@seams/wallet-server 0.27.0 → 0.29.0

package/README.md

@@ -4,14 +4,22 @@ This package owns the reusable signer server surface: route adapters,
 WebAuthn verification policy, threshold signing services, signer storage
 adapters, and server wasm bindings.
 
-The current published package is `@seams/wallet-server@0.17.0`, checked
-October 21, 2026. Pair it with `@seams/wallet@0.17.0` and matching hosted assets.
-Use `@seams/wallet-cli@0.17.0`.
+The current release is `@seams/wallet-server@0.29.0`. Pair it with
+`@seams/wallet@0.29.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
+The wallet iframe protocol is **19.0.0**.
 
 ```sh
-pnpm add @seams/wallet-server@0.17.0
+pnpm add @seams/wallet-server@0.29.0
 ```
 
+## Google BYO authentication
+
+Version 0.29.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
+An environment-specific Google client configuration and an owner-approved wallet association are required.
+Apply the packaged signer migrations before enabling the feature.
+External sessions grant settings reads and remain separate from owner and signing credentials.
+See the [Google SSO guide](https://wallet.seams.sh/docs/guides/google-sso) for configuration, backend exchange, and revocation.
+
 ## Supported runtime and entry points
 
 The packaged Wallet backend runs on Cloudflare Workers with Durable Objects,
@@ -56,3 +64,10 @@ and [release notes](https://wallet.seams.sh/docs/releases).
 
 Hosted product services and their operational tooling live in the private
 `seams-monorepo` repository.
+
+
+Use `createApplicationAuthAssertion` from `@seams/wallet-server/application-auth` on the authenticated application backend.
+Configure the issuer and public key through the existing environment trust setting.
+The assertion binds the stable subject, environment, wallet, Seams attempt, purpose, and expiry.
+Fresh wallet-origin owner proof remains required for identity changes and NEAR transactions.
+See the [application-session guide](https://wallet.seams.sh/docs/guides/application-auth).

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.27.0"
+    "version": "0.29.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "f4d14f9f1a23c8f98f5d12085061337aaf6e80fd79def737d2142527872d29dc",
+      "fingerprint": "bc4c3fb74b4869b98d280dff20ea71488b6e41d9de440d10d26b292360243673",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "ed5b9ff7628a165828660dbff6765db796f0a6bd4ca3292805d08a2ade9c9365"
+          "sha256": "f1f625e28fd7c2de2ba5d7a5f84ec06d21411d0fcb59a0d6ac687373c4a2a0fd"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "3ec071d957795f9ff6d0f20a0c5b33e1e5713b777733a2beb68c0b2b1391bcab",
+      "fingerprint": "5ed3fc53704436a171fc57434e2ad732eb008cf12f1a30c3c2c0d895aaec2b36",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "e54fb17f4c621cef06421c00e4d46714210336eb8a740476704bcebeae36f325"
