@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/authService/rateLimits.js

@@ -1,84 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { readAuthServiceConfigValue } from "./configValues.js";
-import { resolveSigningSessionSealRateLimitFromEnv } from "../../threshold/session/signingSessionSeal/guards/backends.js";
-import "../../threshold/session/signingSessionSeal/index.js";
-//#region src/core/authService/rateLimits.ts
-function readRateLimitConfigValue(input) {
-	return readAuthServiceConfigValue({
-		thresholdStore: input.thresholdStore,
-		name: input.name
-	});
-}
-function parseRateLimiterKind(input) {
-	const value = normalizeOptionalTrimmedString(input.raw).toLowerCase();
-	if (!value) return null;
-	switch (value) {
-		case "in-memory":
-		case "upstash-redis-rest":
-		case "redis-tcp": return value;
-	}
-	throw new Error(`${input.name} must be one of in-memory, upstash-redis-rest, or redis-tcp`);
-}
-function createEmailOtpRateLimiter(input) {
-	const thresholdStore = input.thresholdStore;
-	return resolveSigningSessionSealRateLimitFromEnv({
-		limiterKind: parseRateLimiterKind({
-			raw: readRateLimitConfigValue({
-				thresholdStore,
-				name: "EMAIL_OTP_RATE_LIMITER_KIND"
-			}),
-			name: "EMAIL_OTP_RATE_LIMITER_KIND"
-		}),
-		upstashUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_URL"
-		}) || null,
-		upstashToken: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_UPSTASH_TOKEN"
-		}) || null,
-		redisUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_REDIS_URL"
-		}) || null,
-		keyPrefix: readRateLimitConfigValue({
-			thresholdStore,
-			name: "EMAIL_OTP_RATE_LIMIT_KEY_PREFIX"
-		}) || "email-otp:v2:",
-		limit: 1,
-		windowMs: 1
-	}).limiter;
-}
-function consumedRateLimitError(message, consumed) {
-	const result = failure("rate_limited", message);
-	if (typeof consumed.retryAfterMs === "number") result.retryAfterMs = consumed.retryAfterMs;
-	if (typeof consumed.resetAtMs === "number") result.resetAtMs = consumed.resetAtMs;
-	return result;
-}
-async function consumeEmailOtpRateLimit(input) {
-	const policy = input.policies[input.scope];
-	const keySuffix = `scope=${input.scope}:action=${input.action || "default"}:limit=${policy.limit}:windowMs=${policy.windowMs}`;
-	const keys = [
-		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
-		input.userId ? `${keySuffix}:user:${input.userId}` : "",
-		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
-		input.providerSubject ? `${keySuffix}:providerSubject:${input.providerSubject}` : "",
-		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
-	].filter(Boolean);
-	for (const key of keys) {
-		const consumed = await input.limiter.consume({
-			key,
-			limit: policy.limit,
-			windowMs: policy.windowMs,
-			nowMs: Date.now()
-		});
-		if (!consumed.ok) return consumedRateLimitError("Email OTP rate limit exceeded", consumed);
-	}
-	return { ok: true };
-}
-//#endregion
-export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter };
-
-//# sourceMappingURL=rateLimits.js.map

