@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/authService/AuthService.js

@@ -1,594 +0,0 @@
-import { coerceLogger } from "../logger.js";
-import { isAuthServiceProductionEnvironment, readAuthServiceConfigValue } from "./configValues.js";
-import { resolveEmailOtpConfig, resolveEmailOtpRateLimitPolicies } from "./emailOtpConfig.js";
-import { MinimalNearClient } from "../rpcClients/near/NearClient.js";
-import { isNodeEnvironment } from "./wasm.js";
-import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "./githubOAuth.js";
-import { createWebAuthnLoginOptionsWithStore, createWebAuthnSyncAccountOptionsWithStores, listWebAuthnAuthenticatorsForUserWithStores, verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnLoginWithStores, verifyWebAuthnSyncAccountWithStores } from "./webauthn.js";
-import { createAuthServiceConfig } from "../config.js";
-import { formatGasToTGas, formatYoctoToNear } from "../utils.js";
-import { createRouterAbSigningRuntimes } from "../routerAbSigning/createRouterAbSigningRuntimes.js";
-import { deliverEmailOtpCode, readEmailOtpOutboxEntry } from "./emailOtpDelivery.js";
-import { createEmailOtpChallengeWithAction } from "./emailOtpChallenges.js";
-import { createEmailOtpChallenge, createEmailOtpEnrollmentChallenge, verifyEmailOtpChallenge } from "./emailOtpChallengeOperations.js";
-import { verifyEmailOtpChallengeCode } from "./emailOtpChallengeVerification.js";
-import { isEmailOtpStrongAuthRequiredWithStores, markEmailOtpStrongAuthSatisfiedWithStores, putEmailOtpAuthStateForEnrollmentWithStore, readActiveEmailOtpEnrollmentWithStore, readEmailOtpAuthStateForEnrollmentWithStore, readEmailOtpEnrollmentWithStore } from "./emailOtpEnrollment.js";
-import { verifyEmailOtpEnrollment } from "./emailOtpRegistrationEnrollment.js";
-import { createEmailOtpUnlockChallenge, verifyEmailOtpUnlockProof } from "./emailOtpUnlock.js";
-import { createEmailOtpShamirCipherFromConfig, runEmailOtpServerSealOperation } from "./emailOtpSeal.js";
-import { consumeEmailOtpGrantWithStore } from "./emailOtpGrant.js";
-import { cleanupGoogleEmailOtpDevRegistrationStateForAuthService, completeGoogleEmailOtpRegistrationAttemptForAuthService, consumeGoogleEmailOtpRegistrationAttemptRateLimitForAuthService, failGoogleEmailOtpRegistrationAttemptForAuthService, recordGoogleEmailOtpRegistrationAttemptPublicKeyForAuthService, resolveGoogleEmailOtpSessionForAuthService, resolveOidcWalletIdWithGoogleEmailOtp, validateGoogleEmailOtpRegistrationCandidateWalletForAuthService } from "./googleEmailOtpOperations.js";
-import { consumeEmailOtpRateLimit } from "./rateLimits.js";
-import { summarizeThresholdStoreConfig } from "./thresholdStoreSummary.js";
-import { createGoogleJwksState, verifyGoogleLoginWithIdentityStore } from "./oidcVerification.js";
-import { createInitialAuthServiceRuntimeState, ensureAuthServiceRuntimeReady, ensureAuthServiceSignerWasmReady } from "./runtime.js";
-import { AuthServiceStoreRegistry } from "./storeRegistry.js";
-import { NearAccountOperations } from "./nearAccountOperations.js";
-import { IdentityOperations } from "./identityOperations.js";
-import { listNearPublicKeysForUserWithStore, recordNearPublicKeyMetadataWithStore } from "./nearPublicKeyMetadata.js";
-//#region src/core/authService/AuthService.ts
-/**
-* Framework-agnostic NEAR account service
-* Core business logic for account creation and registration operations
-*/
-var AuthService = class {
-	constructor(config) {
-		this.runtimeState = createInitialAuthServiceRuntimeState();
-		this.routerAbSigningRuntimeState = { kind: "uninitialized" };
-		this.emailOtpMemoryOutbox = /* @__PURE__ */ new Map();
-		this.registrationRuntimeWarmPromise = null;
