@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/core/WebAuthnLoginChallengeStore.js

@@ -1,52 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject } from "../shared-ts/src/utils/validation.js";
-import { D1WebAuthnChallengeStore, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema } from "./webAuthnStoreBackends.js";
-//#region src/core/WebAuthnLoginChallengeStore.ts
-const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL = WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL;
-const ensureWebAuthnLoginChallengeStoreD1Schema = ensureWebAuthnChallengeStoreD1Schema;
-function parseWebAuthnLoginChallengeRecord(raw) {
-	if (!isObject(raw)) return null;
-	const version = normalizeOptionalTrimmedString(raw.version);
-	const challengeId = normalizeOptionalTrimmedString(raw.challengeId);
-	const userId = normalizeOptionalTrimmedString(raw.userId);
-	const rpId = normalizeOptionalTrimmedString(raw.rpId);
-	const challengeB64u = normalizeOptionalTrimmedString(raw.challengeB64u);
-	const createdAtMs = typeof raw.createdAtMs === "number" ? raw.createdAtMs : Number(raw.createdAtMs);
-	const expiresAtMs = typeof raw.expiresAtMs === "number" ? raw.expiresAtMs : Number(raw.expiresAtMs);
-	if (version !== "webauthn_login_challenge_v1") return null;
-	if (!challengeId || !userId || !rpId || !challengeB64u) return null;
-	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
-	if (!Number.isFinite(expiresAtMs) || expiresAtMs <= 0) return null;
-	return {
-		version: "webauthn_login_challenge_v1",
-		challengeId,
-		userId,
-		rpId,
-		challengeB64u,
-		createdAtMs: Math.floor(createdAtMs),
-		expiresAtMs: Math.floor(expiresAtMs)
-	};
-}
-const LOGIN_CHALLENGE_STORE = {
-	label: "login challenge",
-	prefixConfigKey: "WEBAUTHN_LOGIN_CHALLENGE_PREFIX",
-	prefixName: "login_challenge",
-	challengeKind: "login",
-	parse: parseWebAuthnLoginChallengeRecord,
-	durableObjectLogSubject: "login challenge persistence",
-	connectionErrorSubject: "webauthn login challenge store",
-	unconfiguredNote: "non-persistent",
-	d1ScopeLabel: "login challenge"
-};
-var D1WebAuthnLoginChallengeStore = class extends D1WebAuthnChallengeStore {
-	constructor(input) {
-		super(input, LOGIN_CHALLENGE_STORE);
-	}
-};
-function createWebAuthnLoginChallengeStore(input) {
-	return createWebAuthnChallengeStore(input, LOGIN_CHALLENGE_STORE, (options) => new D1WebAuthnLoginChallengeStore(options));
-}
-//#endregion
-export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema };
-
-//# sourceMappingURL=WebAuthnLoginChallengeStore.js.map

