@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/core/authService/webauthn.js

@@ -1,17 +1,9 @@
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
-import { parseWebAuthnAuthenticationCredential } from "../../router/auth/webAuthnCredentialCodecs.js";
-import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "./webauthnVerificationOutcomes.js";
-import { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding } from "./webauthnWalletBinding.js";
-import { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId } from "./webauthnAuthority.js";
 //#region src/core/authService/webauthn.ts
 function readRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -22,18 +14,6 @@ function readNestedRecord(record, key) {
 function readStringField(record, key) {
 	return typeof record[key] === "string" ? record[key].trim() : "";
 }
-function normalizeWebAuthnTtlMs(raw) {
-	const numeric = typeof raw === "number" ? raw : Number(raw);
-	if (!Number.isFinite(numeric) || numeric <= 0) return 5 * 6e4;
-	return Math.min(Math.max(Math.floor(numeric), 1e4), 10 * 6e4);
-}
-function ensureCryptoRandomValues() {
-	if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") return true;
-	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
-}
-function randomWebAuthnB64u(byteLength) {
-	return base64UrlEncode(crypto.getRandomValues(new Uint8Array(byteLength)));
-}
 function credentialRawIdB64u(credential) {
 	const credentialId = credential.id.trim();
 	const chosen = credential.rawId.trim() || credentialId;
@@ -109,40 +89,6 @@ function registrationCredentialCounter(counter) {
 	const numeric = typeof counter === "number" ? counter : Number(counter);
 	return Number.isFinite(numeric) && numeric >= 0 ? Math.floor(numeric) : 0;
 }
-function authenticatorListEntry(input) {
-	return {
-		credentialIdB64u: input.binding.credentialIdB64u,
-		signerSlot: input.binding.signerSlot,
-		publicKey: input.binding.publicKey,
-		createdAtMs: input.authenticator?.createdAtMs ?? input.binding.createdAtMs,
-		updatedAtMs: input.authenticator?.updatedAtMs ?? input.binding.updatedAtMs,
-		device: input.authenticator?.deviceInfo ?? unknownWebAuthnAuthenticatorDeviceInfo()
-	};
-}
-function compareAuthenticatorListEntries(left, right) {
-	return (Number(left.signerSlot || 0) || 0) - (Number(right.signerSlot || 0) || 0);
-}
-async function listCredentialBindingsForUser(input) {
-	if (!input.bindingStore.listByUserId) return {
-		ok: false,
-		code: "not_supported",
-		message: "Credential binding listing is not supported by this store"
-	};
-	return {
-		ok: true,
-		bindings: input.rpId ? await input.bindingStore.listByUserId({
-			userId: input.userId,
-			rpId: input.rpId
-		}) : await input.bindingStore.listByUserId({ userId: input.userId })
-	};
-}
-function ignoreIdentityLinkFailure() {}
-async function linkNearSubjectForWebAuthnLogin(input) {
-	await input.identityStore.linkSubjectToUserId({
-		userId: input.userId,
-		subject: `near:${input.userId}`
-	}).catch(ignoreIdentityLinkFailure);
-}
 async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	const credential = readRecord(input.webauthnRegistration);
 	if (!credential) return failure("invalid_body", "Missing webauthn_registration");
@@ -309,249 +255,7 @@ async function verifyWebAuthnAuthenticationLiteWithStore(input) {
 		};
 	}
 }
-async function listWebAuthnAuthenticatorsForUserWithStores(input) {
-	try {
-		const userId = String(input.userId || "").trim();
-		const rpId = String(input.rpId || "").trim();
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!input.authenticatorStore.list) return failure("not_supported", "Authenticator listing is not supported by this store");
-		const bindingList = await listCredentialBindingsForUser({
-			bindingStore: input.credentialBindingStore,
-			userId,
-			rpId
-		});
-		if (!bindingList.ok) return bindingList;
-		const [authenticators, bindings] = await Promise.all([input.authenticatorStore.list(userId), Promise.resolve(bindingList.bindings)]);
-		const authByCredentialId = /* @__PURE__ */ new Map();
-		for (const authenticator of authenticators) authByCredentialId.set(String(authenticator.credentialIdB64u || "").trim(), authenticator);
-		const merged = [];
-		for (const binding of bindings) merged.push(authenticatorListEntry({
-			binding: {
-				credentialIdB64u: String(binding.credentialIdB64u || "").trim(),
-				signerSlot: binding.signerSlot,
-				publicKey: binding.publicKey,
-				createdAtMs: binding.createdAtMs,
-				updatedAtMs: binding.updatedAtMs
-			},
-			authenticator: authByCredentialId.get(String(binding.credentialIdB64u || "").trim())
-		}));
-		merged.sort(compareAuthenticatorListEntries);
-		return {
-			ok: true,