-		this.googleJwksState = createGoogleJwksState();
-		this.config = createAuthServiceConfig(config);
-		this.logger = coerceLogger(this.config.logger);
-		this.nearClient = new MinimalNearClient(this.config.nearRpcUrl);
-		this.stores = new AuthServiceStoreRegistry({
-			config: this.config,
-			logger: this.logger,
-			isNode: this.isNodeEnvironment.bind(this)
-		});
-		this.nearAccounts = new NearAccountOperations({
-			config: this.config,
-			nearClient: this.nearClient,
-			logger: this.logger,
-			ensureSignerAndRelayerAccount: this._ensureSignerAndRelayerAccount.bind(this),
-			ensureSignerWasm: this.ensureSignerWasm.bind(this),
-			getRelayerPublicKey: () => this.runtimeState.relayerPublicKey
-		});
-		this.logger.info(`
-    AuthService initialized with:
-    • networkId: ${this.config.networkId}
-    • nearRpcUrl: ${this.config.nearRpcUrl}
-    • relayerAccount: ${this.config.relayerAccount}
-    • accountInitialBalance: ${this.config.accountInitialBalance} (${formatYoctoToNear(this.config.accountInitialBalance)} NEAR)
-    • createAccountAndRegisterGas: ${this.config.createAccountAndRegisterGas} (${formatGasToTGas(this.config.createAccountAndRegisterGas)})
-    • ${summarizeThresholdStoreConfig(this.config.thresholdStore)}
-    ${this.config.googleOidc?.clientIds?.length ? `• googleOidc: ${this.config.googleOidc.clientIds.length} clientId(s)` : `• googleOidc: not configured`}
-    • githubOAuth: ${this.config.githubOAuth ? "configured" : "not configured"}
-    `);
-	}
-	async getRelayerAccount() {
-		await this._ensureSignerAndRelayerAccount();
-		return {
-			accountId: this.config.relayerAccount,
-			publicKey: this.runtimeState.relayerPublicKey
-		};
-	}
-	/**
-	* Lightweight config accessor (no RPC) for diagnostics and well-known endpoints.
-	* This is safe to call even when the relayer account has not been warmed/validated yet.
-	*/
-	getConfiguredRelayerAccount() {
-		return this.config.relayerAccount;
-	}
-	isGoogleOidcConfigured() {
-		return Boolean(this.config.googleOidc?.clientIds?.length);
-	}
-	getGoogleOidcPublicConfig() {
-		const clientId = String(this.config.googleOidc?.clientIds?.[0] || "").trim();
-		return {
-			configured: Boolean(clientId),
-			...clientId ? { clientId } : {}
-		};
-	}
-	getGithubOAuthPublicConfig() {
-		return githubOAuthPublicConfig(this.config.githubOAuth);
-	}
-	async consumeGoogleEmailOtpRegistrationRateLimitScope(input) {
-		return await this.consumeEmailOtpRateLimit(input);
-	}
-	googleEmailOtpOperationsInput() {
-		return {
-			config: this.config,
-			identityStore: this.stores.getIdentityStore(),
-			registrationAttemptStore: this.stores.getEmailOtpRegistrationAttemptStore(),
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			readConfigValue: this.readConfigValue.bind(this),
-			isProductionEnvironment: this.isProductionEnvironment(),
-			consumeRateLimit: this.consumeGoogleEmailOtpRegistrationRateLimitScope.bind(this)
-		};
-	}
-	async resolveOidcWalletId(input) {
-		return await resolveOidcWalletIdWithGoogleEmailOtp({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async consumeGoogleEmailOtpRegistrationAttemptRateLimit(input) {
-		return await consumeGoogleEmailOtpRegistrationAttemptRateLimitForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async resolveGoogleEmailOtpSession(input) {
-		return await resolveGoogleEmailOtpSessionForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async completeGoogleEmailOtpRegistrationAttempt(input) {
-		return await completeGoogleEmailOtpRegistrationAttemptForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async validateGoogleEmailOtpRegistrationCandidateWallet(input) {