+          "sha256": "70c82f021615ac41e7b6e68ec7f64c21ba5202d97463710f3184489c693e5d67"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "b56cb2596e6673329b2fc4cbfa7386fc9f4620cc56c3ed6e2485de66ec2bee13",
+      "fingerprint": "8861d75c70c0660f85abdb2fb1d5e05f346c0185180de6482c676b16188e1d89",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "37a251c69a161ada391e28bf6585b512f3074adfef3b160ea6e847bc9fb99b5c"
+          "sha256": "01cd377ff0a7934d33794174f1f9ddfe3e274bcf14d850516e3b0482f7593986"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "62f97b4156ded53b921aa1f7ff4406c89b08666bb3ba17bca90e2460f5333c87",
+      "fingerprint": "c88383e59192e1d8fe7424cd29b4d2045cac3d5fdb6be31770e825ff25c59358",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "6a85061edaecf85c36190d0fdceac7e0674f74f6646924d21ecc839b23e51505"
+          "sha256": "3ed8b25f8604a6d815c5c2f83d82c7775c1d360840ea6f3d58f1335d3ddc0f23"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "c4214e28c3296088b1150f3c56d1fe7536a32dd2e107dc32fe319236cd2cbad5",
+      "fingerprint": "87fcae5b88541e0f69333ae632568e286939ec22bf75395d490be3ba6aeb4272",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "91362b12400759dc63b6893896e2fca6a9d2f3d3c3dad46fb71354119861119c"
+          "sha256": "ff8878e625a5202b8d8607c590a89c2b169ae385c826eb154b5797babb3bf73d"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -165,8 +165,8 @@
   "migrations": {
     "signer": {
       "directory": "migrations/d1-signer",
-      "head": "0084_voiceid_wallet_auth_methods.sql",
-      "fingerprint": "724414d2bc4d41dd761541a0dc465145957275303a1c49610f1fbdc1e60c0316",
+      "head": "0087_registration_without_session.sql",
+      "fingerprint": "2901c4c1b711fde38af1371311fea9e8ae8133c5cc4f47fc0cd5588e1ddf23aa",
       "files": [
         {
           "path": "migrations/d1-signer/0001_signer_d1_initial.sql",
@@ -587,6 +587,21 @@
           "path": "migrations/d1-signer/0084_voiceid_wallet_auth_methods.sql",
           "bytes": 17185,
           "sha256": "01af96f95131fb6ce8e42301bfdc2bd99ead260c817833b6b03a501f836d34a9"
+        },
+        {
+          "path": "migrations/d1-signer/0085_external_wallet_auth.sql",
+          "bytes": 9757,
+          "sha256": "62e98c8200f18cc1d6bc399891f2fd7c57e5b0639f251d10ad6cf7d7b5e30461"
+        },
+        {
+          "path": "migrations/d1-signer/0086_application_auth.sql",
+          "bytes": 4354,
+          "sha256": "a9ecaeec04383536993cb9052aebe188a5035f766fd1ef73b51b9e85736a6bb1"
+        },
+        {
+          "path": "migrations/d1-signer/0087_registration_without_session.sql",
+          "bytes": 2906,
+          "sha256": "1ed454bb25fa5a9b28567bc1f18aad718c086f8b182255fabe2ee01215292ff3"
         }
       ]
     },

