@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/authService/rateLimits.js

@@ -1,87 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { readAuthServiceConfigValue } from "./configValues.js";
-import { resolveSigningSessionSealRateLimitFromEnv } from "../../threshold/session/signingSessionSeal/guards/backends.js";
-import "../../threshold/session/signingSessionSeal/index.js";
-//#region src/core/authService/rateLimits.ts
-function readRateLimitConfigValue(input) {
-	return readAuthServiceConfigValue({
-		thresholdStore: input.thresholdStore,
-		name: input.name
-	});
-}
-function parseRateLimiterKind(input) {
-	const value = normalizeOptionalTrimmedString(input.raw).toLowerCase();
-	if (!value) return null;
-	switch (value) {
-		case "in-memory":
-		case "upstash-redis-rest":
-		case "redis-tcp": return value;
-	}
-	throw new Error(`${input.name} must be one of in-memory, upstash-redis-rest, or redis-tcp`);
-}
-function createEmailOtpRateLimiter(input) {
-	const thresholdStore = input.thresholdStore;
-	return resolveSigningSessionSealRateLimitFromEnv({
-		limiterKind: parseRateLimiterKind({
-			raw: readRateLimitConfigValue({
-				thresholdStore,
-				name: "EMAIL_OTP_RATE_LIMITER_KIND"
-			}),
-			name: "EMAIL_OTP_RATE_LIMITER_KIND"
-		}),
-		upstashUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_URL"
-		}) || null,
-		upstashToken: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_TOKEN"
-		}) || null,
-		redisUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_REDIS_URL"
-		}) || null,
-		keyPrefix: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_KEY_PREFIX"
-		}) || "email-otp:v2:",
-		limit: 1,
-		windowMs: 1
-	}).limiter;
-}
-function consumedRateLimitError(message, consumed) {
-	const result = {
-		ok: false,
-		code: "rate_limited",
-		message
-	};
-	if (typeof consumed.retryAfterMs === "number") result.retryAfterMs = consumed.retryAfterMs;
-	if (typeof consumed.resetAtMs === "number") result.resetAtMs = consumed.resetAtMs;
-	return result;
-}
-async function consumeEmailOtpRateLimit(input) {
-	const policy = input.policies[input.scope];
-	const keySuffix = `scope=${input.scope}:action=${input.action || "default"}:limit=${policy.limit}:windowMs=${policy.windowMs}`;
-	const keys = [
-		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
-		input.userId ? `${keySuffix}:user:${input.userId}` : "",
-		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
-		input.providerSubject ? `${keySuffix}:providerSubject:${input.providerSubject}` : "",
-		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
-	].filter(Boolean);
-	for (const key of keys) {
-		const consumed = await input.limiter.consume({
-			key,
-			limit: policy.limit,
-			windowMs: policy.windowMs,
-			nowMs: Date.now()
-		});
-		if (!consumed.ok) return consumedRateLimitError("Email OTP rate limit exceeded", consumed);
-	}
-	return { ok: true };
-}
-//#endregion
-export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter };
-
-//# sourceMappingURL=rateLimits.js.map

package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetKey } from "../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "../thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/authService/thresholdEcdsaKeyInventory.ts
 function incrementCount(bucket, reason) {

package/dist/esm/core/authService/webauthn.js

@@ -1,16 +1,9 @@
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
-import { parseWebAuthnAuthenticationCredential } from "../../router/auth/webAuthnCredentialCodecs.js";
-import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "./webauthnVerificationOutcomes.js";
-import { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding } from "./webauthnWalletBinding.js";
-import { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId } from "./webauthnAuthority.js";
 //#region src/core/authService/webauthn.ts
 function readRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -21,41 +14,17 @@ function readNestedRecord(record, key) {
 function readStringField(record, key) {