-		return await validateGoogleEmailOtpRegistrationCandidateWalletForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async recordGoogleEmailOtpRegistrationAttemptPublicKey(input) {
-		return await recordGoogleEmailOtpRegistrationAttemptPublicKeyForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async failGoogleEmailOtpRegistrationAttempt(input) {
-		await failGoogleEmailOtpRegistrationAttemptForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async cleanupGoogleEmailOtpDevRegistrationState(input) {
-		return await cleanupGoogleEmailOtpDevRegistrationStateForAuthService({
-			deps: this.googleEmailOtpOperationsInput(),
-			request: input
-		});
-	}
-	async warmRegistrationRuntime() {
-		if (this.registrationRuntimeWarmPromise) return this.registrationRuntimeWarmPromise;
-		this.registrationRuntimeWarmPromise = (async () => {
-			const warmStartedAt = Date.now();
-			const relayerWarmStartedAt = Date.now();
-			await this.getRelayerAccount();
-			this.logger.info(`[AuthService] registration runtime relayer/signer warm completed in ${Date.now() - relayerWarmStartedAt}ms`);
-			const storeWarmStartedAt = Date.now();
-			this.stores.getWebAuthnAuthenticatorStore();
-			this.stores.getWebAuthnCredentialBindingStore();
-			this.stores.getNearPublicKeyStore();
-			this.logger.info(`[AuthService] registration runtime storage warm completed in ${Date.now() - storeWarmStartedAt}ms`);
-			this.logger.info(`[AuthService] registration runtime warm completed in ${Date.now() - warmStartedAt}ms`);
-		})();
-		try {
-			await this.registrationRuntimeWarmPromise;
-		} catch (error) {
-			this.registrationRuntimeWarmPromise = null;
-			throw error;
-		}
-	}
-	async viewAccessKeyList(accountId) {
-		return await this.nearAccounts.viewAccessKeyList(accountId);
-	}
-	async dispatchNearSignedTransactionBorsh(input) {
-		return await this.nearAccounts.dispatchNearSignedTransactionBorsh(input);
-	}
-	getRouterAbNormalSigningRuntime() {
-		const state = this.getRouterAbSigningRuntimeState();
-		return state.kind === "ready" ? state.normalSigning : null;
-	}
-	getRouterAbEcdsaPresignRuntime() {
-		const state = this.getRouterAbSigningRuntimeState();
-		return state.kind === "ready" ? state.ecdsaPresign : null;
-	}
-	getRouterAbSigningRuntimeState() {
-		if (this.routerAbSigningRuntimeState.kind === "uninitialized") if (!this.config.thresholdStore) this.routerAbSigningRuntimeState = { kind: "unconfigured" };
-		else {
-			const runtimes = createRouterAbSigningRuntimes({
-				authService: this,
-				thresholdStore: this.config.thresholdStore,
-				logger: this.logger,
-				isNode: this.isNodeEnvironment()
-			});
-			this.routerAbSigningRuntimeState = {
-				kind: "ready",
-				normalSigning: runtimes.normalSigning,
-				ecdsaPresign: runtimes.ecdsaPresign
-			};
-		}
-		return this.routerAbSigningRuntimeState;
-	}
-	isProductionEnvironment() {
-		return isAuthServiceProductionEnvironment();
-	}
-	readConfigValue(name) {
-		return readAuthServiceConfigValue({
-			thresholdStore: this.config.thresholdStore,
-			name
-		});
-	}
-	resolveEmailOtpRateLimitPolicies() {
-		return resolveEmailOtpRateLimitPolicies({
-			thresholdStore: this.config.thresholdStore,
-			production: this.isProductionEnvironment()
-		});
-	}
-	async consumeEmailOtpRateLimit(args) {
-		return await consumeEmailOtpRateLimit({
-			limiter: this.stores.getEmailOtpRateLimiter(),
-			policies: this.resolveEmailOtpRateLimitPolicies(),
-			scope: args.scope,
-			action: args.action,
-			userId: args.userId,
-			walletId: args.walletId,
-			providerSubject: args.providerSubject,
-			orgId: args.orgId,
-			clientIp: args.clientIp
-		});
-	}
-	resolveEmailOtpConfig() {