package/dist/esm/core/WebAuthnSyncChallengeStore.js

@@ -1,54 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject } from "../shared-ts/src/utils/validation.js";
-import { D1WebAuthnChallengeStore, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema } from "./webAuthnStoreBackends.js";
-//#region src/core/WebAuthnSyncChallengeStore.ts
-const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL = WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL;
-const ensureWebAuthnSyncChallengeStoreD1Schema = ensureWebAuthnChallengeStoreD1Schema;
-function parseWebAuthnSyncChallengeRecord(raw) {
-	if (!isObject(raw)) return null;
-	const version = normalizeOptionalTrimmedString(raw.version);
-	const challengeId = normalizeOptionalTrimmedString(raw.challengeId);
-	const rpId = normalizeOptionalTrimmedString(raw.rpId);
-	const expectedUserId = normalizeOptionalTrimmedString(raw.expectedUserId);
-	const challengeB64u = normalizeOptionalTrimmedString(raw.challengeB64u);
-	const createdAtMsRaw = raw.createdAtMs;
-	const expiresAtMsRaw = raw.expiresAtMs;
-	const createdAtMs = typeof createdAtMsRaw === "number" ? createdAtMsRaw : Number(createdAtMsRaw);
-	const expiresAtMs = typeof expiresAtMsRaw === "number" ? expiresAtMsRaw : Number(expiresAtMsRaw);
-	if (version !== "webauthn_sync_challenge_v1") return null;
-	if (!challengeId || !rpId || !challengeB64u) return null;
-	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
-	if (!Number.isFinite(expiresAtMs) || expiresAtMs <= 0) return null;
-	return {
-		version: "webauthn_sync_challenge_v1",
-		challengeId,
-		rpId,
-		...expectedUserId ? { expectedUserId } : {},
-		challengeB64u,
-		createdAtMs: Math.floor(createdAtMs),
-		expiresAtMs: Math.floor(expiresAtMs)
-	};
-}
-const SYNC_CHALLENGE_STORE = {
-	label: "sync challenge",
-	prefixConfigKey: "WEBAUTHN_SYNC_CHALLENGE_PREFIX",
-	prefixName: "sync_challenge",
-	challengeKind: "sync",
-	parse: parseWebAuthnSyncChallengeRecord,
-	durableObjectLogSubject: "sync challenges",
-	connectionErrorSubject: "webauthn store",
-	unconfiguredNote: "no persistence configured",
-	d1ScopeLabel: "sync challenge"
-};
-var D1WebAuthnSyncChallengeStore = class extends D1WebAuthnChallengeStore {
-	constructor(input) {
-		super(input, SYNC_CHALLENGE_STORE);
-	}
-};
-function createWebAuthnSyncChallengeStore(input) {
-	return createWebAuthnChallengeStore(input, SYNC_CHALLENGE_STORE, (options) => new D1WebAuthnSyncChallengeStore(options));
-}
-//#endregion
-export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema };
-
-//# sourceMappingURL=WebAuthnSyncChallengeStore.js.map

