@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/near/d1SponsoredNearAccount.js

@@ -0,0 +1,242 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
+import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { broadcastPreparedSponsoredNearAccountCreation, prepareSponsoredNearAccountCreationWithRelayer, preparedSponsoredNearAccountCreationArtifactFingerprint } from "../../../../core/nearRelayerAccountProvisioning.js";
+//#region src/router/cloudflare/d1/near/d1SponsoredNearAccount.ts
+/**
+* Validates a persisted claim before it is trusted to skip a broadcast or to be
+* replayed. An invalid record makes the D1 read fail, which leaves the effect
+* uncertain and prevents any network action on unvalidated bytes.
+*/
+function parseSponsoredNearAccountSideEffectRecord(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (Reflect.get(raw, "operation") !== "finalize") return null;
+	const requestFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "requestFingerprint"));
+	const preparedArtifactFingerprint = parseSideEffectFingerprint(Reflect.get(raw, "preparedArtifactFingerprint"));
+	if (requestFingerprint === null || preparedArtifactFingerprint === null) return null;
+	const claimedAtMs = Reflect.get(raw, "claimedAtMs");
+	if (!isNonNegativeSafeInteger(claimedAtMs)) return null;
+	const prepared = parseWalletSponsoredTransaction(Reflect.get(raw, "prepared"));
+	if (prepared === null) return null;
+	const kind = Reflect.get(raw, "kind");
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return {
+		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
+		operation: "finalize",
+		requestFingerprint,
+		preparedArtifactFingerprint,
+		claimedAtMs,
+		prepared
+	};
+	if (kind === "router_ab_ed25519_yao_registration_side_effect_completion_v1") {
+		const completedAtMs = Reflect.get(raw, "completedAtMs");
+		if (!isNonNegativeSafeInteger(completedAtMs)) return null;
+		const response = parseAccountCreationResult(Reflect.get(raw, "response"));
+		if (response === null) return null;
+		return {
+			kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
+			operation: "finalize",
+			requestFingerprint,
+			preparedArtifactFingerprint,
+			claimedAtMs,
+			completedAtMs,
+			prepared,
+			response
+		};
+	}
+	return null;
+}
+function parsePreparedSponsoredNearAccountCreation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	if (Reflect.get(value, "kind") !== "prepared_sponsored_near_account_creation_v1") return null;
+	const accountId = parseNonEmptyString(Reflect.get(value, "accountId"));
+	const publicKey = parseNonEmptyString(Reflect.get(value, "publicKey"));
+	const relayerAccountId = parseNonEmptyString(Reflect.get(value, "relayerAccountId"));
+	const relayerPublicKey = parseNonEmptyString(Reflect.get(value, "relayerPublicKey"));
+	const initialBalanceYocto = parseNonEmptyString(Reflect.get(value, "initialBalanceYocto"));
+	const transactionHash = parseNonEmptyString(Reflect.get(value, "transactionHash"));
+	const nextNonce = parseNonEmptyString(Reflect.get(value, "nextNonce"));
+	const blockHash = parseNonEmptyString(Reflect.get(value, "blockHash"));
+	const signedTransactionBorshB64u = parseBoundedBase64Url(Reflect.get(value, "signedTransactionBorshB64u"));
+	if (accountId === null || publicKey === null || relayerAccountId === null || relayerPublicKey === null || initialBalanceYocto === null || transactionHash === null || nextNonce === null || blockHash === null || signedTransactionBorshB64u === null) return null;
+	return {
+		kind: "prepared_sponsored_near_account_creation_v1",
+		accountId,
+		publicKey,
+		relayerAccountId,
+		relayerPublicKey,
+		initialBalanceYocto,
+		transactionHash,
+		nextNonce,
+		blockHash,
+		signedTransactionBorshB64u
+	};
+}
+function parseAccountCreationResult(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const success = Reflect.get(value, "success");
+	if (typeof success !== "boolean") return null;
+	const accountId = parseOptionalString(Reflect.get(value, "accountId"));
+	const transactionHash = parseOptionalString(Reflect.get(value, "transactionHash"));
+	const error = parseOptionalString(Reflect.get(value, "error"));
+	const message = parseOptionalString(Reflect.get(value, "message"));
+	if ("accountId" in value && accountId === null || "transactionHash" in value && transactionHash === null || "error" in value && error === null || "message" in value && message === null) return null;
+	if (success && (accountId === void 0 || transactionHash === void 0)) return null;
