@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/core/authService/nearAccountOperations.js

@@ -1,229 +0,0 @@
-import { isValidAccountId } from "../../shared-ts/src/utils/near.js";
-import "../../shared-ts/src/utils/validation.js";
-import { ActionType, validateActionArgsWasm } from "../../shared-ts/src/near/actions.js";
-import { executeSignedDelegateWithRelayer } from "../../delegateAction/index.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { checkNearAccountExistsWithClient, dispatchNearSignedTransactionBorshWithClient, fetchNearTxContextWithClient, signGasRelayerNearTransactionWithDeps, verifyAccountAccessKeysPresentWithClient, viewAccessKeyListWithClient } from "./nearTransactions.js";
-import { fundImplicitNearAccountWithRelayer } from "../nearRelayerAccountProvisioning.js";
-import { buildFullAccessAddKeyAction, normalizeBootstrapPublicKeys } from "./registrationThresholdHelpers.js";
-//#region src/core/authService/nearAccountOperations.ts
-const ACCOUNT_CREATE_BROADCAST_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";
-const ACCOUNT_CREATE_FAST_KEY_VISIBILITY_CHECK = {
-	attempts: 2,
-	delayMs: 100,
-	finality: "optimistic"
-};
-const ACCOUNT_CREATE_BACKGROUND_KEY_VISIBILITY_AUDIT = {
-	attempts: 8,
-	delayMs: 250,
-	finality: "final"
-};
-var NearAccountOperations = class {
-	constructor(input) {
-		this.input = input;
-		this.transactionQueue = Promise.resolve();
-		this.queueStats = {
-			pending: 0,
-			completed: 0,
-			failed: 0
-		};
-	}
-	async viewAccessKeyList(accountId) {
-		await this.input.ensureSignerAndRelayerAccount();
-		return await viewAccessKeyListWithClient({
-			nearClient: this.input.nearClient,
-			accountId
-		});
-	}
-	async dispatchNearSignedTransactionBorsh(input) {
-		await this.input.ensureSignerAndRelayerAccount();
-		return await dispatchNearSignedTransactionBorshWithClient({
-			nearClient: this.input.nearClient,
-			signedTransactionBorshB64u: input.signedTransactionBorshB64u
-		});
-	}
-	async txStatus(txHash, senderAccountId) {
-		await this.input.ensureSignerAndRelayerAccount();
-		return this.input.nearClient.txStatus(txHash, senderAccountId);
-	}
-	async createAccount(request) {
-		await this.input.ensureSignerAndRelayerAccount();
-		return this.queueTransaction(this.createAccountQueueTask(request), `create account ${request.accountId}`);
-	}
-	async fundImplicitNearAccount(request) {
-		await this.input.ensureSignerAndRelayerAccount();
-		return await this.queueTransaction(this.createFundImplicitNearAccountQueueTask(request), `fund implicit NEAR account ${request.nearAccountId}`);
-	}
-	async checkAccountExists(accountId) {
-		await this.input.ensureSignerAndRelayerAccount();
-		return await checkNearAccountExistsWithClient({
-			nearClient: this.input.nearClient,
-			logger: this.input.logger,
-			accountId
-		});
-	}
-	async executeSignedDelegate(input) {
-		await this.input.ensureSignerAndRelayerAccount();
-		if (!input?.hash || !input?.signedDelegate) return {
-			ok: false,
-			code: "invalid_delegate_request",
-			error: "hash and signedDelegate are required"
-		};
-		const senderId = input.signedDelegate?.delegateAction?.senderId ?? "unknown-sender";
-		return this.queueTransaction(() => executeSignedDelegateWithRelayer({
-			nearClient: this.input.nearClient,
-			relayerAccount: this.input.config.relayerAccount,
-			relayerPublicKey: this.input.getRelayerPublicKey(),
-			hash: input.hash,
-			signedDelegate: input.signedDelegate,
-			policy: input.policy,
-			signGasRelayerNearTransaction: (args) => this.signGasRelayerNearTransaction(args)
-		}), `execute signed delegate for ${senderId}`);
-	}
-	async fetchTxContext(accountId, publicKey) {
-		return await fetchNearTxContextWithClient({
-			nearClient: this.input.nearClient,
-			accountId,
-			publicKey
-		});
-	}
-	async signGasRelayerNearTransaction(input) {
-		return await signGasRelayerNearTransactionWithDeps({