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793201442665}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793310989490}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793201567116}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793311149098}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793201683620}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793311295695}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793201252625}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793310743369}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793201821080}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793311468276}

package/dist/esm/application-auth.js

@@ -0,0 +1,2 @@
+import { createApplicationAuthAssertion } from "./auth/applicationAuth.js";
+export { createApplicationAuthAssertion };

package/dist/esm/auth/applicationAuth.js

@@ -0,0 +1,85 @@
+import { requireCanonicalString, requireRecord } from "../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { externalAuthFailure } from "../shared-ts/src/auth/externalAuth.js";
+//#region src/auth/applicationAuth.ts
+const ASSERTION_TTL_MS = 12e4;
+function parseClaims(raw) {
+	const value = requireRecord(raw, "application assertion claims");
+	if (typeof value.iat !== "number" || typeof value.exp !== "number" || typeof value.sessionExp !== "number") throw new Error("Application assertion timestamps are missing");
+	if (!Number.isSafeInteger(value.iat) || !Number.isSafeInteger(value.exp) || !Number.isSafeInteger(value.sessionExp)) throw new Error("Application assertion timestamps must be integer seconds");
+	if (value.purpose !== "authenticate" && value.purpose !== "associate") throw new Error("Application assertion purpose is invalid");
+	return {
+		iss: requireCanonicalString(value.iss, "iss"),
+		sub: requireCanonicalString(value.sub, "sub"),
+		aud: requireCanonicalString(value.aud, "aud"),
+		walletId: requireCanonicalString(value.walletId, "walletId"),
+		attemptId: requireCanonicalString(value.attemptId, "attemptId"),
+		iat: value.iat,
+		exp: value.exp,
+		sessionExp: value.sessionExp,
+		purpose: value.purpose
+	};
+}
+function encodeJson(value) {
+	return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}
+function decodeJson(value) {
+	return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(base64UrlDecode(value)));
+}
+function audience(environmentId) {
+	return `seams:external-auth:${environmentId}`;
+}
+/** Called only by the application's authenticated backend with its enrolled issuer key. */
+async function createApplicationAuthAssertion(input) {
+	if (input.privateKey.type !== "private" || input.privateKey.algorithm.name !== "Ed25519") throw new Error("Application issuer requires an Ed25519 signing key");
+	const claims = parseClaims({
+		iss: input.issuer,
+		sub: input.subject,
+		aud: audience(requireCanonicalString(input.environmentId, "environmentId")),
+		walletId: input.walletId,
+		attemptId: input.attemptId,
+		iat: Math.floor(input.nowMs / 1e3),
+		exp: Math.floor(Math.min(input.nowMs + ASSERTION_TTL_MS, input.sessionExpiresAtMs) / 1e3),
+		sessionExp: Math.floor(input.sessionExpiresAtMs / 1e3),
+		purpose: input.purpose
+	});
+	const signed = `${encodeJson({
+		alg: "EdDSA",
+		typ: "JWT"
+	})}.${encodeJson(claims)}`;
+	return `${signed}.${base64UrlEncode(await crypto.subtle.sign("Ed25519", input.privateKey, new TextEncoder().encode(signed)))}`;
+}
+async function verifyApplicationAuthAssertion(input) {
+	try {
+		const segments = input.assertion.split(".");
+		if (segments.length !== 3) return externalAuthFailure("invalid_credential");
+		const [headerText, claimsText, signatureText] = segments;
+		if (!headerText || !claimsText || !signatureText) return externalAuthFailure("invalid_credential");
+		const header = requireRecord(decodeJson(headerText), "application assertion header");
+		if (header.alg !== "EdDSA" || header.typ !== "JWT" || "crit" in header) return externalAuthFailure("invalid_credential");
+		const key = await crypto.subtle.importKey("raw", base64UrlDecode(input.trust.publicKeyB64u), "Ed25519", false, ["verify"]);
+		if (!await crypto.subtle.verify("Ed25519", key, base64UrlDecode(signatureText), new TextEncoder().encode(`${headerText}.${claimsText}`))) return externalAuthFailure("invalid_credential");
+		const claims = parseClaims(decodeJson(claimsText));
+		const expiresAtMs = claims.exp * 1e3;
+		const issuedAtMs = claims.iat * 1e3;
+		if (expiresAtMs <= input.nowMs) return externalAuthFailure("expired");
+		if (claims.iss !== input.trust.issuer || claims.aud !== audience(input.environmentId) || claims.walletId !== input.walletId || claims.attemptId !== input.attemptId || claims.purpose !== input.purpose || issuedAtMs > input.nowMs + 3e4 || expiresAtMs <= issuedAtMs || expiresAtMs - issuedAtMs > ASSERTION_TTL_MS || claims.sessionExp < claims.exp) return externalAuthFailure("invalid_credential");
+		return {
+			ok: true,
+			value: {
+				identity: {
+					provider: "application",
+					issuer: claims.iss,
+					subject: claims.sub
+				},
+				expiresAtMs: claims.sessionExp * 1e3
+			}
+		};
+	} catch {
+		return externalAuthFailure("invalid_credential");
+	}
+}
+//#endregion
+export { createApplicationAuthAssertion, verifyApplicationAuthAssertion };
+
+//# sourceMappingURL=applicationAuth.js.map