-			authenticators: merged
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to list authenticators");
-	}
-}
-async function createWebAuthnLoginOptionsWithStore(input) {
-	try {
-		const userIdRaw = String(input.request.userId ?? input.request.user_id ?? "").trim();
-		const rpId = String(input.request.rpId ?? input.request.rp_id ?? "").trim();
-		if (!userIdRaw) return failure("invalid_body", "Missing userId");
-		const userId = parseBoundaryWalletId(userIdRaw);
-		if (!userId) return failure("invalid_body", "Invalid userId");
-		if (!rpId) return failure("invalid_body", "Missing rpId");
-		const randomAvailable = ensureCryptoRandomValues();
-		if (randomAvailable !== true) return randomAvailable;
-		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + ttlMsClamped;
-		const challengeId = randomWebAuthnB64u(16);
-		const challengeB64u = randomWebAuthnB64u(32);
-		await input.loginChallengeStore.put({
-			version: "webauthn_login_challenge_v1",
-			challengeId,
-			userId,
-			rpId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		});
-		return {
-			ok: true,
-			challengeId,
-			challengeB64u,
-			expiresAtMs
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to create login options");
-	}
-}
-async function createWebAuthnSyncAccountOptionsWithStores(input) {
-	try {
-		const rpId = String(input.request.rp_id || "").trim();
-		if (!rpId) return failure("invalid_body", "Missing rp_id");
-		const expectedUserIdRaw = normalizeOptionalTrimmedString(input.request.account_id);
-		const expectedUserId = expectedUserIdRaw ? parseBoundaryWalletId(expectedUserIdRaw) : null;
-		if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
-		const randomAvailable = ensureCryptoRandomValues();
-		if (randomAvailable !== true) return randomAvailable;
-		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + ttlMsClamped;
-		const challengeId = randomWebAuthnB64u(16);
-		const challengeB64u = randomWebAuthnB64u(32);
-		let credentialIds;
-		let walletBinding;
-		if (expectedUserId) {
-			const bindingList = await listCredentialBindingsForUser({
-				bindingStore: input.credentialBindingStore,
-				userId: expectedUserId,
-				rpId
-			});
-			if (!bindingList.ok) return bindingList;
-			const resolvedBinding = bindingList.bindings.find((binding) => {
-				return Boolean(binding.userId && binding.nearAccountId && binding.nearEd25519SigningKeyId);
-			});
-			if (resolvedBinding) walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding: resolvedBinding }) ?? void 0;
-			const seen = /* @__PURE__ */ new Set();
-			credentialIds = [];
-			for (const binding of bindingList.bindings) {
-				const credentialId = String(binding.credentialIdB64u || "").trim();
-				if (!credentialId || seen.has(credentialId)) continue;
-				seen.add(credentialId);
-				credentialIds.push(credentialId);
-			}
-		}
-		const record = expectedUserId ? {
-			version: "webauthn_sync_challenge_v1",
-			challengeId,
-			rpId,
-			expectedUserId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		} : {
-			version: "webauthn_sync_challenge_v1",
-			challengeId,
-			rpId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		};
-		await input.syncChallengeStore.put(record);
-		const result = {
-			ok: true,
-			challengeId,
-			challengeB64u,
-			expiresAtMs
-		};
-		if (credentialIds) result.credentialIds = credentialIds;
-		if (walletBinding) result.walletBinding = walletBinding;
-		return result;
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to create sync account options");
-	}
-}
-async function verifyWebAuthnSyncAccountWithStores(input) {
-	try {
-		const request = input.request;
-		const challengeId = String(request.challengeId ?? request.challenge_id ?? "").trim();
-		if (!challengeId) return failure("invalid_body", "Missing challengeId");
-		const challenge = await input.syncChallengeStore.consume(challengeId);
-		if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
-		const credential = request.webauthn_authentication;
-		const credentialId = credentialRawIdB64u(credential);
-		if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
-		const syncBinding = webAuthnSyncCredentialBinding(await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u), challenge);
-		if (!syncBinding.ok) return syncBinding;
-		const binding = syncBinding.binding;
-		const expectedOrigin = normalizeOptionalTrimmedString(request.expected_origin);
-		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
-		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: binding.userId,
-			rpId: requireWebAuthnRpId(binding.rpId, "sync credential binding rpId"),
-			expectedChallenge: challenge.challengeB64u,
-			webauthnAuthentication: credential,
-			expectedOrigin,
