@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -1,7 +1,7 @@
 import { parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "./primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { requireEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
 import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
 //#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,9 +1,9 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
 import { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 } from "./participantDigest.js";

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,9 +1,9 @@
 import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
 import { requireRecord } from "./validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId } from "./canonicalPrimitives.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,9 +1,9 @@
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { requireRecord } from "./validation.js";
-import { rejectUnknownFields } from "./exactRecord.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseDigestB64u } from "./canonicalPrimitives.js";
+import { rejectUnknownFields } from "./exactRecord.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
 function buildVoiceIdWalletAuthAuthority(input) {

package/dist/esm/shared-ts/src/wallet-recovery/index.js

@@ -1,10 +1,10 @@
-import "./recoveryCodeReservation.js";
 import "../utils/emailOtpRecoveryKey.js";
+import "./recoveryCodeLocator.js";
+import "./recoveryCodeReservation.js";
 import "./recoveryKeyId.js";
+import "./walletRecoveryEcdsaPossession.js";
 import "./backupAcknowledgement.js";
 import "./recoveryCodes.js";
 import "./walletRecoveryEnvelopeSet.js";
-import "./recoveryCodeLocator.js";
-import "./walletRecoveryEcdsaPossession.js";
 import "./walletRecoveryRotation.js";
 import "./walletRecoveryCommittedProjection.js";

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -1,5 +1,5 @@
-import "../authorization/capabilityKinds.js";
 import { requireTrimmedString } from "../utils/validation.js";
+import "../authorization/capabilityKinds.js";
 import "../utils/walletAuthMethodRecord.js";
 import "../authorization/walletAuthority.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.ts

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js

@@ -1,7 +1,7 @@
 import { parseWalletId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import "../passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "./recoveryCodeReservation.js";
 import { parseDerivedWalletRecoveryKeyId } from "./recoveryKeyId.js";

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
 //#region src/threshold/session/signingSessionSeal/crypto/cipher.ts

package/dist/esm/threshold/session/signingSessionSeal/service.js

@@ -1,7 +1,7 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
+import "../../../shared-ts/src/utils/encoders.js";
 //#region src/threshold/session/signingSessionSeal/service.ts
 const SIGNING_SESSION_SEAL_LOG_LABEL = "[threshold-signing-session-seal]";
 const SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT = 9e4;

package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js

@@ -1,6 +1,6 @@
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
 import { headersToRecord, readJson } from "../../../../router/framework/http.js";
+import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
 function json(body, status = 200) {
 	return new Response(JSON.stringify(body), {

package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js

@@ -1,8 +1,8 @@
 import { parseThresholdSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { ensureLeadingSlash } from "../../../../shared-ts/src/utils/normalize.js";
 import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 //#region src/threshold/session/signingSessionSeal/transport/shared.ts
 const DEFAULT_BASE_PATH = WALLET_SESSION_SEAL_BASE_PATH;
 function readRequiredString(obj, key) {

