@seams/wallet-server 0.27.0 → 0.28.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -1,10 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
+import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
 import { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpUnlockChallengeRecord } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.ts
 function errorMessage(error) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
 import { completeGoogleRegistration } from "./d1GoogleRegistrationCompletion.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -1,10 +1,10 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
-import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import "../../../../shared-ts/src/utils/encoders.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import "../../../../shared-ts/src/utils/encoders.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcBoundary.ts
@@ -134,6 +134,7 @@ function validateGoogleIdTokenClaims(input) {
 	const aud = parseJwtAud(payload.aud);
 	if (aud.length === 0) return failedVerification("invalid_claims", "Missing Google id_token aud");
 	if (!aud.includes(input.clientId)) return failedVerification("invalid_audience", "Google id_token audience mismatch");
+	const authorizedParty = normalizeOptionalTrimmedString(payload.azp);
 	const sub = normalizeOptionalTrimmedString(payload.sub);
 	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const email = normalizeOptionalTrimmedString(payload.email);
@@ -146,6 +147,11 @@ function validateGoogleIdTokenClaims(input) {
 	return {
 		ok: true,
 		sub,
+		issuer: "https://accounts.google.com",
+		audience: input.clientId,
+		expiresAtMs: exp * 1e3,
+		authorizedParty: authorizedParty || null,
+		audienceCount: aud.length,
 		...email ? { email } : {},
 		...name ? { name } : {},
 		...givenName ? { givenName } : {},

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
-import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
 import { verifyGoogleOidcToken } from "./googleOidcToken.js";
+import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -1,11 +1,11 @@
 import { parseEmailOtpProviderUserId, parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isActiveRecoveredWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { buildWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -1,9 +1,9 @@
 import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js

@@ -1,7 +1,7 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -2,9 +2,9 @@ import { parseProviderSubject, parseVerifiedGoogleEmail } from "../../../../shar
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { consumeReservedRecoveryCode } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";

package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js

@@ -1,9 +1,9 @@
 import { parseRootShareEpoch } from "../../../../shared-ts/src/utils/domainIds.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { computeEcdsaDerivationRoleLocalRelayerKeyId, computeEcdsaDerivationRoleLocalThresholdKeyId, computeSdkEcdsaDerivationApplicationBindingDigestB64u, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildRouterAbEcdsaDerivationActiveStateIdV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "./d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.ts
 const REGISTRATION_WALLET_SIGNING_SESSION_REMAINING_USES = 3;

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -1,7 +1,8 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
@@ -27,7 +28,6 @@ import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../..
 import { findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
 import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -1,8 +1,8 @@
 import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { normalizeAddSignerSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
@@ -17,6 +17,7 @@ import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuth
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
@@ -27,7 +28,6 @@ import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseEmailOtpChallengeId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,6 +1,6 @@
 import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts

package/dist/esm/router/cloudflare/d1/wallet/authorizationSnapshotLayout.js

@@ -9,6 +9,7 @@ const TABLES = [
 	"wallet_recovery_code_locators",
 	"wallet_authorities",
 	"wallet_auth_methods",
+	"external_auth_associations",
 	"wallet_relocation_approvals",
 	"webauthn_credential_bindings",
 	"webauthn_authenticators",

package/dist/esm/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.js

@@ -1,9 +1,9 @@
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildVoiceIdWalletSessionChallenge, parseVoiceIdWalletSessionChallenge } from "../../../../shared-ts/src/authorization/voiceIdDeviceAssertion.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/wallet/d1VoiceIdWalletSessionChallenges.ts
 const CHALLENGE_LIFETIME_MS = 6e4;
 const EXPIRY_CLEANUP_LIMIT = 64;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js

@@ -1,8 +1,8 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { parseLinkedDeviceRevokeResultV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { parseLinkedDeviceRevokeResultV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.ts
 const REVOCATION_PROOF_DIGEST_DOMAIN_V1 = "seams/wallet-auth-method-revocation-proof/v1";
 /**