package/dist/esm/core/authService/webauthn.js

@@ -1,17 +1,9 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
-import { parseWebAuthnAuthenticationCredential } from "../../router/auth/webAuthnCredentialCodecs.js";
-import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "./webauthnVerificationOutcomes.js";
-import { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding } from "./webauthnWalletBinding.js";
-import { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId } from "./webauthnAuthority.js";
 //#region src/core/authService/webauthn.ts
 function readRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -22,18 +14,6 @@ function readNestedRecord(record, key) {
 function readStringField(record, key) {
 	return typeof record[key] === "string" ? record[key].trim() : "";
 }
-function normalizeWebAuthnTtlMs(raw) {
-	const numeric = typeof raw === "number" ? raw : Number(raw);
-	if (!Number.isFinite(numeric) || numeric <= 0) return 5 * 6e4;
-	return Math.min(Math.max(Math.floor(numeric), 1e4), 10 * 6e4);
-}
-function ensureCryptoRandomValues() {
-	if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") return true;
-	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
-}
-function randomWebAuthnB64u(byteLength) {
-	return base64UrlEncode(crypto.getRandomValues(new Uint8Array(byteLength)));
-}
 function credentialRawIdB64u(credential) {
 	const credentialId = credential.id.trim();
 	const chosen = credential.rawId.trim() || credentialId;
@@ -109,40 +89,6 @@ function registrationCredentialCounter(counter) {
 	const numeric = typeof counter === "number" ? counter : Number(counter);
 	return Number.isFinite(numeric) && numeric >= 0 ? Math.floor(numeric) : 0;
 }
-function authenticatorListEntry(input) {
-	return {
-		credentialIdB64u: input.binding.credentialIdB64u,
-		signerSlot: input.binding.signerSlot,
-		publicKey: input.binding.publicKey,
-		createdAtMs: input.authenticator?.createdAtMs ?? input.binding.createdAtMs,
-		updatedAtMs: input.authenticator?.updatedAtMs ?? input.binding.updatedAtMs,
-		device: input.authenticator?.deviceInfo ?? unknownWebAuthnAuthenticatorDeviceInfo()
-	};
-}
-function compareAuthenticatorListEntries(left, right) {
-	return (Number(left.signerSlot || 0) || 0) - (Number(right.signerSlot || 0) || 0);
-}
-async function listCredentialBindingsForUser(input) {
-	if (!input.bindingStore.listByUserId) return {
-		ok: false,
-		code: "not_supported",
-		message: "Credential binding listing is not supported by this store"
-	};
-	return {
-		ok: true,
-		bindings: input.rpId ? await input.bindingStore.listByUserId({
-			userId: input.userId,
-			rpId: input.rpId
-		}) : await input.bindingStore.listByUserId({ userId: input.userId })
-	};
-}
-function ignoreIdentityLinkFailure() {}
-async function linkNearSubjectForWebAuthnLogin(input) {
-	await input.identityStore.linkSubjectToUserId({
-		userId: input.userId,
-		subject: `near:${input.userId}`
-	}).catch(ignoreIdentityLinkFailure);
-}
 async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	const credential = readRecord(input.webauthnRegistration);
 	if (!credential) return failure("invalid_body", "Missing webauthn_registration");
@@ -309,249 +255,7 @@ async function verifyWebAuthnAuthenticationLiteWithStore(input) {
 		};
 	}
 }
-async function listWebAuthnAuthenticatorsForUserWithStores(input) {
-	try {
-		const userId = String(input.userId || "").trim();
-		const rpId = String(input.rpId || "").trim();
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!input.authenticatorStore.list) return failure("not_supported", "Authenticator listing is not supported by this store");
-		const bindingList = await listCredentialBindingsForUser({
-			bindingStore: input.credentialBindingStore,
-			userId,
-			rpId
-		});
-		if (!bindingList.ok) return bindingList;
-		const [authenticators, bindings] = await Promise.all([input.authenticatorStore.list(userId), Promise.resolve(bindingList.bindings)]);
-		const authByCredentialId = /* @__PURE__ */ new Map();
-		for (const authenticator of authenticators) authByCredentialId.set(String(authenticator.credentialIdB64u || "").trim(), authenticator);
-		const merged = [];
-		for (const binding of bindings) merged.push(authenticatorListEntry({
-			binding: {
-				credentialIdB64u: String(binding.credentialIdB64u || "").trim(),
-				signerSlot: binding.signerSlot,
-				publicKey: binding.publicKey,
-				createdAtMs: binding.createdAtMs,
-				updatedAtMs: binding.updatedAtMs
-			},
-			authenticator: authByCredentialId.get(String(binding.credentialIdB64u || "").trim())
-		}));
-		merged.sort(compareAuthenticatorListEntries);
-		return {
-			ok: true,
-			authenticators: merged