-			ensureSignerWasm: this.input.ensureSignerWasm,
-			relayerAccount: this.input.config.relayerAccount,
-			relayerPrivateKey: this.input.config.relayerPrivateKey,
-			receiverId: input.receiverId,
-			nonce: input.nonce,
-			blockHash: input.blockHash,
-			actions: input.actions
-		});
-	}
-	async queueTransaction(operation, description) {
-		this.queueStats.pending++;
-		this.input.logger.debug(`[AuthService] Queueing: ${description} (pending: ${this.queueStats.pending})`);
-		const next = this.transactionQueue.then(async () => {
-			try {
-				this.input.logger.debug(`[AuthService] Executing: ${description}`);
-				const result = await operation();
-				this.queueStats.completed++;
-				this.queueStats.pending--;
-				this.input.logger.debug(`[AuthService] Completed: ${description} (pending: ${this.queueStats.pending})`);
-				return result;
-			} catch (error) {
-				this.queueStats.failed++;
-				this.queueStats.pending--;
-				this.input.logger.error(`[AuthService] Failed: ${description} (failed: ${this.queueStats.failed}):`, errorMessage(error) || "unknown error");
-				throw error;
-			}
-		});
-		this.transactionQueue = next.catch(() => void 0);
-		return await next;
-	}
-	createAccountQueueTask(request) {
-		return this.createAccountFromQueue.bind(this, request);
-	}
-	async createAccountFromQueue(request) {
-		try {
-			if (!isValidAccountId(request.accountId)) throw new Error(`Invalid account ID format: ${request.accountId}`);
-			this.input.logger.info(`Checking if account ${request.accountId} already exists...`);
-			if (await this.checkAccountExists(request.accountId)) throw new Error(`Account ${request.accountId} already exists. Cannot create duplicate account.`);
-			this.input.logger.info(`Account ${request.accountId} is available for creation`);
-			const initialBalance = this.input.config.accountInitialBalance;
-			const { publicKey, recoveryPublicKey, expectedPublicKeys } = normalizeBootstrapPublicKeys({
-				publicKey: request.publicKey,
-				recoveryPublicKey: request.recoveryPublicKey
-			});
-			this.input.logger.info(`Creating account: ${request.accountId}`);
-			this.input.logger.info(`Initial balance: ${initialBalance} yoctoNEAR`);
-			const actions = [
-				{ action_type: ActionType.CreateAccount },
-				{
-					action_type: ActionType.Transfer,
-					deposit: String(initialBalance)
-				},
-				buildFullAccessAddKeyAction(publicKey),
-				...recoveryPublicKey ? [buildFullAccessAddKeyAction(recoveryPublicKey)] : []
-			];
-			actions.forEach(validateActionArgsWasm);
-			const { nextNonce, blockHash } = await this.fetchTxContext(this.input.config.relayerAccount, this.input.getRelayerPublicKey());
-			const signed = await this.signGasRelayerNearTransaction({
-				receiverId: request.accountId,
-				nonce: nextNonce,
-				blockHash,
-				actions
-			});
-			const createAccountBroadcastStartedAt = Date.now();
-			const result = await this.input.nearClient.sendTransaction(signed, ACCOUNT_CREATE_BROADCAST_WAIT_UNTIL);
-			this.input.logger.info(`Account creation for ${request.accountId} reached ${ACCOUNT_CREATE_BROADCAST_WAIT_UNTIL} in ${Date.now() - createAccountBroadcastStartedAt}ms`);
-			const createAccountKeyCheckStartedAt = Date.now();
-			const keysVerified = await this.verifyAccountAccessKeysPresent(request.accountId, expectedPublicKeys, ACCOUNT_CREATE_FAST_KEY_VISIBILITY_CHECK);
-			this.input.logger.info(`Account creation for ${request.accountId} key visibility verified=${keysVerified} in ${Date.now() - createAccountKeyCheckStartedAt}ms`);
-			if (!keysVerified) {
-				this.input.logger.warn(recoveryPublicKey ? "Bootstrap committed before both access keys were visible on final state; scheduling background audit" : "Bootstrap committed before the operational access key was visible on final state; scheduling background audit");
-				this.scheduleAccountAccessKeyVisibilityAudit({
