@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -1,22 +1,22 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildAuthorizationGrantRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { buildAuthorizationGrantRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { authorizedOperationReplayBodyInit, parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
+import { json, readJson } from "../../../framework/http.js";
+import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
-import { json, readJson } from "../../../framework/http.js";
-import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../../threshold/statusCodes.js";
 import { signingPrepareSessionResponse } from "../../../domains/signingOperations/signingPrepareSession.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -1,10 +1,10 @@
 import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { json, readJson } from "../../../framework/http.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../../auth/commonRouterUtils.js";
-import { json, readJson } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
 const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
 function parsePreflightRequest(raw) {

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -1,9 +1,9 @@
-import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
-import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
+import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import "../../../../shared-ts/src/utils/walletManagementProtocol.js";
 import { jsonFailure, readJson } from "../../../framework/http.js";
+import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
+import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
 import { routerApiWalletRegistrationRouteService } from "../../../framework/authServicePort.js";
 //#region src/router/transport/fetch/routes/walletRegistration.ts
 const ROUTE_IDS = [
@@ -44,7 +44,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
-	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "4") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "5") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),

package/dist/esm/router/transport/fetch/walletOwnerOperationAuthorization.js

@@ -0,0 +1,306 @@
+import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { requireParsed } from "../../../shared-ts/src/passkey-custody/primitives.js";
+import { computeWalletOwnerAdminChallengeDigest } from "../../../shared-ts/src/authorization/walletOwnerOperation.js";
+import { buildVaultOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
+import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../authorization/domain.js";
+import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseWebAuthnAuthenticationCredential } from "../../auth/webAuthnCredentialCodecs.js";
+import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { toFetchRouteResponse } from "../../framework/routeResponses.js";
+import { parseCustodyOwnerProof } from "./routes/walletCustodyRequestBoundary.js";
+//#region src/router/transport/fetch/walletOwnerOperationAuthorization.ts
+const CUSTODY_OPERATION_CAPABILITY_ID = "wallet-custody-admin";
+const CUSTODY_PROOF_TTL_MS = 6e4;
+function walletOwnerOperationAuthorizationId(operation, challenge) {
+	return requireParsed(parseAuthorizedOperationId(`wallet-custody:authorized:wallet-custody:${operation}:${challenge}`), "owner operation");
+}
+function hasFullOwnerAuthority(authority) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
+}
+async function custodyDigest(domain, value) {
+	return sha256Utf8DigestB64u(`${domain}|${alphabetizeStringify(value)}`);
+}
+async function buildWalletCustodyOperation(input) {
+	const tenantId = requireParsed(parseTenantId(input.tenantId), "authorization");
+	const principalId = requireParsed(parsePrincipalId(input.principalId), "authorization");
+	const capabilityId = requireParsed(parseCapabilityId(CUSTODY_OPERATION_CAPABILITY_ID), "authorization");
+	const operationRef = buildVaultOperationRef("vault.reveal");
+	const laneDigest = await custodyDigest("seams:wallet-custody:lane:v1", {
+		capabilityId,
+		operation: input.operation,
+		operationRef
+	});
+	const challengeDigest = await computeWalletOwnerAdminChallengeDigest({
+		walletId: input.walletId,
+		operation: input.operation,
+		payload: input.payload,
+		requestOrigin: input.requestOrigin
+	});
+	const intentDigest = challengeDigest;
+	const displayDigest = await custodyDigest("seams:wallet-custody:display:v1", {
+		walletId: input.walletId,
+		operation: input.operation
+	});
+	return {
+		operation: buildCapabilityOperationEnvelope({
+			tenantId,
+			principalId,
+			capabilityId,
+			operationId: requireParsed(parseCapabilityOperationId(`wallet-custody:${input.operation}:${intentDigest}`), "authorization"),
+			operation: operationRef,
+			digests: {
+				laneDigest,
+				intentDigest,
+				displayDigest
+			}
+		}),
+		challengeDigest
+	};
+}
+async function authorizeWalletOwnerOperation(input) {
+	const requestOrigin = normalizeOptionalTrimmedString(input.ctx.request.headers.get("origin"));