 	return typeof record[key] === "string" ? record[key].trim() : "";
 }
-function normalizeWebAuthnTtlMs(raw) {
-	const numeric = typeof raw === "number" ? raw : Number(raw);
-	if (!Number.isFinite(numeric) || numeric <= 0) return 5 * 6e4;
-	return Math.min(Math.max(Math.floor(numeric), 1e4), 10 * 6e4);
-}
-function ensureCryptoRandomValues() {
-	if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") return true;
-	return {
-		ok: false,
-		code: "unsupported",
-		message: "crypto.getRandomValues is unavailable in this runtime"
-	};
-}
-function randomWebAuthnB64u(byteLength) {
-	return base64UrlEncode(crypto.getRandomValues(new Uint8Array(byteLength)));
-}
 function credentialRawIdB64u(credential) {
 	const credentialId = credential.id.trim();
 	const chosen = credential.rawId.trim() || credentialId;
-	if (!chosen) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (!chosen) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	try {
 		return {
 			ok: true,
 			credentialIdB64u: base64UrlEncode(decodeBase64UrlOrBase64(chosen, "webauthn_authentication.rawId"))
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(e) || "Invalid credential rawId"
-		};
+		return failure("invalid_body", errorMessage(e) || "Invalid credential rawId");
 	}
 }
 function credentialPublicKeyBytes(record) {
@@ -65,11 +34,7 @@ function credentialPublicKeyBytes(record) {
 			bytes: decodeBase64UrlOrBase64(record.credentialPublicKeyB64u, "authenticator.credentialPublicKeyB64u")
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: `Stored credential public key is invalid: ${errorMessage(e) || "decode failed"}`
-		};
+		return failure("internal", `Stored credential public key is invalid: ${errorMessage(e) || "decode failed"}`);
 	}
 }
 function credentialVerificationInput(input) {
@@ -105,32 +70,16 @@ async function persistAuthenticatorCounter(input) {
 		}));
 		return { ok: true };
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: `Failed to persist authenticator counter: ${errorMessage(e) || "store error"}`
-		};
+		return failure("internal", `Failed to persist authenticator counter: ${errorMessage(e) || "store error"}`);
 	}
 }
 function parseWebAuthnClientDataForRegistration(input) {
 	const response = readNestedRecord(input.credential, "response");
 	const clientData = parseClientDataJsonBase64url(response ? readStringField(response, "clientDataJSON") : "");
-	if (clientData.type !== "webauthn.create") return {
-		ok: false,
-		code: "invalid_body",
-		message: "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)"
-	};
-	if (clientData.challenge !== input.expectedChallenge) return {
-		ok: false,
-		code: "challenge_mismatch",
-		message: "Registration challenge mismatch"
-	};
+	if (clientData.type !== "webauthn.create") return failure("invalid_body", "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)");
+	if (clientData.challenge !== input.expectedChallenge) return failure("challenge_mismatch", "Registration challenge mismatch");
 	const originHost = originHostnameOrEmpty(clientData.origin);
-	if (!isHostWithinRpId(originHost, input.rpId)) return {
-		ok: false,
-		code: "invalid_origin",
-		message: "WebAuthn origin is not within rpId"
-	};
+	if (!isHostWithinRpId(originHost, input.rpId)) return failure("invalid_origin", "WebAuthn origin is not within rpId");
 	return {
 		ok: true,
 		originHost
@@ -140,47 +89,9 @@ function registrationCredentialCounter(counter) {
 	const numeric = typeof counter === "number" ? counter : Number(counter);
 	return Number.isFinite(numeric) && numeric >= 0 ? Math.floor(numeric) : 0;
 }
-function authenticatorListEntry(input) {
-	return {
-		credentialIdB64u: input.binding.credentialIdB64u,
-		signerSlot: input.binding.signerSlot,
-		publicKey: input.binding.publicKey,
-		createdAtMs: input.authenticator?.createdAtMs ?? input.binding.createdAtMs,
-		updatedAtMs: input.authenticator?.updatedAtMs ?? input.binding.updatedAtMs,
-		device: input.authenticator?.deviceInfo ?? unknownWebAuthnAuthenticatorDeviceInfo()
-	};
-}
-function compareAuthenticatorListEntries(left, right) {
-	return (Number(left.signerSlot || 0) || 0) - (Number(right.signerSlot || 0) || 0);
-}
-async function listCredentialBindingsForUser(input) {
-	if (!input.bindingStore.listByUserId) return {
-		ok: false,
-		code: "not_supported",
-		message: "Credential binding listing is not supported by this store"
-	};
-	return {
-		ok: true,
-		bindings: input.rpId ? await input.bindingStore.listByUserId({
-			userId: input.userId,
-			rpId: input.rpId
-		}) : await input.bindingStore.listByUserId({ userId: input.userId })
-	};
-}
-function ignoreIdentityLinkFailure() {}
-async function linkNearSubjectForWebAuthnLogin(input) {
-	await input.identityStore.linkSubjectToUserId({
-		userId: input.userId,
-		subject: `near:${input.userId}`
-	}).catch(ignoreIdentityLinkFailure);
-}
 async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	const credential = readRecord(input.webauthnRegistration);
-	if (!credential) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_registration"
-	};
+	if (!credential) return failure("invalid_body", "Missing webauthn_registration");
 	const parsedClientData = parseWebAuthnClientDataForRegistration({
 		credential,
 		expectedChallenge: input.expectedChallenge,
@@ -188,17 +99,9 @@ async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	});
 	if (!parsedClientData.ok) return parsedClientData;
 	const expectedOrigin = normalizeOptionalTrimmedString(input.expectedOrigin);
-	if (!expectedOrigin) return {
-		ok: false,
-		code: "invalid_body",
-		message: "expected_origin is required for WebAuthn registration verification"
-	};
+	if (!expectedOrigin) return failure("invalid_body", "expected_origin is required for WebAuthn registration verification");
 	const verifyRegistrationResponse = (await loadSimpleWebAuthnServer()).verifyRegistrationResponse;
-	if (typeof verifyRegistrationResponse !== "function") return {
-		ok: false,
-		code: "unsupported",
-		message: "WebAuthn registration verifier is unavailable in this runtime"
-	};
+	if (typeof verifyRegistrationResponse !== "function") return failure("unsupported", "WebAuthn registration verifier is unavailable in this runtime");
 	const registration = await verifyRegistrationResponse({
 		response: credential,
 		expectedChallenge: input.expectedChallenge,
@@ -206,19 +109,11 @@ async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 		expectedRPID: input.rpId,
 		requireUserVerification: false
 	});
-	if (!registration.verified) return {
-		ok: false,
-		code: "not_verified",
-		message: "Registration verification failed"
-	};
+	if (!registration.verified) return failure("not_verified", "Registration verification failed");
 	const verifiedCredential = registration.registrationInfo?.credential;
 	const credentialIdB64u = String(verifiedCredential?.id || "").trim();
 	const credentialPublicKey = verifiedCredential?.publicKey;
-	if (!credentialIdB64u || !credentialPublicKey) return {
-		ok: false,
-		code: "internal",
-		message: "Registration verification did not return credential public key material"
-	};
+	if (!credentialIdB64u || !credentialPublicKey) return failure("internal", "Registration verification did not return credential public key material");
 	return {
 		ok: true,
 		credential: {
@@ -360,352 +255,7 @@ async function verifyWebAuthnAuthenticationLiteWithStore(input) {
 		};
 	}
 }
-async function listWebAuthnAuthenticatorsForUserWithStores(input) {
-	try {
-		const userId = String(input.userId || "").trim();
-		const rpId = String(input.rpId || "").trim();
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!input.authenticatorStore.list) return {
-			ok: false,
-			code: "not_supported",
-			message: "Authenticator listing is not supported by this store"
-		};
-		const bindingList = await listCredentialBindingsForUser({
-			bindingStore: input.credentialBindingStore,
-			userId,
-			rpId
-		});
-		if (!bindingList.ok) return bindingList;
-		const [authenticators, bindings] = await Promise.all([input.authenticatorStore.list(userId), Promise.resolve(bindingList.bindings)]);
-		const authByCredentialId = /* @__PURE__ */ new Map();
-		for (const authenticator of authenticators) authByCredentialId.set(String(authenticator.credentialIdB64u || "").trim(), authenticator);
-		const merged = [];
-		for (const binding of bindings) merged.push(authenticatorListEntry({
-			binding: {
-				credentialIdB64u: String(binding.credentialIdB64u || "").trim(),
-				signerSlot: binding.signerSlot,
-				publicKey: binding.publicKey,
-				createdAtMs: binding.createdAtMs,
-				updatedAtMs: binding.updatedAtMs
-			},
-			authenticator: authByCredentialId.get(String(binding.credentialIdB64u || "").trim())
-		}));
-		merged.sort(compareAuthenticatorListEntries);
-		return {
-			ok: true,
-			authenticators: merged
-		};
-	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list authenticators"
-		};
-	}
-}
-async function createWebAuthnLoginOptionsWithStore(input) {
-	try {
-		const userIdRaw = String(input.request.userId ?? input.request.user_id ?? "").trim();
-		const rpId = String(input.request.rpId ?? input.request.rp_id ?? "").trim();
-		if (!userIdRaw) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
-		const userId = parseBoundaryWalletId(userIdRaw);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid userId"
-		};
-		if (!rpId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing rpId"
-		};
-		const randomAvailable = ensureCryptoRandomValues();
-		if (randomAvailable !== true) return randomAvailable;
-		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + ttlMsClamped;
-		const challengeId = randomWebAuthnB64u(16);
-		const challengeB64u = randomWebAuthnB64u(32);
-		await input.loginChallengeStore.put({
-			version: "webauthn_login_challenge_v1",
-			challengeId,
-			userId,
-			rpId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		});
-		return {
-			ok: true,
-			challengeId,
-			challengeB64u,
-			expiresAtMs
-		};
-	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create login options"
-		};
-	}
-}
-async function createWebAuthnSyncAccountOptionsWithStores(input) {
-	try {
-		const rpId = String(input.request.rp_id || "").trim();
-		if (!rpId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing rp_id"
-		};
-		const expectedUserIdRaw = normalizeOptionalTrimmedString(input.request.account_id);
-		const expectedUserId = expectedUserIdRaw ? parseBoundaryWalletId(expectedUserIdRaw) : null;
-		if (expectedUserIdRaw && !expectedUserId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid wallet account_id"
-		};
-		const randomAvailable = ensureCryptoRandomValues();
-		if (randomAvailable !== true) return randomAvailable;
-		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + ttlMsClamped;
-		const challengeId = randomWebAuthnB64u(16);
-		const challengeB64u = randomWebAuthnB64u(32);
-		let credentialIds;
-		let walletBinding;
-		if (expectedUserId) {
-			const bindingList = await listCredentialBindingsForUser({
-				bindingStore: input.credentialBindingStore,
-				userId: expectedUserId,
-				rpId
-			});
-			if (!bindingList.ok) return bindingList;
-			const resolvedBinding = bindingList.bindings.find((binding) => {
-				return Boolean(binding.userId && binding.nearAccountId && binding.nearEd25519SigningKeyId);
-			});
-			if (resolvedBinding) walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding: resolvedBinding }) ?? void 0;
-			const seen = /* @__PURE__ */ new Set();
-			credentialIds = [];
-			for (const binding of bindingList.bindings) {
-				const credentialId = String(binding.credentialIdB64u || "").trim();
-				if (!credentialId || seen.has(credentialId)) continue;
-				seen.add(credentialId);
-				credentialIds.push(credentialId);
-			}
-		}
-		const record = expectedUserId ? {
-			version: "webauthn_sync_challenge_v1",
-			challengeId,
-			rpId,
-			expectedUserId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		} : {
-			version: "webauthn_sync_challenge_v1",
-			challengeId,
-			rpId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		};
-		await input.syncChallengeStore.put(record);
-		const result = {
-			ok: true,
-			challengeId,
-			challengeB64u,
-			expiresAtMs
-		};
-		if (credentialIds) result.credentialIds = credentialIds;
-		if (walletBinding) result.walletBinding = walletBinding;
-		return result;
-	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create sync account options"
-		};
-	}
-}
-async function verifyWebAuthnSyncAccountWithStores(input) {
-	try {
-		const request = input.request;
-		const challengeId = String(request.challengeId ?? request.challenge_id ?? "").trim();
-		if (!challengeId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
-		const challenge = await input.syncChallengeStore.consume(challengeId);
-		if (!challenge) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Sync challenge expired or invalid"
-		};
-		const credential = request.webauthn_authentication;
-		const credentialId = credentialRawIdB64u(credential);
-		if (!credentialId.ok) return {
-			ok: false,
-			verified: false,
-			code: credentialId.code,
-			message: credentialId.message
-		};
-		const syncBinding = webAuthnSyncCredentialBinding(await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u), challenge);
-		if (!syncBinding.ok) return syncBinding;
-		const binding = syncBinding.binding;
-		const expectedOrigin = normalizeOptionalTrimmedString(request.expected_origin);
-		if (!expectedOrigin) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "expected_origin is required for WebAuthn authentication verification"
-		};
-		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: binding.userId,
-			rpId: requireWebAuthnRpId(binding.rpId, "sync credential binding rpId"),
-			expectedChallenge: challenge.challengeB64u,
-			webauthnAuthentication: credential,
-			expectedOrigin,
-			authenticatorStore: input.authenticatorStore,
-			logger: input.logger
-		}));
-		if (verificationFailure) return verificationFailure;
-		const auth = await input.authenticatorStore.get(binding.userId, credentialId.credentialIdB64u);
-		if (!auth) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential is not registered for user"
-		};
-		const walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding });
-		const bindingPublicKey = binding.publicKey;
-		if (!walletBinding || !bindingPublicKey) return {
-			ok: false,
-			verified: false,
-			code: "ed25519_not_provisioned",
-			message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-		};
-		const ed25519Signer = await input.walletStore.getEd25519SignerBySlot({
-			walletId: walletIdFromString(walletBinding.walletId),
-			signerSlot: walletBinding.signerSlot
-		});
-		if (!ed25519Signer) return {
-			ok: false,
-			verified: false,
-			code: "ed25519_not_provisioned",
-			message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-		};
-		const walletBindingAuthorityScope = passkeyThresholdEd25519AuthorityScope(requireWebAuthnRpId(walletBinding.rpId, "sync credential binding rpId"));
-		const thresholdEd25519 = binding.relayerKeyId ? {
-			relayerKeyId: binding.relayerKeyId,
-			authorityScope: walletBindingAuthorityScope,
-			publicKey: bindingPublicKey,
-			...binding.keyVersion ? { keyVersion: binding.keyVersion } : {},
-			...typeof binding.recoveryExportCapable === "boolean" ? { recoveryExportCapable: binding.recoveryExportCapable } : {},
-			...typeof binding.clientParticipantId === "number" ? { clientParticipantId: binding.clientParticipantId } : {},
-			...typeof binding.relayerParticipantId === "number" ? { relayerParticipantId: binding.relayerParticipantId } : {},
-			...Array.isArray(binding.participantIds) ? { participantIds: binding.participantIds } : {}
-		} : void 0;
-		return {
-			ok: true,
-			verified: true,
-			accountId: walletBinding.walletId,
-			walletId: walletBinding.walletId,
-			nearAccountId: walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-			custodyKeyManifestDigestB64u: parseDigestB64u(ed25519Signer.custodyKeyManifestDigestB64u),
-			walletBinding,