-			authenticatorStore: input.authenticatorStore,
-			logger: input.logger
-		}));
-		if (verificationFailure) return verificationFailure;
-		const auth = await input.authenticatorStore.get(binding.userId, credentialId.credentialIdB64u);
-		if (!auth) return failedVerification("unknown_credential", "Credential is not registered for user");
-		const walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding });
-		const bindingPublicKey = binding.publicKey;
-		if (!walletBinding || !bindingPublicKey) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
-		const ed25519Signer = await input.walletStore.getEd25519SignerBySlot({
-			walletId: walletIdFromString(walletBinding.walletId),
-			signerSlot: walletBinding.signerSlot
-		});
-		if (!ed25519Signer) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
-		const walletBindingAuthorityScope = passkeyThresholdEd25519AuthorityScope(requireWebAuthnRpId(walletBinding.rpId, "sync credential binding rpId"));
-		const thresholdEd25519 = binding.relayerKeyId ? {
-			relayerKeyId: binding.relayerKeyId,
-			authorityScope: walletBindingAuthorityScope,
-			publicKey: bindingPublicKey,
-			...binding.keyVersion ? { keyVersion: binding.keyVersion } : {},
-			...typeof binding.recoveryExportCapable === "boolean" ? { recoveryExportCapable: binding.recoveryExportCapable } : {},
-			...typeof binding.clientParticipantId === "number" ? { clientParticipantId: binding.clientParticipantId } : {},
-			...typeof binding.relayerParticipantId === "number" ? { relayerParticipantId: binding.relayerParticipantId } : {},
-			...Array.isArray(binding.participantIds) ? { participantIds: binding.participantIds } : {}
-		} : void 0;
-		return {
-			ok: true,
-			verified: true,
-			accountId: walletBinding.walletId,
-			walletId: walletBinding.walletId,
-			nearAccountId: walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-			custodyKeyManifestDigestB64u: parseDigestB64u(ed25519Signer.custodyKeyManifestDigestB64u),
-			walletBinding,
-			rpId: walletBinding.rpId,
-			signerSlot: walletBinding.signerSlot,
-			publicKey: bindingPublicKey,
-			...binding.relayerKeyId ? { relayerKeyId: binding.relayerKeyId } : {},
-			credentialIdB64u: credentialId.credentialIdB64u,
-			credentialPublicKeyB64u: auth.credentialPublicKeyB64u,
-			...thresholdEd25519 ? { thresholdEd25519 } : {}
-		};
-	} catch (e) {
-		return failedVerification("internal", errorMessage(e) || "Sync verification failed");
-	}
-}
-async function verifyWebAuthnLoginWithStores(input) {
-	try {
-		const challengeId = String(input.request.challengeId ?? input.request.challenge_id ?? "").trim();
-		if (!challengeId) return failure("invalid_body", "Missing challengeId");
-		const record = await input.loginChallengeStore.consume(challengeId);
-		if (!record) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
-		const expectedOrigin = normalizeOptionalTrimmedString(input.request.expected_origin);
-		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
-		const credential = parseWebAuthnAuthenticationCredential(input.request.webauthn_authentication);
-		if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
-		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: record.userId,
-			rpId: requireWebAuthnRpId(record.rpId, "login challenge rpId"),
-			expectedChallenge: record.challengeB64u,
-			webauthnAuthentication: credential,
-			expectedOrigin,
-			authenticatorStore: input.authenticatorStore,
-			logger: input.logger
-		}));
-		if (verificationFailure) return verificationFailure;
-		const credentialIdB64u = String(credential.rawId || credential.id || "").trim();
-		const binding = credentialIdB64u ? await input.credentialBindingStore.get(record.rpId, credentialIdB64u) : null;
-		const loginSigner = webAuthnLoginEd25519(binding, binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null);
-		if (!loginSigner.ok) return loginSigner;
-		await linkNearSubjectForWebAuthnLogin({
-			identityStore: input.identityStore,
-			userId: record.userId
-		});
-		return {
-			ok: true,
-			verified: true,
-			userId: record.userId,
-			rpId: record.rpId,
-			credentialIdB64u,
-			ed25519: loginSigner.ed25519
-		};
-	} catch (e) {
-		return failedVerification("internal", errorMessage(e) || "Login verification failed");
-	}
-}
 //#endregion
-export { createWebAuthnLoginOptionsWithStore, createWebAuthnSyncAccountOptionsWithStores, listWebAuthnAuthenticatorsForUserWithStores, verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnLoginWithStores, verifyWebAuthnRegistrationCredentialForIntent, verifyWebAuthnSyncAccountWithStores };
+export { verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnRegistrationCredentialForIntent };
 