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to list authenticators");
-	}
-}
-async function createWebAuthnLoginOptionsWithStore(input) {
-	try {
-		const userIdRaw = String(input.request.userId ?? input.request.user_id ?? "").trim();
-		const rpId = String(input.request.rpId ?? input.request.rp_id ?? "").trim();
-		if (!userIdRaw) return failure("invalid_body", "Missing userId");
-		const userId = parseBoundaryWalletId(userIdRaw);
-		if (!userId) return failure("invalid_body", "Invalid userId");
-		if (!rpId) return failure("invalid_body", "Missing rpId");
-		const randomAvailable = ensureCryptoRandomValues();
-		if (randomAvailable !== true) return randomAvailable;
-		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + ttlMsClamped;
-		const challengeId = randomWebAuthnB64u(16);
-		const challengeB64u = randomWebAuthnB64u(32);
-		await input.loginChallengeStore.put({
-			version: "webauthn_login_challenge_v1",
-			challengeId,
-			userId,
-			rpId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		});
-		return {
-			ok: true,
-			challengeId,
-			challengeB64u,
-			expiresAtMs
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to create login options");
-	}
-}
-async function createWebAuthnSyncAccountOptionsWithStores(input) {
-	try {
-		const rpId = String(input.request.rp_id || "").trim();
-		if (!rpId) return failure("invalid_body", "Missing rp_id");
-		const expectedUserIdRaw = normalizeOptionalTrimmedString(input.request.account_id);
-		const expectedUserId = expectedUserIdRaw ? parseBoundaryWalletId(expectedUserIdRaw) : null;
-		if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
-		const randomAvailable = ensureCryptoRandomValues();
-		if (randomAvailable !== true) return randomAvailable;
-		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
-		const createdAtMs = Date.now();
-		const expiresAtMs = createdAtMs + ttlMsClamped;
-		const challengeId = randomWebAuthnB64u(16);
-		const challengeB64u = randomWebAuthnB64u(32);
-		let credentialIds;
-		let walletBinding;
-		if (expectedUserId) {
-			const bindingList = await listCredentialBindingsForUser({
-				bindingStore: input.credentialBindingStore,
-				userId: expectedUserId,
-				rpId
-			});
-			if (!bindingList.ok) return bindingList;
-			const resolvedBinding = bindingList.bindings.find((binding) => {
-				return Boolean(binding.userId && binding.nearAccountId && binding.nearEd25519SigningKeyId);
-			});
-			if (resolvedBinding) walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding: resolvedBinding }) ?? void 0;
-			const seen = /* @__PURE__ */ new Set();
-			credentialIds = [];
-			for (const binding of bindingList.bindings) {
-				const credentialId = String(binding.credentialIdB64u || "").trim();
-				if (!credentialId || seen.has(credentialId)) continue;
-				seen.add(credentialId);
-				credentialIds.push(credentialId);
-			}
-		}
-		const record = expectedUserId ? {
-			version: "webauthn_sync_challenge_v1",
-			challengeId,
-			rpId,
-			expectedUserId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		} : {
-			version: "webauthn_sync_challenge_v1",
-			challengeId,
-			rpId,
-			challengeB64u,
-			createdAtMs,
-			expiresAtMs
-		};
-		await input.syncChallengeStore.put(record);
-		const result = {
-			ok: true,
-			challengeId,
-			challengeB64u,
-			expiresAtMs
-		};
-		if (credentialIds) result.credentialIds = credentialIds;
-		if (walletBinding) result.walletBinding = walletBinding;
-		return result;
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to create sync account options");
-	}
-}
-async function verifyWebAuthnSyncAccountWithStores(input) {
-	try {
-		const request = input.request;
-		const challengeId = String(request.challengeId ?? request.challenge_id ?? "").trim();
-		if (!challengeId) return failure("invalid_body", "Missing challengeId");
-		const challenge = await input.syncChallengeStore.consume(challengeId);
-		if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
-		const credential = request.webauthn_authentication;
-		const credentialId = credentialRawIdB64u(credential);
-		if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
-		const syncBinding = webAuthnSyncCredentialBinding(await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u), challenge);
-		if (!syncBinding.ok) return syncBinding;
-		const binding = syncBinding.binding;
-		const expectedOrigin = normalizeOptionalTrimmedString(request.expected_origin);
-		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
-		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: binding.userId,
-			rpId: requireWebAuthnRpId(binding.rpId, "sync credential binding rpId"),
-			expectedChallenge: challenge.challengeB64u,
-			webauthnAuthentication: credential,