-					accountId: request.accountId,
-					expectedPublicKeys,
-					contextLabel: `Account creation for ${request.accountId}`
-				});
-			}
-			this.input.logger.info(`Account creation completed: ${result.transaction.hash}`);
-			const nearAmount = (Number(BigInt(initialBalance)) / 1e24).toFixed(6);
-			return {
-				success: true,
-				transactionHash: result.transaction.hash,
-				accountId: request.accountId,
-				message: `Account ${request.accountId} created with ${nearAmount} NEAR initial balance`
-			};
-		} catch (error) {
-			this.input.logger.error(`Account creation failed for ${request.accountId}:`, error);
-			const msg = errorMessage(error) || "Unknown account creation error";
-			return {
-				success: false,
-				error: msg,
-				message: `Failed to create account ${request.accountId}: ${msg}`
-			};
-		}
-	}
-	createFundImplicitNearAccountQueueTask(request) {
-		return this.fundImplicitNearAccountFromQueue.bind(this, request);
-	}
-	async fundImplicitNearAccountFromQueue(request) {
-		return await fundImplicitNearAccountWithRelayer({
-			...request,
-			relayerAccount: this.input.config.relayerAccount,
-			relayerPrivateKey: this.input.config.relayerPrivateKey,
-			relayerPublicKey: this.input.getRelayerPublicKey(),
-			nearRpcUrl: this.input.config.nearRpcUrl,
-			fundedAmountYocto: this.input.config.accountInitialBalance,
-			nearClient: this.input.nearClient,
-			ensureSignerWasm: this.input.ensureSignerWasm
-		});
-	}
-	async verifyAccountAccessKeysPresent(accountId, expectedPublicKeys, opts) {
-		return await verifyAccountAccessKeysPresentWithClient({
-			nearClient: this.input.nearClient,
-			accountId,
-			expectedPublicKeys,
-			options: opts
-		});
-	}
-	scheduleAccountAccessKeyVisibilityAudit(input) {
-		this.runAccountAccessKeyVisibilityAudit(input);
-	}
-	async runAccountAccessKeyVisibilityAudit(input) {
-		try {
-			const startedAt = Date.now();
-			if (await this.verifyAccountAccessKeysPresent(input.accountId, input.expectedPublicKeys, ACCOUNT_CREATE_BACKGROUND_KEY_VISIBILITY_AUDIT)) {
-				this.input.logger.info(`${input.contextLabel} final key visibility verified=true in ${Date.now() - startedAt}ms`);
-				return;
-			}
-			this.input.logger.warn(`${input.contextLabel} final key visibility is still pending after ${Date.now() - startedAt}ms`);
-		} catch (error) {
-			this.input.logger.warn(`${input.contextLabel} final key visibility audit failed`, error);
-		}
-	}
-};
-//#endregion
-export { NearAccountOperations };
-
-//# sourceMappingURL=nearAccountOperations.js.map

package/dist/esm/core/authService/nearPublicKeyMetadata.js

@@ -1,108 +0,0 @@
-import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-//#region src/core/authService/nearPublicKeyMetadata.ts
-function optionalPositiveInteger(input) {
-	const value = typeof input === "number" ? input : Number(input);
-	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : null;
-}
-function optionalPositiveTimestamp(input) {
-	const value = typeof input === "number" ? input : Number(input);
-	return Number.isFinite(value) && value > 0 ? Math.floor(value) : null;
-}
-function nearPublicKeyAuthBinding(input) {
-	if (!input.credentialIdB64u && !input.rpIdRaw) return { ok: true };
-	if (!input.credentialIdB64u || !input.rpIdRaw) return {
-		ok: false,
-		message: "passkey near public key binding requires rpId and credentialIdB64u"
-	};
-	const rpId = parseWebAuthnRpId(input.rpIdRaw);
-	if (!rpId.ok) return {
-		ok: false,
-		message: rpId.error.message
-	};
-	return {
-		ok: true,
-		binding: {
-			kind: "passkey",
-			rpId: rpId.value,
-			credentialIdB64u: input.credentialIdB64u
-		}
-	};
-}
-function nearPublicKeyRecord(input) {
-	const record = {
-		version: "near_public_key_v1",
-		userId: input.userId,
-		publicKey: input.publicKey,
-		kind: input.kind,
-		createdAtMs: input.nowMs,
-		updatedAtMs: input.nowMs