package/dist/esm/core/authService/emailOtpConfig.js

@@ -1,200 +1,6 @@
-import { readAuthServiceConfigValue } from "./configValues.js";
 //#region src/core/authService/emailOtpConfig.ts
 const EMAIL_OTP_CODE_LENGTH = 6;
-function readEmailOtpConfigValue(input, name) {
-	return readAuthServiceConfigValue({
-		thresholdStore: input.thresholdStore,
-		name
-	});
-}
-function parseConfiguredInteger(input) {
-	const normalized = String(input.raw || "").trim();
-	if (!normalized) return input.defaultValue;
-	const n = Number(normalized);
-	if (!Number.isFinite(n)) throw new Error(`${input.name} must be a finite number`);
-	if (n < input.min || n > input.max) throw new Error(`${input.name} must be between ${input.min} and ${input.max}`);
-	return Math.floor(n);
-}
-function parseEmailOtpDeliveryMode(raw) {
-	const deliveryModeRaw = raw.toLowerCase();
-	if (!deliveryModeRaw) return "memory";
-	if (deliveryModeRaw === "email_provider" || deliveryModeRaw === "log" || deliveryModeRaw === "memory") return deliveryModeRaw;
-	throw new Error("EMAIL_OTP_DELIVERY_MODE must be one of email_provider, log, or memory");
-}
-function readBooleanFlag(input, name) {
-	const raw = readEmailOtpConfigValue(input, name);
-	if (raw && ![
-		"1",
-		"true",
-		"yes",
-		"on",
-		"0",
-		"false",
-		"no",
-		"off"
-	].includes(raw.toLowerCase())) throw new Error(`${name} must be a boolean flag when provided`);
-	return raw;
-}
-function isTruthyBooleanFlag(raw) {
-	return [
-		"1",
-		"true",
-		"yes",
-		"on"
-	].includes(raw.toLowerCase());
-}
-function resolveEmailOtpRateLimitPolicies(input) {
-	const challengeDefault = input.production ? {
-		limit: 30,
-		windowMs: 6e4
-	} : {
-		limit: 100,
-		windowMs: 6e4
-	};
-	const verifyDefault = input.production ? {
-		limit: 30,
-		windowMs: 6e4
-	} : {
-		limit: 100,
-		windowMs: 6e4
-	};
-	const grantDefault = input.production ? {
-		limit: 30,
-		windowMs: 6e4
-	} : {
-		limit: 100,
-		windowMs: 6e4
-	};
-	const googleRegistrationAttemptDefault = input.production ? {
-		limit: 12,
-		windowMs: 10 * 6e4
-	} : {
-		limit: 200,
-		windowMs: 6e4
-	};
-	return {
-		challenge: {
-			limit: parseConfiguredInteger({
-				name: "EMAIL_OTP_CHALLENGE_RATE_LIMIT_MAX",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_CHALLENGE_RATE_LIMIT_MAX"),
-				defaultValue: challengeDefault.limit,
-				min: 1,
-				max: 500
-			}),
-			windowMs: parseConfiguredInteger({
-				name: "EMAIL_OTP_CHALLENGE_RATE_LIMIT_WINDOW_MS",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_CHALLENGE_RATE_LIMIT_WINDOW_MS"),
-				defaultValue: challengeDefault.windowMs,
-				min: 1e3,
-				max: 1440 * 6e4
-			})
-		},
-		verify: {
-			limit: parseConfiguredInteger({
-				name: "EMAIL_OTP_VERIFY_RATE_LIMIT_MAX",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_VERIFY_RATE_LIMIT_MAX"),
-				defaultValue: verifyDefault.limit,
-				min: 1,
-				max: 1e3
-			}),
-			windowMs: parseConfiguredInteger({
-				name: "EMAIL_OTP_VERIFY_RATE_LIMIT_WINDOW_MS",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_VERIFY_RATE_LIMIT_WINDOW_MS"),
-				defaultValue: verifyDefault.windowMs,