+	if (!requestOrigin) return toCustodyAuthorizationFailure(400, "invalid_origin", "request Origin is required");
+	let origin;
+	let proof;
+	let walletId;
+	try {
+		origin = parseSessionOrigin(requestOrigin);
+		walletId = requireParsed(parseWalletId(input.walletId), "authorization");
+		proof = parseCustodyOwnerProof(input.factorProof);
+	} catch (error) {
+		return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "owner proof is invalid");
+	}
+	if (proof.kind === "passkey" && proof.walletId !== input.walletId) return toCustodyAuthorizationFailure(403, "scope_mismatch", "owner proof wallet differs");
+	let principalId;
+	let factor;
+	let ownerAuthorityRef;
+	let ownerAuthority;
+	let operation;
+	let challengeDigest;
+	try {
+		principalId = proof.kind === "passkey" ? input.walletId : proof.provider_subject_id;
+		const built = await buildWalletCustodyOperation({
+			tenantId: input.ctx.service.authorizedOperations.tenantId,
+			principalId,
+			walletId: input.walletId,
+			operation: input.operation,
+			payload: input.payload,
+			requestOrigin
+		});
+		operation = built.operation;
+		challengeDigest = built.challengeDigest;
+	} catch (error) {
+		return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "owner proof binding is invalid");
+	}
+	const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(operation);
+	const nowMs = Date.now();
+	if (proof.challenge_digest !== String(challengeDigest)) return toCustodyAuthorizationFailure(403, "scope_mismatch", "factor proof challenge does not match the requested operation");
+	if (proof.kind === "passkey") {
+		let authority;
+		try {
+			authority = buildPasskeyWalletAuthAuthority({
+				walletId,
+				rpId: proof.rpId,
+				credentialIdB64u: proof.credentialIdB64u
+			});
+		} catch (error) {
+			return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "passkey authority is invalid");
+		}
+		const active = await input.ctx.service.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId,
+			rpId: authority.verifier.rpId,
+			credentialIdB64u: authority.factor.credentialIdB64u
+		});
+		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
+		if (!hasFullOwnerAuthority(active.walletAuthority)) return toCustodyAuthorizationFailure(403, "forbidden", "Full owner authority is required");
+		ownerAuthority = active.walletAuthority;
+		const credential = parseWebAuthnAuthenticationCredential(proof.webauthn_authentication);
+		if (!credential) return toCustodyAuthorizationFailure(400, "invalid_owner_proof", "passkey assertion is invalid");
+		if (String(credential.rawId || credential.id).trim() !== authority.factor.credentialIdB64u) return toCustodyAuthorizationFailure(401, "unauthorized", "passkey credential changed");
+		const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
+			userId: input.walletId,
+			rpId: authority.verifier.rpId,
+			expectedChallenge: challengeDigest,
+			expected_origin: requestOrigin,
+			webauthn_authentication: credential
+		});
+		if (!verified.success || !verified.verified) return toCustodyAuthorizationFailure(401, verified.code || "not_verified", verified.message || "WebAuthn authentication verification failed");
+		ownerAuthorityRef = await walletAuthAuthorityRef({ authority: active.authority });
+		factor = buildVerifiedWalletOperationPasskeyFactorResult({
+			tenantId: operation.tenantId,
+			principalId: operation.principalId,
+			walletId,
+			authorityRef: ownerAuthorityRef,
+			requestOrigin: origin,
+			audience: origin,
+			factorId: requireParsed(parseAuthFactorId(`passkey:${authority.factor.credentialIdB64u}`), "authorization"),
+			credentialIdB64u: requireParsed(parseWebAuthnCredentialIdB64u(authority.factor.credentialIdB64u), "authorization"),
+			assertionDigest: await custodyDigest("seams:wallet-custody:assertion:v1", { credential }),
+			operation,
+			verifiedAtMs: nowMs,
+			expiresAtMs: nowMs + CUSTODY_PROOF_TTL_MS
+		});
+	} else {
+		const providerSubject = requireParsed(parseProviderSubject(proof.provider_subject_id), "authorization");
+		const orgId = requireParsed(parseOrgId(input.ctx.service.authorizedOperations.tenantId), "authorization");
+		const active = await input.ctx.service.walletAuthMethods.resolveActiveEmailOtpAuthorityForVerifiedSubject({
+			walletId: input.walletId,
+			providerUserId: proof.provider_subject_id
+		});
+		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
+		const activeAuthorityRef = await walletAuthAuthorityRef({ authority: active.authority });
+		ownerAuthorityRef = activeAuthorityRef;
+		ownerAuthority = active.walletAuthority;
+		const ownerProofBindingDigest = await hashEmailOtpOperationBinding({
+			walletId: input.walletId,
+			providerUserId: proof.provider_subject_id,
+			orgId,
+			operation: `wallet_custody:${input.operation}`,
+			requestOrigin,
+			audience: requestOrigin,
+			authorityRef: activeAuthorityRef,
+			operationFingerprintDigest: challengeDigest
+		});
+		const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
+			userId: proof.provider_subject_id,
+			walletId: input.walletId,
+			orgId,
