@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/core/ThresholdService/validation.js

@@ -1,10 +1,10 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
-import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, isVoiceIdWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/ThresholdService/validation.ts
 function decodeFixedB64u(value, expectedLength) {

package/dist/esm/core/WebAuthnCredentialBindingStore.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isObject } from "../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { prepareD1TenantStatement } from "./d1TenantStore.js";
+import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 //#region src/core/WebAuthnCredentialBindingStore.ts
 const INSERT_CREDENTIAL_BINDING_SQL = `INSERT INTO webauthn_credential_bindings (
         namespace,

package/dist/esm/core/authService/webauthn.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
+import "../../shared-ts/src/utils/encoders.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
 //#region src/core/authService/webauthn.ts

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -1,8 +1,8 @@
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
 import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
-import { parseD1JsonColumn } from "../storage/d1Sql.js";
 //#region src/core/d1EcdsaSignerRead.ts
 function prepareWalletEcdsaSignersRead(database, scope, walletId) {
 	return database.prepare(`SELECT record_json FROM wallet_signers

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -1,10 +1,10 @@
 import { parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
-import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { D1_BATCH_CAS_GUARD_SQL, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
 import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
+import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
 //#region src/core/d1WalletAuthMethodStore.ts
 /** Names the wallet auth-method store in D1 scope errors. */
 const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";

package/dist/esm/core/d1WalletStore.js

@@ -1,13 +1,13 @@
 import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
-import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "./d1EcdsaSignerRead.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
 //#region src/core/d1WalletStore.ts

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
 import { requireRecord } from "../../shared-ts/src/utils/validation.js";
-import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseUnixMs, requireParsed } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**
 * The durable one-time Email OTP verification grant.

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -1,6 +1,6 @@
 import { parseLinkedDeviceId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 //#region src/core/deviceLinking/linkedDeviceManagement.ts
 const MAX_LINKED_DEVICE_LIST_LIMIT_V1 = 50;
 var LinkedDeviceListCursorError = class extends Error {

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -1,8 +1,8 @@
 import { hasWhitespaceOrControlCharacters, parseLinkDeviceSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
 import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
-import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
+import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
 import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -1,12 +1,12 @@
 import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
-import { failure } from "../shared-ts/src/utils/failure.js";
+import { errorMessage } from "../shared-ts/src/utils/errors.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
-import { errorMessage } from "../shared-ts/src/utils/errors.js";
 import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { toPublicKeyStringFromSecretKey } from "./nearKeys.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./authService/nearPrivateKeySigning.js";

package/dist/esm/hosted-wallet-gateway.js

@@ -1,10 +1,11 @@
 import { parseWalletId } from "./shared-ts/src/utils/domainIds.js";
-import { parseTenantId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "./shared-ts/src/utils/base64.js";
+import { parseD1JsonColumn } from "./storage/d1Sql.js";
+import { parseTenantId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseSessionOrigin } from "./authorization/domain.js";
-import { parseD1JsonColumn } from "./storage/d1Sql.js";
+import { withCors } from "./router/framework/http.js";
 import { D1WalletStore } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "./core/d1WalletAuthMethodStore.js";
 import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, walletObjectIdentity, walletObjectIdentityHeaders } from "./router/cloudflare/runtime/walletObjectAddresses.js";
@@ -12,7 +13,6 @@ import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcds
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "./shared-ts/src/tenant-root/index.js";
 import { createWalletConsoleOpsClient } from "./router/cloudflare/runtime/walletConsoleOpsClient.js";
-import { withCors } from "./router/framework/http.js";
 import { createCloudflareWalletGatewayRouterV1 } from "./router/cloudflare/runtime/walletGateway.js";
 import { createWalletRuntimeOpsHandler } from "./router/cloudflare/runtime/walletRuntimeOpsHandler.js";
 import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletControlOps.js";

package/dist/esm/index.js

@@ -1,9 +1,9 @@
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal } from "./authorization/domain.js";
 import { AuthorizationService, digestOpaqueValue } from "./authorization/service.js";
+import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./threshold/session/signingSessionSeal/transport/shared.js";
 import { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination } from "./authorization/vaultProxyUse.js";
-import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
 import { computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable } from "./core/ThresholdService/evmCryptoWasm.js";
 import { buildWalletEd25519SignerId } from "./core/WalletStore.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./core/d1WalletStore.js";

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -1,8 +1,8 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
+import "../../shared-ts/src/utils/encoders.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts
 function containsWebAuthnExtensionOutput(value) {

