@seams/wallet-server 0.5.0

package/dist/esm/index.js

@@ -0,0 +1,53 @@
+import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "./shared-ts/src/authorization/capabilityKinds.js";
+import { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal } from "./authorization/domain.js";
+import { AuthorizationService, digestOpaqueValue } from "./authorization/service.js";
+import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./threshold/session/signingSessionSeal/transport/shared.js";
+import { LocalWorkerVaultProxyGateway, VaultProxyUseService, buildVaultProxyUseOperation, createVaultProxyUseRouteExtension, parseVaultProxyDestination } from "./authorization/vaultProxyUse.js";
+import { SessionService, buildCorsOrigins, parseCsvList } from "./core/SessionService.js";
+import { computeEip1559TxHash, encodeEip1559SignedTxFromSignature65, ensureEvmCryptoWasm, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable } from "./core/ThresholdService/evmCryptoWasm.js";
+import { THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT } from "./core/defaultConfigsServer.js";
+import { buildWalletEd25519SignerId, createWalletStore, resolveWalletStoreNamespace } from "./core/WalletStore.js";
+import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./core/d1WalletStore.js";
+import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod } from "./core/d1WalletAuthMethodStore.js";
+import { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion } from "./core/keyMaterialBrands.js";
+import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
+import { registrationPreparationIdFromString } from "./core/types.js";
+import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
+import { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore } from "./router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
+import { normalizeRorHost, sanitizeRorOrigins } from "./router/framework/ror/normalize.js";
+import { resolveRorRpId, validateRouterApiRorOptions } from "./router/framework/ror/provider.js";
+import { handleSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/fetch.js";
+import { createRouterApiModule } from "./router/framework/modules.js";
+import { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace } from "./core/WebAuthnCredentialBindingStore.js";
+import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic } from "./storage/tenantRoute.js";
+import { OrdinaryInactiveSignerMaterialReservationServiceV1, createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "./core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
+import { createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext } from "./threshold/session/signingSessionSeal/crypto/cipher.js";
+import { createSigningSessionSealAuditLogger } from "./threshold/session/signingSessionSeal/observability/audit.js";
+import { composeSigningSessionSealGuards, createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRateLimitGuard } from "./threshold/session/signingSessionSeal/guards/index.js";
+import { createSigningSessionSealService } from "./threshold/session/signingSessionSeal/service.js";
+import { createSigningSessionSealRoutesOptions } from "./threshold/session/signingSessionSeal/routesOptions.js";
+import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./threshold/session/signingSessionSeal/options.js";
+import { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./core/d1IdentityStore.js";
+import { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs } from "./core/config.js";
+import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "./core/ThresholdService/stores/WalletSessionStore.js";
+import { createRouterAbSigningRuntimes } from "./core/routerAbSigning/createRouterAbSigningRuntimes.js";
+import { createInMemorySigningSessionSealIdempotencyStore } from "./threshold/session/signingSessionSeal/idempotency.js";
+import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./threshold/session/signingSessionSeal/guards/backends.js";