-		return resolveEmailOtpConfig({
-			thresholdStore: this.config.thresholdStore,
-			production: this.isProductionEnvironment()
-		});
-	}
-	createEmailOtpShamirCipher() {
-		return createEmailOtpShamirCipherFromConfig({
-			rootSecretB64u: this.readConfigValue("SIGNING_SESSION_SEAL_ROOT_SECRET_B64U"),
-			currentKeyVersion: this.readConfigValue("SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION"),
-			acceptedWarmKeyVersions: this.readConfigValue("SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS").split(",").map((value) => value.trim()).filter(Boolean)
-		});
-	}
-	async deliverEmailOtpCode(input) {
-		return await deliverEmailOtpCode({
-			config: this.resolveEmailOtpConfig(),
-			production: this.isProductionEnvironment(),
-			logger: this.logger,
-			memoryOutbox: this.emailOtpMemoryOutbox,
-			challengeId: input.challengeId,
-			walletId: input.walletId,
-			userId: input.userId,
-			otpChannel: input.otpChannel,
-			action: input.action,
-			operation: input.operation,
-			email: input.email,
-			otpCode: input.otpCode,
-			expiresAtMs: input.expiresAtMs
-		});
-	}
-	identityOperations() {
-		return new IdentityOperations(this.stores.getIdentityStore());
-	}
-	async listIdentities(input) {
-		return await this.identityOperations().listIdentities(input);
-	}
-	async linkIdentity(input) {
-		return await this.identityOperations().linkIdentity(input);
-	}
-	async unlinkIdentity(input) {
-		return await this.identityOperations().unlinkIdentity(input);
-	}
-	async recordNearPublicKeyMetadata(input) {
-		return await recordNearPublicKeyMetadataWithStore({
-			store: this.stores.getNearPublicKeyStore(),
-			logger: this.logger,
-			userId: input.userId,
-			publicKey: input.publicKey,
-			kind: input.kind,
-			signerSlot: input.signerSlot,
-			credentialIdB64u: input.credentialIdB64u,
-			rpId: input.rpId,
-			addedTxHash: input.addedTxHash,
-			removedAtMs: input.removedAtMs,
-			source: input.source
-		});
-	}
-	async txStatus(txHash, senderAccountId) {
-		return await this.nearAccounts.txStatus(txHash, senderAccountId);
-	}
-	async _ensureSignerAndRelayerAccount() {
-		this.runtimeState = await ensureAuthServiceRuntimeReady({
-			state: this.runtimeState,
-			relayerPrivateKey: this.config.relayerPrivateKey,
-			signerWasmOverride: this.config.signerWasm?.moduleOrPath,
-			logger: this.logger
-		});
-	}
-	async ensureSignerWasm() {
-		this.runtimeState = await ensureAuthServiceSignerWasmReady({
-			state: this.runtimeState,
-			signerWasmOverride: this.config.signerWasm?.moduleOrPath,
-			logger: this.logger
-		});
-	}
-	isNodeEnvironment() {
-		return isNodeEnvironment();
-	}
-	/**
-	* ===== Registration & authentication =====
-	*
-	* Helpers for creating accounts, registering WebAuthn credentials,
-	* and verifying authentication responses.
-	*/
-	/**
-	* Create a new account with the specified balance
-	*/
-	async createAccount(request) {
-		return await this.nearAccounts.createAccount(request);
-	}
-	async fundImplicitNearAccount(request) {
-		return await this.nearAccounts.fundImplicitNearAccount(request);
-	}
-	/**
-	* Standard WebAuthn assertion verification for lite flows.
-	*
-	* This verifies:
-	* - the assertion signature against the credential public key stored in relay-private storage,
-	* - the RP ID hash against `rpId`,
-	* - the challenge against `expectedChallenge` (base64url string),
-	* - and that `clientDataJSON.origin` is within the RP ID domain.
-	*
-	* Notes:
-	* - This intentionally does not involve on-chain challenge proofs or `verify_authentication_response`.
-	* - Replay protection is handled by upstream protocol bindings (e.g., unique sessionPolicyDigest32 via sessionId).
