@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -59,8 +58,9 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 			case "passkey": return { ok: true };
 			case "email_otp": switch (input.authority.proofKind) {
 				case "otp_challenge": return { ok: true };
-				case "google_sso_registration": return await this.googleEmailOtpSessions.completeRegistrationAttempt({
+				case "google_sso_registration": return await this.googleEmailOtpSessions.completeCommittedRegistrationAttempt({
 					registrationAttemptId: input.authority.googleEmailOtpRegistrationAttemptId,
+					intentDigest: input.authority.registrationIntentDigestB64u,
 					walletId: input.walletId
 				});
 			}

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "../../../../threshold/session/signingSessionSeal/crypto/cipher.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -1,15 +1,31 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
 import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
+import { completeGoogleRegistration } from "./d1GoogleRegistrationCompletion.js";
 import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Statements.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	constructor(input) {
 		this.prepare = input.prepare;
 		this.orgId = input.orgId;
+		this.batch = input.batch;
+	}
+	complete(input) {
+		return completeGoogleRegistration(this.prepare, this.batch, {
+			kind: "live_offer",
+			attemptId: input.attemptId,
+			walletId: input.walletId
+		});
+	}
+	completeCommitted(input) {
+		return completeGoogleRegistration(this.prepare, this.batch, {
+			kind: "committed_wallet",
+			attemptId: input.attemptId,
+			walletId: input.walletId,
+			intentDigest: input.intentDigest
+		});
 	}
 	async cleanupExpired(nowMs) {
 		return d1MutationChanges(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
@@ -37,8 +53,16 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 			expiresAtMs: nowMs + 30 * 6e4,
 			runtimePolicyScope: input.runtimePolicyScope
 		};
-		await this.put(attempt);
-		return attempt;
+		await emailOtpRegistrationAttemptRows.insertPendingIfAbsent(this.prepare, attempt).run();
+		const winner = await this.findStarted({
+			providerSubject: input.providerSubject,
+			email: input.email,
+			orgId: this.orgId,
+			ownerProofBindingDigest: input.ownerProofBindingDigest,
+			runtimePolicyScope: input.runtimePolicyScope
+		});
+		if (!winner) throw new Error("Registration offer changed during creation; retry the request");
+		return winner;
 	}
 	async findStarted(input) {
 		const nowMs = Date.now();
@@ -51,13 +75,11 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 		if (!parsed) {
 			const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
-			if (malformedAttemptId) await this.delete(malformedAttemptId);
+			if (malformedAttemptId) await this.deleteMalformedUnclaimed(malformedAttemptId);
 			return null;
 		}
 		if (!registrationAttemptMatchesStartedScope(parsed, scope)) return null;
-		const refreshed = pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(parsed, nowMs);
-		await this.put(refreshed);
-		return refreshed;
+		return parsed;
 	}
 	async abandonStartedExceptBinding(input) {
 		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
@@ -65,7 +87,7 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 			const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 			if (!parsed) {
 				const malformedAttemptId = normalizeOptionalTrimmedString(row.attempt_id);
-				if (malformedAttemptId) await this.delete(malformedAttemptId);
+				if (malformedAttemptId) await this.deleteMalformedUnclaimed(malformedAttemptId);
 				continue;
 			}
 			if (!registrationAttemptMatchesReplacementScope(parsed, input)) continue;
@@ -80,16 +102,26 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, input.walletId, input.nowMs).first();
 		return Boolean(row);
 	}
+	async claimCandidate(input) {
+		return d1MutationChanges(await emailOtpRegistrationAttemptRows.claimCandidate(this.prepare, {
+			...input,
+			nowMs: Date.now()
+		}).run()) === 1 ? { ok: true } : {
+			ok: false,
+			code: "registration_candidate_unavailable",
+			message: "Registration offer is unavailable or already claimed by another candidate or intent"
+		};
+	}
 	async read(attemptId) {
 		const record = parseGoogleEmailOtpRegistrationAttemptRow(await emailOtpRegistrationAttemptRows.select(this.prepare, attemptId).first());
 		return record?.runtimePolicyScope?.orgId === this.orgId ? record : null;
 	}
 	async put(record) {
 		if (record.runtimePolicyScope?.orgId !== this.orgId) throw new Error("Google Email OTP registration attempt org scope mismatch");
-		await emailOtpRegistrationAttemptRows.upsert(this.prepare, record).run();
+		if (d1MutationChanges(await emailOtpRegistrationAttemptRows.updatePending(this.prepare, record).run()) !== 1) throw new Error("Registration offer is no longer pending or has changed");
 	}
-	async delete(attemptId) {
-		await emailOtpRegistrationAttemptRows.delete(this.prepare, attemptId).run();
+	async deleteMalformedUnclaimed(attemptId) {
+		await emailOtpRegistrationAttemptRows.deleteUnclaimed(this.prepare, attemptId).run();
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.ts
 const GOOGLE_EMAIL_OTP_AUTH_PROVIDER = "google";
@@ -8,18 +7,6 @@ function requireRuntimePolicyScope(input) {
 	if (scope) return scope;
 	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, runtimePolicyScope.envId, and runtimePolicyScope.signingRootVersion are required for Google Email OTP registration");
 }
-function activeGoogleEmailOtpRegistrationAttemptRecord(input) {
-	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
-		fields: {
-			...input.record,
-			updatedAtMs: input.updatedAtMs
-		},
-		state: "active",
-		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {}
-	});
-	if (!terminal) throw new Error("Failed to build active Google Email OTP registration attempt");
-	return terminal;
-}
 function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
 		fields: {
@@ -33,19 +20,6 @@ function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	if (!terminal) throw new Error("Failed to build expired Google Email OTP registration attempt");
 	return terminal;
 }
-function failedGoogleEmailOtpRegistrationAttemptWithCode(input) {
-	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
-		fields: {
-			...input.record,
-			updatedAtMs: input.updatedAtMs
-		},
-		state: "failed",
-		failureCode: input.failureCode,
-		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {}
-	});
-	if (!terminal) throw new Error("Failed to build failed Google Email OTP registration attempt");
-	return terminal;
-}
 function parseGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const record = parseJsonObject(input);
 	if (!record) return null;
@@ -137,21 +111,6 @@ function googleEmailOtpRegistrationOfferForResponse(input) {
 		candidates: [candidates[0], ...candidates.slice(1)]
 	};
 }
-function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record, updatedAtMs) {
-	return pendingRegistrationAttemptRecord({
-		...record,
-		updatedAtMs
-	}, record);
-}
-function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input) {
-	return pendingRegistrationAttemptRecord({
-		...input.record,
-		walletId: input.candidate.walletId,
-		selectedCandidateId: input.candidate.candidateId,
-		collisionCounter: input.candidate.collisionCounter,
-		updatedAtMs: input.updatedAtMs
-	}, input.record);
-}
 function abandonedGoogleEmailOtpRegistrationAttemptRecord(input) {
 	return registrationAttemptRecord({
 		...input.record,
@@ -244,13 +203,6 @@ function registrationAttemptRecord(fields, state) {
 		...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {}
 	};
 }
-/** Rebuilds a pending attempt from changed fields, keeping its state. */
-function pendingRegistrationAttemptRecord(fields, record) {
-	return record.state === "started" ? registrationAttemptRecord(fields, { state: "started" }) : registrationAttemptRecord(fields, {
-		state: "key_finalized",
-		finalizedPublicKey: record.finalizedPublicKey
-	});
-}
 function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const finalized = input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {};
 	switch (input.state) {
@@ -274,6 +226,6 @@ function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
 	}
 }
 //#endregion
-export { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, requireRuntimePolicyScope };
+export { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope };
 