-	};
-	if (input.signerSlot !== null) record.signerSlot = input.signerSlot;
-	if (input.authBinding) record.authBinding = input.authBinding;
-	if (input.addedTxHash) record.addedTxHash = input.addedTxHash;
-	if (input.removedAtMs !== null) record.removedAtMs = input.removedAtMs;
-	return record;
-}
-function nearPublicKeyListEntry(record) {
-	const entry = {
-		publicKey: record.publicKey,
-		kind: record.kind,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs
-	};
-	if (typeof record.signerSlot === "number") entry.signerSlot = record.signerSlot;
-	if (record.authBinding) entry.authBinding = record.authBinding;
-	return entry;
-}
-async function recordNearPublicKeyMetadataWithStore(input) {
-	const userId = normalizeOptionalTrimmedString(input.userId);
-	const publicKey = normalizeOptionalTrimmedString(input.publicKey);
-	if (!userId || !publicKey) return failure("invalid_args", "userId and publicKey are required");
-	const authBinding = nearPublicKeyAuthBinding({
-		credentialIdB64u: normalizeOptionalTrimmedString(input.credentialIdB64u),
-		rpIdRaw: normalizeOptionalTrimmedString(input.rpId)
-	});
-	if (!authBinding.ok) return failure("invalid_args", authBinding.message);
-	const record = nearPublicKeyRecord({
-		userId,
-		publicKey,
-		kind: input.kind,
-		signerSlot: optionalPositiveInteger(input.signerSlot),
-		authBinding: authBinding.binding,
-		addedTxHash: normalizeOptionalTrimmedString(input.addedTxHash),
-		removedAtMs: optionalPositiveTimestamp(input.removedAtMs),
-		nowMs: Date.now()
-	});
-	try {
-		await input.store.put(record);
-		return { ok: true };
-	} catch (error) {
-		const source = normalizeOptionalTrimmedString(input.source) || "near-public-key-metadata";
-		const message = errorMessage(error) || "Failed to persist NEAR public key metadata";
-		input.logger.warn(`[AuthService] ${source} failed for ${userId}`, error);
-		return failure("internal", message);
-	}
-}
-async function listNearPublicKeysForUserWithStore(input) {
-	try {
-		const userId = String(input.userId || "").trim();
-		if (!userId) return failure("invalid_args", "Missing userId");
-		const records = await input.store.listByUserId(userId);
-		const keys = [];
-		for (const record of records || []) keys.push(nearPublicKeyListEntry(record));
-		return {
-			ok: true,
-			keys
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to list keys");
-	}
-}
-//#endregion
-export { listNearPublicKeysForUserWithStore, recordNearPublicKeyMetadataWithStore };
-
-//# sourceMappingURL=nearPublicKeyMetadata.js.map

package/dist/esm/core/authService/oidcVerification.js

@@ -1,249 +0,0 @@
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
-import { failedVerification } from "../../shared-ts/src/utils/failure.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { parseCacheControlMaxAgeSec, parseJwtAud, parseJwtSegmentJson } from "./webauthnOidcHelpers.js";
-import { toArrayBufferCopy } from "./portableCrypto.js";
-//#region src/core/authService/oidcVerification.ts
-function createGoogleJwksState() {
-	return {
-		cache: null,
-		fetchPromise: null
-	};
-}
-function requireWebCrypto() {
-	return typeof crypto !== "undefined" && Boolean(crypto.subtle);
-}
-function parseJwtParts(input) {
-	const parts = input.token.split(".");
-	if (parts.length !== 3) return failedVerification("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
-	const [headerB64u, payloadB64u, signatureB64u] = parts;
-	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return failedVerification("invalid_body", `Invalid ${input.tokenName} header encoding`);
-	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return failedVerification("invalid_body", `Invalid ${input.tokenName} payload encoding`);
-	return {
-		ok: true,
-		value: {
-			headerB64u,
-			payloadB64u,
-			signatureB64u,
-			header,
-			payload
-		}
-	};
-}
-function jwkFromRaw(rawKey) {