-			rpId: walletBinding.rpId,
-			signerSlot: walletBinding.signerSlot,
-			publicKey: bindingPublicKey,
-			...binding.relayerKeyId ? { relayerKeyId: binding.relayerKeyId } : {},
-			credentialIdB64u: credentialId.credentialIdB64u,
-			credentialPublicKeyB64u: auth.credentialPublicKeyB64u,
-			...thresholdEd25519 ? { thresholdEd25519 } : {}
-		};
-	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Sync verification failed"
-		};
-	}
-}
-async function verifyWebAuthnLoginWithStores(input) {
-	try {
-		const challengeId = String(input.request.challengeId ?? input.request.challenge_id ?? "").trim();
-		if (!challengeId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
-		const record = await input.loginChallengeStore.consume(challengeId);
-		if (!record) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Login challenge expired or invalid"
-		};
-		const expectedOrigin = normalizeOptionalTrimmedString(input.request.expected_origin);
-		if (!expectedOrigin) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "expected_origin is required for WebAuthn authentication verification"
-		};
-		const credential = parseWebAuthnAuthenticationCredential(input.request.webauthn_authentication);
-		if (!credential) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing webauthn_authentication"
-		};
-		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: record.userId,
-			rpId: requireWebAuthnRpId(record.rpId, "login challenge rpId"),
-			expectedChallenge: record.challengeB64u,
-			webauthnAuthentication: credential,
-			expectedOrigin,
-			authenticatorStore: input.authenticatorStore,
-			logger: input.logger
-		}));
-		if (verificationFailure) return verificationFailure;
-		const credentialIdB64u = String(credential.rawId || credential.id || "").trim();
-		const binding = credentialIdB64u ? await input.credentialBindingStore.get(record.rpId, credentialIdB64u) : null;
-		const loginSigner = webAuthnLoginEd25519(binding, binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null);
-		if (!loginSigner.ok) return loginSigner;
-		await linkNearSubjectForWebAuthnLogin({
-			identityStore: input.identityStore,
-			userId: record.userId
-		});
-		return {
-			ok: true,
-			verified: true,
-			userId: record.userId,
-			rpId: record.rpId,
-			credentialIdB64u,
-			ed25519: loginSigner.ed25519
-		};
-	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Login verification failed"
-		};
-	}
-}
 //#endregion
-export { createWebAuthnLoginOptionsWithStore, createWebAuthnSyncAccountOptionsWithStores, listWebAuthnAuthenticatorsForUserWithStores, verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnLoginWithStores, verifyWebAuthnRegistrationCredentialForIntent, verifyWebAuthnSyncAccountWithStores };
+export { verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnRegistrationCredentialForIntent };
 
 //# sourceMappingURL=webauthn.js.map

package/dist/esm/core/authService/webauthnOidcHelpers.js

@@ -57,30 +57,7 @@ function isHostWithinRpId(host, rpId) {
 	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
 	return h === r || h.endsWith(`.${r}`);
 }
-function parseCacheControlMaxAgeSec(cacheControl) {
-	const s = String(cacheControl || "").trim();
-	if (!s) return null;
-	const m = s.match(/(?:^|,)\s*max-age=(\d+)\s*(?:,|$)/i);
-	if (!m) return null;
-	const n = Number(m[1]);
-	if (!Number.isFinite(n) || n <= 0) return null;
-	return Math.floor(n);
-}
-function parseJwtSegmentJson(input) {
-	try {
-		const raw = new TextDecoder().decode(base64UrlDecode(input));
-		const parsed = raw ? JSON.parse(raw) : null;
-		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-function parseJwtAud(input) {
-	if (Array.isArray(input)) return input.map((v) => typeof v === "string" ? v.trim() : "").filter(Boolean);
-	const single = String(input || "").trim();
-	return single ? [single] : [];
-}
 //#endregion
-export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
+export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url };
 
 //# sourceMappingURL=webauthnOidcHelpers.js.map