-	*/
-	async verifyWebAuthnAuthenticationLite(input) {
-		await this._ensureSignerAndRelayerAccount();
-		return await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: input.userId,
-			rpId: input.rpId,
-			expectedChallenge: input.expectedChallenge,
-			webauthnAuthentication: input.webauthn_authentication,
-			expectedOrigin: input.expected_origin,
-			authenticatorStore: this.stores.getWebAuthnAuthenticatorStore(),
-			logger: this.logger
-		});
-	}
-	/**
-	* List WebAuthn authenticators for the given user.
-	*
-	* This is relay-private state (no on-chain authenticator registry).
-	* Intended for UI surfaces like "Linked Devices" in the SDK.
-	*/
-	async listWebAuthnAuthenticatorsForUser(input) {
-		return await listWebAuthnAuthenticatorsForUserWithStores({
-			userId: input.userId,
-			rpId: String(input.rpId || "").trim(),
-			authenticatorStore: this.stores.getWebAuthnAuthenticatorStore(),
-			credentialBindingStore: this.stores.getWebAuthnCredentialBindingStore()
-		});
-	}
-	async listNearPublicKeysForUser(input) {
-		return await listNearPublicKeysForUserWithStore({
-			store: this.stores.getNearPublicKeyStore(),
-			userId: input.userId
-		});
-	}
-	async createWebAuthnLoginOptions(request) {
-		return await createWebAuthnLoginOptionsWithStore({
-			request,
-			loginChallengeStore: this.stores.getWebAuthnLoginChallengeStore()
-		});
-	}
-	async verifyWebAuthnLogin(request) {
-		return await verifyWebAuthnLoginWithStores({
-			request,
-			loginChallengeStore: this.stores.getWebAuthnLoginChallengeStore(),
-			authenticatorStore: this.stores.getWebAuthnAuthenticatorStore(),
-			credentialBindingStore: this.stores.getWebAuthnCredentialBindingStore(),
-			identityStore: this.stores.getIdentityStore(),
-			logger: this.logger
-		});
-	}
-	async createEmailOtpUnlockChallenge(request) {
-		return await createEmailOtpUnlockChallenge({
-			request,
-			unlockChallengeStore: this.stores.getEmailOtpUnlockChallengeStore(),
-			readActiveEnrollment: this.readActiveEmailOtpEnrollment.bind(this)
-		});
-	}
-	async verifyEmailOtpUnlockProof(request) {
-		return await verifyEmailOtpUnlockProof({
-			request,
-			unlockChallengeStore: this.stores.getEmailOtpUnlockChallengeStore(),
-			readActiveEnrollment: this.readActiveEmailOtpEnrollment.bind(this),
-			putAuthStateForEnrollment: this.putEmailOtpAuthStateForEnrollment.bind(this)
-		});
-	}
-	async readEmailOtpAuthStateForEnrollment(enrollmentRecord) {
-		return await readEmailOtpAuthStateForEnrollmentWithStore({
-			authStateStore: this.stores.getEmailOtpAuthStateStore(),
-			enrollment: enrollmentRecord
-		});
-	}
-	async putEmailOtpAuthStateForEnrollment(enrollmentRecord, patch) {
-		return await putEmailOtpAuthStateForEnrollmentWithStore({
-			authStateStore: this.stores.getEmailOtpAuthStateStore(),
-			enrollment: enrollmentRecord,
-			patch,
-			nowMs: Date.now()
-		});
-	}
-	async createEmailOtpChallengeWithAction(request) {
-		return await createEmailOtpChallengeWithAction({
-			request,
-			challengeStore: this.stores.getEmailOtpChallengeStore(),
-			memoryOutbox: this.emailOtpMemoryOutbox,
-			readActiveEnrollment: this.readActiveEmailOtpEnrollment.bind(this),
-			readEnrollmentAuthState: this.readEmailOtpAuthStateForEnrollment.bind(this),
-			consumeRateLimit: this.consumeEmailOtpRateLimit.bind(this),
-			resolveConfig: this.resolveEmailOtpConfig.bind(this),
-			deliverCode: this.deliverEmailOtpCode.bind(this)
-		});
-	}
-	emailOtpChallengeOperationsInput() {
-		return {
-			createChallengeWithAction: this.createEmailOtpChallengeWithAction.bind(this),