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -1,10 +1,12 @@
 import { parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { resolveRecordedPasskeyOwnerOperation } from "./d1RecordedOwnerOperation.js";
 //#region src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.ts
 function createD1AuthorizedOperationRouteService(assembly) {
 	const tenantId = parseTenantId(assembly.options.orgId);
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
+		resolveRecordedPasskeyOwnerOperation: resolveRecordedPasskeyOwnerOperation.bind(null, assembly, tenantId.value),
 		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEd25519WalletSessionOperation: assembly.authorizationStore.admitEd25519WalletSessionOperation.bind(assembly.authorizationStore),

package/dist/esm/router/cloudflare/d1/auth/d1RecordedOwnerOperation.js

@@ -0,0 +1,43 @@
+import { CAPABILITY_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+//#region src/router/cloudflare/d1/auth/d1RecordedOwnerOperation.ts
+/** A continuation uses only the factor digest and exact operation recorded after owner verification. */
+async function resolveRecordedPasskeyOwnerOperation(source, tenantId, input) {
+	const operation = await source.authorizationService.readAuthorizedOperationById({
+		tenantId,
+		authorizedOperationId: input.authorizedOperationId
+	});
+	if (!operation || operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral" || operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.nearEd25519MpcSigning) return null;
+	const scope = source.options;
+	const evidence = await scope.database.prepare(`SELECT authority_digest, expires_at_ms
+       FROM verified_wallet_operation_evidence_sets
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+        AND tenant_id = ? AND wallet_id = ? AND principal_id = ?
+        AND evidence_set_digest = ? AND request_origin = ? AND audience = ?
+        AND lane_digest = ? AND intent_digest = ? AND display_digest = ?
+        AND capability_kind = ? AND operation_kind = ?
+        AND verified_at_ms <= ? AND expires_at_ms > ? AND assurance = 'step_up'
+      LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, tenantId, input.walletId, operation.operation.principalId, operation.authorization.evidenceSetDigest, input.requestOrigin, input.requestOrigin, operation.operation.digests.laneDigest, operation.operation.digests.intentDigest, operation.operation.digests.displayDigest, operation.operation.operation.capabilityKind, operation.operation.operation.operationKind, input.nowMs, input.nowMs).first();
+	if (!evidence || typeof evidence.authority_digest !== "string" || typeof evidence.expires_at_ms !== "number") return null;
+	const methods = await source.walletAuthMethodStore.listForWalletV2({ walletId: input.walletId });
+	for (const method of methods) {
+		if (method.kind !== "passkey" || method.status !== "active") continue;
+		const resolved = await source.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId: input.walletId,
+			rpId: method.rpId,
+			credentialIdB64u: method.credentialIdB64u
+		});
+		if (!resolved.ok) continue;
+		if ((await walletAuthAuthorityRef({ authority: resolved.authority })).authorityDigest !== evidence.authority_digest) continue;
+		return {
+			operation,
+			authority: resolved.authority,
+			expiresAtMs: evidence.expires_at_ms
+		};
+	}
+	return null;
+}
+//#endregion
+export { resolveRecordedPasskeyOwnerOperation };
+
+//# sourceMappingURL=d1RecordedOwnerOperation.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -1,17 +1,19 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
+import { ExternalAuthService } from "../../../../auth/externalAuthService.js";
+import { ExternalAuthStore } from "../../../../auth/externalAuthStore.js";
+import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "../../../../core/d1WalletAuthMethodStore.js";
 import { normalizeLogger } from "../../../../core/logger.js";
 import { executeSignedDelegateWithRelayer } from "../../../../delegateAction/index.js";
 import { parseWalletUnlockIssuanceRejectionCode } from "../../../framework/authServicePort.js";
-import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS, LINKED_DEVICE_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createDeviceLinkingOwnerRequestAuthenticatorV1 } from "../../../transport/fetch/routes/deviceLinkingOwnerAuthorization.js";
-import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
@@ -473,6 +475,27 @@ function parseWalletRegistrationSessionCommitReceipt(raw) {
 function parseWalletRegistrationSessionCommitReceiptCommitted(raw, receipt) {
 	const record = toRecordValue(raw);
 	if (!record || typeof record.kind !== "string") return null;
+	if (record.kind === "near_owner_ready") {
+		if (!hasExactKeys(record, [
+			"kind",
+			"expectedOrigin",
+			"response"
+		])) return null;
+		const response = parseD1WalletRegistrationFinalizeReplayResponse(record.response);
+		if (!response?.ok || response.kind !== "near_ed25519") return null;
+		let expectedOrigin;
+		try {
+			expectedOrigin = new URL(String(record.expectedOrigin)).origin;
+		} catch {
+			return null;
+		}
+		if (expectedOrigin !== record.expectedOrigin) return null;
+		return {
+			kind: "near_owner_ready",
+			expectedOrigin,
+			response
+		};
+	}
 	if (record.kind === "ecdsa_ready") {
 		if (!hasExactKeys(record, [
 			"kind",
@@ -1315,6 +1338,7 @@ function createD1RouterAccountRouteService(assembly) {
 function createCloudflareD1RouterApiAuthService(input) {
 	const assembly = createCloudflareD1RouterApiAuthAssembly(input);
 	return {
+		externalAuth: new ExternalAuthService(new ExternalAuthStore(assembly.options.database, assembly.options), assembly.walletStore, assembly.walletAuthMethodStore),
 		walletExecution: assembly.options.walletExecution,
 		relocationEmailOtp: assembly.relocationEmailOtp,
 		walletRegistration: createD1WalletRegistrationRouteService(assembly),

