@seams/wallet-server 0.28.0 → 0.29.0

package/README.md

@@ -4,14 +4,22 @@ This package owns the reusable signer server surface: route adapters,
 WebAuthn verification policy, threshold signing services, signer storage
 adapters, and server wasm bindings.
 
-The current published package is `@seams/wallet-server@0.17.0`, checked
-October 21, 2026. Pair it with `@seams/wallet@0.17.0` and matching hosted assets.
-Use `@seams/wallet-cli@0.17.0`.
+The current release is `@seams/wallet-server@0.29.0`. Pair it with
+`@seams/wallet@0.29.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
+The wallet iframe protocol is **19.0.0**.
 
 ```sh
-pnpm add @seams/wallet-server@0.17.0
+pnpm add @seams/wallet-server@0.29.0
 ```
 
+## Google BYO authentication
+
+Version 0.29.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
+An environment-specific Google client configuration and an owner-approved wallet association are required.
+Apply the packaged signer migrations before enabling the feature.
+External sessions grant settings reads and remain separate from owner and signing credentials.
+See the [Google SSO guide](https://wallet.seams.sh/docs/guides/google-sso) for configuration, backend exchange, and revocation.
+
 ## Supported runtime and entry points
 
 The packaged Wallet backend runs on Cloudflare Workers with Durable Objects,
@@ -56,3 +64,10 @@ and [release notes](https://wallet.seams.sh/docs/releases).
 
 Hosted product services and their operational tooling live in the private
 `seams-monorepo` repository.
+
+
+Use `createApplicationAuthAssertion` from `@seams/wallet-server/application-auth` on the authenticated application backend.
+Configure the issuer and public key through the existing environment trust setting.
+The assertion binds the stable subject, environment, wallet, Seams attempt, purpose, and expiry.
+Fresh wallet-origin owner proof remains required for identity changes and NEAR transactions.
+See the [application-session guide](https://wallet.seams.sh/docs/guides/application-auth).

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.28.0"
+    "version": "0.29.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "9354a23aa130d53ead7ac72f4101910e46f52e992519f44bb50f1804c3563808",
+      "fingerprint": "bc4c3fb74b4869b98d280dff20ea71488b6e41d9de440d10d26b292360243673",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "fb89fa2ce50c5af95cb5464754523d31cbc827d780e3cc5767f55df49170f171"
+          "sha256": "f1f625e28fd7c2de2ba5d7a5f84ec06d21411d0fcb59a0d6ac687373c4a2a0fd"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "9aa8706dd8d77691a8afa8096f3295b1e94d6a92f67c4106d8edd950ff838bbd",