-			verifyChallengeCode: this.verifyEmailOtpChallengeCode.bind(this),
-			grantStore: this.stores.getEmailOtpGrantStore(),
-			resolveConfig: this.resolveEmailOtpConfig.bind(this)
-		};
-	}
-	async createEmailOtpChallenge(request) {
-		return await createEmailOtpChallenge(this.emailOtpChallengeOperationsInput(), request);
-	}
-	async createEmailOtpEnrollmentChallenge(request) {
-		return await createEmailOtpEnrollmentChallenge(this.emailOtpChallengeOperationsInput(), request);
-	}
-	async verifyEmailOtpChallengeCode(request) {
-		return await verifyEmailOtpChallengeCode({
-			request,
-			challengeStore: this.stores.getEmailOtpChallengeStore(),
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			memoryOutbox: this.emailOtpMemoryOutbox,
-			logger: this.logger,
-			readActiveEnrollment: this.readActiveEmailOtpEnrollment.bind(this),
-			readEnrollmentAuthState: this.readEmailOtpAuthStateForEnrollment.bind(this),
-			putEnrollmentAuthState: this.putEmailOtpAuthStateForEnrollment.bind(this),
-			consumeRateLimit: this.consumeEmailOtpRateLimit.bind(this),
-			resolveConfig: this.resolveEmailOtpConfig.bind(this)
-		});
-	}
-	async verifyEmailOtpChallenge(request) {
-		return await verifyEmailOtpChallenge(this.emailOtpChallengeOperationsInput(), request);
-	}
-	async verifyEmailOtpEnrollment(request) {
-		return await verifyEmailOtpEnrollment({
-			request,
-			walletStore: this.stores.getWalletStore(),
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			authStateStore: this.stores.getEmailOtpAuthStateStore(),
-			registrationAttemptStore: this.stores.getEmailOtpRegistrationAttemptStore(),
-			identityStore: this.stores.getIdentityStore(),
-			verifyChallengeCode: this.verifyEmailOtpChallengeCode.bind(this)
-		});
-	}
-	async readEmailOtpEnrollment(request) {
-		return await readEmailOtpEnrollmentWithStore({
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			request
-		});
-	}
-	async readActiveEmailOtpEnrollment(request) {
-		return await readActiveEmailOtpEnrollmentWithStore({
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			request
-		});
-	}
-	async isEmailOtpStrongAuthRequired(request) {
-		return await isEmailOtpStrongAuthRequiredWithStores({
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			authStateStore: this.stores.getEmailOtpAuthStateStore(),
-			request
-		});
-	}
-	async markEmailOtpStrongAuthSatisfied(request) {
-		return await markEmailOtpStrongAuthSatisfiedWithStores({
-			walletEnrollmentStore: this.stores.getEmailOtpWalletEnrollmentStore(),
-			authStateStore: this.stores.getEmailOtpAuthStateStore(),
-			request,
-			nowMs: Date.now()
-		});
-	}
-	async consumeEmailOtpGrant(request) {
-		return await consumeEmailOtpGrantWithStore({
-			request,
-			grantStore: this.stores.getEmailOtpGrantStore(),
-			consumeRateLimit: this.consumeEmailOtpRateLimit.bind(this),
-			nowMs: Date.now()
-		});
-	}
-	async readEmailOtpOutboxEntry(request) {
-		return readEmailOtpOutboxEntry({
-			config: this.resolveEmailOtpConfig(),
-			memoryOutbox: this.emailOtpMemoryOutbox,
-			request,
-			nowMs: Date.now()
-		});
-	}
-	async removeEmailOtpServerSeal(request) {
-		return await runEmailOtpServerSealOperation({
-			operation: "remove-server-seal",
-			request,
-			shamir: this.createEmailOtpShamirCipher()
-		});
-	}
-	async applyEmailOtpServerSeal(request) {
-		return await runEmailOtpServerSealOperation({
-			operation: "apply-server-seal",
-			request,
-			shamir: this.createEmailOtpShamirCipher()
-		});
-	}
-	async verifyGithubOAuthCode(request) {
-		return await verifyGithubOAuthCodeWithIdentityStore({