+			challengeId: proof.challenge_id,
+			otpCode: proof.otp_code,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest,
+			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
+		});
+		if (!verified.ok) return toCustodyAuthorizationFailure(verified.code === "invalid_body" ? 400 : 401, verified.code, verified.message);
+		const consumed = await input.ctx.service.emailOtp.consumeEmailOtpGrant({
+			subject: {
+				kind: "provider_identity",
+				orgId,
+				providerSubject,
+				walletId
+			},
+			loginGrant: verified.loginGrant,
+			otpChannel: EMAIL_OTP_CHANNEL
+		});
+		if (!consumed.ok) return toCustodyAuthorizationFailure(emailOtpStatusCode(consumed.code), consumed.code, consumed.message);
+		factor = buildVerifiedWalletOperationEmailOtpFactorResult({
+			tenantId: operation.tenantId,
+			principalId: operation.principalId,
+			walletId,
+			authorityRef: activeAuthorityRef,
+			requestOrigin: origin,
+			audience: origin,
+			factorId: requireParsed(parseAuthFactorId(`email_otp:${active.authority.factor.provider}:${proof.provider_subject_id}`), "authorization"),
+			operation,
+			challengeId: requireParsed(parseEmailOtpChallengeId(consumed.challengeId), "authorization"),
+			verificationReceiptDigest: await custodyDigest("seams:wallet-custody:otp-receipt:v1", {
+				challengeId: consumed.challengeId,
+				operationFingerprintDigest
+			}),
+			verifiedAtMs: nowMs,
+			expiresAtMs: Math.min(nowMs + CUSTODY_PROOF_TTL_MS, verified.grantExpiresAtMs)
+		});
+	}
+	const ownerProof = await input.ctx.service.authorizedOperations.buildVerifiedOwnerProof({
+		purpose: "operation",
+		proofId: parseVerifiedOwnerProofId(`wallet-custody:${operation.operationId}`),
+		factor
+	});
+	if (ownerProof.purpose !== "operation" || ownerProof.operation.operationFingerprintDigest !== operationFingerprintDigest) return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "owner proof binding is invalid");
+	const existing = await input.ctx.service.authorizedOperations.readAuthorizedOperation({
+		tenantId: operation.tenantId,
+		operationFingerprintDigest
+	});
+	if (existing) {
+		if (existing.authorization.kind !== "verified_step_up" || existing.quota.kind !== "quota_neutral") return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "Owner operation authorization differs");
+		return {
+			ok: false,
+			response: authorizedOperationReplay(existing)
+		};
+	}
+	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
+		operation,
+		evidenceId: requireParsed(parseAuthorizationEvidenceId(`wallet-custody:evidence:${operation.operationId}`), "authorization"),
+		evidenceSetId: requireParsed(parseAuthorizationEvidenceSetId(`wallet-custody:evidence-set:${operation.operationId}`), "authorization"),
+		factor
+	});
+	const admission = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
+		tenantId: operation.tenantId,
+		authorizedOperationId: walletOwnerOperationAuthorizationId(input.operation, challengeDigest),
+		auditEventId: requireParsed(parseAuthorizationAuditEventId(`wallet-custody:audit:${operation.operationId}`), "authorization"),
+		operation,
+		authorization: {
+			kind: "verified_step_up",
+			evidenceSetDigest: evidenceSet.evidenceSetDigest
+		},
+		quota: { kind: "quota_neutral" },
+		claimedAtMs: nowMs
+	} });
+	switch (admission.kind) {
+		case "claimed": return {
+			ok: true,
+			operation: admission.operation,
+			ownerAuthority
+		};
+		case "replayed":
+		case "operation_in_progress": return {
+			ok: false,
+			response: authorizedOperationReplay(admission.operation)
+		};
+		case "authorization_grant_rejected":
+		case "verified_step_up_rejected":
+		case "wallet_session_quota_exhausted":
+		case "material_mismatch": return toCustodyAuthorizationFailure(403, "owner_proof_rejected", "owner proof was rejected");
+	}
+}
+function toCustodyAuthorizationFailure(status, code, message) {
+	return {
+		ok: false,
+		response: routeErrorResponse(status, code, message)
+	};
+}
+function routeErrorResponse(status, code, message) {
+	return toFetchRouteResponse({
+		status,
+		body: {
+			ok: false,
+			code,
+			message
+		}
+	});
+}
+function authorizedOperationReplay(operation) {
+	if (operation.lifecycle !== "completed") return routeErrorResponse(409, "recovery_in_progress", "wallet recovery is still in progress");
+	return new Response(operation.response.bodyText, {
+		status: operation.response.status,
+		headers: { "content-type": operation.response.contentType }
+	});
+}
+async function completeWalletOwnerOperation(ctx, operation, status, body, result = "succeeded") {
+	const bodyText = JSON.stringify(body);
+	await ctx.service.authorizedOperations.completeAuthorizedOperation({
+		operation,
+		result,
+		response: {
+			status,
+			contentType: "application/json",
+			bodyText
+		},
+		completedAtMs: Date.now()
+	});
+	return toFetchRouteResponse({
+		status,
+		body
+	});
+}
+//#endregion
+export { authorizeWalletOwnerOperation, completeWalletOwnerOperation, walletOwnerOperationAuthorizationId };
+
+//# sourceMappingURL=walletOwnerOperationAuthorization.js.map

