@seams/wallet-server 0.5.0

package/dist/esm/core/authService/oidcVerification.js

@@ -0,0 +1,262 @@
+import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
+import "../../shared-ts/src/utils/encoders.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+import { parseCacheControlMaxAgeSec, parseJwtAud, parseJwtSegmentJson } from "./webauthnOidcHelpers.js";
+import { isObject } from "./record.js";
+import { toArrayBufferCopy } from "./portableCrypto.js";
+//#region src/core/authService/oidcVerification.ts
+function createGoogleJwksState() {
+	return {
+		cache: null,
+		fetchPromise: null
+	};
+}
+function jwtError(code, message) {
+	return {
+		ok: false,
+		verified: false,
+		code,
+		message
+	};
+}
+function requireWebCrypto() {
+	return typeof crypto !== "undefined" && Boolean(crypto.subtle);
+}
+function parseJwtParts(input) {
+	const parts = input.token.split(".");
+	if (parts.length !== 3) return jwtError("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
+	const [headerB64u, payloadB64u, signatureB64u] = parts;
+	const header = parseJwtSegmentJson(headerB64u);
+	if (!header) return jwtError("invalid_body", `Invalid ${input.tokenName} header encoding`);
+	const payload = parseJwtSegmentJson(payloadB64u);
+	if (!payload) return jwtError("invalid_body", `Invalid ${input.tokenName} payload encoding`);
+	return {
+		ok: true,
+		value: {
+			headerB64u,
+			payloadB64u,
+			signatureB64u,
+			header,
+			payload
+		}
+	};
+}
+function jwkFromRaw(rawKey) {
+	if (!isObject(rawKey)) return null;
+	const kid = normalizeOptionalTrimmedString(rawKey.kid);
+	const kty = normalizeOptionalTrimmedString(rawKey.kty);
+	const use = normalizeOptionalTrimmedString(rawKey.use);
+	const alg = normalizeOptionalTrimmedString(rawKey.alg);
+	const n = normalizeOptionalTrimmedString(rawKey.n);
+	const e = normalizeOptionalTrimmedString(rawKey.e);
+	if (!kid || kty !== "RSA" || !n || !e) return null;
+	if (use !== "sig" || alg !== "RS256") return null;
+	return {
+		kid,
+		jwk: rawKey
+	};
+}
+async function fetchJwks(input) {
+	const now = Date.now();
+	const resp = await fetch(input.url);
+	const text = await resp.text();
+	if (!resp.ok) throw new Error(`${input.failureLabel} (HTTP ${resp.status}): ${text.slice(0, 200)}`);
+	let json;
+	try {
+		json = text ? JSON.parse(text) : null;
+	} catch {
+		throw new Error(input.invalidJsonLabel);
+	}
+	if (!isObject(json)) throw new Error(input.invalidShapeLabel);
+	const keysRaw = json.keys;
+	if (!Array.isArray(keysRaw)) throw new Error(input.missingKeysLabel);
+	const keysByKid = /* @__PURE__ */ new Map();
+	for (const rawKey of keysRaw) {
+		const key = jwkFromRaw(rawKey);
+		if (key) keysByKid.set(key.kid, key.jwk);
+	}
+	if (!keysByKid.size) throw new Error(input.noUsableKeysLabel);
+	return {
+		keysByKid,
+		expiresAtMs: now + (parseCacheControlMaxAgeSec(resp.headers.get("cache-control")) || 3600) * 1e3
+	};
+}
+async function getGoogleJwks(state) {
+	const now = Date.now();
+	if (state.cache && now < state.cache.expiresAtMs) return state.cache;
+	if (state.fetchPromise) return state.fetchPromise;
+	state.fetchPromise = fetchJwks({
+		url: "https://www.googleapis.com/oauth2/v3/certs",
+		failureLabel: "Google OIDC certs fetch failed",
+		missingKeysLabel: "Google OIDC certs missing \"keys\" array",
+		invalidJsonLabel: "Google OIDC certs returned non-JSON response",
+		invalidShapeLabel: "Google OIDC certs returned invalid JSON shape",