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -1,9 +1,10 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
@@ -19,7 +20,6 @@ import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64
 import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.js

@@ -1,8 +1,8 @@
 import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
-import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { evictWalletEd25519CapabilityCache } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.ts
@@ -35,6 +35,7 @@ const TABLES = [
 	"wallet_recovery_code_locators",
 	"wallets",
 	"wallet_auth_methods",
+	"external_auth_associations",
 	"wallet_relocation_approvals",
 	"wallet_authorities",
 	"wallet_relocation_authorization_import_receipts",

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationIntake.js

@@ -1,9 +1,9 @@
 import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
-import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
 import { D1WalletAuthorizationHistory } from "./d1WalletAuthorizationHistory.js";
 import "./d1WalletAuthorizationSnapshot.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.js

@@ -1,8 +1,8 @@
 import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.ts
 const CHUNK_BYTES = 32768;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.js

@@ -1,8 +1,8 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.ts
 const MAX_CHALLENGE_LIFETIME_MS = 3e5;
 var WalletRelocationChallengeBinding = class WalletRelocationChallengeBinding {

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.js

@@ -1,8 +1,8 @@
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1, parseSessionOrigin, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
 import { digestOpaqueValue } from "../../../../authorization/service.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { WalletRelocationChallengeBinding } from "./d1WalletRelocationChallenges.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.ts

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -1,11 +1,11 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
-import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,7 +1,8 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -9,7 +10,6 @@ import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
 function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
 	return parseWebAuthnAuthenticatorDeviceInfoJson(raw);

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -1,3 +1,4 @@
+import { parseExternalAuthConfiguration } from "../../../shared-ts/src/auth/externalAuth.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
 import { WALLET_CONSOLE_OP_PATHS_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1 } from "./walletConsoleOps.js";
@@ -16,6 +17,10 @@ function parseStaticWalletConsoleBindingConfigV1(value) {
 			scopes: requiredScopeList(credential.scopes)
 		},
 		deployment: {
+			externalAuth: parseExternalAuthConfiguration(deployment.externalAuth ?? {
+				kind: "disabled",
+				revision: 0
+			}),
 			orgId: requiredConfigText(deployment.orgId, "deployment.orgId"),
 			projectId: requiredConfigText(deployment.projectId, "deployment.projectId"),
 			environmentId: requiredConfigText(deployment.environmentId, "deployment.environmentId"),
@@ -97,6 +102,10 @@ function registrationContextResponse(config, value) {
 }
 function projectEnvironment(config) {
 	return {
+		externalAuth: config.deployment.externalAuth ?? {
+			kind: "disabled",
+			revision: 0
+		},
 		id: config.deployment.environmentId,
 		projectId: config.deployment.projectId,
 		key: config.deployment.environmentKey,

package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js

@@ -1,3 +1,4 @@
+import { parseExternalAuthConfiguration } from "../../../shared-ts/src/auth/externalAuth.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
 import { unavailableRegistrationContext, walletRegistrationContext } from "../../auth/walletRegistrationContext.js";
 import { WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./walletConsoleOps.js";
@@ -23,6 +24,7 @@ const PRINCIPAL_FIELDS = new Set([
 	"scopes"
 ]);
 const PROJECT_ENVIRONMENT_FIELDS = new Set([
+	"externalAuth",
 	"id",
 	"projectId",
 	"key",
@@ -143,6 +145,10 @@ function parseProjectEnvironment(value) {
 		projectId,
 		key,
 		signingRootVersion,
+		externalAuth: parseExternalAuthConfiguration(record.externalAuth ?? {
+			kind: "disabled",
+			revision: 0
+		}),
 		...status ? { status } : {}
 	};
 }

package/dist/esm/router/cloudflare-adaptor.js

@@ -1,6 +1,6 @@
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
-import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
+import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { getRouterApiRouteExtensionRoutes } from "./framework/routeExtensions.js";