-				min: 1e3,
-				max: 1440 * 6e4
-			})
-		},
-		grant: {
-			limit: parseConfiguredInteger({
-				name: "EMAIL_OTP_GRANT_RATE_LIMIT_MAX",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GRANT_RATE_LIMIT_MAX"),
-				defaultValue: grantDefault.limit,
-				min: 1,
-				max: 1e3
-			}),
-			windowMs: parseConfiguredInteger({
-				name: "EMAIL_OTP_GRANT_RATE_LIMIT_WINDOW_MS",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GRANT_RATE_LIMIT_WINDOW_MS"),
-				defaultValue: grantDefault.windowMs,
-				min: 1e3,
-				max: 1440 * 6e4
-			})
-		},
-		googleRegistrationAttempt: {
-			limit: parseConfiguredInteger({
-				name: "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX"),
-				defaultValue: googleRegistrationAttemptDefault.limit,
-				min: 1,
-				max: 1e3
-			}),
-			windowMs: parseConfiguredInteger({
-				name: "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS",
-				raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS"),
-				defaultValue: googleRegistrationAttemptDefault.windowMs,
-				min: 1e3,
-				max: 1440 * 6e4
-			})
-		}
-	};
-}
-function resolveEmailOtpConfig(input) {
-	const deliveryMode = parseEmailOtpDeliveryMode(readEmailOtpConfigValue(input, "EMAIL_OTP_DELIVERY_MODE"));
-	const devOutboxEnabledRaw = readBooleanFlag(input, "EMAIL_OTP_DEV_OUTBOX_ENABLED");
-	const devOutboxEnabled = deliveryMode === "memory" && !input.production && (devOutboxEnabledRaw ? isTruthyBooleanFlag(devOutboxEnabledRaw) : true);
-	return {
-		deliveryMode,
-		challengeTtlMs: parseConfiguredInteger({
-			name: "EMAIL_OTP_CHALLENGE_TTL_MS",
-			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_CHALLENGE_TTL_MS"),
-			defaultValue: 5 * 6e4,
-			min: 3e4,
-			max: 15 * 6e4
-		}),
-		grantTtlMs: parseConfiguredInteger({
-			name: "EMAIL_OTP_GRANT_TTL_MS",
-			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_GRANT_TTL_MS"),
-			defaultValue: 3e4,
-			min: 1e4,
-			max: 5 * 6e4
-		}),
-		maxAttempts: parseConfiguredInteger({
-			name: "EMAIL_OTP_MAX_ATTEMPTS",
-			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_MAX_ATTEMPTS"),
-			defaultValue: 5,
-			min: 1,
-			max: 10
-		}),
-		lockoutTtlMs: parseConfiguredInteger({
-			name: "EMAIL_OTP_LOCKOUT_TTL_MS",
-			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_LOCKOUT_TTL_MS"),
-			defaultValue: 5 * 6e4,
-			min: 6e4,
-			max: 1440 * 6e4
-		}),
-		codeLength: parseEmailOtpCodeLength(readEmailOtpConfigValue(input, "EMAIL_OTP_CODE_LENGTH")),
-		devOutboxEnabled,
-		maxActiveChallengesPerContext: parseConfiguredInteger({
-			name: "EMAIL_OTP_MAX_ACTIVE_CHALLENGES_PER_CONTEXT",
-			raw: readEmailOtpConfigValue(input, "EMAIL_OTP_MAX_ACTIVE_CHALLENGES_PER_CONTEXT"),
-			defaultValue: 5,
-			min: 1,
-			max: 20
-		})
-	};
-}
-function parseEmailOtpCodeLength(raw) {
-	if (parseConfiguredInteger({
-		name: "EMAIL_OTP_CODE_LENGTH",
-		raw,
-		defaultValue: 6,
-		min: 6,
-		max: 8
-	}) !== 6) throw new Error(`EMAIL_OTP_CODE_LENGTH must be 6`);
-	return 6;
-}
 //#endregion
-export { EMAIL_OTP_CODE_LENGTH, resolveEmailOtpConfig, resolveEmailOtpRateLimitPolicies };
+export { EMAIL_OTP_CODE_LENGTH };
 