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -1,12 +1,11 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts
 var CloudflareD1GoogleEmailOtpSessionResolver = class {
@@ -130,41 +129,22 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 			clientIp: normalizeOptionalTrimmedString(input.clientIp)
 		});
 	}
+	completeCommittedRegistrationAttempt(input) {
+		return this.registrationAttempts.completeCommitted({
+			attemptId: input.registrationAttemptId,
+			walletId: input.walletId,
+			intentDigest: input.intentDigest
+		});
+	}
 	async completeRegistrationAttempt(input) {
 		const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
 		if (!registrationAttemptId) return { ok: true };
 		const walletId = parseD1BoundaryWalletIdResult(input.walletId);
 		if (!walletId.ok) return failure("invalid_body", walletId.code === "missing" ? "Missing walletId" : "Invalid walletId");
-		const attempt = await this.registrationAttempts.read(registrationAttemptId);
-		if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
-		if (attempt.expiresAtMs <= Date.now()) {
-			await this.registrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
-				record: attempt,
-				updatedAtMs: Date.now()
-			}));
-			return failure("registration_incomplete", "Google Email OTP registration attempt expired");
-		}
-		if (walletId.value !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
-		if (attempt.state === "active") return { ok: true };
-		if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
-		const linked = await this.linkIdentity({
-			userId: attempt.walletId,
-			subject: `wallet:${attempt.providerSubject}`,
-			allowMoveIfSoleIdentity: true
+		return this.registrationAttempts.complete({
+			attemptId: registrationAttemptId,
+			walletId: walletId.value
 		});
-		if (!linked.ok) {
-			await this.registrationAttempts.put(failedGoogleEmailOtpRegistrationAttemptWithCode({
-				record: attempt,
-				failureCode: linked.code,
-				updatedAtMs: Date.now()
-			}));
-			return failure(linked.code, linked.message);
-		}
-		await this.registrationAttempts.put(activeGoogleEmailOtpRegistrationAttemptRecord({
-			record: attempt,
-			updatedAtMs: Date.now()
-		}));
-		return { ok: true };
 	}
 	async validateRegistrationCandidateWallet(input) {
 		const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
@@ -206,6 +186,14 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 					hasEmailOtpEnrollment: true
 				};
 			}
+			return {
+				ok: false,
+				mode: "wallet_identity_mismatch",
+				code: "wallet_identity_mismatch",
+				walletId: input.loginWalletId,
+				providerSubject: input.providerSubject,
+				message: "The selected wallet does not match the verified Google account"
+			};
 		}
 		if (input.linkedWalletId) {
 			const enrollment = await this.readActiveEnrollment({