-			expectedOrigin,
-			authenticatorStore: input.authenticatorStore,
-			logger: input.logger
-		}));
-		if (verificationFailure) return verificationFailure;
-		const auth = await input.authenticatorStore.get(binding.userId, credentialId.credentialIdB64u);
-		if (!auth) return failedVerification("unknown_credential", "Credential is not registered for user");
-		const walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding });
-		const bindingPublicKey = binding.publicKey;
-		if (!walletBinding || !bindingPublicKey) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
-		const ed25519Signer = await input.walletStore.getEd25519SignerBySlot({
-			walletId: walletIdFromString(walletBinding.walletId),
-			signerSlot: walletBinding.signerSlot
-		});
-		if (!ed25519Signer) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
-		const walletBindingAuthorityScope = passkeyThresholdEd25519AuthorityScope(requireWebAuthnRpId(walletBinding.rpId, "sync credential binding rpId"));
-		const thresholdEd25519 = binding.relayerKeyId ? {
-			relayerKeyId: binding.relayerKeyId,
-			authorityScope: walletBindingAuthorityScope,
-			publicKey: bindingPublicKey,
-			...binding.keyVersion ? { keyVersion: binding.keyVersion } : {},
-			...typeof binding.recoveryExportCapable === "boolean" ? { recoveryExportCapable: binding.recoveryExportCapable } : {},
-			...typeof binding.clientParticipantId === "number" ? { clientParticipantId: binding.clientParticipantId } : {},
-			...typeof binding.relayerParticipantId === "number" ? { relayerParticipantId: binding.relayerParticipantId } : {},
-			...Array.isArray(binding.participantIds) ? { participantIds: binding.participantIds } : {}
-		} : void 0;
-		return {
-			ok: true,
-			verified: true,
-			accountId: walletBinding.walletId,
-			walletId: walletBinding.walletId,
-			nearAccountId: walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-			custodyKeyManifestDigestB64u: parseDigestB64u(ed25519Signer.custodyKeyManifestDigestB64u),
-			walletBinding,
-			rpId: walletBinding.rpId,
-			signerSlot: walletBinding.signerSlot,
-			publicKey: bindingPublicKey,
-			...binding.relayerKeyId ? { relayerKeyId: binding.relayerKeyId } : {},
-			credentialIdB64u: credentialId.credentialIdB64u,
-			credentialPublicKeyB64u: auth.credentialPublicKeyB64u,
-			...thresholdEd25519 ? { thresholdEd25519 } : {}
-		};
-	} catch (e) {
-		return failedVerification("internal", errorMessage(e) || "Sync verification failed");
-	}
-}
-async function verifyWebAuthnLoginWithStores(input) {
-	try {
-		const challengeId = String(input.request.challengeId ?? input.request.challenge_id ?? "").trim();
-		if (!challengeId) return failure("invalid_body", "Missing challengeId");
-		const record = await input.loginChallengeStore.consume(challengeId);
-		if (!record) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
-		const expectedOrigin = normalizeOptionalTrimmedString(input.request.expected_origin);
-		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
-		const credential = parseWebAuthnAuthenticationCredential(input.request.webauthn_authentication);
-		if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
-		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
-			userId: record.userId,
-			rpId: requireWebAuthnRpId(record.rpId, "login challenge rpId"),
-			expectedChallenge: record.challengeB64u,
-			webauthnAuthentication: credential,
-			expectedOrigin,
-			authenticatorStore: input.authenticatorStore,
-			logger: input.logger
-		}));
-		if (verificationFailure) return verificationFailure;
-		const credentialIdB64u = String(credential.rawId || credential.id || "").trim();
-		const binding = credentialIdB64u ? await input.credentialBindingStore.get(record.rpId, credentialIdB64u) : null;
-		const loginSigner = webAuthnLoginEd25519(binding, binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null);
-		if (!loginSigner.ok) return loginSigner;
-		await linkNearSubjectForWebAuthnLogin({
-			identityStore: input.identityStore,
-			userId: record.userId
-		});
-		return {
-			ok: true,
-			verified: true,
-			userId: record.userId,
-			rpId: record.rpId,
-			credentialIdB64u,
-			ed25519: loginSigner.ed25519
-		};
-	} catch (e) {
-		return failedVerification("internal", errorMessage(e) || "Login verification failed");
-	}
-}
 //#endregion
-export { createWebAuthnLoginOptionsWithStore, createWebAuthnSyncAccountOptionsWithStores, listWebAuthnAuthenticatorsForUserWithStores, verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnLoginWithStores, verifyWebAuthnRegistrationCredentialForIntent, verifyWebAuthnSyncAccountWithStores };
+export { verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnRegistrationCredentialForIntent };
 
 //# sourceMappingURL=webauthn.js.map

package/dist/esm/core/authService/webauthnOidcHelpers.js

@@ -57,30 +57,7 @@ function isHostWithinRpId(host, rpId) {
 	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
 	return h === r || h.endsWith(`.${r}`);
 }
-function parseCacheControlMaxAgeSec(cacheControl) {
-	const s = String(cacheControl || "").trim();
-	if (!s) return null;
-	const m = s.match(/(?:^|,)\s*max-age=(\d+)\s*(?:,|$)/i);
-	if (!m) return null;
-	const n = Number(m[1]);
-	if (!Number.isFinite(n) || n <= 0) return null;
-	return Math.floor(n);
-}
-function parseJwtSegmentJson(input) {
-	try {
-		const raw = new TextDecoder().decode(base64UrlDecode(input));
-		const parsed = raw ? JSON.parse(raw) : null;
-		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-function parseJwtAud(input) {
-	if (Array.isArray(input)) return input.map((v) => typeof v === "string" ? v.trim() : "").filter(Boolean);
-	const single = String(input || "").trim();
-	return single ? [single] : [];
-}
 //#endregion
-export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
+export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url };
 
 //# sourceMappingURL=webauthnOidcHelpers.js.map

package/dist/esm/core/authService/webauthnWalletBinding.js

@@ -1,37 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
-//#region src/core/authService/webauthnWalletBinding.ts
-function parseBoundaryWalletId(raw) {
-	const value = normalizeOptionalTrimmedString(raw);
-	if (!value) return null;
-	try {
-		return String(walletIdFromString(value));
-	} catch {
-		return null;
-	}
-}
-/**
-* Returns `null` when the binding carries no Ed25519 identity, which is the
-* valid state for a wallet whose Ed25519 Yao ceremony has not settled yet.
-* Callers must surface that as a typed "not provisioned" outcome rather than
-* treating it as a missing credential.
-*/
-function resolvedEd25519WalletBindingFromCredentialBinding(args) {
-	const { nearAccountId, nearEd25519SigningKeyId } = args.binding;
-	if (!nearAccountId || !nearEd25519SigningKeyId) return null;
-	const resolvedSignerSlot = Number.isSafeInteger(args.signerSlot) && Number(args.signerSlot) > 0 ? Math.floor(Number(args.signerSlot)) : args.binding.signerSlot;
-	if (!Number.isSafeInteger(resolvedSignerSlot) || Number(resolvedSignerSlot) < 1) return null;
-	return {
-		walletId: args.binding.userId,
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		rpId: args.binding.rpId,
-		credentialIdB64u: args.binding.credentialIdB64u,
-		signerSlot: Number(resolvedSignerSlot)
-	};
-}
-//#endregion
-export { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding };
-
-//# sourceMappingURL=webauthnWalletBinding.js.map