+	const normalizedAccountId = accountId ?? void 0;
+	const normalizedTransactionHash = transactionHash ?? void 0;
+	const normalizedError = error ?? void 0;
+	const normalizedMessage = message ?? void 0;
+	return {
+		success,
+		...normalizedAccountId === void 0 ? {} : { accountId: normalizedAccountId },
+		...normalizedTransactionHash === void 0 ? {} : { transactionHash: normalizedTransactionHash },
+		...normalizedError === void 0 ? {} : { error: normalizedError },
+		...normalizedMessage === void 0 ? {} : { message: normalizedMessage }
+	};
+}
+function parseNonEmptyString(value) {
+	return typeof value === "string" && value.trim() ? value : null;
+}
+function parseSideEffectFingerprint(value) {
+	return typeof value === "string" && /^[a-zA-Z0-9:_-]{32,192}$/u.test(value) ? value : null;
+}
+function parseBoundedBase64Url(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 8192 && /^[\w-]+$/u.test(value) ? value : null;
+}
+function parseOptionalString(value) {
+	return value === void 0 ? void 0 : parseNonEmptyString(value);
+}
+function isNonNegativeSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function sponsoredNearAccountSideEffectStore(options) {
+	return createCloudflareD1VersionedJsonRecordStore({
+		database: options.database,
+		scope: {
+			namespace: options.namespace,
+			orgId: options.orgId,
+			projectId: options.projectId,
+			envId: options.envId
+		},
+		keyPrefix: "router-ab-yao-sponsored-account:",
+		encode: encodeSponsoredRecord,
+		parse: parseSponsoredNearAccountSideEffectRecord
+	});
+}
+/**
+* Creates the sponsored account through a durable claim. The signed transaction
+* and its hash are persisted before the broadcast, so a lost response replays
+* those exact bytes instead of building a second transaction under a fresh
+* nonce. Rebroadcasting an identical signed transaction reuses its hash, so the
+* network treats the retry as the same transaction.
+*/
+async function createSponsoredNamedNearAccountForOptions(options, input) {
+	const relayerAccount = options.relayerAccount;
+	const relayerPrivateKey = options.relayerPrivateKey;
+	const nearRpcUrl = options.nearRpcUrl;
+	const initialBalanceYocto = options.accountInitialBalance;
+	if (!relayerAccount || !relayerPrivateKey || !nearRpcUrl || !initialBalanceYocto) return {
+		kind: "rejected",
+		message: "Sponsored NEAR account creation is not configured on this server"
+	};
+	const relayerInput = {
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccount,
+		relayerPrivateKey,
+		relayerPublicKey: options.relayerPublicKey,
+		nearRpcUrl,
+		initialBalanceYocto
+	};
+	const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: "sponsored_near_account_creation_v1",
+		walletId: input.walletId,
+		accountId: input.accountId,
+		publicKey: input.publicKey,
+		relayerAccountId: relayerAccount,
+		initialBalanceYocto
+	})));
+	const outcome = await runRouterAbEd25519YaoRegistrationSideEffectV1(sponsoredNearAccountSideEffectStore(options), {
+		kind: "prepared_resumable",
+		resumeAfterMs: 3e4,
+		operation: "finalize",
+		key: `sponsored-account:${input.idempotencyKey}`,
+		requestFingerprint,
+		nowMs: () => Date.now(),
+		prepare: prepareWalletSponsoredTransaction.bind(null, input.walletId, relayerInput),
+		derivePreparedArtifactFingerprint: fingerprintWalletSponsoredTransaction,
+		execute: executeWalletSponsoredTransaction.bind(null, {
+			walletId: input.walletId,
+			nearRpcUrl,
+			relayerAccountId: relayerAccount
+		})
+	});
+	switch (outcome.kind) {
+		case "executed":
+		case "exact_replay":
+			if (outcome.value.success && outcome.value.accountId && outcome.value.transactionHash) return {
+				kind: "created",
+				accountId: outcome.value.accountId,
+				transactionHash: outcome.value.transactionHash
+			};
+			return {
+				kind: "rejected",
+				message: outcome.value.message || outcome.value.error || "Sponsored NEAR account creation was rejected"
+			};
+		case "in_progress":
+		case "uncertain": return {
+			kind: "retryable",
+			message: outcome.kind === "uncertain" ? outcome.message : "Sponsored NEAR account creation is already in progress for this registration",
+			retryAfterMs: 3e4
+		};
+		case "request_conflict": return {
+			kind: "rejected",
+			message: "Sponsored NEAR account creation idempotency key conflicts with another request"
+		};
+	}
+}
+function parseWalletSponsoredTransaction(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const walletId = parseWalletId(Reflect.get(raw, "walletId"));
