AND a.wallet_id = ?6 AND a.provider_subject = ?7 AND a.status = 'active'
+             AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
+             AND ${ACTIVE_HOME}),
+         trust_revision = ?8, code_hash = ?9, session_expires_at_ms = ?11
+       WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6
+         AND status = 'prepared' AND expires_at_ms > ?10
+         AND EXISTS (SELECT 1 FROM external_auth_associations a
+           JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
+             AND w.project_id = a.project_id AND w.env_id = a.env_id
+             AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
+           WHERE a.namespace = ?1 AND a.org_id = ?2 AND a.project_id = ?3 AND a.env_id = ?4
+             AND a.wallet_id = ?6 AND a.provider_subject = ?7 AND a.status = 'active'
+             AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
+             AND ${ACTIVE_HOME})`, [
+			input.attemptId,
+			input.walletId,
+			input.subject,
+			input.trust.revision,
+			input.codeHash,
+			input.nowMs,
+			input.sessionExpiresAtMs
+		]).run()) === 1;
+	}
+	async redeem(input) {
+		await this.prepare(`UPDATE external_auth_attempts SET status = 'consumed'
+       WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6 AND origin = ?7
+         AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND status = 'verified' AND expires_at_ms > ?11 AND session_expires_at_ms > ?11
+         AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.nowMs,
+			input.trustRevision
+		]).run();
+		const row = await this.prepare(`SELECT attempt_id, association_id, wallet_id, session_expires_at_ms
+       FROM external_auth_attempts WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6
+         AND origin = ?7 AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND status = 'consumed' AND session_expires_at_ms > ?11 AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.nowMs,
+			input.trustRevision
+		]).first();
+		return row ? this.authentication(row) : null;
+	}
+	async readSession(input) {
+		const row = await this.prepare(`SELECT attempt_id, association_id, wallet_id, session_expires_at_ms
+       FROM external_auth_attempts WHERE ${SCOPE} AND session_token_hash = ?5 AND origin = ?6
+         AND status = 'consumed' AND session_expires_at_ms > ?7
+         AND trust_revision = ?8 AND ${LIVE_ASSOCIATION}`, [
+			input.tokenHash,
+			input.originBinding,
+			input.nowMs,
+			input.trustRevision
+		]).first();
+		return row ? this.authentication(row) : null;
+	}
+	async revokeSession(tokenHash, originBinding) {
+		await this.prepare(`UPDATE external_auth_attempts SET status = 'revoked'
+       WHERE ${SCOPE} AND session_token_hash = ?5 AND origin = ?6`, [tokenHash, originBinding]).run();
+	}
+	async devices(walletId) {
+		const result = await this.prepare(`SELECT DISTINCT device_id FROM wallet_authorities WHERE ${SCOPE}
+       AND wallet_id = ?5 AND lifecycle_state = 'active' ORDER BY device_id`, [walletId]).all();
+		const devices = [];
+		for (const row of result.results || []) devices.push({ id: requireCanonicalString(row.device_id, "device_id") });
+		return devices;
+	}
+	authentication(row) {
+		return parseExternalWalletAuthentication({
+			kind: "external_authenticated",
+			walletId: row.wallet_id,
+			sessionId: row.attempt_id,
+			associationId: row.association_id,
+			environmentId: this.scope.envId,
+			provider: "google",
+			permission: "wallet_settings_read",
+			expiresAtMs: parseUnixMs(row.session_expires_at_ms, "session expiry")
+		});
+	}
+};
+//#endregion
+export { ExternalAuthStore };
+
+//# sourceMappingURL=externalAuthStore.js.map

package/dist/esm/authorization/domain.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import "../shared-ts/src/utils/encoders.js";
+import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { parseActiveWalletSessionV1, parseWalletSessionHome } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
-import "../shared-ts/src/utils/encoders.js";
 import "../shared-ts/src/device-linking/index.js";
 //#region src/authorization/domain.ts
 function buildExactWalletSessionQuotaProjectionV1(fields) {

package/dist/esm/authorization/factorEvidence.js

@@ -1,7 +1,7 @@
 import { parseProviderSubject } from "../shared-ts/src/utils/domainIds.js";
-import { AUTHORIZATION_EVIDENCE_KINDS } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { AUTHORIZATION_EVIDENCE_KINDS } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { computeCapabilityOperationFingerprintDigest } from "../shared-ts/src/authorization/operationFingerprint.js";
 //#region src/authorization/factorEvidence.ts
 const FACTOR_EVIDENCE_DIGEST_DOMAIN_V1 = "seams:authorization:factor-evidence:v1";

package/dist/esm/authorization/service.js

@@ -1,9 +1,9 @@
-import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import "../shared-ts/src/utils/encoders.js";
+import { parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { parseWalletSessionOperationCredentialV1 } from "../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildActiveWalletSessionQuota, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, walletSessionCapabilitySubjectsV1Equal } from "./domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletOperationFactorEvidenceSet } from "./factorEvidence.js";
 import { secureRandomBase64Url } from "../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/authorization/vaultProxyUse.js

@@ -1,6 +1,6 @@
-import { buildVaultOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { buildVaultOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId } from "../shared-ts/src/authorization/capabilityKinds.js";
 import { buildCapabilityOperationEnvelope } from "../shared-ts/src/authorization/operationFingerprint.js";
 import { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit } from "./domain.js";
 import { hasExactKeys } from "../shared-ts/src/utils/exactKeys.js";