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.js

@@ -0,0 +1,85 @@
+//#region src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.ts
+const PENDING_OFFER = `SELECT * FROM email_otp_registration_attempts
+  WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+    AND attempt_id = ? AND wallet_id = ? AND selection_digest IS NOT NULL
+    AND state IN ('started', 'key_finalized')`;
+async function completeGoogleRegistration(prepare, batch, input) {
+	const nowMs = Date.now();
+	const eligibility = input.kind === "live_offer" ? `${PENDING_OFFER} AND expires_at_ms > ?` : `${PENDING_OFFER} AND selection_digest = ?`;
+	const scopeValues = [
+		input.attemptId,
+		input.walletId,
+		input.kind === "live_offer" ? nowMs : input.intentDigest
+	];
+	const results = await batch([
+		prepare(`WITH offer AS (${eligibility})
+      INSERT INTO identity_links (
+        namespace, org_id, project_id, env_id, subject, user_id, record_json,
+        created_at_ms, updated_at_ms
+      )
+      SELECT namespace, org_id, project_id, env_id, 'wallet:' || provider_subject,
+        wallet_id, json_object('version', 'identity_subject_v1',
+          'subject', 'wallet:' || provider_subject, 'userId', wallet_id,
+          'createdAtMs', ?, 'updatedAtMs', ?), ?, ?
+      FROM offer WHERE 1
+      ON CONFLICT (namespace, org_id, project_id, env_id, subject) DO UPDATE SET
+        user_id = excluded.user_id,
+        record_json = json_set(identity_links.record_json,
+          '$.userId', excluded.user_id,
+          '$.updatedAtMs', MAX(identity_links.updated_at_ms, excluded.updated_at_ms)),
+        updated_at_ms = MAX(identity_links.updated_at_ms, excluded.updated_at_ms)
+      WHERE identity_links.user_id = excluded.user_id OR (
+        SELECT COUNT(*) FROM identity_links old
+        WHERE old.namespace = identity_links.namespace AND old.org_id = identity_links.org_id
+          AND old.project_id = identity_links.project_id AND old.env_id = identity_links.env_id
+          AND old.user_id = identity_links.user_id
+      ) = 1`, [
+			...scopeValues,
+			nowMs,
+			nowMs,
+			nowMs,
+			nowMs
+		]),
+		prepare(`WITH offer AS (${eligibility})
+      UPDATE email_otp_registration_attempts AS attempt
+      SET state = 'active', updated_at_ms = MAX(updated_at_ms, ?),
+        record_json = json_set(record_json, '$.state', 'active', '$.updatedAtMs', MAX(updated_at_ms, ?))
+      WHERE EXISTS (SELECT 1 FROM offer
+        JOIN identity_links link ON link.namespace = offer.namespace AND link.org_id = offer.org_id
+          AND link.project_id = offer.project_id AND link.env_id = offer.env_id
+          AND link.subject = 'wallet:' || offer.provider_subject AND link.user_id = offer.wallet_id
+        WHERE attempt.namespace = offer.namespace AND attempt.org_id = offer.org_id
+          AND attempt.project_id = offer.project_id AND attempt.env_id = offer.env_id
+          AND attempt.attempt_id = offer.attempt_id)`, [
+			...scopeValues,
+			nowMs,
+			nowMs
+		]),
+		prepare(`SELECT 1 AS completed FROM email_otp_registration_attempts offer
+      JOIN identity_links link ON link.namespace = offer.namespace AND link.org_id = offer.org_id
+        AND link.project_id = offer.project_id AND link.env_id = offer.env_id
+        AND link.subject = 'wallet:' || offer.provider_subject AND link.user_id = offer.wallet_id
+      WHERE offer.namespace = ? AND offer.org_id = ? AND offer.project_id = ? AND offer.env_id = ?
+        AND offer.attempt_id = ? AND offer.wallet_id = ?
+        AND offer.selection_digest IS NOT NULL AND offer.state = 'active'
+        ${input.kind === "committed_wallet" ? "AND offer.selection_digest = ?" : ""}`, input.kind === "committed_wallet" ? [
+			input.attemptId,
+			input.walletId,
+			input.intentDigest
+		] : [input.attemptId, input.walletId])
+	]);
+	if (results.some(batchFailed)) throw new Error("Registration completion transaction failed");
+	if (results[2]?.results?.[0]?.completed === 1) return { ok: true };
+	return {
+		ok: false,
+		code: "registration_incomplete",
+		message: "Registration offer or identity link is unavailable for completion"
+	};
+}
+function batchFailed(result) {
+	return !result.success;
+}
+//#endregion
+export { completeGoogleRegistration };
+
+//# sourceMappingURL=d1GoogleRegistrationCompletion.js.map