+import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./threshold/session/signingSessionSeal/idempotencyBackends.js";
+import { registerSigningSessionSealRoutes } from "./threshold/session/signingSessionSeal/transport/express.js";
+import "./threshold/session/signingSessionSeal/index.js";
+import { createIdentityStore, resolveIdentityStoreNamespace } from "./core/IdentityStore.js";
+import { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema } from "./core/NearPublicKeyStore.js";
+import { createWalletAuthMethodStore, resolveWalletAuthMethodStoreNamespace } from "./core/WalletAuthMethodStore.js";
+import { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace } from "./core/WebAuthnAuthenticatorStore.js";
+import { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema } from "./core/WebAuthnLoginChallengeStore.js";
+import { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema } from "./core/WebAuthnSyncChallengeStore.js";
+import { AuthService } from "./core/authService/AuthService.js";
+import "./core/AuthService.js";
+import { createThresholdEd25519KeyStore } from "./core/ThresholdService/stores/KeyStore.js";
+import { createThresholdEd25519SessionStore } from "./core/ThresholdService/stores/SessionStore.js";
+import "./core/ThresholdService/index.js";
+import { StaticRorOriginsProvider } from "./router/framework/ror/staticProvider.js";
+import { createRorOptions } from "./router/framework/ror/options.js";
+import "./router/framework/ror/index.js";
+export { AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES, AUTH_SERVICE_CONFIG_DEFAULTS, AuthService, AuthorizationService, CloudflareD1RouterAbNormalSigningAdmissionStore, D1IdentityStore, D1NearPublicKeyStore, D1WalletAuthMethodStore, D1WalletStore, D1WebAuthnAuthenticatorStore, D1WebAuthnCredentialBindingStore, D1WebAuthnLoginChallengeStore, D1WebAuthnSyncChallengeStore, IDENTITY_STORE_D1_SCHEMA_SQL, InMemoryRouterAbNormalSigningAdmissionStore, LocalWorkerVaultProxyGateway, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, OrdinaryInactiveSignerMaterialReservationServiceV1, RouterAbEcdsaPresignRuntime, SessionService, StaticCloudflareTenantStorageRouteResolver, StaticRorOriginsProvider, THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT, VaultProxyUseService, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_STORE_D1_SCHEMA_SQL, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, authorizeSigningSessionSealRequest, authorizedOperationReplayBodyInit, buildActiveWalletSessionQuota, buildAuthorizedOperation, buildCorsOrigins, buildExactWalletSessionQuotaProjectionV1, buildPersistedActiveWalletSessionAuthorizationV2, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, buildVaultProxyUseOperation, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, buildWalletSessionAuthorizationV2, buildWalletSessionCapabilitySubjectsV1, composeSigningSessionSealGuards, computeAuthorizedOperationResultDigest, computeEip1559TxHash, createAuthServiceConfig, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareTenantStorageRoute, createEcdsaWalletSessionStore, createEd25519WalletSessionStore, createIdentityStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createNearPublicKeyStore, createOrdinaryInactiveSignerMaterialReservationServiceV1, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createRorOptions, createRouterAbNormalSigningAdmissionAdapter, createRouterAbSigningRuntimes, createRouterApiModule, createSignerD1DoStorageTarget, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, createVaultProxyUseRouteExtension, createWalletAuthMethodStore, createWalletStore, createWebAuthnAuthenticatorStore, createWebAuthnCredentialBindingStore, createWebAuthnLoginChallengeStore, createWebAuthnSyncChallengeStore, digestOpaqueValue, encodeEip1559SignedTxFromSignature65, encodeSigningSessionSealServerLockContext, ensureEvmCryptoWasm, ensureIdentityStoreD1Schema, ensureNearPublicKeyStoreD1Schema, ensureWalletAuthMethodStoreD1Schema, ensureWalletStoreD1Schema, ensureWebAuthnAuthenticatorStoreD1Schema, ensureWebAuthnCredentialBindingStoreD1Schema, ensureWebAuthnLoginChallengeStoreD1Schema, ensureWebAuthnSyncChallengeStoreD1Schema, exactWalletSessionCapabilitySubjectsResolveAuthority, formatSigningSessionSealKeyVersionForWire, handleSigningSessionSealRoutes, normalizeRorHost, normalizeWalletAuthMethod, parseAuthorizedOperationReplayResponse, parseBool, parseCsvList, parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parseHostedWalletSessionCredentialId, parseHostedWalletSessionOperationCredentialToken, parseHostedWalletSessionOperationCredentialV1, parseMpcWalletSigningQuotaId, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, parseSigningSessionSealApplyBody, parseSigningSessionSealKeyVersion, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, parseVaultProxyDestination, parseVerifiedOwnerProofId, parseWalletSessionAuthorizationV2, parseWalletSessionId, projectActiveWalletSession, projectExactWalletSessionAuthorizationV1, registerSigningSessionSealRoutes, registrationPreparationIdFromString, requireEnvVar, resolveIdentityStoreNamespace, resolveRorRpId, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, resolveWalletAuthMethodStoreNamespace, resolveWalletStoreNamespace, resolveWebAuthnAuthenticatorStoreNamespace, resolveWebAuthnCredentialBindingStoreNamespace, sanitizeRorOrigins, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, signSecp256k1Recoverable, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic, validateConfigs, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1, validateRouterApiRorOptions, walletSessionAuthorizationV2RecordsEqual, walletSessionCapabilitySubjectsV1Equal };

package/dist/esm/local-hosted-wallet-gateway-worker.js

@@ -0,0 +1,23 @@
+import { runRouterAbPrewarmScheduledV1 } from "./router/cloudflare/runtime/routerAbPrewarm.js";
+import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
+import "./cloud-host.js";
+import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+//#region src/local-hosted-wallet-gateway-worker.ts
+async function fetch(request, env, ctx) {
+	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
+	return await handleSplitGatewayRequest(request, {
+		...env,
+		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)
+	}, ctx);
+}
+async function scheduled(event, env, _ctx) {
+	await runRouterAbPrewarmScheduledV1(event, env);
+}
+var local_hosted_wallet_gateway_worker_default = {
+	fetch,
+	scheduled
+};
+//#endregion
+export { local_hosted_wallet_gateway_worker_default as default };
+
+//# sourceMappingURL=local-hosted-wallet-gateway-worker.js.map

package/dist/esm/node_modules/@near-js/types/lib/esm/provider/response.js

@@ -0,0 +1,17 @@
+//#region ../../node_modules/@near-js/types/lib/esm/provider/response.js
+var ExecutionStatusBasic = /* @__PURE__ */ ((ExecutionStatusBasic2) => {
+	ExecutionStatusBasic2["Unknown"] = "Unknown";
+	ExecutionStatusBasic2["Pending"] = "Pending";
+	ExecutionStatusBasic2["Failure"] = "Failure";
+	return ExecutionStatusBasic2;
+})(ExecutionStatusBasic || {});
+var FinalExecutionStatusBasic = /* @__PURE__ */ ((FinalExecutionStatusBasic2) => {
+	FinalExecutionStatusBasic2["NotStarted"] = "NotStarted";
+	FinalExecutionStatusBasic2["Started"] = "Started";
+	FinalExecutionStatusBasic2["Failure"] = "Failure";
+	return FinalExecutionStatusBasic2;
+})(FinalExecutionStatusBasic || {});
+//#endregion
+export { ExecutionStatusBasic, FinalExecutionStatusBasic };
+
+//# sourceMappingURL=response.js.map

package/dist/esm/router/auth/authRequestValidation.js

@@ -0,0 +1,264 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
+import { parseWebAuthnAuthenticationCredential } from "./webAuthnCredentialCodecs.js";
+//#region src/router/auth/authRequestValidation.ts
+const PASSKEY_OPTIONS_KEYS = [
+	"user_id",
+	"rp_id",
+	"ttl_ms"
+];
+const PASSKEY_VERIFY_KEYS = ["challengeId", "webauthn_authentication"];
+const GOOGLE_VERIFY_KEYS = [
+	"account_mode",
+	"id_token",
+	"project_environment_id",
+	"restart_registration_offer",
+	"wallet_id"
+];
+const AUTH_LINK_KEYS = [
+	"provider",
+	"id_token",
+	"step_up_challenge_id",
+	"webauthn_authentication"
+];
+const AUTH_UNLINK_KEYS = [
+	"subject",
+	"step_up_challenge_id",
+	"webauthn_authentication"
+];
+function invalidAuthBody(message) {
+	return {
+		ok: false,
+		status: 400,
+		body: {
+			ok: false,
+			code: "invalid_body",
+			message
+		}
+	};
+}
+function unexpectedAuthKey(record, allowedKeys) {
+	for (const key of Object.keys(record)) if (!allowedKeys.includes(key)) return key;
+	return null;
+}
+function requireJsonObject(raw) {
+	if (!isPlainObject(raw)) return invalidAuthBody("Expected JSON object body");
+	return {
+		ok: true,
+		request: raw
+	};
+}
+function requireOnlyAllowedKeys(record, allowedKeys, context) {
+	const unexpectedKey = unexpectedAuthKey(record, allowedKeys);
+	if (unexpectedKey) return invalidAuthBody(`Unsupported ${context} field: ${unexpectedKey}`);
+	return {
+		ok: true,
+		request: true
+	};
+}
+function requireTrimmedField(record, fieldName) {
+	const value = normalizeOptionalTrimmedString(record[fieldName]);
+	if (!value) return invalidAuthBody(`${fieldName} is required`);
+	return {
+		ok: true,
+		request: value
+	};
+}
+function parseOptionalPositiveInteger(raw, fieldName) {
+	if (raw == null) return { ok: true };
+	const value = typeof raw === "number" ? raw : Number(raw);
+	if (!Number.isFinite(value) || value <= 0) return {
+		ok: false,
+		message: `${fieldName} must be a positive number`
+	};
+	return {
+		ok: true,
+		value: Math.floor(value)
+	};
+}
+function parseAuthProviderAction(input) {
+	const provider = normalizeOptionalTrimmedString(input.provider);
+	const action = normalizeOptionalTrimmedString(input.action);
+	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
+	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
+	if (provider === "google" && action === "options") return { kind: "google_options" };
+	if (provider === "google" && action === "verify") return { kind: "google_verify" };
+	if (provider === "github" && action === "options") return { kind: "github_options" };
+	return null;
+}
+function parseAuthProviderActionPath(pathname) {
+	const parts = String(pathname || "").split("/").filter(Boolean);
+	if (parts.length !== 3 || parts[0] !== "auth") return null;
+	return parseAuthProviderAction({
+		provider: parts[1],
+		action: parts[2]
+	});
+}
+function parsePasskeyLoginOptionsRequest(raw) {
+	const body = requireJsonObject(raw);
+	if (!body.ok) return body;
+	const keys = requireOnlyAllowedKeys(body.request, PASSKEY_OPTIONS_KEYS, "passkey login options");
+	if (!keys.ok) return keys;
+	const userId = requireTrimmedField(body.request, "user_id");
+	if (!userId.ok) return userId;
+	const rpId = requireTrimmedField(body.request, "rp_id");
+	if (!rpId.ok) return rpId;
+	const ttlMs = parseOptionalPositiveInteger(body.request.ttl_ms, "ttl_ms");
+	if (!ttlMs.ok) return invalidAuthBody(ttlMs.message);
+	return {
+		ok: true,
+		request: {
+			user_id: userId.request,
+			rp_id: rpId.request,
+			...ttlMs.value ? { ttl_ms: ttlMs.value } : {}
+		}
+	};
+}
+function parsePasskeyLoginVerifyRequest(input) {
+	const body = requireJsonObject(input.body);
+	if (!body.ok) return body;
+	const keys = requireOnlyAllowedKeys(body.request, PASSKEY_VERIFY_KEYS, "passkey login verify");
+	if (!keys.ok) return keys;
+	const challengeId = requireTrimmedField(body.request, "challengeId");
+	if (!challengeId.ok) return challengeId;
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential(body.request.webauthn_authentication);
+	if (!webauthnAuthentication) return invalidAuthBody("webauthn_authentication is required");
+	const expectedOrigin = normalizeOptionalTrimmedString(input.origin);