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSessionCredentialId, parseSessionOrigin, parseWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS } from "../../../../core/ecdsaMaterialReadSnapshot.js";
-import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { EcdsaMaterialRead } from "../../../../core/d1EcdsaSignerRead.js";
 import { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { normalizeWalletAuthMethodV2 } from "../../../../core/d1WalletAuthMethodStore.js";

package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js

@@ -1,8 +1,8 @@
-import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
 import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
+import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
 //#region src/router/cloudflare/d1/authorization/d1VaultProxyStore.ts
 const VAULT_PROXY_SECRET_AAD_DOMAIN_V1 = "seams:vault:proxy-secret:v1";
 const AES_GCM_NONCE_BYTES = 12;

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -1,10 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
@@ -19,7 +20,6 @@ import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/
 import { walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
-import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
 import "../../../../core/deviceLinking/requestProof.js";
 import { reservePasskeyCredential } from "../../../../core/passkeyCredentialClaims.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js

@@ -1,5 +1,5 @@
-import { linkedDeviceEd25519ExportRootMatchesRecipientV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { d1ChangedRows, queryD1One } from "../../../../storage/d1Sql.js";
+import { linkedDeviceEd25519ExportRootMatchesRecipientV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.ts
 const TRANSFER_TABLE = "linked_device_ed25519_export_root_transfers";
 var D1LinkedDeviceEd25519ExportRootStoreV1 = class {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseEcdsaRelayerKeyId, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildFullOwnerDelegatedWalletAuthorityV1, hasDelegatedWalletPermissionV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -1,8 +1,8 @@
 import { hasControlCharacter, parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
 import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
 import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
-import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
 import { requireLinkedDeviceBootstrapRecord } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { LinkedDeviceRetiredSessionShapeErrorV1, approvalTranscriptMatchesDigest, claimTranscriptMatchesDigest, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js

@@ -1,7 +1,7 @@
 import { buildMpcMaterialActivationRef, parseMpcMaterialActivationId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetAuthenticatorStore.js

@@ -1,6 +1,6 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetAuthenticatorStore.ts
 const TARGET_CREDENTIAL_TABLE = "linked_device_target_credentials";
 var D1LinkedDeviceTargetAuthenticatorStoreV1 = class {

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -3,11 +3,11 @@ import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceTargetCredentialRegistrationResultV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceTargetPreparationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
-import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
 import { parseClientDataJsonBase64url } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.js

@@ -1,6 +1,6 @@
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { hasDelegatedWalletPermissionV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildLinkedDeviceTargetPreparationV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDevicePasskeyTargetConfigurationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js

@@ -1,9 +1,9 @@
 import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { sourceKeyManifestDigestForFamilyV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseWalletAuthorityV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parsePersistedWalletSessionAuthorizationV2 } from "../authorization/persistedWalletSessionAuthorization.js";
 import { ed25519NearPublicKeyFromBytes, replaceYaoEd25519WalletSignerActiveCapability } from "./d1Ed25519YaoWalletSigner.js";
 //#region src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, generateNumericOtp } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpGrantRecord, maskEmail, parseEmailOtpLoginOperation } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,5 +1,5 @@
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
 import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -1,10 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow, parseEmailOtpChallengePurpose } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -1,9 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
-import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpUnlockChallengeRecord } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.ts
 function errorMessage(error) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { validateEmailOtpEnrollmentMaterial } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.ts
 function parseEmailOtpEnrollmentMaterialBoundaryInput(value) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
 import { completeGoogleRegistration } from "./d1GoogleRegistrationCompletion.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -1,10 +1,10 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts