@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js

@@ -1,165 +1,15 @@
 import { parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
 import { validateSecp256k1PublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
 import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../shared-ts/src/utils/emailOtpDomain.js";
+import { validateEmailOtpEnrollmentMaterial } from "../../router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js";
 import { parseRawEmailOtpRegistrationChallengeProofInput } from "./emailOtpChallengeProof.js";
 import { completeGoogleEmailOtpRegistrationAttemptWithStore } from "./googleEmailOtpRegistration.js";
 //#region src/core/authService/emailOtpRegistrationEnrollment.ts
 function assertNever(value) {
 	throw new Error(`Unexpected value: ${String(value)}`);
 }
-async function validateEmailOtpEnrollmentMaterial(request) {
-	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(request.enrollmentSealKeyVersion);
-	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(request.clientUnlockPublicKeyB64u);
-	const unlockKeyVersion = normalizeOptionalTrimmedString(request.unlockKeyVersion);
-	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(request.serverSealedFactorCiphertextB64u);
-	if (!enrollmentSealKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "enrollmentSealKeyVersion is required"
-	};
-	if (!clientUnlockPublicKeyB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u is required"
-	};
-	if (!unlockKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "unlockKeyVersion is required"
-	};
-	if (!serverSealedFactorCiphertextB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "serverSealedFactorCiphertextB64u is required"
-	};
-	let unlockPublicKeyBytes;
-	try {
-		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
-	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u must be valid base64url"
-		};
-	}
-	if (unlockPublicKeyBytes.length !== 33) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
-	};
-	try {
-		await validateSecp256k1PublicKey33(unlockPublicKeyBytes);
-	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
-		};
-	}
-	return {
-		ok: true,
-		enrollmentSealKeyVersion,
-		clientUnlockPublicKeyB64u,
-		unlockKeyVersion,
-		serverSealedFactorCiphertextB64u
-	};
-}
-async function buildEmailOtpRegistrationEnrollmentPersistence(input) {
-	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial(input.material);
-	if (!enrollmentMaterial.ok) return enrollmentMaterial;
-	const orgId = normalizeOptionalTrimmedString(input.orgId) || "";
-	const walletId = normalizeOptionalTrimmedString(input.walletId) || "";
-	const authSubjectId = normalizeOptionalTrimmedString(input.authSubjectId) || "";
-	const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail)?.toLowerCase() || "";
-	if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration enrollment requires wallet, org, and email identity"
-	};
-	const existing = await input.walletEnrollmentStore.get(walletId);
-	const existingState = await input.authStateStore.get(walletId);
-	const enrollment = {
-		version: "email_otp_wallet_enrollment_v1",
-		walletId,
-		providerUserId: authSubjectId,
-		orgId,
-		verifiedEmail,
-		enrollmentId: emailOtpDeviceEnrollmentId(walletId, authSubjectId),
-		enrollmentVersion: "1",
-		enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
-		serverSealedFactorCiphertextB64u: enrollmentMaterial.serverSealedFactorCiphertextB64u,
-		clientUnlockPublicKeyB64u: enrollmentMaterial.clientUnlockPublicKeyB64u,
-		unlockKeyVersion: enrollmentMaterial.unlockKeyVersion,
-		createdAtMs: existing?.createdAtMs ?? input.nowMs,
-		updatedAtMs: input.nowMs
-	};
-	const existingProviderEnrollment = await input.walletEnrollmentStore.getByProviderUserId({
-		providerUserId: enrollment.providerUserId,
-		orgId: enrollment.orgId
-	});
-	const authState = {
-		version: "email_otp_auth_state_v1",
-		walletId: enrollment.walletId,
-		providerUserId: enrollment.providerUserId,
-		orgId: enrollment.orgId,
-		createdAtMs: existingState && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? existingState.createdAtMs : input.nowMs,
-		updatedAtMs: input.nowMs,
-		otpFailureCount: 0,
-		lastOtpFailureAtMs: void 0,
-		otpLockedUntilMs: void 0,
-		...existingState?.lastEmailOtpLoginAtMs && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? { lastEmailOtpLoginAtMs: existingState.lastEmailOtpLoginAtMs } : {},
-		...existingState?.lastStrongAuthAtMs && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? { lastStrongAuthAtMs: existingState.lastStrongAuthAtMs } : {}
-	};
-	return {
-		ok: true,
-		persistence: {
-			...existingProviderEnrollment && existingProviderEnrollment.walletId !== enrollment.walletId ? { previousProviderWalletId: existingProviderEnrollment.walletId } : {},
-			enrollment,
-			authState
-		}
-	};
-}
-async function emailOtpEnrollmentPersistenceForRegistrationFinalize(input) {
-	if (input.authority.kind !== "email_otp") {
-		if (input.request.emailOtpEnrollment) return {
-			ok: false,
-			code: "invalid_body",
-			message: "emailOtpEnrollment is only valid for Email OTP registration"
-		};
-		return { ok: true };
-	}
-	if (!input.request.emailOtpEnrollment) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration finalize requires emailOtpEnrollment"
-	};
-	if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return {
-		ok: false,
-		code: "authority_binding_mismatch",
-		message: "Email OTP registration authority does not match finalize scope"
-	};
-	const authSubjectId = normalizeOptionalTrimmedString(input.authority.providerSubject) || "";
-	const verifiedEmail = normalizeOptionalTrimmedString(input.authority.email)?.toLowerCase() || "";
-	const enrollment = await buildEmailOtpRegistrationEnrollmentPersistence({
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		authStateStore: input.authStateStore,
-		walletId: input.walletId,
-		orgId: input.orgId,
-		authSubjectId,
-		verifiedEmail,
-		material: input.request.emailOtpEnrollment,
-		nowMs: input.nowMs
-	});
-	if (!enrollment.ok) return enrollment;
-	return {
-		ok: true,
-		persistence: enrollment.persistence
-	};
-}
 async function resolveEmailOtpRegistrationChallengeProof(input) {
 	const proofInput = input.proofInput;
 	switch (proofInput.kind) {
@@ -240,7 +90,10 @@ async function verifyEmailOtpEnrollment(input) {
 		code: "internal",
 		message: "Email OTP enrollment verification did not include a verified email"
 	};
-	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial(request);
+	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial({
+		material: request,
+		validateSecp256k1PublicKey33
+	});
 	if (!enrollmentMaterial.ok) return enrollmentMaterial;
 	const orgId = normalizeOptionalTrimmedString(verified.orgId) || "";
 	if (!orgId) return {
@@ -317,6 +170,6 @@ async function verifyEmailOtpEnrollment(input) {
 	};
 }
 //#endregion
-export { buildEmailOtpRegistrationEnrollmentPersistence, emailOtpEnrollmentPersistenceForRegistrationFinalize, resolveEmailOtpRegistrationChallengeProof, validateEmailOtpEnrollmentMaterial, verifyEmailOtpEnrollment };
+export { verifyEmailOtpEnrollment };
 
 //# sourceMappingURL=emailOtpRegistrationEnrollment.js.map

package/dist/esm/core/authService/googleEmailOtpRegistration.js

@@ -669,6 +669,6 @@ function isTruthyBoundaryFlag(value) {
 	return value === true || String(value || "").trim().toLowerCase() === "true";
 }
 //#endregion
-export { cleanupGoogleEmailOtpDevRegistrationStateWithStores, cleanupGoogleEmailOtpRegistrationAttemptsWithStore, completeGoogleEmailOtpRegistrationAttemptWithStore, consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps, failGoogleEmailOtpRegistrationAttemptWithStore, recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore, resolveGoogleEmailOtpSessionWithDeps, validateGoogleEmailOtpRegistrationCandidateWalletWithStore };
+export { cleanupGoogleEmailOtpDevRegistrationStateWithStores, completeGoogleEmailOtpRegistrationAttemptWithStore, consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps, failGoogleEmailOtpRegistrationAttemptWithStore, recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore, resolveGoogleEmailOtpSessionWithDeps, validateGoogleEmailOtpRegistrationCandidateWalletWithStore };
 
 //# sourceMappingURL=googleEmailOtpRegistration.js.map

package/dist/esm/core/authService/nearPrivateKeySigning.js

@@ -1,5 +1,6 @@
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
+import { coerceNonEmptyString, requireRecordOrArray } from "../../shared-ts/src/utils/validation.js";
 import { decodeNearSecretKey, toPublicKeyStringFromSecretKey } from "../nearKeys.js";
 //#region src/core/authService/nearPrivateKeySigning.ts
 const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
@@ -20,28 +21,19 @@ const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
 	4,
 	32
 ]);
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object") throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireNonEmptyString(value, label) {
-	const text = String(value || "").trim();
-	if (!text) throw new Error(`${label} is required`);
-	return text;
-}
 function requireSingleUnsignedNearTxBorshOutput(value) {
 	if (!Array.isArray(value) || value.length !== 1) throw new Error("Expected exactly one unsigned NEAR transaction from signer WASM");
-	const record = requireRecord(value[0], "unsigned NEAR transaction output");
+	const record = requireRecordOrArray(value[0], "unsigned NEAR transaction output");
 	return {
-		unsignedTransactionBorshB64u: requireNonEmptyString(record.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
-		signingDigestB64u: requireNonEmptyString(record.signingDigestB64u, "signingDigestB64u")
+		unsignedTransactionBorshB64u: coerceNonEmptyString(record.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
+		signingDigestB64u: coerceNonEmptyString(record.signingDigestB64u, "signingDigestB64u")
 	};
 }
 function requireFinalizeNearTxFromSignatureOutput(value) {
-	const record = requireRecord(value, "finalized NEAR transaction output");
+	const record = requireRecordOrArray(value, "finalized NEAR transaction output");
 	return {
-		signedTransactionBorshB64u: requireNonEmptyString(record.signedTransactionBorshB64u, "signedTransactionBorshB64u"),
-		transactionHash: requireNonEmptyString(record.transactionHash, "transactionHash")
+		signedTransactionBorshB64u: coerceNonEmptyString(record.signedTransactionBorshB64u, "signedTransactionBorshB64u"),
+		transactionHash: coerceNonEmptyString(record.transactionHash, "transactionHash")
 	};
 }
 function createEd25519Pkcs8FromSeed(seed32) {

package/dist/esm/core/authService/nearTransactions.js

@@ -4,7 +4,8 @@ import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
 import "../../shared-ts/src/utils/validation.js";
 import { toError } from "../../shared-ts/src/utils/errors.js";
 import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
-import { SignedTransaction } from "../rpcClients/near/NearClient.js";
+import { SignedTransaction } from "../../shared-ts/src/near/nearClient.js";
+import "../rpcClients/near/NearClient.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./nearPrivateKeySigning.js";
 import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../../wasm/near_signer/pkg/wasm_signer_worker.js";
 //#region src/core/authService/nearTransactions.ts

package/dist/esm/core/authService/oidcVerification.js

@@ -1,10 +1,9 @@
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { parseCacheControlMaxAgeSec, parseJwtAud, parseJwtSegmentJson } from "./webauthnOidcHelpers.js";
-import { isObject } from "./record.js";
 import { toArrayBufferCopy } from "./portableCrypto.js";
 //#region src/core/authService/oidcVerification.ts
 function createGoogleJwksState() {
@@ -44,7 +43,7 @@ function parseJwtParts(input) {
 	};
 }
 function jwkFromRaw(rawKey) {
-	if (!isObject(rawKey)) return null;
+	if (!isPlainObject(rawKey)) return null;
 	const kid = normalizeOptionalTrimmedString(rawKey.kid);
 	const kty = normalizeOptionalTrimmedString(rawKey.kty);
 	const use = normalizeOptionalTrimmedString(rawKey.use);
@@ -69,7 +68,7 @@ async function fetchJwks(input) {
 	} catch {
 		throw new Error(input.invalidJsonLabel);
 	}
-	if (!isObject(json)) throw new Error(input.invalidShapeLabel);
+	if (!isPlainObject(json)) throw new Error(input.invalidShapeLabel);
 	const keysRaw = json.keys;
 	if (!Array.isArray(keysRaw)) throw new Error(input.missingKeysLabel);
 	const keysByKid = /* @__PURE__ */ new Map();

package/dist/esm/core/authService/rateLimits.js

@@ -20,36 +20,6 @@ function parseRateLimiterKind(input) {
 	}
 	throw new Error(`${input.name} must be one of in-memory, upstash-redis-rest, or redis-tcp`);
 }
-function createRegistrationPrepareRateLimiter(input) {
-	const thresholdStore = input.thresholdStore;
-	return resolveSigningSessionSealRateLimitFromEnv({
-		limiterKind: parseRateLimiterKind({
-			raw: readRateLimitConfigValue({
-				thresholdStore,
-				name: "REGISTRATION_PREPARE_RATE_LIMITER_KIND"
-			}),
-			name: "REGISTRATION_PREPARE_RATE_LIMITER_KIND"
-		}),
-		upstashUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_UPSTASH_URL"
-		}) || null,
-		upstashToken: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_UPSTASH_TOKEN"
-		}) || null,
-		redisUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_REDIS_URL"
-		}) || null,
-		keyPrefix: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_KEY_PREFIX"
-		}) || "registration-prepare:v1:",
-		limit: 1,
-		windowMs: 1
-	}).limiter;
-}
 function createEmailOtpRateLimiter(input) {
 	const thresholdStore = input.thresholdStore;
 	return resolveSigningSessionSealRateLimitFromEnv({
@@ -112,6 +82,6 @@ async function consumeEmailOtpRateLimit(input) {
 	return { ok: true };
 }
 //#endregion
-export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter, createRegistrationPrepareRateLimiter };
+export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter };
 
 //# sourceMappingURL=rateLimits.js.map

package/dist/esm/core/authService/registrationThresholdHelpers.js

@@ -1,16 +1,8 @@
-import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
-import { parseEvmFamilySigningKeySlotId } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
 import "../../shared-ts/src/utils/validation.js";
 import { ActionType } from "../../shared-ts/src/near/actions.js";
-import "../../shared-ts/src/signing-lanes/index.js";
-import { normalizeThresholdRuntimePolicyScope, thresholdRuntimePolicyScopesEqual } from "./thresholdRuntimePolicy.js";
 //#region src/core/authService/registrationThresholdHelpers.ts
-function requireEvmFamilySigningKeySlotId(value) {
-	const parsed = parseEvmFamilySigningKeySlotId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function buildFullAccessAddKeyAction(publicKey) {
 	return {
 		action_type: ActionType.AddKey,
@@ -32,100 +24,7 @@ function normalizeBootstrapPublicKeys(args) {
 		expectedPublicKeys: recoveryPublicKey ? [publicKey, recoveryPublicKey] : [publicKey]
 	};
 }
-async function resolveBoundThresholdRuntimePolicyScope(args) {
-	if (typeof args.bindingStore.listByUserId !== "function") return void 0;
-	const bindings = await args.bindingStore.listByUserId({
-		userId: args.userId,
-		rpId: args.rpId
-	});
-	for (const binding of bindings) {
-		const scope = normalizeThresholdRuntimePolicyScope(binding.runtimePolicyScope);
-		if (scope) return scope;
-	}
-}
-function buildEcdsaWalletKeysFromBootstrap(args) {
-	const bootstrap = args.bootstrap;
-	const required = {
-		walletId: normalizeOptionalTrimmedString(bootstrap.walletId),
-		evmFamilySigningKeySlotId: normalizeOptionalTrimmedString(bootstrap.evmFamilySigningKeySlotId),
-		keyHandle: normalizeOptionalTrimmedString(bootstrap.keyHandle),
-		ecdsaThresholdKeyId: normalizeOptionalTrimmedString(bootstrap.ecdsaThresholdKeyId),
-		signingRootId: normalizeOptionalTrimmedString(bootstrap.signingRootId),
-		signingRootVersion: normalizeOptionalTrimmedString(bootstrap.signingRootVersion),
-		thresholdEcdsaPublicKeyB64u: normalizeOptionalTrimmedString(bootstrap.thresholdEcdsaPublicKeyB64u),
-		thresholdOwnerAddress: normalizeOptionalTrimmedString(bootstrap.ethereumAddress),
-		relayerKeyId: normalizeOptionalTrimmedString(bootstrap.relayerKeyId),
-		relayerVerifyingShareB64u: normalizeOptionalTrimmedString(bootstrap.relayerVerifyingShareB64u),
-		contextBinding32B64u: normalizeOptionalTrimmedString(bootstrap.contextBinding32B64u),
-		derivationClientSharePublicKey33B64u: normalizeOptionalTrimmedString(bootstrap.publicIdentity.derivationClientSharePublicKey33B64u)
-	};
-	const missingField = Object.entries(required).find(([, value]) => !value)?.[0];
-	if (missingField) return {
-		ok: false,
-		code: "incomplete_ecdsa_wallet_key",
-		message: `${args.errorContext} returned incomplete ECDSA wallet key material: ${missingField}`
-	};
-	const participantIds = Array.isArray(bootstrap.participantIds) ? bootstrap.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : [];
-	if (participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) return {
-		ok: false,
-		code: "incomplete_ecdsa_wallet_key",
-		message: `${args.errorContext} returned incomplete ECDSA wallet key material: participantIds`
-	};
-	if (!Array.isArray(args.chainTargets) || args.chainTargets.length === 0) return {
-		ok: false,
-		code: "incomplete_ecdsa_wallet_key",
-		message: `${args.errorContext} has no ECDSA chain targets`
-	};
-	return {
-		ok: true,
-		walletKeys: args.chainTargets.map((chainTarget) => ({
-			keyScope: "evm-family",
-			chainTarget,
-			walletId: required.walletId,
-			evmFamilySigningKeySlotId: required.evmFamilySigningKeySlotId,
-			keyHandle: required.keyHandle,
-			ecdsaThresholdKeyId: required.ecdsaThresholdKeyId,
-			signingRootId: required.signingRootId,
-			signingRootVersion: required.signingRootVersion,
-			thresholdEcdsaPublicKeyB64u: required.thresholdEcdsaPublicKeyB64u,
-			thresholdOwnerAddress: required.thresholdOwnerAddress,
-			relayerKeyId: required.relayerKeyId,
-			relayerVerifyingShareB64u: required.relayerVerifyingShareB64u,
-			contextBinding32B64u: required.contextBinding32B64u,
-			derivationClientSharePublicKey33B64u: bootstrap.publicIdentity.derivationClientSharePublicKey33B64u,
-			clientShareRetryCounter: bootstrap.clientShareRetryCounter,
-			relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-			participantIds: [1, 2],
-			publicCapability: args.publicCapability
-		}))
-	};
-}
-function isMatchingEcdsaClientBootstrap(expected, actual) {
-	return actual.formatVersion === expected.formatVersion && actual.walletId === expected.walletId && actual.evmFamilySigningKeySlotId === expected.evmFamilySigningKeySlotId && actual.ecdsaThresholdKeyId === expected.ecdsaThresholdKeyId && actual.signingRootId === expected.signingRootId && actual.signingRootVersion === expected.signingRootVersion && actual.keyScope === expected.keyScope && actual.relayerKeyId === expected.relayerKeyId && actual.registrationPreparationId === expected.registrationPreparationId && actual.requestId === expected.requestId && actual.thresholdSessionId === expected.thresholdSessionId && actual.ttlMs === expected.ttlMs && actual.remainingUses === expected.remainingUses && actual.participantIds[0] === expected.participantIds[0] && actual.participantIds[1] === expected.participantIds[1] && thresholdRuntimePolicyScopesEqual(actual.runtimePolicyScope, expected.runtimePolicyScope);
-}
-function toEcdsaDerivationClientBootstrapRequest(clientBootstrap) {
-	return {
-		formatVersion: clientBootstrap.formatVersion,
-		walletId: clientBootstrap.walletId,
-		evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(clientBootstrap.evmFamilySigningKeySlotId),
-		ecdsaThresholdKeyId: clientBootstrap.ecdsaThresholdKeyId,
-		signingRootId: clientBootstrap.signingRootId,
-		signingRootVersion: clientBootstrap.signingRootVersion,
-		keyScope: clientBootstrap.keyScope,
-		relayerKeyId: clientBootstrap.relayerKeyId,
-		registrationPreparationId: clientBootstrap.registrationPreparationId,
-		derivationClientSharePublicKey33B64u: clientBootstrap.derivationClientSharePublicKey33B64u,
-		clientShareRetryCounter: clientBootstrap.clientShareRetryCounter,
-		contextBinding32B64u: clientBootstrap.contextBinding32B64u,
-		requestId: clientBootstrap.requestId,
-		sessionId: clientBootstrap.thresholdSessionId,
-		ttlMs: clientBootstrap.ttlMs,
-		remainingUses: clientBootstrap.remainingUses,
-		participantIds: [...clientBootstrap.participantIds],
-		runtimePolicyScope: clientBootstrap.runtimePolicyScope
-	};
-}
 //#endregion
-export { buildEcdsaWalletKeysFromBootstrap, buildFullAccessAddKeyAction, isMatchingEcdsaClientBootstrap, normalizeBootstrapPublicKeys, resolveBoundThresholdRuntimePolicyScope, toEcdsaDerivationClientBootstrapRequest };
+export { buildFullAccessAddKeyAction, normalizeBootstrapPublicKeys };
 
 //# sourceMappingURL=registrationThresholdHelpers.js.map

package/dist/esm/core/authService/storeRegistry.js

@@ -1,10 +1,9 @@
 import { createWalletStore } from "../WalletStore.js";
 import { createWebAuthnCredentialBindingStore } from "../WebAuthnCredentialBindingStore.js";
-import { createRegistrationCeremonyStore } from "../RegistrationCeremonyStore.js";
-import { createEmailOtpRateLimiter, createRegistrationPrepareRateLimiter } from "./rateLimits.js";
+import { createNearPublicKeyStore } from "../NearPublicKeyStore.js";
+import { createEmailOtpRateLimiter } from "./rateLimits.js";
 import { createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore } from "../EmailOtpStores.js";
 import { createIdentityStore } from "../IdentityStore.js";
-import { createNearPublicKeyStore } from "../NearPublicKeyStore.js";
 import { createWalletAuthMethodStore } from "../WalletAuthMethodStore.js";
 import { createWebAuthnAuthenticatorStore } from "../WebAuthnAuthenticatorStore.js";
 import { createWebAuthnLoginChallengeStore } from "../WebAuthnLoginChallengeStore.js";
@@ -31,10 +30,8 @@ var AuthServiceStoreRegistry = class {
 		this.emailOtpUnlockChallengeStore = null;
 		this.emailOtpRegistrationAttemptStore = null;
 		this.emailOtpRateLimiter = null;
-		this.registrationPrepareRateLimiter = null;
 		this.nearPublicKeyStore = null;
 		this.identityStore = null;
-		this.registrationCeremonyStore = null;
 		this.walletStore = null;
 		this.walletAuthMethodStore = null;
 	}
@@ -54,10 +51,6 @@ var AuthServiceStoreRegistry = class {
 		this.webAuthnSyncChallengeStore ??= createWebAuthnSyncChallengeStore(createStoreFactoryInput(this.input));
 		return this.webAuthnSyncChallengeStore;
 	}
-	getRegistrationCeremonyStore() {
-		this.registrationCeremonyStore ??= createRegistrationCeremonyStore(createStoreFactoryInput(this.input));
-		return this.registrationCeremonyStore;
-	}
 	getWalletStore() {
 		this.walletStore ??= createWalletStore(createStoreFactoryInput(this.input));
 		return this.walletStore;
@@ -90,10 +83,6 @@ var AuthServiceStoreRegistry = class {
 		this.emailOtpRegistrationAttemptStore ??= createEmailOtpRegistrationAttemptStore(createStoreFactoryInput(this.input));
 		return this.emailOtpRegistrationAttemptStore;
 	}
-	getRegistrationPrepareRateLimiter() {
-		this.registrationPrepareRateLimiter ??= createRegistrationPrepareRateLimiter({ thresholdStore: this.input.config.thresholdStore });
-		return this.registrationPrepareRateLimiter;
-	}
 	getEmailOtpRateLimiter() {
 		this.emailOtpRateLimiter ??= createEmailOtpRateLimiter({ thresholdStore: this.input.config.thresholdStore });
 		return this.emailOtpRateLimiter;

package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js

@@ -1,8 +1,7 @@
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../thresholdEcdsaChainTarget.js";
-import { isObject } from "./record.js";
+import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/authService/thresholdEcdsaKeyInventory.ts
 function incrementCount(bucket, reason) {
 	bucket[reason] = (bucket[reason] || 0) + 1;
@@ -32,7 +31,7 @@ function thresholdEcdsaKeyInventorySelectorMatchesIdentity(selector, identity) {
 	return identity.keyHandle === selector.keyHandle;
 }
 function parseThresholdEcdsaKeyInventoryTarget(raw) {
-	if (!isObject(raw)) return {
+	if (!isPlainObject(raw)) return {
 		ok: false,
 		reason: "non_object"
 	};
@@ -141,6 +140,6 @@ async function listThresholdEcdsaKeyIdentityTargetsForUser(input) {
 	};
 }
 //#endregion
-export { incrementCount, listThresholdEcdsaKeyIdentityTargetsForUser, normalizeEvmAddress, parseThresholdEcdsaKeyInventoryTarget, thresholdEcdsaKeyInventorySelectorMatchesIdentity };
+export { listThresholdEcdsaKeyIdentityTargetsForUser };
 
 //# sourceMappingURL=thresholdEcdsaKeyInventory.js.map

package/dist/esm/core/authService/webauthn.js

@@ -1,13 +1,14 @@
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIntent.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
 import { parseWebAuthnAuthenticationCredential } from "../../router/auth/webAuthnCredentialCodecs.js";
+import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "./webauthnVerificationOutcomes.js";
 import { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding } from "./webauthnWalletBinding.js";
 import { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId } from "./webauthnAuthority.js";
 //#region src/core/authService/webauthn.ts
@@ -558,19 +559,9 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 			code: credentialId.code,
 			message: credentialId.message
 		};
-		const binding = await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u);
-		if (!binding) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential is not registered on this relay"
-		};
-		if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: `Credential is not registered for account ${challenge.expectedUserId}`
-		};
+		const syncBinding = webAuthnSyncCredentialBinding(await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u), challenge);
+		if (!syncBinding.ok) return syncBinding;
+		const binding = syncBinding.binding;
 		const expectedOrigin = normalizeOptionalTrimmedString(request.expected_origin);
 		if (!expectedOrigin) return {
 			ok: false,
@@ -578,7 +569,7 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 			code: "invalid_body",
 			message: "expected_origin is required for WebAuthn authentication verification"
 		};
-		const verification = await verifyWebAuthnAuthenticationLiteWithStore({
+		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
 			userId: binding.userId,
 			rpId: requireWebAuthnRpId(binding.rpId, "sync credential binding rpId"),
 			expectedChallenge: challenge.challengeB64u,
@@ -586,13 +577,8 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 			expectedOrigin,
 			authenticatorStore: input.authenticatorStore,
 			logger: input.logger
-		});
-		if (!verification.success || !verification.verified) return {
-			ok: false,
-			verified: false,
-			code: verification.code || "not_verified",
-			message: verification.message || "Authentication verification failed"
-		};
+		}));
+		if (verificationFailure) return verificationFailure;
 		const auth = await input.authenticatorStore.get(binding.userId, credentialId.credentialIdB64u);
 		if (!auth) return {
 			ok: false,
@@ -684,7 +670,7 @@ async function verifyWebAuthnLoginWithStores(input) {
 			code: "invalid_body",
 			message: "Missing webauthn_authentication"
 		};
-		const verification = await verifyWebAuthnAuthenticationLiteWithStore({
+		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
 			userId: record.userId,
 			rpId: requireWebAuthnRpId(record.rpId, "login challenge rpId"),
 			expectedChallenge: record.challengeB64u,
@@ -692,33 +678,12 @@ async function verifyWebAuthnLoginWithStores(input) {
 			expectedOrigin,
 			authenticatorStore: input.authenticatorStore,
 			logger: input.logger
-		});
-		if (!verification.success || !verification.verified) return {
-			ok: false,
-			verified: false,
-			code: verification.code || "not_verified",
-			message: verification.message || "Authentication verification failed"
-		};
+		}));
+		if (verificationFailure) return verificationFailure;
 		const credentialIdB64u = String(credential.rawId || credential.id || "").trim();
 		const binding = credentialIdB64u ? await input.credentialBindingStore.get(record.rpId, credentialIdB64u) : null;
-		const walletBinding = binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null;
-		const firstParticipantId = binding?.participantIds?.[0];
-		const secondParticipantId = binding?.participantIds?.[1];
-		if (!binding) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential has no wallet binding"
-		};
-		const ed25519 = walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
-			kind: "active",
-			nearAccountId: walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-			signerSlot: walletBinding.signerSlot,
-			publicKey: binding.publicKey,
-			relayerKeyId: binding.relayerKeyId,
-			participantIds: [firstParticipantId, secondParticipantId]
-		} : { kind: "absent" };
+		const loginSigner = webAuthnLoginEd25519(binding, binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null);
+		if (!loginSigner.ok) return loginSigner;
 		await linkNearSubjectForWebAuthnLogin({
 			identityStore: input.identityStore,
 			userId: record.userId
@@ -729,7 +694,7 @@ async function verifyWebAuthnLoginWithStores(input) {
 			userId: record.userId,
 			rpId: record.rpId,
 			credentialIdB64u,
-			ed25519
+			ed25519: loginSigner.ed25519
 		};
 	} catch (e) {
 		return {

package/dist/esm/core/authService/webauthnOidcHelpers.js

@@ -66,11 +66,6 @@ function parseCacheControlMaxAgeSec(cacheControl) {
 	if (!Number.isFinite(n) || n <= 0) return null;
 	return Math.floor(n);
 }
-function normalizeOidcIssuer(input) {
-	const trimmed = String(input || "").trim();
-	if (!trimmed) return "";
-	return trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
-}
 function parseJwtSegmentJson(input) {
 	try {
 		const raw = new TextDecoder().decode(base64UrlDecode(input));
@@ -86,6 +81,6 @@ function parseJwtAud(input) {
 	return single ? [single] : [];
 }
 //#endregion
-export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, normalizeOidcIssuer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
+export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
 
 //# sourceMappingURL=webauthnOidcHelpers.js.map