+      "fingerprint": "5ed3fc53704436a171fc57434e2ad732eb008cf12f1a30c3c2c0d895aaec2b36",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "b61d9f995aa1e168b0d04ccc55e41ca2adc45aac5139ec5bbca8c097b340d3dd"
+          "sha256": "70c82f021615ac41e7b6e68ec7f64c21ba5202d97463710f3184489c693e5d67"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "ff8f66cca668aba7d4d2adf0f6183731098149012461d03880f43d2155fc04e5",
+      "fingerprint": "8861d75c70c0660f85abdb2fb1d5e05f346c0185180de6482c676b16188e1d89",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "a0a83b79b96f30cc6b5c97f933d921a4c8842a2c138b1548971f1b09f8a58980"
+          "sha256": "01cd377ff0a7934d33794174f1f9ddfe3e274bcf14d850516e3b0482f7593986"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "7970e31e74739d47eebd1ee17d5ddde2a43c12eca8f9682cf65acd491eb4823a",
+      "fingerprint": "c88383e59192e1d8fe7424cd29b4d2045cac3d5fdb6be31770e825ff25c59358",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "ce676751103f5b0457884cecf38a1ecda5af7033e3c93e71d17bb8f7eecbbb7e"
+          "sha256": "3ed8b25f8604a6d815c5c2f83d82c7775c1d360840ea6f3d58f1335d3ddc0f23"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "70f00da01cea7d89aca4c051a85344fd72ec553bb92a63d0d54db2171a59c2c2",
+      "fingerprint": "87fcae5b88541e0f69333ae632568e286939ec22bf75395d490be3ba6aeb4272",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "9782d8c4537c51cbd99632eca61ead34f7137b7fd18ea4feafd4db6f27df5255"
+          "sha256": "ff8878e625a5202b8d8607c590a89c2b169ae385c826eb154b5797babb3bf73d"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",
@@ -165,8 +165,8 @@
   "migrations": {
     "signer": {
       "directory": "migrations/d1-signer",
-      "head": "0085_external_wallet_auth.sql",
-      "fingerprint": "a73558668541d4d00f06178f690a239cff675b118fe39c2e8ea2b5c5ec36cc86",
+      "head": "0087_registration_without_session.sql",
+      "fingerprint": "2901c4c1b711fde38af1371311fea9e8ae8133c5cc4f47fc0cd5588e1ddf23aa",
       "files": [
         {
           "path": "migrations/d1-signer/0001_signer_d1_initial.sql",
@@ -592,6 +592,16 @@
           "path": "migrations/d1-signer/0085_external_wallet_auth.sql",
           "bytes": 9757,
           "sha256": "62e98c8200f18cc1d6bc399891f2fd7c57e5b0639f251d10ad6cf7d7b5e30461"
+        },
+        {
+          "path": "migrations/d1-signer/0086_application_auth.sql",
+          "bytes": 4354,
+          "sha256": "a9ecaeec04383536993cb9052aebe188a5035f766fd1ef73b51b9e85736a6bb1"
+        },
+        {
+          "path": "migrations/d1-signer/0087_registration_without_session.sql",
+          "bytes": 2906,
+          "sha256": "1ed454bb25fa5a9b28567bc1f18aad718c086f8b182255fabe2ee01215292ff3"
         }
       ]
     },