package/dist/types/shared-ts/src/auth/externalAuth.d.ts

@@ -0,0 +1,127 @@
+import { type WalletId } from '../utils/domainIds';
+import { type Ed25519PublicKeyB64u } from '../passkey-custody/primitives';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+export declare const EXTERNAL_AUTH_PATH = "/wallet/external-auth";
+export type ExternalAuthProvider = ReadonlyExclusiveUnion<{
+    kind: 'disabled';
+} | {
+    kind: 'google';
+    clientId: string;
+} | {
+    kind: 'application';
+    issuer: string;
+    publicKeyB64u: Ed25519PublicKeyB64u;
+}>;
+export type ExternalAuthConfiguration = ExternalAuthProvider & Readonly<{
+    revision: number;
+}>;
+export type ExternalIdentity = ReadonlyExclusiveUnion<{
+    provider: 'google';
+    issuer: 'https://accounts.google.com';
+    subject: string;
+} | {
+    provider: 'application';
+    issuer: string;
+    subject: string;
+}>;
+export type ExternalIdentityProof = ReadonlyExclusiveUnion<{
+    kind: 'google';
+    idToken: string;
+} | {
+    kind: 'application';
+    assertion: string;
+}>;
+export declare function parseExternalAuthProvider(raw: unknown): ExternalAuthProvider;
+export declare function parseExternalAuthConfiguration(raw: unknown): ExternalAuthConfiguration;
+export declare function serializeExternalIdentity(identity: ExternalIdentity): string;
+export declare function parseStoredExternalIdentity(serialized: string): ExternalIdentity;
+export type ExternalOwnerChallenge = Readonly<{
+    walletId: WalletId;
+    attemptId: string;
+    identity: ExternalIdentity;
+    challengeB64u: DigestB64u;
+    expiresAtMs: number;
+}> & ReadonlyExclusiveUnion<{
+    kind: 'associate';
+} | {
+    kind: 'unlink';
+    associationId: string;
+}>;
+export declare function parseExternalOwnerChallenge(raw: unknown): ExternalOwnerChallenge;
+type ExternalAuthFailureCode = 'invalid_request' | 'invalid_credential' | 'access_denied' | 'expired' | 'superseded' | 'unavailable' | 'rate_limited' | 'cancelled';
+export type ExternalAuthResult<T> = ReadonlyExclusiveUnion<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: ExternalAuthFailureCode;
+    message: string;
+}>;
+export type ExternalAuthenticateInput = ReadonlyExclusiveUnion<{
+    method: 'google';
+    walletId: string;
+    idToken: string;
+} | {
+    method: 'handoff';
+    walletId: string;
+    attemptId: string;
+    code: string;
+}>;
+export type ExternalAuthPurpose = 'authenticate' | 'associate';
+export type ExternalAuthAttempt<Purpose extends ExternalAuthPurpose = 'authenticate'> = Readonly<{
+    purpose: Purpose;
+    attemptId: string;
+    walletId: WalletId;
+    expiresAtMs: number;
+}>;
+export type ExternalAuthCommand = ReadonlyExclusiveUnion<{
+    action: 'authenticate';
+    input: ExternalAuthenticateInput;
+} | {
+    action: 'prepare';
+    walletId: string;
+} | {
+    action: 'prepare_association';
+    walletId: string;
+} | {
+    action: 'associate';
+    input: ExternalAuthenticateInput;
+} | {
+    action: 'unlink';
+    walletId: string;
+    associationId: string;
+}>;
+export declare function parseExternalAuthCommand(raw: unknown): ExternalAuthCommand;
+export type ExternalWalletAuthentication = Readonly<{
+    kind: 'external_authenticated';
+    walletId: WalletId;
+    sessionId: string;
+    associationId: string;
+    environmentId: string;
+    provider: ExternalIdentity['provider'];
+    permission: 'wallet_settings_read';
+    expiresAtMs: number;
+    authMethod?: never;
+}>;
+export type ExternalWalletSettings = Readonly<{
+    authentication: ExternalWalletAuthentication;
+    accounts: readonly Readonly<{
+        family: 'ed25519' | 'ecdsa';
+        address: string;
+        publicKey: string;
+    }>[];
+    methods: readonly Readonly<{
+        id: string;
+        kind: 'passkey' | 'email_otp' | 'voiceid';
+    }>[];
+    devices: readonly Readonly<{
+        id: string;
+    }>[];
+}>;
+export declare function parseExternalWalletAuthentication(value: unknown): ExternalWalletAuthentication;
+export declare function externalAuthFailure(code: ExternalAuthFailureCode): ExternalAuthResult<never>;
+export declare function parseExternalAuthFailure(value: unknown): ExternalAuthResult<never>;
+export declare function parseExternalWalletSettings(value: unknown): ExternalWalletSettings;
+export {};
+//# sourceMappingURL=externalAuth.d.ts.map

package/dist/types/shared-ts/src/authorization/index.d.ts

@@ -1,7 +1,7 @@
 export * from './capabilityKinds';
 export * from './delegatedAuthority';
 export * from './operationFingerprint';
-export * from './walletCustodyOperation';
+export * from './walletOwnerOperation';
 export * from './walletAuthority';
 export * from './walletSessionIssuance';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/authorization/walletOwnerOperation.d.ts