+		noUsableKeysLabel: "Google OIDC certs returned no usable RSA keys"
+	});
+	try {
+		state.cache = await state.fetchPromise;
+		return state.cache;
+	} finally {
+		state.fetchPromise = null;
+	}
+}
+async function verifyJwtSignature(input) {
+	let signatureBytes;
+	try {
+		signatureBytes = base64UrlDecode(input.parts.signatureB64u);
+	} catch {
+		return jwtError("invalid_body", `Invalid ${input.tokenName} signature encoding`);
+	}
+	const dataBytes = new TextEncoder().encode(`${input.parts.headerB64u}.${input.parts.payloadB64u}`);
+	const key = await crypto.subtle.importKey("jwk", input.jwk, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["verify"]);
+	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return jwtError("invalid_signature", `Invalid ${input.tokenName} signature`);
+	return { ok: true };
+}
+function verifyGoogleTimeClaims(payload) {
+	const nowSec = Math.floor(Date.now() / 1e3);
+	const exp = Number(payload.exp);
+	if (!Number.isFinite(exp) || exp <= 0) return jwtError("invalid_claims", "Invalid Google id_token exp");
+	if (nowSec >= exp) return jwtError("expired", "Google id_token is expired");
+	const nbfRaw = payload.nbf;
+	if (nbfRaw !== void 0) {
+		const nbf = Number(nbfRaw);
+		if (!Number.isFinite(nbf)) return jwtError("invalid_claims", "Invalid Google id_token nbf");
+		if (nowSec < nbf) return jwtError("not_yet_valid", "Google id_token is not yet valid");
+	}
+	return { ok: true };
+}
+function parseGoogleEmailVerified(value) {
+	if (typeof value === "boolean") return value;
+	if (typeof value === "string") return value.trim().toLowerCase() === "true";
+	return null;
+}
+function buildGoogleLoginVerificationSuccess(input) {
+	const result = {
+		ok: true,
+		verified: true,
+		providerSubject: input.providerSubject,
+		sub: input.sub
+	};
+	if (input.email) result.email = input.email;
+	if (input.name) result.name = input.name;
+	if (input.givenName) result.given_name = input.givenName;
+	if (input.familyName) result.family_name = input.familyName;
+	if (input.emailVerified !== null) result.emailVerified = input.emailVerified;
+	if (input.hostedDomain) result.hostedDomain = input.hostedDomain;
+	return result;
+}
+async function resolveLinkedProviderUserId(input) {
+	let userId = input.providerSubject;
+	try {
+		const linked = await input.identityStore.getUserIdBySubject(input.providerSubject);
+		if (linked) userId = linked;
+		await input.identityStore.linkSubjectToUserId({
+			userId,
+			subject: input.providerSubject,
+			allowMoveIfSoleIdentity: false
+		});
+	} catch {}
+	return userId;
+}
+function buildGoogleLoginFacadeSuccess(input) {
+	const result = {
+		ok: true,
+		verified: true,
+		userId: input.userId,
+		providerSubject: input.verified.providerSubject,
+		sub: input.verified.sub
+	};
+	if (input.verified.email) result.email = input.verified.email;
+	if (input.verified.name) result.name = input.verified.name;
+	if (input.verified.given_name) result.given_name = input.verified.given_name;
+	if (input.verified.family_name) result.family_name = input.verified.family_name;
+	if (typeof input.verified.emailVerified === "boolean") result.emailVerified = input.verified.emailVerified;
+	if (input.verified.hostedDomain) result.hostedDomain = input.verified.hostedDomain;
+	return result;
+}
+async function verifyGoogleIdToken(input) {
+	if (!input.config?.clientIds?.length) return jwtError("not_configured", "Google OIDC is not configured on this server");