+	if (!expectedOrigin) return invalidAuthBody("Origin header is required");
+	return {
+		ok: true,
+		request: {
+			challengeId: challengeId.request,
+			webauthn_authentication: webauthnAuthentication,
+			expected_origin: expectedOrigin
+		}
+	};
+}
+function parseGoogleLoginVerifyRequest(raw) {
+	const body = requireJsonObject(raw);
+	if (!body.ok) return body;
+	const keys = requireOnlyAllowedKeys(body.request, GOOGLE_VERIFY_KEYS, "google login verify");
+	if (!keys.ok) return keys;
+	const idToken = requireTrimmedField(body.request, "id_token");
+	if (!idToken.ok) return idToken;
+	const accountMode = requireTrimmedField(body.request, "account_mode");
+	if (!accountMode.ok) return accountMode;
+	const projectEnvironmentId = requireTrimmedField(body.request, "project_environment_id");
+	if (!projectEnvironmentId.ok) return projectEnvironmentId;
+	if (accountMode.request !== "login" && accountMode.request !== "register") return invalidAuthBody("account_mode must be login or register");
+	const restartRaw = body.request.restart_registration_offer;
+	if (restartRaw !== void 0 && restartRaw !== true) return invalidAuthBody("restart_registration_offer must be true when present");
+	if (restartRaw === true && accountMode.request !== "register") return invalidAuthBody("restart_registration_offer is only valid with account_mode register");
+	const loginWalletId = normalizeOptionalTrimmedString(body.request.wallet_id);
+	if (body.request.wallet_id !== void 0 && !loginWalletId) return invalidAuthBody("wallet_id must be a non-empty string when present");
+	if (loginWalletId && accountMode.request !== "login") return invalidAuthBody("wallet_id is only valid with account_mode login");
+	return {
+		ok: true,
+		request: {
+			idToken: idToken.request,
+			accountMode: accountMode.request,
+			projectEnvironmentId: projectEnvironmentId.request,
+			restartRegistrationOffer: restartRaw === true,
+			...loginWalletId ? { loginWalletId } : {}
+		}
+	};
+}
+function parsePasskeyStepUpRequest(input) {
+	const challengeId = requireTrimmedField(input.body, "step_up_challenge_id");
+	if (!challengeId.ok) return challengeId;
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential(input.body.webauthn_authentication);
+	if (!webauthnAuthentication) return invalidAuthBody("webauthn_authentication is required for step-up");
+	const expectedOrigin = normalizeOptionalTrimmedString(input.origin);
+	if (!expectedOrigin) return invalidAuthBody("Origin header is required");
+	return {
+		ok: true,
+		request: {
+			challengeId: challengeId.request,
+			webauthn_authentication: webauthnAuthentication,
+			expected_origin: expectedOrigin
+		}
+	};
+}
+function parseAuthLinkIdentityRequest(input) {
+	const body = requireJsonObject(input.body);
+	if (!body.ok) return body;
+	const keys = requireOnlyAllowedKeys(body.request, AUTH_LINK_KEYS, "auth link");
+	if (!keys.ok) return keys;
+	const provider = requireTrimmedField(body.request, "provider");
+	if (!provider.ok) return provider;
+	if (provider.request !== "google") return invalidAuthBody("provider must be: google");
+	const idToken = requireTrimmedField(body.request, "id_token");
+	if (!idToken.ok) return idToken;
+	const stepUp = parsePasskeyStepUpRequest({
+		body: body.request,
+		origin: input.origin
+	});
+	if (!stepUp.ok) return stepUp;
+	return {
+		ok: true,
+		request: {
+			provider: "google",
+			idToken: idToken.request,
+			stepUp: stepUp.request
+		}
+	};
+}
+function parseAuthUnlinkIdentityRequest(input) {
+	const body = requireJsonObject(input.body);
+	if (!body.ok) return body;
+	const keys = requireOnlyAllowedKeys(body.request, AUTH_UNLINK_KEYS, "auth unlink");
+	if (!keys.ok) return keys;
+	const subject = requireTrimmedField(body.request, "subject");
+	if (!subject.ok) return subject;
+	const stepUp = parsePasskeyStepUpRequest({
+		body: body.request,
+		origin: input.origin
+	});
+	if (!stepUp.ok) return stepUp;
+	return {
+		ok: true,
+		request: {
+			subject: subject.request,
+			stepUp: stepUp.request
+		}
+	};
+}
+function parseAuthIdentityMutationRequest(input) {
+	switch (normalizeOptionalTrimmedString(input.pathname)) {
+		case "/auth/link": {
+			const parsed = parseAuthLinkIdentityRequest({
+				body: input.body,
+				origin: input.origin
+			});
+			if (!parsed.ok) return parsed;
+			return {
+				ok: true,
+				request: {
+					kind: "link",
+					source: "auth.link",
+					request: parsed.request
+				}
+			};
+		}
+		case "/auth/unlink": {
+			const parsed = parseAuthUnlinkIdentityRequest({
+				body: input.body,
+				origin: input.origin
+			});
+			if (!parsed.ok) return parsed;
+			return {
+				ok: true,
+				request: {
+					kind: "unlink",
+					source: "auth.unlink",
+					request: parsed.request
+				}
+			};
+		}
+		default: return null;
+	}
+}
+//#endregion
+export { parseAuthIdentityMutationRequest, parseAuthLinkIdentityRequest, parseAuthProviderAction, parseAuthProviderActionPath, parseAuthUnlinkIdentityRequest, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest };
+
+//# sourceMappingURL=authRequestValidation.js.map

package/dist/esm/router/auth/commonRouterUtils.js

@@ -0,0 +1,305 @@
+import { normalizeRuntimePolicyScope, normalizeRuntimePolicyScopeFields } from "../../shared-ts/src/threshold/signingRootScope.js";
+import { extractBearerCredential } from "./routerApiKeyAuth.js";
+import { walletSessionFailure, walletSessionFailureMessage } from "./walletSessionFailure.js";
+import { resolveWalletSessionAuthorizationV2AdministrationAdmission, resolveWalletSessionAuthorizationV2Admission } from "../domains/signingOperations/walletExecutionAdmission.js";
+//#region src/router/auth/commonRouterUtils.ts
+function resolveWalletSessionOperationCredentialAdmissionFromContext(input) {
+	const context = input.context;
+	const identity = {
+		tenantId: context.authorization.session.tenantId,
+		principalId: context.authorization.session.principalId,
+		walletId: context.authorization.session.walletId
+	};
+	const operation = input.operation.keyFamily === "ed25519" ? {
+		...identity,
+		keyFamily: "ed25519",
+		operationKind: input.operation.operationKind
+	} : {
+		...identity,
+		keyFamily: "ecdsa_secp256k1",
+		operationKind: input.operation.operationKind
+	};
+	const admission = resolveWalletSessionAuthorizationV2Admission({
+		authorization: context.authorization.session,
+		authority: context.authority,
+		authMethod: context.authMethod,
+		operation,
+		retiredAtMs: context.retiredAtMs,
+		nowMs: input.nowMs
+	});
+	if (!admission.ok || admission.keyFamily !== input.operation.keyFamily) return { kind: "rejected" };
+	if (admission.keyFamily === "ed25519") return {
+		kind: "admitted",
+		admission: {
+			kind: "wallet_session_operation_credential_v1",
+			curve: "ed25519",
+			context,
+			admission
+		}
+	};
+	return {
+		kind: "admitted",
+		admission: {
+			kind: "wallet_session_operation_credential_v1",
+			curve: "ecdsa",
+			context,
+			admission
+		}
+	};
+}
+async function resolveWalletSessionOperationCredentialAdmission(input) {
+	const context = await input.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+		tenantId: input.authorizationSessions.tenantId,
+		token: input.token,
+		nowMs: input.nowMs
+	});
+	if (!context) return { kind: "not_found" };
+	return resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context,
+		nowMs: input.nowMs,
+		operation: input.operation
+	});
+}
+async function resolveWalletSessionAdministrationAdmission(input) {
+	const context = await input.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
+		tenantId: input.authorizationSessions.tenantId,
+		token: input.token,
+		nowMs: input.nowMs
+	});
+	if (!context) return { kind: "not_found" };
+	const session = context.authorization.session;
+	const admission = resolveWalletSessionAuthorizationV2AdministrationAdmission({
+		authorization: session,
+		authority: context.authority,