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793281741952}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1793310989490}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793281927715}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1793311149098}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793282099467}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1793311295695}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793281450811}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1793310743369}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793282301221}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1793311468276}

package/dist/esm/application-auth.js

@@ -0,0 +1,2 @@
+import { createApplicationAuthAssertion } from "./auth/applicationAuth.js";
+export { createApplicationAuthAssertion };

package/dist/esm/auth/applicationAuth.js

@@ -0,0 +1,85 @@
+import { requireCanonicalString, requireRecord } from "../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.js";
+import { externalAuthFailure } from "../shared-ts/src/auth/externalAuth.js";
+//#region src/auth/applicationAuth.ts
+const ASSERTION_TTL_MS = 12e4;
+function parseClaims(raw) {
+	const value = requireRecord(raw, "application assertion claims");
+	if (typeof value.iat !== "number" || typeof value.exp !== "number" || typeof value.sessionExp !== "number") throw new Error("Application assertion timestamps are missing");
+	if (!Number.isSafeInteger(value.iat) || !Number.isSafeInteger(value.exp) || !Number.isSafeInteger(value.sessionExp)) throw new Error("Application assertion timestamps must be integer seconds");
+	if (value.purpose !== "authenticate" && value.purpose !== "associate") throw new Error("Application assertion purpose is invalid");
+	return {
+		iss: requireCanonicalString(value.iss, "iss"),
+		sub: requireCanonicalString(value.sub, "sub"),
+		aud: requireCanonicalString(value.aud, "aud"),
+		walletId: requireCanonicalString(value.walletId, "walletId"),
+		attemptId: requireCanonicalString(value.attemptId, "attemptId"),
+		iat: value.iat,
+		exp: value.exp,
+		sessionExp: value.sessionExp,
+		purpose: value.purpose
+	};
+}
+function encodeJson(value) {
+	return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}
+function decodeJson(value) {
+	return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(base64UrlDecode(value)));
+}
+function audience(environmentId) {
+	return `seams:external-auth:${environmentId}`;
+}
+/** Called only by the application's authenticated backend with its enrolled issuer key. */
+async function createApplicationAuthAssertion(input) {
+	if (input.privateKey.type !== "private" || input.privateKey.algorithm.name !== "Ed25519") throw new Error("Application issuer requires an Ed25519 signing key");
+	const claims = parseClaims({
+		iss: input.issuer,
+		sub: input.subject,
+		aud: audience(requireCanonicalString(input.environmentId, "environmentId")),
+		walletId: input.walletId,
+		attemptId: input.attemptId,
+		iat: Math.floor(input.nowMs / 1e3),
+		exp: Math.floor(Math.min(input.nowMs + ASSERTION_TTL_MS, input.sessionExpiresAtMs) / 1e3),
+		sessionExp: Math.floor(input.sessionExpiresAtMs / 1e3),
+		purpose: input.purpose
+	});
+	const signed = `${encodeJson({
+		alg: "EdDSA",
+		typ: "JWT"
+	})}.${encodeJson(claims)}`;
+	return `${signed}.${base64UrlEncode(await crypto.subtle.sign("Ed25519", input.privateKey, new TextEncoder().encode(signed)))}`;
+}
+async function verifyApplicationAuthAssertion(input) {
+	try {
+		const segments = input.assertion.split(".");
+		if (segments.length !== 3) return externalAuthFailure("invalid_credential");
+		const [headerText, claimsText, signatureText] = segments;
+		if (!headerText || !claimsText || !signatureText) return externalAuthFailure("invalid_credential");
+		const header = requireRecord(decodeJson(headerText), "application assertion header");
+		if (header.alg !== "EdDSA" || header.typ !== "JWT" || "crit" in header) return externalAuthFailure("invalid_credential");
+		const key = await crypto.subtle.importKey("raw", base64UrlDecode(input.trust.publicKeyB64u), "Ed25519", false, ["verify"]);
+		if (!await crypto.subtle.verify("Ed25519", key, base64UrlDecode(signatureText), new TextEncoder().encode(`${headerText}.${claimsText}`))) return externalAuthFailure("invalid_credential");
+		const claims = parseClaims(decodeJson(claimsText));
+		const expiresAtMs = claims.exp * 1e3;
+		const issuedAtMs = claims.iat * 1e3;
+		if (expiresAtMs <= input.nowMs) return externalAuthFailure("expired");
+		if (claims.iss !== input.trust.issuer || claims.aud !== audience(input.environmentId) || claims.walletId !== input.walletId || claims.attemptId !== input.attemptId || claims.purpose !== input.purpose || issuedAtMs > input.nowMs + 3e4 || expiresAtMs <= issuedAtMs || expiresAtMs - issuedAtMs > ASSERTION_TTL_MS || claims.sessionExp < claims.exp) return externalAuthFailure("invalid_credential");
+		return {
+			ok: true,
+			value: {
+				identity: {
+					provider: "application",
+					issuer: claims.iss,
+					subject: claims.sub
+				},
+				expiresAtMs: claims.sessionExp * 1e3
+			}
+		};
+	} catch {
+		return externalAuthFailure("invalid_credential");
+	}
+}
+//#endregion
+export { createApplicationAuthAssertion, verifyApplicationAuthAssertion };
+
+//# sourceMappingURL=applicationAuth.js.map