+	const idToken = normalizeOptionalTrimmedString(input.request.idToken ?? input.request.id_token);
+	if (!idToken) return jwtError("invalid_body", "id_token is required");
+	if (!requireWebCrypto()) return jwtError("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
+	const parts = parseJwtParts({
+		token: idToken,
+		tokenName: "id_token"
+	});
+	if (!parts.ok) return parts;
+	const kid = normalizeOptionalTrimmedString(parts.value.header.kid);
+	const alg = normalizeOptionalTrimmedString(parts.value.header.alg);
+	if (!kid) return jwtError("invalid_body", "id_token header.kid is required");
+	if (alg !== "RS256") return jwtError("invalid_body", "id_token header.alg must be RS256");
+	const jwk = (await getGoogleJwks(input.jwksState)).keysByKid.get(kid);
+	if (!jwk) return jwtError("unknown_kid", "Unknown Google key id (kid)");
+	const signature = await verifyJwtSignature({
+		jwk,
+		parts: parts.value,
+		tokenName: "Google id_token"
+	});
+	if (!signature.ok) return signature;
+	const iss = normalizeOptionalTrimmedString(parts.value.payload.iss);
+	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return jwtError("invalid_issuer", "Invalid Google id_token issuer");
+	const time = verifyGoogleTimeClaims(parts.value.payload);
+	if (!time.ok) return time;
+	const aud = parseJwtAud(parts.value.payload.aud);
+	if (!aud.length) return jwtError("invalid_claims", "Missing Google id_token aud");
+	const allowedAudSet = new Set(input.config.clientIds);
+	if (!aud.some((value) => allowedAudSet.has(value))) return jwtError("invalid_audience", "Google id_token audience mismatch");
+	const sub = normalizeOptionalTrimmedString(parts.value.payload.sub);
+	if (!sub) return jwtError("invalid_claims", "Missing Google id_token sub");
+	const hostedDomain = normalizeOptionalTrimmedString(parts.value.payload.hd);
+	if (input.config.hostedDomains?.length) {
+		const allowHd = new Set(input.config.hostedDomains.map((d) => d.toLowerCase()));
+		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return jwtError("invalid_hosted_domain", "Google hosted domain is not allowed");
+	}
+	const email = normalizeOptionalTrimmedString(parts.value.payload.email);
+	const name = normalizeOptionalTrimmedString(parts.value.payload.name);
+	const givenName = normalizeOptionalTrimmedString(parts.value.payload.given_name);
+	const familyName = normalizeOptionalTrimmedString(parts.value.payload.family_name);
+	const emailVerified = parseGoogleEmailVerified(parts.value.payload.email_verified);
+	return buildGoogleLoginVerificationSuccess({
+		providerSubject: `google:${sub}`,
+		sub,
+		email,
+		name,
+		givenName,
+		familyName,
+		emailVerified,
+		hostedDomain
+	});
+}
+async function verifyGoogleLoginWithIdentityStore(input) {
+	try {
+		const verified = await verifyGoogleIdToken({
+			request: input.request,
+			config: input.config,
+			jwksState: input.jwksState
+		});
+		if (!verified.ok) return verified;
+		return buildGoogleLoginFacadeSuccess({
+			verified,
+			userId: await resolveLinkedProviderUserId({
+				identityStore: input.identityStore,
+				providerSubject: verified.providerSubject
+			})
+		});
+	} catch (e) {
+		return {
+			ok: false,
+			verified: false,
+			code: "internal",
+			message: errorMessage(e) || "Google OIDC verification failed"
+		};
+	}
+}
+//#endregion
+export { createGoogleJwksState, getGoogleJwks, verifyGoogleIdToken, verifyGoogleLoginWithIdentityStore };
+
+//# sourceMappingURL=oidcVerification.js.map