+		authMethod: context.authMethod,
+		operation: {
+			kind: input.operation.kind,
+			tenantId: session.tenantId,
+			principalId: session.principalId,
+			walletId: input.operation.walletId
+		},
+		retiredAtMs: context.retiredAtMs,
+		nowMs: input.nowMs
+	});
+	if (!admission.ok) return { kind: "rejected" };
+	return {
+		kind: "admitted",
+		admission: {
+			kind: "wallet_session_administration_v1",
+			operationKind: admission.operationKind,
+			context,
+			admission
+		}
+	};
+}
+async function validateRouterAbEd25519WalletSessionInputs(input) {
+	const authorizationSessions = input.authorizationSessions;
+	if (!authorizationSessions) return {
+		ok: false,
+		code: "sessions_disabled",
+		message: "Sessions are not configured on this server"
+	};
+	const token = extractBearerCredential(input.headers);
+	if (!token) return walletSessionFailure("wallet_session_missing");
+	const nowMs = input.nowMs || Date.now;
+	let resolution;
+	try {
+		resolution = await resolveWalletSessionOperationCredentialAdmission({
+			authorizationSessions,
+			token,
+			nowMs: nowMs(),
+			operation: {
+				keyFamily: "ed25519",
+				operationKind: input.operationKind
+			}
+		});
+	} catch {
+		return walletSessionFailure("wallet_session_unavailable");
+	}
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
+	if (resolution.kind === "not_found") return {
+		ok: false,
+		code: "wallet_session_invalid",
+		message: walletSessionFailureMessage("wallet_session_invalid")
+	};
+	if (resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
+	return {
+		ok: true,
+		kind: "wallet_session_operation_credential_v1",
+		admission: resolution.admission,
+		context: resolution.admission.context
+	};
+}
+async function validateRouterAbEcdsaDerivationWalletSessionInputs(input) {
+	const authorizationSessions = input.authorizationSessions;
+	if (!authorizationSessions) return {
+		ok: false,
+		code: "sessions_disabled",
+		message: "Sessions are not configured on this server"
+	};
+	const token = extractBearerCredential(input.headers);
+	if (!token) return walletSessionFailure("wallet_session_missing");
+	const nowMs = input.nowMs || Date.now;
+	let resolution;
+	try {
+		resolution = await resolveWalletSessionOperationCredentialAdmission({
+			authorizationSessions,
+			token,
+			nowMs: nowMs(),
+			operation: {
+				keyFamily: "ecdsa_secp256k1",
+				operationKind: input.operationKind
+			}
+		});
+	} catch {
+		return walletSessionFailure("wallet_session_unavailable");
+	}
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
+	if (resolution.kind === "not_found") return {
+		ok: false,
+		code: "wallet_session_invalid",
+		message: walletSessionFailureMessage("wallet_session_invalid")
+	};
+	if (resolution.admission.curve !== "ecdsa") return walletSessionFailure("wallet_session_scope_mismatch");
+	return {
+		ok: true,
+		kind: "wallet_session_operation_credential_v1",
+		admission: resolution.admission,
+		context: resolution.admission.context
+	};
+}
+async function resolveThresholdRuntimePolicyScope(input) {
+	if (input.explicitScopeRaw !== null && typeof input.explicitScopeRaw === "object" && !Array.isArray(input.explicitScopeRaw)) try {
+		return {
+			ok: true,
+			scope: await resolveActiveRuntimePolicyScopeFromFields({
+				orgProjectEnv: input.orgProjectEnv || null,
+				fields: normalizeRuntimePolicyScopeFields(input.explicitScopeRaw)
+			})
+		};
+	} catch {
+		return { ok: true };
+	}
+	const projectEnvironmentId = String(input.projectEnvironmentIdRaw || "").trim();
+	const publishableKey = extractBearerCredential(input.headers);
+	if (!publishableKey) {
+		if (!projectEnvironmentId) return { ok: true };
+		return {
+			ok: false,
+			status: 401,
+			code: "unauthorized",
+			message: "Managed runtime scope bootstrap requires a publishable key"
+		};
+	}
+	const publishableKeyAuth = input.publishableKeyAuth || null;
+	if (!publishableKeyAuth) return {
+		ok: false,
+		status: 500,