@@ -0,0 +1,10 @@
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+export type WalletOwnerAdminOperation = 'external_identity_associate' | 'external_identity_unlink' | 'credentials_list' | 'credential_label' | 'recovery_rotate' | 'recovery_read' | 'recovery_status' | 'recovery_backup_acknowledge';
+/** Public challenge digest for a single wallet-administration factor proof. */
+export declare function computeWalletOwnerAdminChallengeDigest(input: {
+    readonly walletId: string;
+    readonly operation: WalletOwnerAdminOperation;
+    readonly payload: Record<string, unknown>;
+    readonly requestOrigin: string;
+}): Promise<DigestB64u>;
+//# sourceMappingURL=walletOwnerOperation.d.ts.map

package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts

@@ -72,6 +72,10 @@ export type RegistrationEstablishedSessionV2 = {
     readonly tokens: RegistrationEstablishedSessionProjectionTokensV2;
 };
 export type RegistrationEstablishedSessionResultV2 = {
+    readonly kind: 'owner_operations';
+    readonly walletId: WalletId;
+    readonly session?: never;
+} | {
     readonly kind: 'issued';
     readonly session: RegistrationEstablishedSessionV2;
 } | {

package/dist/types/shared-ts/src/utils/registrationIntent.d.ts

@@ -18,7 +18,9 @@ export type RuntimePolicyScopeLike = {
     envId: string;
     signingRootVersion?: string;
 };
+export type RegistrationCompletion = 'wallet_session' | 'owner_operations';
 export type RegistrationIntentV1 = {
+    completion: RegistrationCompletion;
     version: 'registration_intent_v1';
     walletId: WalletId;
     authMethod: RegistrationAuthMethodInput;

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "4";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "5";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet-server/src/application-auth.d.ts

@@ -0,0 +1,3 @@
+/** Backend-only application-session assertions for the external-auth exchange. */
+export { createApplicationAuthAssertion } from './auth/applicationAuth';
+//# sourceMappingURL=application-auth.d.ts.map

package/dist/types/wallet-server/src/auth/applicationAuth.d.ts

@@ -0,0 +1,29 @@
+import type { ExternalAuthConfiguration, ExternalAuthPurpose, ExternalAuthResult, ExternalIdentity } from '../../../shared-ts/src/auth/externalAuth';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
+type ApplicationTrust = Variant<ExternalAuthConfiguration, 'kind', 'application'>;
+/** Called only by the application's authenticated backend with its enrolled issuer key. */
+export declare function createApplicationAuthAssertion(input: {
+    readonly privateKey: CryptoKey;
+    readonly issuer: string;
+    readonly subject: string;
+    readonly environmentId: string;
+    readonly walletId: string;
+    readonly attemptId: string;
+    readonly nowMs: number;
+    readonly sessionExpiresAtMs: number;
+    readonly purpose: ExternalAuthPurpose;
+}): Promise<string>;
+export declare function verifyApplicationAuthAssertion(input: {
+    readonly trust: ApplicationTrust;
+    readonly assertion: string;
+    readonly environmentId: string;
+    readonly walletId: string;
+    readonly attemptId: string;
+    readonly nowMs: number;
+    readonly purpose: ExternalAuthPurpose;
+}): Promise<ExternalAuthResult<{
+    identity: Variant<ExternalIdentity, 'provider', 'application'>;
+    expiresAtMs: number;
+}>>;
+export {};
+//# sourceMappingURL=applicationAuth.d.ts.map

package/dist/types/wallet-server/src/auth/externalAuthService.d.ts

@@ -0,0 +1,55 @@
+import type { ExternalAuthResult, ExternalWalletAuthentication, ExternalWalletSettings, ExternalIdentity, ExternalIdentityProof, ExternalAuthPurpose, ExternalAuthAttempt } from '../../../shared-ts/src/auth/externalAuth';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStore } from '../core/d1WalletStore';
+import type { WalletAuthMethodV2Store } from '../core/d1WalletAuthMethodStore';
+import { ExternalAuthStore, type ExternalAuthTrust } from './externalAuthStore';
+import type { Variant } from '../../../shared-ts/src/utils/variant';
+export declare class ExternalAuthService {
+    readonly store: ExternalAuthStore;
+    private readonly wallets;
+    private readonly methods;
+    constructor(store: ExternalAuthStore, wallets: D1WalletStore, methods: WalletAuthMethodV2Store);
+    verifyGoogle(trust: Variant<ExternalAuthTrust, 'kind', 'google'>, idToken: string): Promise<ExternalAuthResult<{
+        identity: ExternalIdentity;
+        expiresAtMs: number;
+    }>>;
+    prepare(input: {
+        purpose: ExternalAuthPurpose;
+        walletId: WalletId;
+        originBinding: string;
+        binding: string;
+        sessionToken: string;
+    }): Promise<ExternalAuthResult<ExternalAuthAttempt<ExternalAuthPurpose>>>;
+    exchange(input: {
+        walletId: WalletId;
+        attemptId: string;
+        proof: ExternalIdentityProof;
+        trust: ExternalAuthTrust;
+    }): Promise<ExternalAuthResult<{
+        code: string;
+    }>>;
+    prepareUnlink(input: {
+        walletId: WalletId;
+        associationId: string;
+        originBinding: string;
+        binding: string;
+        sessionToken: string;
+        trustRevision: number;
+    }): Promise<ExternalAuthResult<{
+        attemptId: string;
+        code: string;
+        expiresAtMs: number;
+    }>>;
+    verifyIdentity(input: {
+        readonly trust: ExternalAuthTrust;
+        readonly proof: ExternalIdentityProof;
+        readonly walletId: WalletId;
+        readonly attemptId: string;
+        readonly purpose: ExternalAuthPurpose;
+    }): Promise<ExternalAuthResult<{
+        identity: ExternalIdentity;
+        expiresAtMs: number;
+    }>>;
+    settings(authentication: ExternalWalletAuthentication): Promise<ExternalWalletSettings>;
+}
+//# sourceMappingURL=externalAuthService.d.ts.map