package/dist/esm/core/authService/portableCrypto.js

@@ -0,0 +1,19 @@
+//#region src/core/authService/portableCrypto.ts
+async function sha256BytesPortable(input) {
+	const subtle = globalThis.crypto?.subtle;
+	if (subtle && typeof subtle.digest === "function") return new Uint8Array(await subtle.digest("SHA-256", toArrayBufferCopy(input)));
+	if (typeof process !== "undefined" && process.versions?.node) {
+		const { createHash } = await import("node:crypto");
+		return Uint8Array.from(createHash("sha256").update(input).digest());
+	}
+	throw new Error("SHA-256 digest is unavailable in this runtime");
+}
+function toArrayBufferCopy(bytes) {
+	const out = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(out).set(bytes);
+	return out;
+}
+//#endregion
+export { sha256BytesPortable, toArrayBufferCopy };
+
+//# sourceMappingURL=portableCrypto.js.map

package/dist/esm/core/authService/rateLimits.js

@@ -0,0 +1,117 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { readAuthServiceConfigValue } from "./configValues.js";
+import { resolveSigningSessionSealRateLimitFromEnv } from "../../threshold/session/signingSessionSeal/guards/backends.js";
+import "../../threshold/session/signingSessionSeal/index.js";
+//#region src/core/authService/rateLimits.ts
+function readRateLimitConfigValue(input) {
+	return readAuthServiceConfigValue({
+		thresholdStore: input.thresholdStore,
+		name: input.name
+	});
+}
+function parseRateLimiterKind(input) {
+	const value = normalizeOptionalTrimmedString(input.raw).toLowerCase();
+	if (!value) return null;
+	switch (value) {
+		case "in-memory":
+		case "upstash-redis-rest":
+		case "redis-tcp": return value;
+	}
+	throw new Error(`${input.name} must be one of in-memory, upstash-redis-rest, or redis-tcp`);
+}
+function createRegistrationPrepareRateLimiter(input) {
+	const thresholdStore = input.thresholdStore;
+	return resolveSigningSessionSealRateLimitFromEnv({
+		limiterKind: parseRateLimiterKind({
+			raw: readRateLimitConfigValue({
+				thresholdStore,
+				name: "REGISTRATION_PREPARE_RATE_LIMITER_KIND"
+			}),
+			name: "REGISTRATION_PREPARE_RATE_LIMITER_KIND"
+		}),
+		upstashUrl: readRateLimitConfigValue({
+			thresholdStore,
+			name: "REGISTRATION_PREPARE_RATE_LIMIT_UPSTASH_URL"
+		}) || null,
+		upstashToken: readRateLimitConfigValue({
+			thresholdStore,
+			name: "REGISTRATION_PREPARE_RATE_LIMIT_UPSTASH_TOKEN"
+		}) || null,
+		redisUrl: readRateLimitConfigValue({
+			thresholdStore,
+			name: "REGISTRATION_PREPARE_RATE_LIMIT_REDIS_URL"
+		}) || null,
+		keyPrefix: readRateLimitConfigValue({
+			thresholdStore,
+			name: "REGISTRATION_PREPARE_RATE_LIMIT_KEY_PREFIX"
+		}) || "registration-prepare:v1:",
+		limit: 1,
+		windowMs: 1
+	}).limiter;
+}
+function createEmailOtpRateLimiter(input) {
+	const thresholdStore = input.thresholdStore;
+	return resolveSigningSessionSealRateLimitFromEnv({
+		limiterKind: parseRateLimiterKind({
+			raw: readRateLimitConfigValue({
+				thresholdStore,
+				name: "EMAIL_OTP_RATE_LIMITER_KIND"
+			}),
+			name: "EMAIL_OTP_RATE_LIMITER_KIND"
+		}),
+		upstashUrl: readRateLimitConfigValue({
+			thresholdStore,
+			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_URL"
+		}) || null,
+		upstashToken: readRateLimitConfigValue({
+			thresholdStore,
+			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_TOKEN"
+		}) || null,
+		redisUrl: readRateLimitConfigValue({
+			thresholdStore,
+			name: "EMAIL_OTP_RATE_LIMIT_REDIS_URL"
+		}) || null,
+		keyPrefix: readRateLimitConfigValue({
+			thresholdStore,
+			name: "EMAIL_OTP_RATE_LIMIT_KEY_PREFIX"
+		}) || "email-otp:v2:",
+		limit: 1,
+		windowMs: 1
+	}).limiter;
+}
+function consumedRateLimitError(message, consumed) {
+	const result = {
+		ok: false,
+		code: "rate_limited",
+		message
+	};
+	if (typeof consumed.retryAfterMs === "number") result.retryAfterMs = consumed.retryAfterMs;
+	if (typeof consumed.resetAtMs === "number") result.resetAtMs = consumed.resetAtMs;
+	return result;
+}
+async function consumeEmailOtpRateLimit(input) {
+	const policy = input.policies[input.scope];
+	const keySuffix = `scope=${input.scope}:action=${input.action || "default"}:limit=${policy.limit}:windowMs=${policy.windowMs}`;
+	const keys = [
+		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
+		input.userId ? `${keySuffix}:user:${input.userId}` : "",
+		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
+		input.providerSubject ? `${keySuffix}:providerSubject:${input.providerSubject}` : "",
+		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
+	].filter(Boolean);
+	for (const key of keys) {
+		const consumed = await input.limiter.consume({
+			key,
+			limit: policy.limit,
+			windowMs: policy.windowMs,
+			nowMs: Date.now()
+		});
+		if (!consumed.ok) return consumedRateLimitError("Email OTP rate limit exceeded", consumed);
+	}
+	return { ok: true };
+}
+//#endregion
+export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter, createRegistrationPrepareRateLimiter };
+
+//# sourceMappingURL=rateLimits.js.map

package/dist/esm/core/authService/record.js

@@ -0,0 +1,8 @@
+//#region src/core/authService/record.ts
+function isObject(v) {
+	return !!v && typeof v === "object" && !Array.isArray(v);
+}
+//#endregion
+export { isObject };
+
+//# sourceMappingURL=record.js.map

package/dist/esm/core/authService/registrationThresholdHelpers.js

@@ -0,0 +1,131 @@
+import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
+import { parseEvmFamilySigningKeySlotId } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { ActionType } from "../../shared-ts/src/near/actions.js";
+import "../../shared-ts/src/signing-lanes/index.js";
+import { normalizeThresholdRuntimePolicyScope, thresholdRuntimePolicyScopesEqual } from "./thresholdRuntimePolicy.js";
+//#region src/core/authService/registrationThresholdHelpers.ts
+function requireEvmFamilySigningKeySlotId(value) {
+	const parsed = parseEvmFamilySigningKeySlotId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function buildFullAccessAddKeyAction(publicKey) {
+	return {
+		action_type: ActionType.AddKey,
+		public_key: publicKey,
+		access_key: JSON.stringify({
+			nonce: 0,
+			permission: { FullAccess: {} }
+		})
+	};
+}
+function normalizeBootstrapPublicKeys(args) {
+	const publicKey = ensureEd25519Prefix(normalizeOptionalTrimmedString(args.publicKey) || "");
+	if (!publicKey) throw new Error("Missing or invalid bootstrap operational public key");
+	const recoveryPublicKey = ensureEd25519Prefix(normalizeOptionalTrimmedString(args.recoveryPublicKey) || "");
+	if (recoveryPublicKey && recoveryPublicKey === publicKey) throw new Error("Bootstrap recovery public key must differ from the operational public key");
+	return {
+		publicKey,
+		...recoveryPublicKey ? { recoveryPublicKey } : {},
+		expectedPublicKeys: recoveryPublicKey ? [publicKey, recoveryPublicKey] : [publicKey]
+	};
+}
+async function resolveBoundThresholdRuntimePolicyScope(args) {
+	if (typeof args.bindingStore.listByUserId !== "function") return void 0;
+	const bindings = await args.bindingStore.listByUserId({
+		userId: args.userId,
+		rpId: args.rpId
+	});
+	for (const binding of bindings) {
+		const scope = normalizeThresholdRuntimePolicyScope(binding.runtimePolicyScope);
+		if (scope) return scope;
+	}
+}
+function buildEcdsaWalletKeysFromBootstrap(args) {
+	const bootstrap = args.bootstrap;
+	const required = {
+		walletId: normalizeOptionalTrimmedString(bootstrap.walletId),
+		evmFamilySigningKeySlotId: normalizeOptionalTrimmedString(bootstrap.evmFamilySigningKeySlotId),
+		keyHandle: normalizeOptionalTrimmedString(bootstrap.keyHandle),
+		ecdsaThresholdKeyId: normalizeOptionalTrimmedString(bootstrap.ecdsaThresholdKeyId),
+		signingRootId: normalizeOptionalTrimmedString(bootstrap.signingRootId),
+		signingRootVersion: normalizeOptionalTrimmedString(bootstrap.signingRootVersion),
+		thresholdEcdsaPublicKeyB64u: normalizeOptionalTrimmedString(bootstrap.thresholdEcdsaPublicKeyB64u),
+		thresholdOwnerAddress: normalizeOptionalTrimmedString(bootstrap.ethereumAddress),
+		relayerKeyId: normalizeOptionalTrimmedString(bootstrap.relayerKeyId),
+		relayerVerifyingShareB64u: normalizeOptionalTrimmedString(bootstrap.relayerVerifyingShareB64u),
+		contextBinding32B64u: normalizeOptionalTrimmedString(bootstrap.contextBinding32B64u),
+		derivationClientSharePublicKey33B64u: normalizeOptionalTrimmedString(bootstrap.publicIdentity.derivationClientSharePublicKey33B64u)
+	};
+	const missingField = Object.entries(required).find(([, value]) => !value)?.[0];
+	if (missingField) return {
+		ok: false,
+		code: "incomplete_ecdsa_wallet_key",
+		message: `${args.errorContext} returned incomplete ECDSA wallet key material: ${missingField}`
+	};
+	const participantIds = Array.isArray(bootstrap.participantIds) ? bootstrap.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : [];