package/dist/esm/auth/externalAuthService.js

@@ -1,6 +1,7 @@
 import { base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256HexUtf8 } from "../shared-ts/src/utils/digests.js";
 import { externalAuthFailure } from "../shared-ts/src/auth/externalAuth.js";
+import { verifyApplicationAuthAssertion } from "./applicationAuth.js";
 import { verifyGoogleOidcToken } from "../router/cloudflare/d1/oidc/googleOidcToken.js";
 //#region src/auth/externalAuthService.ts
 var ExternalAuthService = class {
@@ -16,9 +17,12 @@ var ExternalAuthService = class {
 		return {
 			ok: true,
 			value: {
-				subject: proof.sub,
-				expiresAtMs: proof.expiresAtMs,
-				trust
+				identity: {
+					provider: "google",
+					issuer: "https://accounts.google.com",
+					subject: proof.sub
+				},
+				expiresAtMs: proof.expiresAtMs
 			}
 		};
 	}
@@ -26,6 +30,7 @@ var ExternalAuthService = class {
 		const attemptId = crypto.randomUUID();
 		const expiresAtMs = Date.now() + 12e4;
 		await this.store.prepareAttempt({
+			purpose: input.purpose,
 			attemptId,
 			walletId: input.walletId,
 			originBinding: input.originBinding,
@@ -36,6 +41,7 @@ var ExternalAuthService = class {
 		return {
 			ok: true,
 			value: {
+				purpose: input.purpose,
 				attemptId,
 				walletId: input.walletId,
 				expiresAtMs
@@ -43,23 +49,68 @@ var ExternalAuthService = class {
 		};
 	}
 	async exchange(input) {
-		const verified = await this.verifyGoogle(input.trust, input.idToken);
+		const purpose = await this.store.readPreparedPurpose(input.walletId, input.attemptId, Date.now());
+		if (purpose === null) return externalAuthFailure("access_denied");
+		const verified = await this.verifyIdentity({
+			trust: input.trust,
+			proof: input.proof,
+			walletId: input.walletId,
+			attemptId: input.attemptId,
+			purpose
+		});
 		if (!verified.ok) return verified;
 		const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
 		const nowMs = Date.now();
 		return await this.store.verifyAttempt({
 			attemptId: input.attemptId,
 			walletId: input.walletId,
-			subject: verified.value.subject,
-			trust: verified.value.trust,
+			identity: verified.value.identity,
+			trust: input.trust,
 			codeHash: await sha256HexUtf8(code),
 			nowMs,
-			sessionExpiresAtMs: Math.min(nowMs + 36e5, verified.value.expiresAtMs)
+			sessionExpiresAtMs: Math.min(nowMs + 36e5, verified.value.expiresAtMs),
+			purpose
 		}) ? {
 			ok: true,
 			value: { code }
 		} : externalAuthFailure("access_denied");
 	}
+	async prepareUnlink(input) {
+		const attemptId = crypto.randomUUID();
+		const code = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+		const expiresAtMs = Date.now() + 12e4;
+		return await this.store.prepareUnlink({
+			walletId: input.walletId,
+			associationId: input.associationId,
+			attemptId,
+			originBinding: input.originBinding,
+			bindingHash: await sha256HexUtf8(input.binding),
+			sessionTokenHash: await sha256HexUtf8(input.sessionToken),
+			codeHash: await sha256HexUtf8(code),
+			expiresAtMs,
+			trustRevision: input.trustRevision
+		}) ? {
+			ok: true,
+			value: {
+				attemptId,
+				code,
+				expiresAtMs
+			}
+		} : externalAuthFailure("access_denied");
+	}
+	async verifyIdentity(input) {
+		if (input.trust.kind === "google" && input.proof.kind === "google") return this.verifyGoogle(input.trust, input.proof.idToken);
+		if (input.trust.kind === "application" && input.proof.kind === "application") return verifyApplicationAuthAssertion({
+			trust: input.trust,
+			assertion: input.proof.assertion,
+			environmentId: this.store.scope.envId,
+			walletId: input.walletId,
+			attemptId: input.attemptId,
+			nowMs: Date.now(),
+			purpose: input.purpose
+		});
+		return externalAuthFailure("invalid_credential");
+	}
 	async settings(authentication) {
 		const walletId = authentication.walletId;
 		const [ed25519, ecdsa, methods, devices] = await Promise.all([