package/dist/esm/shared-ts/src/auth/externalAuth.js

@@ -0,0 +1,118 @@
+import { parseWalletId } from "../utils/domainIds.js";
+import { requireCanonicalString, requireRecord } from "../utils/validation.js";
+import { parseEd25519PublicKeyB64u, parseUnixMs } from "../passkey-custody/primitives.js";
+//#region ../shared-ts/src/auth/externalAuth.ts
+const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+function parseExternalAuthProvider(raw) {
+	const value = requireRecord(raw, "external authentication provider");
+	switch (value.kind) {
+		case "disabled": return { kind: "disabled" };
+		case "google": return {
+			kind: "google",
+			clientId: requireCanonicalString(value.clientId, "clientId")
+		};
+		case "application": {
+			const issuer = requireCanonicalString(value.issuer, "issuer");
+			const url = new URL(issuer);
+			if (url.protocol !== "https:" || url.origin !== issuer) throw new Error("Application issuer must be a canonical HTTPS origin");
+			return {
+				kind: "application",
+				issuer,
+				publicKeyB64u: parseEd25519PublicKeyB64u(value.publicKeyB64u, "publicKeyB64u")
+			};
+		}
+		default: throw new Error("Unsupported external authentication provider");
+	}
+}
+function externalAuthConfiguration(provider, revision) {
+	switch (provider.kind) {
+		case "disabled": return {
+			kind: "disabled",
+			revision
+		};
+		case "google": return {
+			kind: "google",
+			revision,
+			clientId: provider.clientId
+		};
+		case "application": return {
+			kind: "application",
+			revision,
+			issuer: provider.issuer,
+			publicKeyB64u: provider.publicKeyB64u
+		};
+		default: return assertNever(provider);
+	}
+}
+function parseExternalAuthConfiguration(raw) {
+	const value = requireRecord(raw, "external authentication configuration");
+	if (typeof value.revision !== "number" || !Number.isSafeInteger(value.revision) || value.revision < 0) throw new Error("Invalid external authentication revision");
+	return externalAuthConfiguration(parseExternalAuthProvider(value), value.revision);
+}
+function serializeExternalIdentity(identity) {
+	return JSON.stringify([
+		identity.provider,
+		identity.issuer,
+		identity.subject
+	]);
+}
+function parseStoredExternalIdentity(serialized) {
+	const raw = JSON.parse(serialized);
+	if (!Array.isArray(raw) || raw.length !== 3) throw new Error("Invalid external identity");
+	const [provider, issuer, subject] = raw;
+	return parseExternalIdentity({
+		provider,
+		issuer,
+		subject
+	});
+}
+function parseExternalIdentity(raw) {
+	const value = requireRecord(raw, "external identity");
+	const provider = value.provider;
+	const issuer = requireCanonicalString(value.issuer, "issuer");
+	const subject = requireCanonicalString(value.subject, "subject");
+	switch (provider) {
+		case "google":
+			if (issuer !== "https://accounts.google.com") throw new Error("Invalid Google issuer");
+			return {
+				provider,
+				issuer,
+				subject
+			};
+		case "application": return {
+			provider,
+			issuer,
+			subject
+		};
+		default: throw new Error("Invalid external identity provider");
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unsupported external authentication provider: ${String(value)}`);
+}
+function parseExternalWalletAuthentication(value) {
+	const record = requireRecord(value, "external authentication");
+	const walletId = parseWalletId(record.walletId);
+	if (!walletId.ok || record.kind !== "external_authenticated" || record.provider !== "google" && record.provider !== "application" || record.permission !== "wallet_settings_read" || "authMethod" in record) throw new Error("External authentication is invalid");
+	return {
+		kind: "external_authenticated",
+		walletId: walletId.value,
+		sessionId: requireCanonicalString(record.sessionId, "sessionId"),
+		associationId: requireCanonicalString(record.associationId, "associationId"),
+		environmentId: requireCanonicalString(record.environmentId, "environmentId"),
+		provider: record.provider,
+		permission: "wallet_settings_read",
+		expiresAtMs: parseUnixMs(record.expiresAtMs, "expiresAtMs")
+	};
+}
+function externalAuthFailure(code) {
+	return {
+		ok: false,
+		code,
+		message: "Wallet authentication could not be completed."
+	};
+}
+//#endregion
+export { EXTERNAL_AUTH_PATH, externalAuthFailure, parseExternalAuthConfiguration, parseExternalAuthProvider, parseExternalWalletAuthentication, parseStoredExternalIdentity, serializeExternalIdentity };
+
+//# sourceMappingURL=externalAuth.js.map