+	if (participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) return {
+		ok: false,
+		code: "incomplete_ecdsa_wallet_key",
+		message: `${args.errorContext} returned incomplete ECDSA wallet key material: participantIds`
+	};
+	if (!Array.isArray(args.chainTargets) || args.chainTargets.length === 0) return {
+		ok: false,
+		code: "incomplete_ecdsa_wallet_key",
+		message: `${args.errorContext} has no ECDSA chain targets`
+	};
+	return {
+		ok: true,
+		walletKeys: args.chainTargets.map((chainTarget) => ({
+			keyScope: "evm-family",
+			chainTarget,
+			walletId: required.walletId,
+			evmFamilySigningKeySlotId: required.evmFamilySigningKeySlotId,
+			keyHandle: required.keyHandle,
+			ecdsaThresholdKeyId: required.ecdsaThresholdKeyId,
+			signingRootId: required.signingRootId,
+			signingRootVersion: required.signingRootVersion,
+			thresholdEcdsaPublicKeyB64u: required.thresholdEcdsaPublicKeyB64u,
+			thresholdOwnerAddress: required.thresholdOwnerAddress,
+			relayerKeyId: required.relayerKeyId,
+			relayerVerifyingShareB64u: required.relayerVerifyingShareB64u,
+			contextBinding32B64u: required.contextBinding32B64u,
+			derivationClientSharePublicKey33B64u: bootstrap.publicIdentity.derivationClientSharePublicKey33B64u,
+			clientShareRetryCounter: bootstrap.clientShareRetryCounter,
+			relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
+			participantIds: [1, 2],
+			publicCapability: args.publicCapability
+		}))
+	};
+}
+function isMatchingEcdsaClientBootstrap(expected, actual) {
+	return actual.formatVersion === expected.formatVersion && actual.walletId === expected.walletId && actual.evmFamilySigningKeySlotId === expected.evmFamilySigningKeySlotId && actual.ecdsaThresholdKeyId === expected.ecdsaThresholdKeyId && actual.signingRootId === expected.signingRootId && actual.signingRootVersion === expected.signingRootVersion && actual.keyScope === expected.keyScope && actual.relayerKeyId === expected.relayerKeyId && actual.registrationPreparationId === expected.registrationPreparationId && actual.requestId === expected.requestId && actual.thresholdSessionId === expected.thresholdSessionId && actual.ttlMs === expected.ttlMs && actual.remainingUses === expected.remainingUses && actual.participantIds[0] === expected.participantIds[0] && actual.participantIds[1] === expected.participantIds[1] && thresholdRuntimePolicyScopesEqual(actual.runtimePolicyScope, expected.runtimePolicyScope);
+}
+function toEcdsaDerivationClientBootstrapRequest(clientBootstrap) {
+	return {
+		formatVersion: clientBootstrap.formatVersion,
+		walletId: clientBootstrap.walletId,
+		evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(clientBootstrap.evmFamilySigningKeySlotId),
+		ecdsaThresholdKeyId: clientBootstrap.ecdsaThresholdKeyId,
+		signingRootId: clientBootstrap.signingRootId,
+		signingRootVersion: clientBootstrap.signingRootVersion,
+		keyScope: clientBootstrap.keyScope,
+		relayerKeyId: clientBootstrap.relayerKeyId,
+		registrationPreparationId: clientBootstrap.registrationPreparationId,
+		derivationClientSharePublicKey33B64u: clientBootstrap.derivationClientSharePublicKey33B64u,
+		clientShareRetryCounter: clientBootstrap.clientShareRetryCounter,
+		contextBinding32B64u: clientBootstrap.contextBinding32B64u,
+		requestId: clientBootstrap.requestId,
+		sessionId: clientBootstrap.thresholdSessionId,
+		ttlMs: clientBootstrap.ttlMs,
+		remainingUses: clientBootstrap.remainingUses,
+		participantIds: [...clientBootstrap.participantIds],
+		runtimePolicyScope: clientBootstrap.runtimePolicyScope
+	};
+}
+//#endregion
+export { buildEcdsaWalletKeysFromBootstrap, buildFullAccessAddKeyAction, isMatchingEcdsaClientBootstrap, normalizeBootstrapPublicKeys, resolveBoundThresholdRuntimePolicyScope, toEcdsaDerivationClientBootstrapRequest };
+
+//# sourceMappingURL=registrationThresholdHelpers.js.map