-	if (!isPlainObject(rawKey)) return null;
-	const kid = normalizeOptionalTrimmedString(rawKey.kid);
-	const kty = normalizeOptionalTrimmedString(rawKey.kty);
-	const use = normalizeOptionalTrimmedString(rawKey.use);
-	const alg = normalizeOptionalTrimmedString(rawKey.alg);
-	const n = normalizeOptionalTrimmedString(rawKey.n);
-	const e = normalizeOptionalTrimmedString(rawKey.e);
-	if (!kid || kty !== "RSA" || !n || !e) return null;
-	if (use !== "sig" || alg !== "RS256") return null;
-	return {
-		kid,
-		jwk: rawKey
-	};
-}
-async function fetchJwks(input) {
-	const now = Date.now();
-	const resp = await fetch(input.url);
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`${input.failureLabel} (HTTP ${resp.status}): ${text.slice(0, 200)}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(input.invalidJsonLabel);
-	}
-	if (!isPlainObject(json)) throw new Error(input.invalidShapeLabel);
-	const keysRaw = json.keys;
-	if (!Array.isArray(keysRaw)) throw new Error(input.missingKeysLabel);
-	const keysByKid = /* @__PURE__ */ new Map();
-	for (const rawKey of keysRaw) {
-		const key = jwkFromRaw(rawKey);
-		if (key) keysByKid.set(key.kid, key.jwk);
-	}
-	if (!keysByKid.size) throw new Error(input.noUsableKeysLabel);
-	return {
-		keysByKid,
-		expiresAtMs: now + (parseCacheControlMaxAgeSec(resp.headers.get("cache-control")) || 3600) * 1e3
-	};
-}
-async function getGoogleJwks(state) {
-	const now = Date.now();
-	if (state.cache && now < state.cache.expiresAtMs) return state.cache;
-	if (state.fetchPromise) return state.fetchPromise;
-	state.fetchPromise = fetchJwks({
-		url: "https://www.googleapis.com/oauth2/v3/certs",
-		failureLabel: "Google OIDC certs fetch failed",
-		missingKeysLabel: "Google OIDC certs missing \"keys\" array",
-		invalidJsonLabel: "Google OIDC certs returned non-JSON response",
-		invalidShapeLabel: "Google OIDC certs returned invalid JSON shape",
-		noUsableKeysLabel: "Google OIDC certs returned no usable RSA keys"
-	});
-	try {
-		state.cache = await state.fetchPromise;
-		return state.cache;
-	} finally {
-		state.fetchPromise = null;
-	}
-}
-async function verifyJwtSignature(input) {
-	let signatureBytes;
-	try {
-		signatureBytes = base64UrlDecode(input.parts.signatureB64u);
-	} catch {
-		return failedVerification("invalid_body", `Invalid ${input.tokenName} signature encoding`);
-	}
-	const dataBytes = new TextEncoder().encode(`${input.parts.headerB64u}.${input.parts.payloadB64u}`);
-	const key = await crypto.subtle.importKey("jwk", input.jwk, {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, false, ["verify"]);
-	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return failedVerification("invalid_signature", `Invalid ${input.tokenName} signature`);
-	return { ok: true };
-}
-function verifyGoogleTimeClaims(payload) {
-	const nowSec = Math.floor(Date.now() / 1e3);
-	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return failedVerification("invalid_claims", "Invalid Google id_token exp");
-	if (nowSec >= exp) return failedVerification("expired", "Google id_token is expired");
-	const nbfRaw = payload.nbf;
-	if (nbfRaw !== void 0) {
-		const nbf = Number(nbfRaw);
-		if (!Number.isFinite(nbf)) return failedVerification("invalid_claims", "Invalid Google id_token nbf");
-		if (nowSec < nbf) return failedVerification("not_yet_valid", "Google id_token is not yet valid");
-	}
-	return { ok: true };
-}
-function parseGoogleEmailVerified(value) {
-	if (typeof value === "boolean") return value;
-	if (typeof value === "string") return value.trim().toLowerCase() === "true";
-	return null;
-}
-function buildGoogleLoginVerificationSuccess(input) {
-	const result = {
-		ok: true,
-		verified: true,
-		providerSubject: input.providerSubject,
-		sub: input.sub
-	};
-	if (input.email) result.email = input.email;
-	if (input.name) result.name = input.name;
-	if (input.givenName) result.given_name = input.givenName;