package/dist/esm/auth/externalAuthService.js

@@ -0,0 +1,149 @@
+import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { sha256HexUtf8 } from "../shared-ts/src/utils/digests.js";
+import { externalAuthFailure } from "../shared-ts/src/auth/externalAuth.js";
+import { verifyApplicationAuthAssertion } from "./applicationAuth.js";
+import { verifyGoogleOidcToken } from "../router/cloudflare/d1/oidc/googleOidcToken.js";
+//#region src/auth/externalAuthService.ts
+var ExternalAuthService = class {
+	constructor(store, wallets, methods) {
+		this.store = store;
+		this.wallets = wallets;
+		this.methods = methods;
+	}
+	async verifyGoogle(trust, idToken) {
+		const proof = await verifyGoogleOidcToken(trust.clientId, idToken);
+		if (!proof.ok) return externalAuthFailure(proof.code === "expired" ? "expired" : "invalid_credential");
+		if (proof.audienceCount > 1 && proof.authorizedParty === null || proof.authorizedParty !== null && proof.authorizedParty !== trust.clientId) return externalAuthFailure("invalid_credential");
+		return {
+			ok: true,
+			value: {
+				identity: {
+					provider: "google",
+					issuer: "https://accounts.google.com",
+					subject: proof.sub
+				},
+				expiresAtMs: proof.expiresAtMs
+			}
+		};
+	}
+	async prepare(input) {
+		const attemptId = crypto.randomUUID();
+		const expiresAtMs = Date.now() + 12e4;
+		await this.store.prepareAttempt({
+			purpose: input.purpose,
+			attemptId,
+			walletId: input.walletId,
+			originBinding: input.originBinding,
+			bindingHash: await sha256HexUtf8(input.binding),
+			sessionTokenHash: await sha256HexUtf8(input.sessionToken),
+			expiresAtMs
+		});
+		return {
+			ok: true,
+			value: {
+				purpose: input.purpose,
+				attemptId,
+				walletId: input.walletId,
+				expiresAtMs
+			}
+		};
+	}
+	async exchange(input) {
+		const purpose = await this.store.readPreparedPurpose(input.walletId, input.attemptId, Date.now());
+		if (purpose === null) return externalAuthFailure("access_denied");
+		const verified = await this.verifyIdentity({
+			trust: input.trust,
+			proof: input.proof,
+			walletId: input.walletId,
+			attemptId: input.attemptId,
+			purpose
+		});
+		if (!verified.ok) return verified;
+		const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+		const nowMs = Date.now();
+		return await this.store.verifyAttempt({
+			attemptId: input.attemptId,
+			walletId: input.walletId,
+			identity: verified.value.identity,
+			trust: input.trust,
+			codeHash: await sha256HexUtf8(code),
+			nowMs,
+			sessionExpiresAtMs: Math.min(nowMs + 36e5, verified.value.expiresAtMs),
+			purpose
+		}) ? {
+			ok: true,
+			value: { code }
+		} : externalAuthFailure("access_denied");
+	}
+	async prepareUnlink(input) {
+		const attemptId = crypto.randomUUID();
+		const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+		const expiresAtMs = Date.now() + 12e4;
+		return await this.store.prepareUnlink({
+			walletId: input.walletId,
+			associationId: input.associationId,
+			attemptId,
+			originBinding: input.originBinding,
+			bindingHash: await sha256HexUtf8(input.binding),
+			sessionTokenHash: await sha256HexUtf8(input.sessionToken),
+			codeHash: await sha256HexUtf8(code),
+			expiresAtMs,
+			trustRevision: input.trustRevision
+		}) ? {
+			ok: true,
+			value: {
+				attemptId,
+				code,
+				expiresAtMs
+			}
+		} : externalAuthFailure("access_denied");
+	}
+	async verifyIdentity(input) {
+		if (input.trust.kind === "google" && input.proof.kind === "google") return this.verifyGoogle(input.trust, input.proof.idToken);
+		if (input.trust.kind === "application" && input.proof.kind === "application") return verifyApplicationAuthAssertion({
+			trust: input.trust,
+			assertion: input.proof.assertion,
+			environmentId: this.store.scope.envId,
+			walletId: input.walletId,
+			attemptId: input.attemptId,
+			nowMs: Date.now(),
+			purpose: input.purpose
+		});
+		return externalAuthFailure("invalid_credential");
+	}
+	async settings(authentication) {
+		const walletId = authentication.walletId;
+		const [ed25519, ecdsa, methods, devices] = await Promise.all([
+			this.wallets.listEd25519SignersForWallet({ walletId }),
+			this.wallets.listEcdsaSignersForWallet({ walletId }),
+			this.methods.listForWalletV2({ walletId }),
+			this.store.devices(walletId)
+		]);
+		const accounts = [];
+		for (const signer of ed25519) accounts.push({
+			family: "ed25519",
+			address: signer.nearAccountId,
+			publicKey: signer.publicKey
+		});
+		for (const signer of ecdsa) accounts.push({
+			family: "ecdsa",
+			address: signer.walletKey.thresholdOwnerAddress,
+			publicKey: signer.walletKey.thresholdEcdsaPublicKeyB64u
+		});
+		const summaries = [];
+		for (const method of methods) if (method.status === "active") summaries.push({
+			id: method.walletAuthMethodId,
+			kind: method.kind
+		});
+		return {
+			authentication,
+			accounts,
+			methods: summaries,
+			devices
+		};
+	}
+};
+//#endregion
+export { ExternalAuthService };
+
+//# sourceMappingURL=externalAuthService.js.map