 //# sourceMappingURL=emailOtpConfig.js.map

package/dist/esm/core/authService/emailOtpEnrollment.js

@@ -1,110 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-//#region src/core/authService/emailOtpEnrollment.ts
-async function readEmailOtpEnrollmentWithStore(input) {
-	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	const orgId = normalizeOptionalTrimmedString(input.request.orgId);
-	if (!walletId) return failure("invalid_body", "Missing walletId");
-	if (!orgId) return failure("invalid_body", "Missing orgId");
-	const enrollment = await input.walletEnrollmentStore.get(walletId);
-	if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
-	if (enrollment.orgId !== orgId) return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
-	return {
-		ok: true,
-		enrollment
-	};
-}
-async function readActiveEmailOtpEnrollmentWithStore(input) {
-	const result = await readEmailOtpEnrollmentWithStore(input);
-	if (!result.ok) return result;
-	const providerUserId = normalizeOptionalTrimmedString(input.request.providerUserId);
-	if (providerUserId && result.enrollment.providerUserId !== providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
-	return result;
-}
-async function readEmailOtpAuthStateForEnrollmentWithStore(input) {
-	const state = await input.authStateStore.get(input.enrollment.walletId);
-	if (!state) return {
-		ok: true,
-		state: null
-	};
-	if (state.orgId !== input.enrollment.orgId || state.providerUserId !== input.enrollment.providerUserId) return failure("auth_state_enrollment_mismatch", "Email OTP auth state does not match the active enrollment");
-	return {
-		ok: true,
-		state
-	};
-}
-async function putEmailOtpAuthStateForEnrollmentWithStore(input) {
-	const existing = await input.authStateStore.get(input.enrollment.walletId);
-	if (existing && (existing.orgId !== input.enrollment.orgId || existing.providerUserId !== input.enrollment.providerUserId)) throw new Error("Email OTP auth state does not match the active enrollment");
-	const next = {
-		version: "email_otp_auth_state_v1",
-		walletId: input.enrollment.walletId,
-		providerUserId: input.enrollment.providerUserId,
-		orgId: input.enrollment.orgId,
-		createdAtMs: existing?.createdAtMs ?? input.nowMs,
-		updatedAtMs: input.nowMs,
-		...existing?.otpFailureCount != null ? { otpFailureCount: existing.otpFailureCount } : {},
-		...existing?.lastOtpFailureAtMs ? { lastOtpFailureAtMs: existing.lastOtpFailureAtMs } : {},
-		...existing?.otpLockedUntilMs ? { otpLockedUntilMs: existing.otpLockedUntilMs } : {},
-		...existing?.lastEmailOtpLoginAtMs ? { lastEmailOtpLoginAtMs: existing.lastEmailOtpLoginAtMs } : {},
-		...existing?.lastStrongAuthAtMs ? { lastStrongAuthAtMs: existing.lastStrongAuthAtMs } : {},
-		...input.patch
-	};
-	await input.authStateStore.put(next);
-	return next;
-}
-async function isEmailOtpStrongAuthRequiredWithStores(input) {
-	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	if (!walletId) return failure("invalid_body", "Missing walletId");
-	const enrollment = await input.walletEnrollmentStore.get(walletId);
-	if (!enrollment) return {
-		ok: true,
-		required: false,
-		walletId
-	};
-	const authState = await readEmailOtpAuthStateForEnrollmentWithStore({
-		authStateStore: input.authStateStore,
-		enrollment
-	});
-	if (!authState.ok) return authState;
-	const state = authState.state;
-	if (!state) return {
-		ok: true,
-		required: false,
-		walletId
-	};
-	const lastEmailOtpLoginAtMs = typeof state.lastEmailOtpLoginAtMs === "number" ? state.lastEmailOtpLoginAtMs : void 0;
-	const lastStrongAuthAtMs = typeof state.lastStrongAuthAtMs === "number" ? state.lastStrongAuthAtMs : void 0;
-	return {
-		ok: true,
-		required: Boolean(lastEmailOtpLoginAtMs && (!lastStrongAuthAtMs || lastEmailOtpLoginAtMs > lastStrongAuthAtMs)),
-		walletId,
-		...lastEmailOtpLoginAtMs ? { lastEmailOtpLoginAtMs } : {},
-		...lastStrongAuthAtMs ? { lastStrongAuthAtMs } : {}
-	};
-}
-async function markEmailOtpStrongAuthSatisfiedWithStores(input) {
-	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	if (!walletId) return failure("invalid_body", "Missing walletId");
-	const enrollment = await input.walletEnrollmentStore.get(walletId);
-	if (!enrollment) return {
-		ok: true,
-		walletId
-	};
-	await putEmailOtpAuthStateForEnrollmentWithStore({
-		authStateStore: input.authStateStore,
-		enrollment,
-		patch: { lastStrongAuthAtMs: input.nowMs },
-		nowMs: input.nowMs
-	});
-	return {
-		ok: true,
-		walletId,
-		lastStrongAuthAtMs: input.nowMs
-	};
-}
-//#endregion
-export { isEmailOtpStrongAuthRequiredWithStores, markEmailOtpStrongAuthSatisfiedWithStores, putEmailOtpAuthStateForEnrollmentWithStore, readActiveEmailOtpEnrollmentWithStore, readEmailOtpAuthStateForEnrollmentWithStore, readEmailOtpEnrollmentWithStore };
-
-//# sourceMappingURL=emailOtpEnrollment.js.map