-	if (input.familyName) result.family_name = input.familyName;
-	if (input.emailVerified !== null) result.emailVerified = input.emailVerified;
-	if (input.hostedDomain) result.hostedDomain = input.hostedDomain;
-	return result;
-}
-async function resolveLinkedProviderUserId(input) {
-	let userId = input.providerSubject;
-	try {
-		const linked = await input.identityStore.getUserIdBySubject(input.providerSubject);
-		if (linked) userId = linked;
-		await input.identityStore.linkSubjectToUserId({
-			userId,
-			subject: input.providerSubject,
-			allowMoveIfSoleIdentity: false
-		});
-	} catch {}
-	return userId;
-}
-function buildGoogleLoginFacadeSuccess(input) {
-	const result = {
-		ok: true,
-		verified: true,
-		userId: input.userId,
-		providerSubject: input.verified.providerSubject,
-		sub: input.verified.sub
-	};
-	if (input.verified.email) result.email = input.verified.email;
-	if (input.verified.name) result.name = input.verified.name;
-	if (input.verified.given_name) result.given_name = input.verified.given_name;
-	if (input.verified.family_name) result.family_name = input.verified.family_name;
-	if (typeof input.verified.emailVerified === "boolean") result.emailVerified = input.verified.emailVerified;
-	if (input.verified.hostedDomain) result.hostedDomain = input.verified.hostedDomain;
-	return result;
-}
-async function verifyGoogleIdToken(input) {
-	if (!input.config?.clientIds?.length) return failedVerification("not_configured", "Google OIDC is not configured on this server");
-	const idToken = normalizeOptionalTrimmedString(input.request.idToken ?? input.request.id_token);
-	if (!idToken) return failedVerification("invalid_body", "id_token is required");
-	if (!requireWebCrypto()) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
-	const parts = parseJwtParts({
-		token: idToken,
-		tokenName: "id_token"
-	});
-	if (!parts.ok) return parts;
-	const kid = normalizeOptionalTrimmedString(parts.value.header.kid);
-	const alg = normalizeOptionalTrimmedString(parts.value.header.alg);
-	if (!kid) return failedVerification("invalid_body", "id_token header.kid is required");
-	if (alg !== "RS256") return failedVerification("invalid_body", "id_token header.alg must be RS256");
-	const jwk = (await getGoogleJwks(input.jwksState)).keysByKid.get(kid);
-	if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
-	const signature = await verifyJwtSignature({
-		jwk,
-		parts: parts.value,
-		tokenName: "Google id_token"
-	});
-	if (!signature.ok) return signature;
-	const iss = normalizeOptionalTrimmedString(parts.value.payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return failedVerification("invalid_issuer", "Invalid Google id_token issuer");
-	const time = verifyGoogleTimeClaims(parts.value.payload);
-	if (!time.ok) return time;
-	const aud = parseJwtAud(parts.value.payload.aud);
-	if (!aud.length) return failedVerification("invalid_claims", "Missing Google id_token aud");
-	const allowedAudSet = new Set(input.config.clientIds);
-	if (!aud.some((value) => allowedAudSet.has(value))) return failedVerification("invalid_audience", "Google id_token audience mismatch");
-	const sub = normalizeOptionalTrimmedString(parts.value.payload.sub);
-	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
-	const hostedDomain = normalizeOptionalTrimmedString(parts.value.payload.hd);
-	if (input.config.hostedDomains?.length) {
-		const allowHd = new Set(input.config.hostedDomains.map((d) => d.toLowerCase()));
-		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return failedVerification("invalid_hosted_domain", "Google hosted domain is not allowed");
-	}
-	const email = normalizeOptionalTrimmedString(parts.value.payload.email);
-	const name = normalizeOptionalTrimmedString(parts.value.payload.name);
-	const givenName = normalizeOptionalTrimmedString(parts.value.payload.given_name);