 //# sourceMappingURL=webauthn.js.map

package/dist/esm/core/authService/webauthnOidcHelpers.js

@@ -57,30 +57,7 @@ function isHostWithinRpId(host, rpId) {
 	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
 	return h === r || h.endsWith(`.${r}`);
 }
-function parseCacheControlMaxAgeSec(cacheControl) {
-	const s = String(cacheControl || "").trim();
-	if (!s) return null;
-	const m = s.match(/(?:^|,)\s*max-age=(\d+)\s*(?:,|$)/i);
-	if (!m) return null;
-	const n = Number(m[1]);
-	if (!Number.isFinite(n) || n <= 0) return null;
-	return Math.floor(n);
-}
-function parseJwtSegmentJson(input) {
-	try {
-		const raw = new TextDecoder().decode(base64UrlDecode(input));
-		const parsed = raw ? JSON.parse(raw) : null;
-		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-function parseJwtAud(input) {
-	if (Array.isArray(input)) return input.map((v) => typeof v === "string" ? v.trim() : "").filter(Boolean);
-	const single = String(input || "").trim();
-	return single ? [single] : [];
-}
 //#endregion
-export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
+export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url };
 
 //# sourceMappingURL=webauthnOidcHelpers.js.map

package/dist/esm/core/authService/webauthnWalletBinding.js

@@ -1,37 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
-//#region src/core/authService/webauthnWalletBinding.ts
-function parseBoundaryWalletId(raw) {
-	const value = normalizeOptionalTrimmedString(raw);
-	if (!value) return null;
-	try {
-		return String(walletIdFromString(value));
-	} catch {
-		return null;
-	}
-}
-/**
-* Returns `null` when the binding carries no Ed25519 identity, which is the
-* valid state for a wallet whose Ed25519 Yao ceremony has not settled yet.
-* Callers must surface that as a typed "not provisioned" outcome rather than
-* treating it as a missing credential.
-*/
-function resolvedEd25519WalletBindingFromCredentialBinding(args) {
-	const { nearAccountId, nearEd25519SigningKeyId } = args.binding;
-	if (!nearAccountId || !nearEd25519SigningKeyId) return null;
-	const resolvedSignerSlot = Number.isSafeInteger(args.signerSlot) && Number(args.signerSlot) > 0 ? Math.floor(Number(args.signerSlot)) : args.binding.signerSlot;
-	if (!Number.isSafeInteger(resolvedSignerSlot) || Number(resolvedSignerSlot) < 1) return null;
-	return {
-		walletId: args.binding.userId,
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		rpId: args.binding.rpId,
-		credentialIdB64u: args.binding.credentialIdB64u,
-		signerSlot: Number(resolvedSignerSlot)
-	};
-}
-//#endregion
-export { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding };
-
-//# sourceMappingURL=webauthnWalletBinding.js.map