package/dist/esm/shared-ts/src/authorization/index.js

@@ -1,6 +1,6 @@
+import "./walletOwnerOperation.js";
 import "./capabilityKinds.js";
 import "./delegatedAuthority.js";
 import "./operationFingerprint.js";
 import "./walletAuthority.js";
-import "./walletCustodyOperation.js";
 import "./walletSessionIssuance.js";

package/dist/esm/shared-ts/src/authorization/voiceIdDeviceAssertion.js

@@ -1,9 +1,9 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
-import { parseWalletSessionMintId } from "./capabilityKinds.js";
 import { isPlainObject } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseWalletSessionMintId } from "./capabilityKinds.js";
 //#region ../shared-ts/src/authorization/voiceIdDeviceAssertion.ts
 const CHALLENGE_DOMAIN = "seams:wallet-session:voiceid-device:v1";
 const MAXIMUM_CHALLENGE_MS = 6e4;

package/dist/esm/shared-ts/src/authorization/walletAuthority.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
-import { parseDeviceId } from "./capabilityKinds.js";
 import { requireRecord } from "../utils/validation.js";
-import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseDeviceId } from "./capabilityKinds.js";
+import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 //#region ../shared-ts/src/authorization/walletAuthority.ts

package/dist/esm/shared-ts/src/authorization/{walletCustodyOperation.js → walletOwnerOperation.js}

@@ -1,8 +1,8 @@
 import { alphabetizeStringify } from "../utils/digests.js";
 import { sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
-//#region ../shared-ts/src/authorization/walletCustodyOperation.ts
+//#region ../shared-ts/src/authorization/walletOwnerOperation.ts
 /** Public challenge digest for a single wallet-administration factor proof. */
-async function computeWalletCustodyAdminChallengeDigest(input) {
+async function computeWalletOwnerAdminChallengeDigest(input) {
 	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
 		walletId: input.walletId,
 		operation: input.operation,
@@ -11,6 +11,6 @@ async function computeWalletCustodyAdminChallengeDigest(input) {
 	})}`);
 }
 //#endregion
-export { computeWalletCustodyAdminChallengeDigest };
+export { computeWalletOwnerAdminChallengeDigest };
 
-//# sourceMappingURL=walletCustodyOperation.js.map
+//# sourceMappingURL=walletOwnerOperation.js.map

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,7 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -1,6 +1,6 @@
-import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { sha256DigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
+import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/digests.ts

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -1,9 +1,9 @@
 import { requireArray, requireRecord } from "../utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
 import { exactRecord } from "../utils/exactRecord.js";
 import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
 import "../authorization/delegatedAuthority.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
 import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";
 import { requireRouterAbX25519PublicKey } from "../utils/routerAbPublicKeyset.js";

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { requireRecordCopy } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
+import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationBindingV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";

package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { parseLinkDevicePublicKeyB64u } from "./parsers.js";
 //#region ../shared-ts/src/device-linking/walletSessionCredentialDelivery.ts
 const DELIVERY_AAD_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-aad/v1";

package/dist/esm/shared-ts/src/device-linking/wireFields.js

@@ -1,9 +1,9 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { parseUnixMs } from "../passkey-custody/primitives.js";
 import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
 import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseUnixMs } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/wireFields.ts
 const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);
 const walletId = /* @__PURE__ */ wireResult(parseWalletId);

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -1,7 +1,7 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs } from "./primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
 //#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";