+	const transaction = parsePreparedSponsoredNearAccountCreation(Reflect.get(raw, "transaction"));
+	if (!walletId.ok || !transaction) return null;
+	return {
+		walletId: walletId.value,
+		transaction
+	};
+}
+async function fingerprintWalletSponsoredTransaction(prepared) {
+	const transactionFingerprint = await preparedSponsoredNearAccountCreationArtifactFingerprint(prepared.transaction);
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		walletId: prepared.walletId,
+		transactionFingerprint
+	})));
+}
+function encodeSponsoredRecord(record) {
+	return record;
+}
+async function prepareWalletSponsoredTransaction(walletId, input) {
+	const prepared = await prepareSponsoredNearAccountCreationWithRelayer(input);
+	if (!prepared.ok) throw new Error(prepared.message);
+	return {
+		walletId,
+		transaction: prepared.prepared
+	};
+}
+async function executeWalletSponsoredTransaction(context, prepared, attempt) {
+	if (prepared.walletId !== context.walletId) throw new Error("Sponsored NEAR account claim belongs to another wallet");
+	const broadcast = await broadcastPreparedSponsoredNearAccountCreation({
+		prepared: prepared.transaction,
+		nearRpcUrl: context.nearRpcUrl,
+		relayerAccountId: context.relayerAccountId,
+		reconcileFirst: attempt === "resumed"
+	});
+	if (broadcast.kind === "uncertain") throw new Error(broadcast.message);
+	return broadcast.result;
+}
+//#endregion
+export { createSponsoredNamedNearAccountForOptions };
+
+//# sourceMappingURL=d1SponsoredNearAccount.js.map

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -1,8 +1,9 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
-import { toArrayBufferCopy, toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcBoundary.ts
 function parseJwtAud(input) {
 	const values = [];
@@ -75,43 +76,18 @@ var CloudflareD1OidcJwksCache = class {
 };
 function parseRs256JwtForVerification(input) {
 	const parts = input.token.split(".");
-	if (parts.length !== 3) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} must be a JWT (3 segments)`
-	};
+	if (parts.length !== 3) return failedVerification("invalid_body", `${input.tokenLabel} must be a JWT (3 segments)`);
 	const headerB64u = parts[0] || "";
 	const payloadB64u = parts[1] || "";
 	const signatureB64u = parts[2] || "";
 	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `Invalid ${input.tokenLabel} header encoding`
-	};
+	if (!header) return failedVerification("invalid_body", `Invalid ${input.tokenLabel} header encoding`);
 	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `Invalid ${input.tokenLabel} payload encoding`
-	};
+	if (!payload) return failedVerification("invalid_body", `Invalid ${input.tokenLabel} payload encoding`);
 	const kid = normalizeOptionalTrimmedString(header.kid);
 	const alg = normalizeOptionalTrimmedString(header.alg);
-	if (!kid) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} header.kid is required`
-	};
-	if (alg !== "RS256") return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} header.alg must be RS256`
-	};
+	if (!kid) return failedVerification("invalid_body", `${input.tokenLabel} header.kid is required`);
+	if (alg !== "RS256") return failedVerification("invalid_body", `${input.tokenLabel} header.alg must be RS256`);
 	return {
 		ok: true,
 		jwt: {
@@ -128,24 +104,14 @@ async function verifyRs256JwtSignature(input) {
 	try {
 		signatureBytes = base64UrlDecode(input.jwt.signatureB64u);
 	} catch {
-		return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: `Invalid ${input.tokenLabel} signature encoding`
-		};
+		return failedVerification("invalid_body", `Invalid ${input.tokenLabel} signature encoding`);
 	}
 	const dataBytes = new TextEncoder().encode(`${input.jwt.headerB64u}.${input.jwt.payloadB64u}`);
 	const key = await input.subtle.importKey("jwk", input.jwk, {
 		name: "RSASSA-PKCS1-v1_5",
 		hash: "SHA-256"
 	}, false, ["verify"]);
-	if (!await input.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return {
-		ok: false,
-		verified: false,
-		code: "invalid_signature",
-		message: input.invalidSignatureMessage
-	};
+	if (!await input.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return failedVerification("invalid_signature", input.invalidSignatureMessage);
 	return { ok: true };
 }
 function parseBooleanJwtClaim(input) {
@@ -157,61 +123,21 @@ function parseBooleanJwtClaim(input) {
 function validateGoogleIdTokenClaims(input) {
 	const payload = input.payload;
 	const iss = normalizeOptionalTrimmedString(payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return {
-		ok: false,
-		verified: false,
-		code: "invalid_issuer",
-		message: "Invalid Google id_token issuer"
-	};
+	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return failedVerification("invalid_issuer", "Invalid Google id_token issuer");
 	const nowSec = Math.floor(Date.now() / 1e3);
 	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Invalid Google id_token exp"
-	};
-	if (nowSec >= exp) return {
-		ok: false,
-		verified: false,
-		code: "expired",
-		message: "Google id_token is expired"
-	};
+	if (!Number.isFinite(exp) || exp <= 0) return failedVerification("invalid_claims", "Invalid Google id_token exp");
+	if (nowSec >= exp) return failedVerification("expired", "Google id_token is expired");
 	if (payload.nbf !== void 0) {
 		const nbf = Number(payload.nbf);
-		if (!Number.isFinite(nbf)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_claims",
-			message: "Invalid Google id_token nbf"
-		};
-		if (nowSec < nbf) return {
-			ok: false,
-			verified: false,
-			code: "not_yet_valid",
-			message: "Google id_token is not yet valid"
-		};
+		if (!Number.isFinite(nbf)) return failedVerification("invalid_claims", "Invalid Google id_token nbf");
+		if (nowSec < nbf) return failedVerification("not_yet_valid", "Google id_token is not yet valid");
 	}
 	const aud = parseJwtAud(payload.aud);
-	if (aud.length === 0) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Missing Google id_token aud"
-	};
-	if (!aud.includes(input.clientId)) return {
-		ok: false,
-		verified: false,
-		code: "invalid_audience",
-		message: "Google id_token audience mismatch"
-	};
+	if (aud.length === 0) return failedVerification("invalid_claims", "Missing Google id_token aud");
+	if (!aud.includes(input.clientId)) return failedVerification("invalid_audience", "Google id_token audience mismatch");
 	const sub = normalizeOptionalTrimmedString(payload.sub);
-	if (!sub) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Missing Google id_token sub"
-	};
+	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const email = normalizeOptionalTrimmedString(payload.email);
 	const name = normalizeOptionalTrimmedString(payload.name);
 	const givenName = normalizeOptionalTrimmedString(payload.given_name);

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,14 +1,13 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
-import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
 import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
+import { verifyGoogleOidcToken } from "./googleOidcToken.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1OidcVerificationService = class {
 	constructor(input) {
-		this.oidcJwksCache = new CloudflareD1OidcJwksCache();
 		this.googleOidcClientId = input.googleOidcClientId;
 		this.githubOAuth = input.githubOAuth;
 		this.identityStore = input.identityStore;
@@ -44,52 +43,7 @@ var CloudflareD1OidcVerificationService = class {
 	}
 	async verifyGoogleIdToken(input, linkIdentity) {
 		try {
-			const clientId = normalizeOptionalTrimmedString(this.googleOidcClientId);
-			if (!clientId) return {
-				ok: false,
-				verified: false,
-				code: "not_configured",
-				message: "Google OIDC is not configured on this Worker"
-			};
-			const idToken = normalizeOptionalTrimmedString(input.idToken ?? input.id_token);
-			if (!idToken) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "id_token is required"
-			};
-			const subtle = globalThis.crypto?.subtle;
-			if (!subtle) return {
-				ok: false,
-				verified: false,
-				code: "unsupported",
-				message: "WebCrypto (crypto.subtle) is unavailable in this runtime"
-			};
-			const parsed = parseRs256JwtForVerification({
-				token: idToken,
-				tokenLabel: "id_token"
-			});
-			if (!parsed.ok) return parsed;
-			const jwt = parsed.jwt;
-			const jwk = (await this.oidcJwksCache.getGoogleJwks()).keysByKid.get(jwt.kid);
-			if (!jwk) return {
-				ok: false,
-				verified: false,
-				code: "unknown_kid",
-				message: "Unknown Google key id (kid)"
-			};
-			const signature = await verifyRs256JwtSignature({
-				subtle,
-				jwt,
-				jwk,
-				tokenLabel: "id_token",
-				invalidSignatureMessage: "Invalid Google id_token signature"
-			});
-			if (!signature.ok) return signature;
-			const claims = validateGoogleIdTokenClaims({
-				payload: jwt.payload,
-				clientId
-			});
+			const claims = await verifyGoogleOidcToken(this.googleOidcClientId, input.idToken ?? input.id_token);