package/dist/esm/core/config.js

@@ -1,98 +1,4 @@
-import { normalizeOptionalTrimmedString, normalizeTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import { THRESHOLD_DO_OBJECT_NAME_DEFAULT } from "./defaultConfigsServer.js";
 //#region src/core/config.ts
-const AUTH_SERVICE_CONFIG_DEFAULTS = {
-	nearRpcUrlTestnet: "https://rpc.testnet.fastnear.com",
-	nearRpcUrlMainnet: "https://rpc.mainnet.near.org",
-	networkId: "testnet",
-	accountInitialBalance: "30000000000000000000000",
-	createAccountAndRegisterGas: "85000000000000"
-};
-function defaultNearRpcUrl(networkId) {
-	if (String(networkId || "").trim().toLowerCase() === "mainnet") return AUTH_SERVICE_CONFIG_DEFAULTS.nearRpcUrlMainnet;
-	return AUTH_SERVICE_CONFIG_DEFAULTS.nearRpcUrlTestnet;
-}
-function parseCsv(input) {
-	return String(input || "").split(",").map((s) => s.trim()).filter(Boolean);
-}
-function normalizeGoogleOidcConfig(input) {
-	if (!input) return void 0;
-	if (typeof input === "object" && !Array.isArray(input) && Array.isArray(input.clientIds)) {
-		const clientIds = Array.from(new Set(input.clientIds.map((v) => String(v || "").trim()).filter(Boolean)));
-		if (!clientIds.length) return void 0;
-		const hostedDomains = Array.isArray(input.hostedDomains) ? Array.from(new Set(input.hostedDomains.map((v) => String(v || "").trim().toLowerCase()).filter(Boolean))) : [];
-		return {
-			clientIds,
-			...hostedDomains.length ? { hostedDomains } : {}
-		};
-	}
-	const envInput = input;
-	const single = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_CLIENT_ID);
-	const csv = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_CLIENT_IDS);
-	const hostedRaw = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_HOSTED_DOMAINS);
-	if (!Boolean(single || csv || hostedRaw)) return void 0;
-	const clientIds = Array.from(new Set([...single ? [single] : [], ...parseCsv(csv)]));
-	if (!clientIds.length) throw new Error("googleOidc enabled but GOOGLE_OIDC_CLIENT_ID(S) is not set");
-	const hostedDomains = hostedRaw ? Array.from(new Set(parseCsv(hostedRaw).map((d) => d.toLowerCase()))) : [];
-	return {
-		clientIds,
-		...hostedDomains.length ? { hostedDomains } : {}
-	};
-}
-function normalizeGithubOAuthConfig(input) {
-	if (!input) return void 0;
-	const candidate = input;
-	const clientId = normalizeOptionalTrimmedString(candidate.clientId ?? candidate.GITHUB_OAUTH_CLIENT_ID);
-	const clientSecret = normalizeOptionalTrimmedString(candidate.clientSecret ?? candidate.GITHUB_OAUTH_CLIENT_SECRET);
-	const callbackUrl = normalizeOptionalTrimmedString(candidate.callbackUrl ?? candidate.GITHUB_OAUTH_CALLBACK_URL);
-	if (!clientId && !clientSecret && !callbackUrl) return void 0;
-	if (!clientId || !clientSecret || !callbackUrl) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
-	const parsedCallbackUrl = new URL(callbackUrl);
-	const localCallbackHost = parsedCallbackUrl.hostname === "localhost" || parsedCallbackUrl.hostname.endsWith(".localhost");
-	if (parsedCallbackUrl.protocol !== "https:" && !localCallbackHost) throw new Error("githubOAuth.callbackUrl must use HTTPS outside localhost");
-	return {
-		clientId,
-		clientSecret,
-		callbackUrl: parsedCallbackUrl.toString()
-	};
-}
-function normalizeThresholdStoreConfig(input) {
-	if (!input) return void 0;
-	if (typeof input !== "object" || Array.isArray(input)) return void 0;
-	const c = input;