package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE } from "../../../../core/authService/googleEmailOtpErrors.js";
 //#region src/router/cloudflare/d1/identity/d1IdentityRecords.ts
 function hasDifferentWalletIdentitySubject(input) {

package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js

@@ -1,38 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { parseD1BoundaryWalletId } from "../auth/d1RouterApiAuthBoundary.js";
-import { requireD1RouterApiAuthScopeString } from "../auth/d1RouterApiAuthConfig.js";
-import { deriveHostedNearAccountId } from "../../../../core/hostedAccountIds.js";
 //#region src/router/cloudflare/d1/identity/d1IdentityService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
-function isHostedOidcWalletScopeRecord(input) {
-	return input !== null && typeof input === "object" && !Array.isArray(input);
-}
-function resolveHostedOidcWalletScope(input) {
-	const scope = isHostedOidcWalletScopeRecord(input) ? input : {};
-	const orgId = normalizeOptionalTrimmedString(scope.orgId);
-	const projectId = normalizeOptionalTrimmedString(scope.projectId);
-	const envId = normalizeOptionalTrimmedString(scope.envId);
-	if (orgId && projectId && envId) return {
-		projectId,
-		envId
-	};
-	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, and runtimePolicyScope.envId are required for hosted wallet id derivation");
-}
-function codedError(code, message) {
-	const error = new Error(message);
-	error.code = code;
-	return error;
-}
 var CloudflareD1IdentityService = class {
 	constructor(input) {
-		this.accountIdDerivationSecret = input.accountIdDerivationSecret;
 		this.identityStore = input.identityStore;
-		this.relayerAccount = input.relayerAccount;
-		this.resolveGoogleEmailOtpSession = input.resolveGoogleEmailOtpSession;
 	}
 	async listIdentities(input) {
 		try {
@@ -75,28 +49,6 @@ var CloudflareD1IdentityService = class {
 			return failure("internal", errorMessage(error) || "Failed to unlink identity");
 		}
 	}
-	async resolveOidcWalletId(input) {
-		const providerSubject = normalizeOptionalTrimmedString(input.providerSubject ?? input.sub);
-		if (!providerSubject) throw new Error("Cannot resolve OIDC wallet id without provider subject");
-		if (providerSubject.startsWith("google:")) {
-			const resolution = await this.resolveGoogleEmailOtpSession(input);
-			if (resolution.ok) return resolution.walletId;
-			throw codedError(resolution.code, resolution.message);
-		}
-		const parsedLinkedWalletId = parseD1BoundaryWalletId(await this.identityStore.getUserIdBySubject(`wallet:${providerSubject}`));
-		if (parsedLinkedWalletId) return parsedLinkedWalletId;
-		const scope = resolveHostedOidcWalletScope(input.runtimePolicyScope);
-		const verifiedEmail = normalizeOptionalTrimmedString(input.email);
-		return await deriveHostedNearAccountId({
-			accountIdDerivationSecret: requireD1RouterApiAuthScopeString(this.accountIdDerivationSecret, "ACCOUNT_ID_DERIVATION_SECRET"),
-			relayerAccount: requireD1RouterApiAuthScopeString(this.relayerAccount, "relayerAccount"),
-			projectId: scope.projectId,
-			envId: scope.envId,
-			authProvider: "oidc",
-			providerSubject,
-			...verifiedEmail ? { verifiedEmail } : {}
-		});
-	}
 };
 //#endregion
 export { CloudflareD1IdentityService };