package/dist/esm/core/authService/emailOtpSeal.js

@@ -1,63 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { createSigningSessionSealShamir3PassCipherAdapter } from "../../threshold/session/signingSessionSeal/crypto/cipher.js";
-import { parseSigningSessionSealRootConfig } from "../../threshold/session/signingSessionSeal/options.js";
-import "../../threshold/session/signingSessionSeal/index.js";
-//#region src/core/authService/emailOtpSeal.ts
-function createEmailOtpShamirCipherFromConfig(input) {
-	if (!input.rootSecretB64u || !input.currentKeyVersion) return failure("not_configured", "Email OTP unseal requires a signing-session seal root and current key version");
-	try {
-		const config = parseSigningSessionSealRootConfig({
-			rootSecretB64u: input.rootSecretB64u,
-			currentKeyVersion: input.currentKeyVersion,
-			acceptedWarmKeyVersions: input.acceptedWarmKeyVersions
-		});
-		return {
-			ok: true,
-			keyVersion: config.currentKeyVersion,
-			cipher: createSigningSessionSealShamir3PassCipherAdapter({ config })
-		};
-	} catch (error) {
-		return failure("not_configured", errorMessage(error) || "Email OTP Shamir configuration is invalid");
-	}
-}
-function emailOtpServerSealThresholdSessionId(operation) {
-	switch (operation) {
-		case "apply-server-seal": return "email-otp-enroll";
-		case "remove-server-seal": return "email-otp-unseal";
-	}
-}
-function emailOtpServerSealFailureMessage(operation) {
-	switch (operation) {
-		case "apply-server-seal": return "Failed to apply Email OTP server seal";
-		case "remove-server-seal": return "Failed to remove Email OTP server seal";
-	}
-}
-async function runEmailOtpServerSealOperation(input) {
-	try {
-		const wrappedCiphertext = normalizeOptionalTrimmedString(input.request.wrappedCiphertext);
-		if (!wrappedCiphertext) return failure("invalid_body", "Missing wrappedCiphertext");
-		if (!input.shamir.ok) return input.shamir;
-		const result = await input.shamir.cipher.run({
-			operation: input.operation,
-			thresholdSessionId: emailOtpServerSealThresholdSessionId(input.operation),
-			ciphertext: wrappedCiphertext,
-			keyVersion: input.shamir.keyVersion,
-			auth: { userId: "email_otp" }
-		});
-		if (!result.ok) return result;
-		return {
-			ok: true,
-			ciphertext: result.ciphertext,
-			enrollmentSealKeyVersion: result.keyVersion || input.shamir.keyVersion
-		};
-	} catch (error) {
-		return failure("internal", errorMessage(error) || emailOtpServerSealFailureMessage(input.operation));
-	}
-}
-//#endregion
-export { createEmailOtpShamirCipherFromConfig, runEmailOtpServerSealOperation };
-
-//# sourceMappingURL=emailOtpSeal.js.map