package/dist/types/wallet-server/src/auth/externalAuthStore.d.ts

@@ -0,0 +1,115 @@
+import type { ExternalWalletAuthentication, ExternalAuthConfiguration, ExternalIdentity, ExternalAuthPurpose } from '../../../shared-ts/src/auth/externalAuth';
+import type { WalletId, WalletAuthorityId } from '../../../shared-ts/src/utils/domainIds';
+import { type D1TenantScope } from '../core/d1TenantStore';
+import type { D1DatabaseLike } from '../storage/tenantRoute';
+import type { ReadonlyExclusiveUnion } from '../../../shared-ts/src/utils/variant';
+import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
+export type ExternalAuthTrust = Exclude<ExternalAuthConfiguration, {
+    kind: 'disabled';
+}>;
+type ExternalAuthPreparedAttempt = Readonly<{
+    purpose: ExternalAuthPurpose;
+    attemptId: string;
+    walletId: WalletId;
+    originBinding: string;
+    bindingHash: string;
+    sessionTokenHash: string;
+    expiresAtMs: number;
+}>;
+export type ExternalOwnerAttemptBinding = Readonly<{
+    walletId: WalletId;
+    attemptId: string;
+    originBinding: string;
+    bindingHash: string;
+    sessionTokenHash: string;
+    codeHash: string;
+    trustRevision: number;
+    nowMs: number;
+}>;
+export type ExternalOwnerAttempt = Readonly<{
+    walletId: WalletId;
+    attemptId: string;
+    identity: ExternalIdentity;
+    originBinding: string;
+    trustRevision: number;
+    expiresAtMs: number;
+    status: 'verified' | 'consumed';
+    challenge: {
+        kind: 'unprepared';
+    } | {
+        kind: 'ready';
+        expiresAtMs: number;
+    };
+}> & ReadonlyExclusiveUnion<{
+    purpose: 'associate';
+} | {
+    purpose: 'unlink';
+    associationId: string;
+}>;
+export declare class ExternalAuthStore {
+    private readonly database;
+    readonly scope: D1TenantScope;
+    constructor(database: D1DatabaseLike, scope: D1TenantScope);
+    private prepare;
+    consumeAuthenticationAllowance(rateKey: string, nowMs: number): Promise<boolean>;
+    associate(input: {
+        walletId: WalletId;
+        identity: ExternalIdentity;
+        authorityId: WalletAuthorityId;
+        authorityEpoch: number;
+    }): Promise<boolean>;
+    revokeAssociation(input: {
+        walletId: WalletId;
+        associationId: string;
+        owner: ActiveWalletAuthorityV1;
+    }): Promise<void>;
+    prepareUnlink(input: {
+        walletId: WalletId;
+        associationId: string;
+        attemptId: string;
+        originBinding: string;
+        bindingHash: string;
+        sessionTokenHash: string;
+        codeHash: string;
+        expiresAtMs: number;
+        trustRevision: number;
+    }): Promise<boolean>;
+    readOwnerAttempt(input: ExternalOwnerAttemptBinding): Promise<ExternalOwnerAttempt | null>;
+    prepareOwnerChallenge(input: ExternalOwnerAttemptBinding): Promise<ExternalOwnerAttempt | null>;
+    consumeOwnerAttempt(input: ExternalOwnerAttemptBinding, owner: ActiveWalletAuthorityV1): Promise<boolean>;
+    prepareAttempt(input: ExternalAuthPreparedAttempt): Promise<void>;
+    readPreparedPurpose(walletId: WalletId, attemptId: string, nowMs: number): Promise<ExternalAuthPurpose | null>;
+    verifyAttempt(input: {
+        attemptId: string;
+        walletId: WalletId;
+        identity: ExternalIdentity;
+        trust: ExternalAuthTrust;
+        codeHash: string;
+        nowMs: number;
+        sessionExpiresAtMs: number;
+        purpose: ExternalAuthPurpose;
+    }): Promise<boolean>;
+    redeem(input: {
+        attemptId: string;
+        walletId: WalletId;
+        originBinding: string;
+        bindingHash: string;
+        sessionTokenHash: string;
+        codeHash: string;
+        nowMs: number;
+        trustRevision: number;
+    }): Promise<ExternalWalletAuthentication | null>;
+    readSession(input: {
+        tokenHash: string;
+        originBinding: string;
+        nowMs: number;
+        trustRevision: number;
+    }): Promise<ExternalWalletAuthentication | null>;
+    revokeSession(tokenHash: string, originBinding: string): Promise<void>;
+    devices(walletId: WalletId): Promise<readonly {
+        id: string;
+    }[]>;
+    private authentication;
+}
+export {};
+//# sourceMappingURL=externalAuthStore.d.ts.map