 			if (!claims.ok) return claims;
 			const providerSubject = `google:${claims.sub}`;
 			return {
@@ -106,12 +60,7 @@ var CloudflareD1OidcVerificationService = class {
 				...claims.hostedDomain ? { hostedDomain: claims.hostedDomain } : {}
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Google OIDC verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Google OIDC verification failed");
 		}
 	}
 	async linkGoogleIdentity(providerSubject) {

package/dist/esm/router/cloudflare/d1/oidc/googleOidcToken.js

@@ -0,0 +1,41 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
+//#region src/router/cloudflare/d1/oidc/googleOidcToken.ts
+const googleJwks = new CloudflareD1OidcJwksCache();
+/** Verifies provider proof without reading or mutating wallet identity state. */
+async function verifyGoogleOidcToken(configuredClientId, rawToken) {
+	const clientId = normalizeOptionalTrimmedString(configuredClientId);
+	if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
+	const token = normalizeOptionalTrimmedString(rawToken);
+	if (!token) return failedVerification("invalid_body", "id_token is required");
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
+	const parsed = parseRs256JwtForVerification({
+		token,
+		tokenLabel: "id_token"
+	});
+	if (!parsed.ok) return parsed;
+	try {
+		const jwk = (await googleJwks.getGoogleJwks()).keysByKid.get(parsed.jwt.kid);
+		if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
+		const signature = await verifyRs256JwtSignature({
+			subtle,
+			jwt: parsed.jwt,
+			jwk,
+			tokenLabel: "id_token",
+			invalidSignatureMessage: "Invalid Google id_token signature"
+		});
+		if (!signature.ok) return signature;
+		return validateGoogleIdTokenClaims({
+			payload: parsed.jwt.payload,
+			clientId
+		});
+	} catch {
+		return failedVerification("internal", "Google OIDC verification unavailable");
+	}
+}
+//#endregion
+export { verifyGoogleOidcToken };
+
+//# sourceMappingURL=googleOidcToken.js.map

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js

@@ -5,6 +5,7 @@ import "../../../../shared-ts/src/utils/encoders.js";
 import { isActiveRecoveredWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { buildWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding } from "../../../../shared-ts/src/wallet-recovery/backupAcknowledgement.js";
 import "../../../../shared-ts/src/wallet-recovery/recoveryCodes.js";
@@ -251,20 +252,12 @@ function createD1PasskeyCustodyRouteService(assembly) {
 			const expectedOrigin = String(request.expectedOrigin || "").trim();
 			if (!challengeId || !expectedOrigin) return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "challenge_required",
-					message: "custody retrieval needs a server-issued challenge and an origin"
-				}
+				body: failure("challenge_required", "custody retrieval needs a server-issued challenge and an origin")
 			};
 			const challenge = await assembly.webAuthnStore.consumeLoginChallenge(challengeId);
 			if (!challenge) return {
 				status: 401,
-				body: {
-					ok: false,
-					code: "challenge_unknown",
-					message: "the challenge is unknown, expired, or already used"
-				}
+				body: failure("challenge_unknown", "the challenge is unknown, expired, or already used")
 			};
 			const projections = await assembly.passkeyCustodyEnvelopes.listWalletCredentialActivity(request.locator.walletId);
 			const requestedFactor = request.locator.factor;
@@ -275,11 +268,7 @@ function createD1PasskeyCustodyRouteService(assembly) {
 			const projection = matchingProjections.find((entry) => entry.index.lifecycle.state === "active") ?? matchingProjections[0];
 			if (!projection || projection.index.factor.kind !== "passkey") return {
 				status: 404,
-				body: {
-					ok: false,
-					code: "envelope_missing",
-					message: "no custody envelope for this wallet and credential"
-				}
+				body: failure("envelope_missing", "no custody envelope for this wallet and credential")
 			};
 			const locator = {
 				walletId: request.locator.walletId,
@@ -462,6 +451,11 @@ async function prepareRecoveryForRoute(assembly, request) {
 		reservationTtlMs: RECOVERY_RESERVATION_TTL_MS
 	});
 	if (prepared.kind !== "prepared") return prepared;
+	try {
+		await assembly.walletCustodyCommits.publishRecoveryOperation(walletId, targetIdentity.recoveryOperationId);
+	} catch {
+		return { kind: "routing_unavailable" };
+	}
 	try {
 		const manifest = await resolveWalletRecoveryKeyManifestV1({
 			registry: assembly.walletStore,