+		code: "route_auth_not_configured",
+		message: "Runtime scope bootstrap requires publishable key auth on this server"
+	};
+	const origin = String(input.origin || "").trim();
+	if (!origin) return {
+		ok: false,
+		status: 403,
+		code: "forbidden",
+		message: "Managed runtime scope bootstrap requires an Origin header"
+	};
+	const authResult = await publishableKeyAuth.authenticate({
+		secret: publishableKey,
+		origin,
+		environmentId: projectEnvironmentId
+	});
+	if (!authResult.ok) return {
+		ok: false,
+		status: authResult.status,
+		code: authResult.status === 403 ? "forbidden" : "unauthorized",
+		message: authResult.message
+	};
+	const projectEnvironment = await resolveRuntimeProjectEnvironment({
+		orgProjectEnv: input.orgProjectEnv || null,
+		orgId: authResult.principal.orgId,
+		environmentId: authResult.principal.environmentId
+	});
+	if (!projectEnvironment) return { ok: true };
+	return {
+		ok: true,
+		scope: {
+			orgId: authResult.principal.orgId,
+			projectId: projectEnvironment.projectId,
+			envId: projectEnvironment.envId,
+			signingRootVersion: projectEnvironment.signingRootVersion
+		}
+	};
+}
+async function resolveActiveRuntimePolicyScopeFromFields(input) {
+	const resolved = await resolveActiveRuntimePolicyScopeForEnvironment({
+		orgProjectEnv: input.orgProjectEnv,
+		orgId: input.fields.orgId,
+		projectId: input.fields.projectId,
+		envId: input.fields.envId,
+		fallbackSigningRootVersion: input.fields.signingRootVersion
+	});
+	if (resolved) return resolved;
+	return normalizeRuntimePolicyScope(input.fields);
+}
+async function resolveActiveRuntimePolicyScopeForEnvironment(input) {
+	const orgId = String(input.orgId || "").trim();
+	if (!orgId) return void 0;
+	const activeEnvironment = await resolveRuntimeProjectEnvironment({
+		orgProjectEnv: input.orgProjectEnv,
+		orgId,
+		environmentId: input.environmentId,
+		projectId: input.projectId,
+		envId: input.envId
+	});
+	if (activeEnvironment) return {
+		orgId,
+		projectId: activeEnvironment.projectId,
+		envId: activeEnvironment.envId,
+		signingRootVersion: activeEnvironment.signingRootVersion
+	};
+	const projectId = String(input.projectId || "").trim();
+	const envId = String(input.envId || "").trim();
+	const signingRootVersion = String(input.fallbackSigningRootVersion || "").trim();
+	if (projectId && envId && signingRootVersion) return {
+		orgId,
+		projectId,
+		envId,
+		signingRootVersion
+	};
+}
+async function resolveRuntimeProjectEnvironment(input) {
+	if (!input.orgProjectEnv) return void 0;
+	try {
+		const environmentId = String(input.environmentId || "").trim();
+		const projectIdFilter = String(input.projectId || "").trim();
+		const envIdFilter = String(input.envId || "").trim();
+		const environment = (await input.orgProjectEnv.listEnvironments({
+			orgId: input.orgId,
+			actorUserId: "runtime-scope-bootstrap",
+			roles: ["system"],
+			...environmentId ? { environmentId } : {},
+			...projectIdFilter ? { projectId: projectIdFilter } : {}
+		})).find((entry) => {
+			if (environmentId && entry.id !== environmentId) return false;
+			if (projectIdFilter && entry.projectId !== projectIdFilter) return false;
+			if (envIdFilter && entry.key !== envIdFilter) return false;
+			return true;
+		});
+		const projectId = String(environment?.projectId || "").trim();
+		const envId = String(environment?.key || "").trim();
+		const signingRootVersion = String(environment?.signingRootVersion || "").trim();
+		return projectId && envId && signingRootVersion ? {
+			projectId,
+			envId,
+			signingRootVersion
+		} : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { resolveActiveRuntimePolicyScopeForEnvironment, resolveActiveRuntimePolicyScopeFromFields, resolveThresholdRuntimePolicyScope, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext, validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs };
+
+//# sourceMappingURL=commonRouterUtils.js.map