package/dist/types/wallet-server/src/auth/externalOwnerOperations.d.ts

@@ -0,0 +1,18 @@
+import { type ExternalAuthResult, type ExternalOwnerChallenge } from '../../../shared-ts/src/auth/externalAuth';
+import { type WalletOwnerAdminOperation } from '../../../shared-ts/src/authorization/walletOwnerOperation';
+import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import { ExternalAuthStore, type ExternalOwnerAttempt, type ExternalOwnerAttemptBinding } from './externalAuthStore';
+export type ExternalOwnerOperation = Readonly<{
+    attempt: ExternalOwnerAttempt;
+    operation: Extract<WalletOwnerAdminOperation, 'external_identity_associate' | 'external_identity_unlink'>;
+    payload: Readonly<Record<string, unknown>>;
+    challengeB64u: DigestB64u;
+}>;
+export declare function readExternalOwnerOperation(input: {
+    readonly store: ExternalAuthStore;
+    readonly binding: ExternalOwnerAttemptBinding;
+    readonly requestOrigin: string;
+    readonly phase: 'prepare' | 'complete';
+}): Promise<ExternalAuthResult<ExternalOwnerOperation>>;
+export declare function externalOwnerChallenge(operation: ExternalOwnerOperation): ExternalOwnerChallenge;
+//# sourceMappingURL=externalOwnerOperations.d.ts.map

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -1,3 +1,4 @@
+export { parseExternalAuthConfiguration, parseExternalAuthProvider, type ExternalAuthConfiguration, type ExternalAuthProvider, } from '../../shared-ts/src/auth/externalAuth';
 export * from './core/SessionService';
 export * from './core/ThresholdService/evmCryptoWasm';
 export * from './core/d1WalletStore';
@@ -121,5 +122,5 @@ export type { LinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDev
 export { computeLinkedDeviceSessionClaimDigestV1 } from '../../shared-ts/src/device-linking/digests';
 export { admitD1EstablishedWalletHome, resumeRegistrationDirectoryPublicationsV1, type RegistrationDirectoryPublicationDelivery, } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
 export { D1WalletObjectAddresses } from './router/cloudflare/d1/walletObjectAddresses';
-export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity } from './router/cloudflare/runtime/walletObjectAddresses';
+export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity, } from './router/cloudflare/runtime/walletObjectAddresses';
 //# sourceMappingURL=cloud-host.d.ts.map