package/dist/esm/auth/externalAuthStore.js

@@ -1,6 +1,6 @@
 import { requireCanonicalString } from "../shared-ts/src/utils/validation.js";
 import { parseUnixMs } from "../shared-ts/src/passkey-custody/primitives.js";
-import { parseExternalWalletAuthentication } from "../shared-ts/src/auth/externalAuth.js";
+import { parseExternalWalletAuthentication, parseStoredExternalIdentity, serializeExternalIdentity } from "../shared-ts/src/auth/externalAuth.js";
 import { d1ChangedRows } from "../storage/d1Sql.js";
 import { prepareD1TenantStatement } from "../core/d1TenantStore.js";
 //#region src/auth/externalAuthStore.ts
@@ -28,6 +28,11 @@ const LIVE_ASSOCIATION = `EXISTS (
     AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
     AND ${ACTIVE_HOME}
 )`;
+const AUTHENTICATION_COLUMNS = `attempt_id, association_id, wallet_id, session_expires_at_ms,
+  (SELECT a.provider_subject FROM external_auth_associations a
+   WHERE a.namespace = external_auth_attempts.namespace AND a.org_id = external_auth_attempts.org_id
+     AND a.project_id = external_auth_attempts.project_id AND a.env_id = external_auth_attempts.env_id
+     AND a.association_id = external_auth_attempts.association_id) AS provider_subject`;
 var ExternalAuthStore = class {
 	constructor(database, scope) {
 		this.database = database;
@@ -50,6 +55,7 @@ var ExternalAuthStore = class {
 		]).run()) === 1;
 	}
 	async associate(input) {
+		const subject = serializeExternalIdentity(input.identity);
 		const revokePriorAuthority = this.prepare(`UPDATE external_auth_associations SET status = 'revoked'
        WHERE ${SCOPE} AND wallet_id = ?5 AND provider_subject = ?6 AND status = 'active'
          AND (authority_id != ?7 OR authority_epoch != ?8)
@@ -57,7 +63,7 @@ var ExternalAuthStore = class {
            AND wallet_id = ?5 AND authority_id = ?7 AND lifecycle_state = 'active'
            AND revocation_epoch = ?8)`, [
 			input.walletId,
-			input.subject,
+			subject,
 			input.authorityId,
 			input.authorityEpoch
 		]);
@@ -72,7 +78,7 @@ var ExternalAuthStore = class {
          WHERE status = 'active' DO NOTHING`, [
 			crypto.randomUUID(),
 			input.walletId,
-			input.subject,
+			subject,
 			input.authorityId,
 			input.authorityEpoch
 		]);
@@ -86,14 +92,128 @@ var ExternalAuthStore = class {
          AND wallet_id = ?5 AND authority_id = ?7 AND lifecycle_state = 'active'
          AND revocation_epoch = ?8)`, [
 			input.walletId,
-			input.subject,
+			subject,
 			input.authorityId,
 			input.authorityEpoch
 		]).first() !== null;
 	}
-	async revokeAssociation(walletId, associationId) {
+	async revokeAssociation(input) {
 		await this.prepare(`UPDATE external_auth_associations SET status = 'revoked'
-       WHERE ${SCOPE} AND wallet_id = ?5 AND association_id = ?6`, [walletId, associationId]).run();
+       WHERE ${SCOPE} AND wallet_id = ?5 AND association_id = ?6
+         AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+           AND wallet_id = ?5 AND authority_id = ?7 AND revocation_epoch = ?8 AND lifecycle_state = 'active')`, [
+			input.walletId,
+			input.associationId,
+			input.owner.authorityId,
+			input.owner.revocationEpoch
+		]).run();
+	}
+	async prepareUnlink(input) {
+		return d1ChangedRows(await this.prepare(`INSERT INTO external_auth_attempts
+       (namespace, org_id, project_id, env_id, attempt_id, wallet_id, origin, binding_hash,
+        session_token_hash, expires_at_ms, status, purpose, association_id, identity_subject, code_hash, trust_revision)
+       SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'verified', 'unlink', ?11, provider_subject, ?12, ?13
+       FROM external_auth_associations WHERE ${SCOPE} AND wallet_id = ?6 AND association_id = ?11`, [
+			input.attemptId,
+			input.walletId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.expiresAtMs,
+			input.associationId,
+			input.codeHash,
+			input.trustRevision
+		]).run()) === 1;
+	}
+	async readOwnerAttempt(input) {
+		const row = await this.prepare(`SELECT purpose, status, identity_subject, association_id, expires_at_ms, owner_challenge_expires_at_ms
+       FROM external_auth_attempts WHERE ${SCOPE} AND wallet_id = ?5 AND attempt_id = ?6
+         AND origin = ?7 AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND trust_revision = ?11 AND expires_at_ms > ?12 AND status IN ('verified', 'consumed')