package/dist/esm/core/authService/runtime.js

@@ -0,0 +1,45 @@
+import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
+import { ensureSignerWasmRuntime } from "./wasm.js";
+//#region src/core/authService/runtime.ts
+function createInitialAuthServiceRuntimeState() {
+	return {
+		isInitialized: false,
+		relayerPublicKey: "",
+		signerWasmReady: false
+	};
+}
+async function ensureAuthServiceSignerWasmReady(input) {
+	const signerState = await ensureSignerWasmRuntime({
+		state: { signerWasmReady: input.state.signerWasmReady },
+		override: input.signerWasmOverride,
+		logger: input.logger
+	});
+	return {
+		...input.state,
+		signerWasmReady: signerState.signerWasmReady
+	};
+}
+async function ensureAuthServiceRuntimeReady(input) {
+	if (input.state.isInitialized) return input.state;
+	let relayerPublicKey = "";
+	try {
+		relayerPublicKey = toPublicKeyStringFromSecretKey(input.relayerPrivateKey);
+	} catch {
+		input.logger.warn("Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format");
+	}
+	return {
+		...await ensureAuthServiceSignerWasmReady({
+			state: {
+				...input.state,
+				relayerPublicKey
+			},
+			signerWasmOverride: input.signerWasmOverride,
+			logger: input.logger
+		}),
+		isInitialized: true
+	};
+}
+//#endregion
+export { createInitialAuthServiceRuntimeState, ensureAuthServiceRuntimeReady, ensureAuthServiceSignerWasmReady };
+
+//# sourceMappingURL=runtime.js.map

package/dist/esm/core/authService/signerWasmUrls.js

@@ -0,0 +1,20 @@
+//#region src/core/authService/signerWasmUrls.ts
+const SIGNER_WASM_PACKAGE_DIST_PATH = "../../wasm/near_signer/pkg/wasm_signer_worker_bg.wasm";
+const SIGNER_WASM_SOURCE_PATH = "../../wasm/near_signer/pkg/wasm_signer_worker_bg.wasm";
+function getSignerWasmUrls(logger) {
+	const paths = [SIGNER_WASM_PACKAGE_DIST_PATH, SIGNER_WASM_SOURCE_PATH];
+	const resolved = [];
+	const baseUrl = import.meta.url;
+	for (const path of paths) try {
+		if (!baseUrl) throw new Error("import.meta.url is undefined");
+		resolved.push(new URL(path, baseUrl));
+	} catch (err) {
+		logger.warn(`Failed to resolve signer WASM relative URL for path "${path}":`, err);
+	}
+	if (!resolved.length) throw new Error("Unable to resolve signer WASM location from import.meta.url. Provide AuthServiceConfig.signerWasm.moduleOrPath in this runtime.");
+	return resolved;
+}
+//#endregion
+export { getSignerWasmUrls };
+
+//# sourceMappingURL=signerWasmUrls.js.map