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -94,6 +94,18 @@ type WalletRegistrationSessionCommitReadyBaseV2 = WalletRegistrationSessionCommi
     readonly walletCustody?: WalletCustodyRegistrationOutcome;
 };
 export type WalletRegistrationSessionCommitReceiptV2 = {
+    readonly kind: 'wallet_registration_session_commit_receipt_v2';
+    readonly operation: 'near_provisioning';
+    readonly operationFingerprint: string;
+    readonly registrationCeremonyId: string;
+    readonly committed: {
+        readonly kind: 'near_owner_ready';
+        readonly expectedOrigin: string;
+        readonly response: Extract<WalletRegistrationFinalizeSuccess, {
+            kind: 'near_ed25519';
+        }>;
+    };
+} | {
     readonly kind: 'wallet_registration_session_commit_receipt_v2';
     readonly operation: 'registration_activate' | 'near_provisioning';
     readonly operationFingerprint: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts

@@ -1,11 +1,15 @@
 import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
 import type { RouterApiServiceBag } from '../../../framework/authServicePort';
 import type { CloudflareD1AuthorizationStore } from '../authorization/d1AuthorizationStore';
+import type { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
 import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
 type D1AuthorizedOperationRouteServiceAssembly = {
     readonly authorizationService: AuthorizationService;
     readonly authorizationStore: CloudflareD1AuthorizationStore;
-    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'orgId'>;
+    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId'>;
+    readonly walletAuthMethodStore: D1WalletAuthMethodStore;
+    readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
 };
 export declare function createD1AuthorizedOperationRouteService(assembly: D1AuthorizedOperationRouteServiceAssembly): RouterApiServiceBag['authorizedOperations'];
 export {};

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RecordedOwnerOperation.d.ts

@@ -0,0 +1,16 @@
+import { type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { RouterApiAuthorizedOperationService } from '../../../framework/authServicePort';
+import type { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
+import type { NormalizedCloudflareD1RouterApiAuthServiceOptions } from './d1RouterApiAuthConfig';
+type RecordedOwnerOperationSource = {
+    readonly options: Pick<NormalizedCloudflareD1RouterApiAuthServiceOptions, 'database' | 'namespace' | 'orgId' | 'projectId' | 'envId'>;
+    readonly authorizationService: AuthorizationService;
+    readonly walletAuthMethodStore: D1WalletAuthMethodStore;
+    readonly walletAuthMethods: CloudflareD1WalletAuthMethodService;
+};
+/** A continuation uses only the factor digest and exact operation recorded after owner verification. */
+export declare function resolveRecordedPasskeyOwnerOperation(source: RecordedOwnerOperationSource, tenantId: TenantId, input: Parameters<RouterApiAuthorizedOperationService['resolveRecordedPasskeyOwnerOperation']>[0]): ReturnType<RouterApiAuthorizedOperationService['resolveRecordedPasskeyOwnerOperation']>;
+export {};
+//# sourceMappingURL=d1RecordedOwnerOperation.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcBoundary.d.ts

@@ -22,6 +22,11 @@ export type ParsedRs256JwtResult = {
 export type GoogleIdTokenClaims = {
     readonly ok: true;
     readonly sub: string;
+    readonly issuer: 'https://accounts.google.com';
+    readonly audience: string;
+    readonly expiresAtMs: number;
+    readonly authorizedParty: string | null;
+    readonly audienceCount: number;
     readonly email?: string;
     readonly name?: string;
     readonly givenName?: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts

@@ -20,6 +20,7 @@ export declare function inferRuntimePolicyScopeFromSigningRoot(input: {
     readonly signingRootVersion?: string;
 }): RuntimePolicyScope | undefined;
 export declare function buildRegistrationIntent(input: {
+    readonly completion: RegistrationIntentV1['completion'];
     readonly nonceB64u: string;
     readonly walletId: WalletId;
     readonly authMethod: RegistrationAuthMethodInput;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts

@@ -1,3 +1,4 @@
+import type { RegistrationIntentV1 } from '../../../../../../shared-ts/src/utils/registrationIntent';
 /**
  * `/wallets/register/setup` — one request replacing the bootstrap grant, the
  * registration intent, and registration start.
@@ -39,6 +40,7 @@ import type { WalletRegistrationSetupRequest } from '../../../domains/walletRegi
 import { mintSignedWalletRegistrationSetup, type WalletRegistrationSetupMinter } from '../../../domains/walletRegistration/walletRegistrationSetupPayload';
 export declare function normalizeWalletRegistrationSetupRequest(request: WalletRegistrationSetupRequest): {
     readonly ok: true;
+    readonly completion: RegistrationIntentV1['completion'];
     readonly signerSelection: RegistrationSignerSetSelection;
     readonly authMethod: RegistrationAuthMethodInput;
 } | {