package/dist/esm/core/authService/nearTransactions.js

@@ -1,67 +1,11 @@
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
-import "../../shared-ts/src/utils/validation.js";
-import { toError } from "../../shared-ts/src/utils/errors.js";
+import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
+import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./nearPrivateKeySigning.js";
 import { SignedTransaction } from "../../shared-ts/src/near/nearClient.js";
 import "../rpcClients/near/NearClient.js";
-import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./nearPrivateKeySigning.js";
-import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../../wasm/near_signer/pkg/wasm_signer_worker.js";
 //#region src/core/authService/nearTransactions.ts
-function nearAccountNotFound(message) {
-	return /does not exist|UNKNOWN_ACCOUNT|unknown\s+account/i.test(message);
-}
-function retryableNearAccountLookupError(message) {
-	return /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed/i.test(message);
-}
-function errorDetailsBlob(error) {
-	const details = error.details;
-	if (!details) return "";
-	try {
-		return typeof details === "string" ? details : JSON.stringify(details);
-	} catch {
-		return "";
-	}
-}
-function accountLookupRetryDelayMs(attemptNumber) {
-	return 150 * Math.pow(2, attemptNumber - 1);
-}
-function delay(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function normalizedExpectedEd25519PublicKeys(expectedPublicKeys) {
-	return Array.from(new Set(expectedPublicKeys.map((key) => ensureEd25519Prefix(key)).filter(Boolean)));
-}
-function accessKeyPublicKeys(accessKeyList) {
-	return accessKeyList.keys.map((key) => ensureEd25519Prefix(String(key?.public_key || "").trim())).filter(Boolean);
-}
-async function viewAccessKeyListWithClient(input) {
-	return await input.nearClient.viewAccessKeyList(input.accountId);
-}
-async function dispatchNearSignedTransactionBorshWithClient(input) {
-	const signedTransactionBorsh = base64UrlDecode(input.signedTransactionBorshB64u);
-	const signedTransaction = SignedTransaction.fromPlain({
-		transaction: {},
-		signature: {},
-		borsh_bytes: Array.from(signedTransactionBorsh)
-	});
-	return { rpcResult: await input.nearClient.sendTransaction(signedTransaction) };
-}
-async function fetchNearTxContextWithClient(input) {
-	let nonce = 0n;
-	try {
-		const accessKey = await input.nearClient.viewAccessKey(input.accountId, input.publicKey);
-		nonce = BigInt(accessKey?.nonce ?? 0);
-	} catch {
-		nonce = 0n;
-	}
-	const block = await input.nearClient.viewBlock({ finality: "final" });
-	return {
-		nextNonce: (nonce + 1n).toString(),
-		blockHash: block.header.hash
-	};
-}
 async function signGasRelayerNearTransactionWithDeps(input) {
 	await input.ensureSignerWasm();
 	const signerPublicKey = toPublicKeyStringFromSecretKey(input.relayerPrivateKey);
@@ -95,46 +39,7 @@ async function signGasRelayerNearTransactionWithDeps(input) {
 		borsh_bytes: Array.from(base64UrlDecode(finalized.signedTransactionBorshB64u))
 	});
 }
-async function checkNearAccountExistsWithClient(input) {
-	const attempts = 3;
-	let lastError = null;
-	for (let attempt = 1; attempt <= attempts; attempt += 1) try {
-		const view = await input.nearClient.viewAccount(input.accountId);
-		return Boolean(view);
-	} catch (error) {
-		const parsedError = toError(error);
-		lastError = parsedError;
-		const message = parsedError.message;
-		if (nearAccountNotFound(`${message}\n${errorDetailsBlob(parsedError)}`)) return false;
-		if (retryableNearAccountLookupError(message) && attempt < attempts) {
-			await delay(accountLookupRetryDelayMs(attempt));
-			continue;
-		}
-		if (retryableNearAccountLookupError(message)) {
-			input.logger.warn(`[AuthService] Assuming account '${input.accountId}' not found after retryable RPC errors:`, message);
-			return false;
-		}
-		input.logger.error(`Error checking account existence for ${input.accountId}:`, parsedError);
-		throw parsedError;
-	}
-	throw lastError || /* @__PURE__ */ new Error("Unknown error");
-}
-async function verifyAccountAccessKeysPresentWithClient(input) {
-	const expectedPublicKeys = normalizedExpectedEd25519PublicKeys(input.expectedPublicKeys);
-	if (!expectedPublicKeys.length) return false;
-	const attempts = Math.max(1, Math.floor(input.options?.attempts ?? 4));
-	const delayMs = Math.max(50, Math.floor(input.options?.delayMs ?? 250));
-	const finality = input.options?.finality ?? "final";
-	for (let attempt = 0; attempt < attempts; attempt += 1) {
-		try {
-			const actualPublicKeys = accessKeyPublicKeys(await input.nearClient.viewAccessKeyList(input.accountId, { finality }));
-			if (expectedPublicKeys.every((expected) => actualPublicKeys.includes(expected))) return true;
-		} catch {}
-		if (attempt < attempts - 1) await delay(delayMs);
-	}
-	return false;
-}
 //#endregion
-export { checkNearAccountExistsWithClient, dispatchNearSignedTransactionBorshWithClient, fetchNearTxContextWithClient, signGasRelayerNearTransactionWithDeps, verifyAccountAccessKeysPresentWithClient, viewAccessKeyListWithClient };
+export { signGasRelayerNearTransactionWithDeps };
 