-	if (!Boolean(normalizeOptionalTrimmedString(c.THRESHOLD_NODE_ROLE) || normalizeOptionalTrimmedString(c.THRESHOLD_COORDINATOR_SHARED_SECRET_B64U) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNERS) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNER_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNER_T) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_SHARE_MODE) || normalizeOptionalTrimmedString(c.THRESHOLD_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_KEYSTORE_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_KEYSTORE_PREFIX) || normalizeOptionalTrimmedString(c.ROUTER_AB_NORMAL_SIGNING_WORKER_ID) || normalizeOptionalTrimmedString(c.ROUTER_AB_SIGNING_WORKER_URL) || normalizeOptionalTrimmedString(c.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET) || typeof c.routerAbSigningWorkerFetch === "function" || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_ROOT_SECRET_B64U) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS) || normalizeOptionalTrimmedString(c.kind) || normalizeOptionalTrimmedString(c.url) || normalizeOptionalTrimmedString(c.token) || normalizeOptionalTrimmedString(c.redisUrl) || normalizeOptionalTrimmedString(c.UPSTASH_REDIS_REST_URL) || normalizeOptionalTrimmedString(c.UPSTASH_REDIS_REST_TOKEN) || normalizeOptionalTrimmedString(c.REDIS_URL))) return void 0;
-	const normalized = { ...input };
-	if (normalizeOptionalTrimmedString(normalized.kind) === "cloudflare-do") {
-		if (!normalizeOptionalTrimmedString(normalized.name)) normalized.name = THRESHOLD_DO_OBJECT_NAME_DEFAULT;
-		const thresholdPrefix = normalizeOptionalTrimmedString(normalized.THRESHOLD_PREFIX);
-		const anySpecificPrefix = Boolean(normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_SESSION_PREFIX) || normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_KEYSTORE_PREFIX));
-		if (!thresholdPrefix && !anySpecificPrefix) normalized.THRESHOLD_PREFIX = "w3a";
-	}
-	return normalized;
-}
-function createAuthServiceConfig(input) {
-	const networkId = normalizeTrimmedString(input.networkId) || AUTH_SERVICE_CONFIG_DEFAULTS.networkId;
-	const config = {
-		relayerAccount: normalizeTrimmedString(input.relayerAccount),
-		relayerPrivateKey: normalizeTrimmedString(input.relayerPrivateKey),
-		nearRpcUrl: normalizeTrimmedString(input.nearRpcUrl) || defaultNearRpcUrl(networkId),
-		networkId,
-		accountInitialBalance: normalizeTrimmedString(input.accountInitialBalance) || AUTH_SERVICE_CONFIG_DEFAULTS.accountInitialBalance,
-		createAccountAndRegisterGas: normalizeTrimmedString(input.createAccountAndRegisterGas) || AUTH_SERVICE_CONFIG_DEFAULTS.createAccountAndRegisterGas,
-		signerWasm: input.signerWasm,
-		thresholdStore: normalizeThresholdStoreConfig(input.thresholdStore),
-		logger: input.logger,
-		googleOidc: normalizeGoogleOidcConfig(input.googleOidc),
-		githubOAuth: normalizeGithubOAuthConfig(input.githubOAuth)
-	};
-	validateConfigs(config);
-	return config;
-}
-function validateConfigs(config) {
-	for (const key of ["relayerAccount", "relayerPrivateKey"]) if (!config[key]) throw new Error(`Missing required config variable: ${key}`);
-	if (!config.relayerPrivateKey?.startsWith("ed25519:")) throw new Error("Relayer private key must be in format \"ed25519:base58privatekey\"");
-}
 function parseBool(v) {
 	const s = String(v ?? "").trim().toLowerCase();
 	return s === "1" || s === "true" || s === "yes" || s === "on";
@@ -105,6 +11,6 @@ function requireEnvVar(env, name) {
 	return v;
 }
 //#endregion
-export { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs };
+export { parseBool, requireEnvVar };
 