+         AND purpose IN ('associate', 'unlink')`, [
+			input.walletId,
+			input.attemptId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.trustRevision,
+			input.nowMs
+		]).first();
+		if (!row) return null;
+		if (row.status !== "verified" && row.status !== "consumed") throw new Error("Invalid owner attempt state");
+		const status = row.status;
+		const identity = parseStoredExternalIdentity(requireCanonicalString(row.identity_subject, "identity_subject"));
+		const expiresAtMs = parseUnixMs(row.expires_at_ms, "attempt expiry");
+		const challenge = row.owner_challenge_expires_at_ms === null ? { kind: "unprepared" } : {
+			kind: "ready",
+			expiresAtMs: parseUnixMs(row.owner_challenge_expires_at_ms, "owner challenge expiry")
+		};
+		switch (row.purpose) {
+			case "associate": return {
+				purpose: "associate",
+				walletId: input.walletId,
+				attemptId: input.attemptId,
+				identity,
+				originBinding: input.originBinding,
+				trustRevision: input.trustRevision,
+				expiresAtMs,
+				status,
+				challenge
+			};
+			case "unlink": return {
+				purpose: "unlink",
+				walletId: input.walletId,
+				attemptId: input.attemptId,
+				identity,
+				originBinding: input.originBinding,
+				trustRevision: input.trustRevision,
+				expiresAtMs,
+				status,
+				challenge,
+				associationId: requireCanonicalString(row.association_id, "association_id")
+			};
+			default: throw new Error("Invalid owner attempt purpose");
+		}
+	}
+	async prepareOwnerChallenge(input) {
+		await this.prepare(`UPDATE external_auth_attempts
+       SET owner_challenge_expires_at_ms = COALESCE(owner_challenge_expires_at_ms, MIN(expires_at_ms, ?13))
+       WHERE ${SCOPE} AND wallet_id = ?5 AND attempt_id = ?6 AND origin = ?7
+         AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND trust_revision = ?11 AND expires_at_ms > ?12 AND status = 'verified'
+         AND purpose IN ('associate', 'unlink')`, [
+			input.walletId,
+			input.attemptId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.trustRevision,
+			input.nowMs,
+			input.nowMs + 6e4
+		]).run();
+		return this.readOwnerAttempt(input);
+	}
+	async consumeOwnerAttempt(input, owner) {
+		return d1ChangedRows(await this.prepare(`UPDATE external_auth_attempts SET status = 'consumed'
+       WHERE ${SCOPE} AND wallet_id = ?5 AND attempt_id = ?6 AND origin = ?7
+         AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
+         AND trust_revision = ?11 AND expires_at_ms > ?12 AND owner_challenge_expires_at_ms > ?12
+         AND status = 'verified' AND purpose IN ('associate', 'unlink')
+         AND EXISTS (SELECT 1 FROM wallet_authorities WHERE ${SCOPE}
+           AND wallet_id = ?5 AND authority_id = ?13 AND revocation_epoch = ?14 AND lifecycle_state = 'active')`, [
+			input.walletId,
+			input.attemptId,
+			input.originBinding,
+			input.bindingHash,
+			input.sessionTokenHash,
+			input.codeHash,
+			input.trustRevision,
+			input.nowMs,
+			owner.authorityId,
+			owner.revocationEpoch
+		]).run()) === 1;
 	}
 	async prepareAttempt(input) {
 		const nowMs = Date.now();
@@ -105,16 +225,31 @@ var ExternalAuthStore = class {
       )`).bind(nowMs)]);
 		await this.prepare(`INSERT INTO external_auth_attempts
         (namespace, org_id, project_id, env_id, attempt_id, wallet_id, origin,
-         binding_hash, session_token_hash, expires_at_ms, status)
-       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'prepared')`, [
+         binding_hash, session_token_hash, expires_at_ms, status, purpose)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, 'prepared', ?11)`, [
 			input.attemptId,
 			input.walletId,
 			input.originBinding,
 			input.bindingHash,
 			input.sessionTokenHash,
-			input.expiresAtMs
+			input.expiresAtMs,
+			input.purpose
 		]).run();
 	}
+	async readPreparedPurpose(walletId, attemptId, nowMs) {
+		const row = await this.prepare(`SELECT purpose FROM external_auth_attempts WHERE ${SCOPE} AND wallet_id = ?5
+         AND attempt_id = ?6 AND status = 'prepared' AND expires_at_ms > ?7`, [
+			walletId,
+			attemptId,
+			nowMs
+		]).first();
+		if (!row) return null;
+		switch (row.purpose) {
+			case "authenticate":
+			case "associate": return row.purpose;
+			default: return null;