 //# sourceMappingURL=nearTransactions.js.map

package/dist/esm/core/authService/rateLimits.js

@@ -1,84 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { readAuthServiceConfigValue } from "./configValues.js";
-import { resolveSigningSessionSealRateLimitFromEnv } from "../../threshold/session/signingSessionSeal/guards/backends.js";
-import "../../threshold/session/signingSessionSeal/index.js";
-//#region src/core/authService/rateLimits.ts
-function readRateLimitConfigValue(input) {
-	return readAuthServiceConfigValue({
-		thresholdStore: input.thresholdStore,
-		name: input.name
-	});
-}
-function parseRateLimiterKind(input) {
-	const value = normalizeOptionalTrimmedString(input.raw).toLowerCase();
-	if (!value) return null;
-	switch (value) {
-		case "in-memory":
-		case "upstash-redis-rest":
-		case "redis-tcp": return value;
-	}
-	throw new Error(`${input.name} must be one of in-memory, upstash-redis-rest, or redis-tcp`);
-}
-function createEmailOtpRateLimiter(input) {
-	const thresholdStore = input.thresholdStore;
-	return resolveSigningSessionSealRateLimitFromEnv({
-		limiterKind: parseRateLimiterKind({
-			raw: readRateLimitConfigValue({
-				thresholdStore,
-				name: "EMAIL_OTP_RATE_LIMITER_KIND"
-			}),
-			name: "EMAIL_OTP_RATE_LIMITER_KIND"
-		}),
-		upstashUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_URL"
-		}) || null,
-		upstashToken: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_TOKEN"
-		}) || null,
-		redisUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_REDIS_URL"
-		}) || null,
-		keyPrefix: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_KEY_PREFIX"
-		}) || "email-otp:v2:",
-		limit: 1,
-		windowMs: 1
-	}).limiter;
-}
-function consumedRateLimitError(message, consumed) {
-	const result = failure("rate_limited", message);
-	if (typeof consumed.retryAfterMs === "number") result.retryAfterMs = consumed.retryAfterMs;
-	if (typeof consumed.resetAtMs === "number") result.resetAtMs = consumed.resetAtMs;
-	return result;
-}
-async function consumeEmailOtpRateLimit(input) {
-	const policy = input.policies[input.scope];
-	const keySuffix = `scope=${input.scope}:action=${input.action || "default"}:limit=${policy.limit}:windowMs=${policy.windowMs}`;
-	const keys = [
-		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
-		input.userId ? `${keySuffix}:user:${input.userId}` : "",
-		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
-		input.providerSubject ? `${keySuffix}:providerSubject:${input.providerSubject}` : "",
-		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
-	].filter(Boolean);
-	for (const key of keys) {
-		const consumed = await input.limiter.consume({
-			key,
-			limit: policy.limit,
-			windowMs: policy.windowMs,
-			nowMs: Date.now()
-		});
-		if (!consumed.ok) return consumedRateLimitError("Email OTP rate limit exceeded", consumed);
-	}
-	return { ok: true };
-}
-//#endregion
-export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter };
-
-//# sourceMappingURL=rateLimits.js.map