-	const familyName = normalizeOptionalTrimmedString(parts.value.payload.family_name);
-	const emailVerified = parseGoogleEmailVerified(parts.value.payload.email_verified);
-	return buildGoogleLoginVerificationSuccess({
-		providerSubject: `google:${sub}`,
-		sub,
-		email,
-		name,
-		givenName,
-		familyName,
-		emailVerified,
-		hostedDomain
-	});
-}
-async function verifyGoogleLoginWithIdentityStore(input) {
-	try {
-		const verified = await verifyGoogleIdToken({
-			request: input.request,
-			config: input.config,
-			jwksState: input.jwksState
-		});
-		if (!verified.ok) return verified;
-		return buildGoogleLoginFacadeSuccess({
-			verified,
-			userId: await resolveLinkedProviderUserId({
-				identityStore: input.identityStore,
-				providerSubject: verified.providerSubject
-			})
-		});
-	} catch (e) {
-		return failedVerification("internal", errorMessage(e) || "Google OIDC verification failed");
-	}
-}
-//#endregion
-export { createGoogleJwksState, getGoogleJwks, verifyGoogleIdToken, verifyGoogleLoginWithIdentityStore };
-
-//# sourceMappingURL=oidcVerification.js.map

package/dist/esm/core/authService/registrationThresholdHelpers.js

@@ -1,30 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
-import "../../shared-ts/src/utils/validation.js";
-import { ActionType } from "../../shared-ts/src/near/actions.js";
-//#region src/core/authService/registrationThresholdHelpers.ts
-function buildFullAccessAddKeyAction(publicKey) {
-	return {
-		action_type: ActionType.AddKey,
-		public_key: publicKey,
-		access_key: JSON.stringify({
-			nonce: 0,
-			permission: { FullAccess: {} }
-		})
-	};
-}
-function normalizeBootstrapPublicKeys(args) {
-	const publicKey = ensureEd25519Prefix(normalizeOptionalTrimmedString(args.publicKey) || "");
-	if (!publicKey) throw new Error("Missing or invalid bootstrap operational public key");
-	const recoveryPublicKey = ensureEd25519Prefix(normalizeOptionalTrimmedString(args.recoveryPublicKey) || "");
-	if (recoveryPublicKey && recoveryPublicKey === publicKey) throw new Error("Bootstrap recovery public key must differ from the operational public key");
-	return {
-		publicKey,
-		...recoveryPublicKey ? { recoveryPublicKey } : {},
-		expectedPublicKeys: recoveryPublicKey ? [publicKey, recoveryPublicKey] : [publicKey]
-	};
-}
-//#endregion
-export { buildFullAccessAddKeyAction, normalizeBootstrapPublicKeys };
-
-//# sourceMappingURL=registrationThresholdHelpers.js.map

package/dist/esm/core/authService/runtime.js

@@ -1,45 +0,0 @@
-import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
-import { ensureSignerWasmRuntime } from "./wasm.js";
-//#region src/core/authService/runtime.ts
-function createInitialAuthServiceRuntimeState() {
-	return {
-		isInitialized: false,
-		relayerPublicKey: "",
-		signerWasmReady: false
-	};
-}
-async function ensureAuthServiceSignerWasmReady(input) {
-	const signerState = await ensureSignerWasmRuntime({
-		state: { signerWasmReady: input.state.signerWasmReady },
-		override: input.signerWasmOverride,
-		logger: input.logger
-	});
-	return {
-		...input.state,
-		signerWasmReady: signerState.signerWasmReady
-	};
-}
-async function ensureAuthServiceRuntimeReady(input) {
-	if (input.state.isInitialized) return input.state;
-	let relayerPublicKey = "";
-	try {
-		relayerPublicKey = toPublicKeyStringFromSecretKey(input.relayerPrivateKey);
-	} catch {
-		input.logger.warn("Failed to derive public key from relayerPrivateKey; ensure it is in ed25519:<base58> format");
-	}
-	return {
-		...await ensureAuthServiceSignerWasmReady({
-			state: {
-				...input.state,
-				relayerPublicKey
-			},
-			signerWasmOverride: input.signerWasmOverride,
-			logger: input.logger
-		}),
-		isInitialized: true
-	};
-}
-//#endregion
-export { createInitialAuthServiceRuntimeState, ensureAuthServiceRuntimeReady, ensureAuthServiceSignerWasmReady };
-
-//# sourceMappingURL=runtime.js.map