 //# sourceMappingURL=config.js.map

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -1,8 +1,8 @@
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
-import { parseD1JsonColumn } from "../storage/d1Sql.js";
 import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
 //#region src/core/d1EcdsaSignerRead.ts
 function prepareWalletEcdsaSignersRead(database, scope, walletId) {
 	return database.prepare(`SELECT record_json FROM wallet_signers

package/dist/esm/core/d1IdentityStore.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
 import { failure } from "../shared-ts/src/utils/failure.js";
 import { d1ChangedRows } from "../storage/d1Sql.js";
 import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
@@ -242,6 +241,6 @@ var D1IdentityStore = class {
 	}
 };
 //#endregion
-export { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
 
 //# sourceMappingURL=d1IdentityStore.js.map

package/dist/esm/core/d1TenantStore.js

@@ -1,20 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import "./defaultConfigsServer.js";
-import { toPrefixWithColon } from "./ThresholdService/validation.js";
 import { formatD1ExecStatement } from "../storage/d1Sql.js";
 //#region src/core/d1TenantStore.ts
-/**
-* A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
-* `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
-*/
-function resolveStorePrefix(config, explicitKeys, segment) {
-	for (const key of explicitKeys) {
-		const explicit = normalizeOptionalTrimmedString(config[key]);
-		if (explicit) return toPrefixWithColon(explicit, "");
-	}
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}${segment}`;
-}
 /** Requires each part of the scope; `store` ends the error, e.g. `identity store`. */
 function requireD1TenantScope(input, store) {
 	const field = (value, name) => {
@@ -29,15 +15,6 @@ function requireD1TenantScope(input, store) {
 		envId: field(input.envId, "envId")
 	};
 }
-/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
-function d1TenantScopeFromConfig(config, namespace, store) {
-	return requireD1TenantScope({
-		namespace,
-		orgId: config.orgId || config.ORG_ID,
-		projectId: config.projectId || config.PROJECT_ID,
-		envId: config.envId || config.ENV_ID
-	}, store);
-}
 async function ensureD1Schema(database, statements) {
 	for (const statement of statements) await database.exec(formatD1ExecStatement(statement));
 }
@@ -77,6 +54,6 @@ var D1TenantTable = class {
 	}
 };
 //#endregion
-export { D1Schema, D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema, prepareD1TenantStatement, resolveStorePrefix };
+export { D1Schema, D1TenantTable, ensureD1Schema, prepareD1TenantStatement };
 
 //# sourceMappingURL=d1TenantStore.js.map

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -3,8 +3,8 @@ import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { D1_BATCH_CAS_GUARD_SQL, parseD1JsonColumn } from "../storage/d1Sql.js";
-import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
+import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1WalletAuthMethodStore.ts
 /** Names the wallet auth-method store in D1 scope errors. */
 const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";
@@ -243,9 +243,6 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
 async function ensureWalletAuthMethodStoreD1Schema(options) {
 	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL);
 }
-async function ensureWalletAuthMethodStoreD1SchemaV2(options) {
-	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL);
-}
 function trimString(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
@@ -712,6 +709,6 @@ var D1WalletAuthMethodStore = class {
 	}
 };
 //#endregion
-export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
 
 //# sourceMappingURL=d1WalletAuthMethodStore.js.map

package/dist/esm/core/d1WalletStore.js

@@ -5,11 +5,11 @@ import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/rou
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
-import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "./d1EcdsaSignerRead.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
 //#region src/core/d1WalletStore.ts
 function sameD1WalletRuntimePolicyScopeV1(left, right) {
 	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;

package/dist/esm/core/deviceLinking/linkedDeviceBootstrap.js

@@ -0,0 +1,13 @@
+//#region src/core/deviceLinking/linkedDeviceBootstrap.ts
+function requireLinkedDeviceBootstrapRecord(result) {
+	if (result.ok) return result.record;
+	throw Object.assign(/* @__PURE__ */ new Error("Linked-device bootstrap authority rejected the request"), { code: result.code });
+}
+function linkedDeviceBootstrapFailure(error) {
+	if (error && typeof error === "object" && "code" in error && (error.code === "home_conflict" || error.code === "home_unavailable")) return error.code;
+	return null;
+}
+//#endregion
+export { linkedDeviceBootstrapFailure, requireLinkedDeviceBootstrapRecord };
+
+//# sourceMappingURL=linkedDeviceBootstrap.js.map