@seams/wallet-server 0.27.0 → 0.29.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -1,9 +1,10 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
@@ -12,14 +13,13 @@ import { buildWalletAuthMethodRecordV2, computeWalletAuthMethodRevokeOperationFi
 import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
-import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
@@ -1413,7 +1413,8 @@ var CloudflareD1WalletAuthMethodService = class {
 					provider,
 					providerUserId,
 					emailHashHex: record.emailHashHex
-				}), record.walletAuthMethodId)
+				}), record.walletAuthMethodId),
+				walletAuthority
 			};
 		} catch (error) {
 			return {

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
-import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.js

@@ -1,8 +1,8 @@
 import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
-import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { evictWalletEd25519CapabilityCache } from "../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js";
 import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationCleanup.ts
@@ -35,6 +35,7 @@ const TABLES = [
 	"wallet_recovery_code_locators",
 	"wallets",
 	"wallet_auth_methods",
+	"external_auth_associations",
 	"wallet_relocation_approvals",
 	"wallet_authorities",
 	"wallet_relocation_authorization_import_receipts",

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationIntake.js

@@ -1,9 +1,9 @@
 import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
-import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
 import { D1WalletAuthorizationHistory } from "./d1WalletAuthorizationHistory.js";
 import "./d1WalletAuthorizationSnapshot.js";

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.js

@@ -1,8 +1,8 @@
 import { requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { parseNonNegativeSafeInteger } from "../../../../shared-ts/src/device-linking/wireFields.js";
 import { AuthorizationSnapshotLayout } from "./authorizationSnapshotLayout.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorizationSnapshot.ts
 const CHUNK_BYTES = 32768;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.js

@@ -1,8 +1,8 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject, requireCanonicalString } from "../../../../shared-ts/src/utils/validation.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletRelocationChallenges.ts
 const MAX_CHALLENGE_LIFETIME_MS = 3e5;
 var WalletRelocationChallengeBinding = class WalletRelocationChallengeBinding {

package/dist/esm/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.js

@@ -1,8 +1,8 @@
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1, parseSessionOrigin, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
 import { digestOpaqueValue } from "../../../../authorization/service.js";
-import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { WalletRelocationChallengeBinding } from "./d1WalletRelocationChallenges.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletRelocationOwnerRequest.ts

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -1,11 +1,11 @@
 import { parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { WalletLifecycleLocator } from "../../../../authorization/lifecycleRouting.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
-import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,7 +1,8 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
@@ -9,7 +10,6 @@ import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/
 import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.ts
 function parseWebAuthnAuthenticatorRowDeviceInfo(raw) {
 	return parseWebAuthnAuthenticatorDeviceInfoJson(raw);

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -1,3 +1,4 @@
+import { parseExternalAuthConfiguration } from "../../../shared-ts/src/auth/externalAuth.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
 import { WALLET_CONSOLE_OP_PATHS_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1 } from "./walletConsoleOps.js";
@@ -16,6 +17,10 @@ function parseStaticWalletConsoleBindingConfigV1(value) {
 			scopes: requiredScopeList(credential.scopes)
 		},
 		deployment: {
+			externalAuth: parseExternalAuthConfiguration(deployment.externalAuth ?? {
+				kind: "disabled",
+				revision: 0
+			}),
 			orgId: requiredConfigText(deployment.orgId, "deployment.orgId"),
 			projectId: requiredConfigText(deployment.projectId, "deployment.projectId"),
 			environmentId: requiredConfigText(deployment.environmentId, "deployment.environmentId"),
@@ -97,6 +102,10 @@ function registrationContextResponse(config, value) {
 }
 function projectEnvironment(config) {
 	return {
+		externalAuth: config.deployment.externalAuth ?? {
+			kind: "disabled",
+			revision: 0
+		},
 		id: config.deployment.environmentId,
 		projectId: config.deployment.projectId,
 		key: config.deployment.environmentKey,

package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js

@@ -1,3 +1,4 @@
+import { parseExternalAuthConfiguration } from "../../../shared-ts/src/auth/externalAuth.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
 import { unavailableRegistrationContext, walletRegistrationContext } from "../../auth/walletRegistrationContext.js";
 import { WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./walletConsoleOps.js";
@@ -23,6 +24,7 @@ const PRINCIPAL_FIELDS = new Set([
 	"scopes"
 ]);
 const PROJECT_ENVIRONMENT_FIELDS = new Set([
+	"externalAuth",
 	"id",
 	"projectId",
 	"key",
@@ -143,6 +145,10 @@ function parseProjectEnvironment(value) {
 		projectId,
 		key,
 		signingRootVersion,
+		externalAuth: parseExternalAuthConfiguration(record.externalAuth ?? {
+			kind: "disabled",
+			revision: 0
+		}),
 		...status ? { status } : {}
 	};
 }

package/dist/esm/router/cloudflare-adaptor.js

@@ -1,6 +1,6 @@
 import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
-import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders } from "./auth/routerApiKeyAuth.js";
+import { defineRoute, matchesRouteDefinitionRequest } from "./framework/routeDefinitions.js";
 import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { getRouterApiRouteExtensionRoutes } from "./framework/routeExtensions.js";