-			request,
-			config: this.config.githubOAuth,
-			identityStore: this.stores.getIdentityStore()
-		});
-	}
-	async verifyGoogleLogin(request) {
-		return await verifyGoogleLoginWithIdentityStore({
-			request,
-			config: this.config.googleOidc,
-			jwksState: this.googleJwksState,
-			identityStore: this.stores.getIdentityStore()
-		});
-	}
-	async createWebAuthnSyncAccountOptions(request) {
-		return await createWebAuthnSyncAccountOptionsWithStores({
-			request,
-			syncChallengeStore: this.stores.getWebAuthnSyncChallengeStore(),
-			credentialBindingStore: this.stores.getWebAuthnCredentialBindingStore()
-		});
-	}
-	async verifyWebAuthnSyncAccount(request) {
-		return await verifyWebAuthnSyncAccountWithStores({
-			request,
-			syncChallengeStore: this.stores.getWebAuthnSyncChallengeStore(),
-			credentialBindingStore: this.stores.getWebAuthnCredentialBindingStore(),
-			authenticatorStore: this.stores.getWebAuthnAuthenticatorStore(),
-			walletStore: this.stores.getWalletStore(),
-			logger: this.logger
-		});
-	}
-	/**
-	* Account existence helper used by registration flows.
-	*/
-	async checkAccountExists(accountId) {
-		return await this.nearAccounts.checkAccountExists(accountId);
-	}
-	/**
-	* ===== Delegate actions & transaction execution =====
-	*
-	* Flows that build and submit on-chain transactions, including NEP-461
-	* SignedDelegate meta-transactions.
-	*/
-	/**
-	* Execute a NEP-461 SignedDelegate by wrapping it in an outer transaction
-	* from the relayer account. This method is intended to be called by
-	* example relayers (Node/Cloudflare) once a SignedDelegate has been
-	* produced by the signer worker and returned to the application.
-	*
-	* Notes:
-	* - Signature and hash computation are performed by the signer worker.
-	*   This method focuses on expiry/policy enforcement and meta-tx submission.
-	* - Nonce/replay protection is left to the integrator; see docs for guidance.
-	*/
-	async executeSignedDelegate(input) {
-		return await this.nearAccounts.executeSignedDelegate(input);
-	}
-};
-//#endregion
-export { AuthService };
-
-//# sourceMappingURL=AuthService.js.map

package/dist/esm/core/authService/bytes.js

@@ -1,22 +0,0 @@
-import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-//#region src/core/authService/bytes.ts
-function randomBase64Url(bytes) {
-	const data = new Uint8Array(bytes);
-	crypto.getRandomValues(data);
-	return base64UrlEncode(data);
-}
-function randomOpaqueId(byteLength = 16) {
-	return randomBase64Url(byteLength);
-}
-function randomNumericCode(length) {
-	const bytes = new Uint8Array(length);
-	crypto.getRandomValues(bytes);
-	let code = "";
-	for (const byte of bytes) code += String(byte % 10);
-	return code;
-}
-//#endregion
-export { randomBase64Url, randomNumericCode, randomOpaqueId };
-
-//# sourceMappingURL=bytes.js.map

package/dist/esm/core/authService/configValues.js

@@ -1,15 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-//#region src/core/authService/configValues.ts
-function isAuthServiceProductionEnvironment() {
-	return String(globalThis.process?.env?.NODE_ENV || "").trim().toLowerCase() === "production";
-}
-function readAuthServiceConfigValue(input) {
-	const fromStoreConfig = normalizeOptionalTrimmedString(input.thresholdStore?.[input.name]);
-	if (fromStoreConfig) return fromStoreConfig;
-	return normalizeOptionalTrimmedString(globalThis.process?.env?.[input.name]) || "";
-}
-//#endregion
-export { isAuthServiceProductionEnvironment, readAuthServiceConfigValue };
-
-//# sourceMappingURL=configValues.js.map