+		}
+	}
 	async verifyAttempt(input) {
 		return d1ChangedRows(await this.prepare(`UPDATE external_auth_attempts SET status = 'verified',
          association_id = (SELECT a.association_id FROM external_auth_associations a
@@ -125,31 +260,32 @@ var ExternalAuthStore = class {
              AND a.wallet_id = ?6 AND a.provider_subject = ?7 AND a.status = 'active'
              AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
              AND ${ACTIVE_HOME}),
-         trust_revision = ?8, code_hash = ?9, session_expires_at_ms = ?11
+         trust_revision = ?8, code_hash = ?9, session_expires_at_ms = ?11, identity_subject = ?7
        WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6
-         AND status = 'prepared' AND expires_at_ms > ?10
-         AND EXISTS (SELECT 1 FROM external_auth_associations a
+         AND status = 'prepared' AND expires_at_ms > ?10 AND purpose = ?12
+         AND (purpose = 'associate' OR EXISTS (SELECT 1 FROM external_auth_associations a
            JOIN wallet_authorities w ON w.namespace = a.namespace AND w.org_id = a.org_id
              AND w.project_id = a.project_id AND w.env_id = a.env_id
              AND w.authority_id = a.authority_id AND w.wallet_id = a.wallet_id
            WHERE a.namespace = ?1 AND a.org_id = ?2 AND a.project_id = ?3 AND a.env_id = ?4
              AND a.wallet_id = ?6 AND a.provider_subject = ?7 AND a.status = 'active'
              AND w.lifecycle_state = 'active' AND w.revocation_epoch = a.authority_epoch
-             AND ${ACTIVE_HOME})`, [
+             AND ${ACTIVE_HOME}))`, [
 			input.attemptId,
 			input.walletId,
-			input.subject,
+			serializeExternalIdentity(input.identity),
 			input.trust.revision,
 			input.codeHash,
 			input.nowMs,
-			input.sessionExpiresAtMs
+			input.sessionExpiresAtMs,
+			input.purpose
 		]).run()) === 1;
 	}
 	async redeem(input) {
 		await this.prepare(`UPDATE external_auth_attempts SET status = 'consumed'
        WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6 AND origin = ?7
          AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
-         AND status = 'verified' AND expires_at_ms > ?11 AND session_expires_at_ms > ?11
+         AND purpose = 'authenticate' AND status = 'verified' AND expires_at_ms > ?11 AND session_expires_at_ms > ?11
          AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
 			input.attemptId,
 			input.walletId,
@@ -160,10 +296,10 @@ var ExternalAuthStore = class {
 			input.nowMs,
 			input.trustRevision
 		]).run();
-		const row = await this.prepare(`SELECT attempt_id, association_id, wallet_id, session_expires_at_ms
+		const row = await this.prepare(`SELECT ${AUTHENTICATION_COLUMNS}
        FROM external_auth_attempts WHERE ${SCOPE} AND attempt_id = ?5 AND wallet_id = ?6
          AND origin = ?7 AND binding_hash = ?8 AND session_token_hash = ?9 AND code_hash = ?10
-         AND status = 'consumed' AND session_expires_at_ms > ?11 AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
+         AND purpose = 'authenticate' AND status = 'consumed' AND session_expires_at_ms > ?11 AND trust_revision = ?12 AND ${LIVE_ASSOCIATION}`, [
 			input.attemptId,
 			input.walletId,
 			input.originBinding,
@@ -176,9 +312,9 @@ var ExternalAuthStore = class {
 		return row ? this.authentication(row) : null;
 	}
 	async readSession(input) {
-		const row = await this.prepare(`SELECT attempt_id, association_id, wallet_id, session_expires_at_ms
+		const row = await this.prepare(`SELECT ${AUTHENTICATION_COLUMNS}
        FROM external_auth_attempts WHERE ${SCOPE} AND session_token_hash = ?5 AND origin = ?6
-         AND status = 'consumed' AND session_expires_at_ms > ?7
+         AND purpose = 'authenticate' AND status = 'consumed' AND session_expires_at_ms > ?7
          AND trust_revision = ?8 AND ${LIVE_ASSOCIATION}`, [
 			input.tokenHash,
 			input.originBinding,
@@ -205,7 +341,7 @@ var ExternalAuthStore = class {
 			sessionId: row.attempt_id,
 			associationId: row.association_id,
 			environmentId: this.scope.envId,
-			provider: "google",
+			provider: parseStoredExternalIdentity(requireCanonicalString(row.provider_subject, "provider_subject")).provider,
 			permission: "wallet_settings_read",
 			expiresAtMs: parseUnixMs(row.session_expires_at_ms, "session expiry")
 		});