package/dist/esm/core/config.js

@@ -1,98 +1,4 @@
-import { normalizeOptionalTrimmedString, normalizeTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import { THRESHOLD_DO_OBJECT_NAME_DEFAULT } from "./defaultConfigsServer.js";
 //#region src/core/config.ts
-const AUTH_SERVICE_CONFIG_DEFAULTS = {
-	nearRpcUrlTestnet: "https://rpc.testnet.fastnear.com",
-	nearRpcUrlMainnet: "https://rpc.mainnet.near.org",
-	networkId: "testnet",
-	accountInitialBalance: "30000000000000000000000",
-	createAccountAndRegisterGas: "85000000000000"
-};
-function defaultNearRpcUrl(networkId) {
-	if (String(networkId || "").trim().toLowerCase() === "mainnet") return AUTH_SERVICE_CONFIG_DEFAULTS.nearRpcUrlMainnet;
-	return AUTH_SERVICE_CONFIG_DEFAULTS.nearRpcUrlTestnet;
-}
-function parseCsv(input) {
-	return String(input || "").split(",").map((s) => s.trim()).filter(Boolean);
-}
-function normalizeGoogleOidcConfig(input) {
-	if (!input) return void 0;
-	if (typeof input === "object" && !Array.isArray(input) && Array.isArray(input.clientIds)) {
-		const clientIds = Array.from(new Set(input.clientIds.map((v) => String(v || "").trim()).filter(Boolean)));
-		if (!clientIds.length) return void 0;
-		const hostedDomains = Array.isArray(input.hostedDomains) ? Array.from(new Set(input.hostedDomains.map((v) => String(v || "").trim().toLowerCase()).filter(Boolean))) : [];
-		return {
-			clientIds,
-			...hostedDomains.length ? { hostedDomains } : {}
-		};
-	}
-	const envInput = input;
-	const single = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_CLIENT_ID);
-	const csv = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_CLIENT_IDS);
-	const hostedRaw = normalizeOptionalTrimmedString(envInput.GOOGLE_OIDC_HOSTED_DOMAINS);
-	if (!Boolean(single || csv || hostedRaw)) return void 0;
-	const clientIds = Array.from(new Set([...single ? [single] : [], ...parseCsv(csv)]));
-	if (!clientIds.length) throw new Error("googleOidc enabled but GOOGLE_OIDC_CLIENT_ID(S) is not set");
-	const hostedDomains = hostedRaw ? Array.from(new Set(parseCsv(hostedRaw).map((d) => d.toLowerCase()))) : [];
-	return {
-		clientIds,
-		...hostedDomains.length ? { hostedDomains } : {}
-	};
-}
-function normalizeGithubOAuthConfig(input) {
-	if (!input) return void 0;
-	const candidate = input;
-	const clientId = normalizeOptionalTrimmedString(candidate.clientId ?? candidate.GITHUB_OAUTH_CLIENT_ID);
-	const clientSecret = normalizeOptionalTrimmedString(candidate.clientSecret ?? candidate.GITHUB_OAUTH_CLIENT_SECRET);
-	const callbackUrl = normalizeOptionalTrimmedString(candidate.callbackUrl ?? candidate.GITHUB_OAUTH_CALLBACK_URL);
-	if (!clientId && !clientSecret && !callbackUrl) return void 0;
-	if (!clientId || !clientSecret || !callbackUrl) throw new Error("githubOAuth requires clientId, clientSecret, and callbackUrl");
-	const parsedCallbackUrl = new URL(callbackUrl);
-	const localCallbackHost = parsedCallbackUrl.hostname === "localhost" || parsedCallbackUrl.hostname.endsWith(".localhost");
-	if (parsedCallbackUrl.protocol !== "https:" && !localCallbackHost) throw new Error("githubOAuth.callbackUrl must use HTTPS outside localhost");
-	return {
-		clientId,
-		clientSecret,
-		callbackUrl: parsedCallbackUrl.toString()
-	};
-}
-function normalizeThresholdStoreConfig(input) {
-	if (!input) return void 0;
-	if (typeof input !== "object" || Array.isArray(input)) return void 0;
-	const c = input;
-	if (!Boolean(normalizeOptionalTrimmedString(c.THRESHOLD_NODE_ROLE) || normalizeOptionalTrimmedString(c.THRESHOLD_COORDINATOR_SHARED_SECRET_B64U) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNERS) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNER_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_COSIGNER_T) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_SHARE_MODE) || normalizeOptionalTrimmedString(c.THRESHOLD_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ED25519_KEYSTORE_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_SESSION_PREFIX) || normalizeOptionalTrimmedString(c.THRESHOLD_ECDSA_KEYSTORE_PREFIX) || normalizeOptionalTrimmedString(c.ROUTER_AB_NORMAL_SIGNING_WORKER_ID) || normalizeOptionalTrimmedString(c.ROUTER_AB_SIGNING_WORKER_URL) || normalizeOptionalTrimmedString(c.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET) || typeof c.routerAbSigningWorkerFetch === "function" || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_ROOT_SECRET_B64U) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX) || normalizeOptionalTrimmedString(c.SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS) || normalizeOptionalTrimmedString(c.kind) || normalizeOptionalTrimmedString(c.url) || normalizeOptionalTrimmedString(c.token) || normalizeOptionalTrimmedString(c.redisUrl) || normalizeOptionalTrimmedString(c.UPSTASH_REDIS_REST_URL) || normalizeOptionalTrimmedString(c.UPSTASH_REDIS_REST_TOKEN) || normalizeOptionalTrimmedString(c.REDIS_URL))) return void 0;
-	const normalized = { ...input };
-	if (normalizeOptionalTrimmedString(normalized.kind) === "cloudflare-do") {
-		if (!normalizeOptionalTrimmedString(normalized.name)) normalized.name = THRESHOLD_DO_OBJECT_NAME_DEFAULT;
-		const thresholdPrefix = normalizeOptionalTrimmedString(normalized.THRESHOLD_PREFIX);
-		const anySpecificPrefix = Boolean(normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_SESSION_PREFIX) || normalizeOptionalTrimmedString(normalized.THRESHOLD_ED25519_KEYSTORE_PREFIX));
-		if (!thresholdPrefix && !anySpecificPrefix) normalized.THRESHOLD_PREFIX = "w3a";
-	}
-	return normalized;
-}
-function createAuthServiceConfig(input) {
-	const networkId = normalizeTrimmedString(input.networkId) || AUTH_SERVICE_CONFIG_DEFAULTS.networkId;
-	const config = {
-		relayerAccount: normalizeTrimmedString(input.relayerAccount),
-		relayerPrivateKey: normalizeTrimmedString(input.relayerPrivateKey),
-		nearRpcUrl: normalizeTrimmedString(input.nearRpcUrl) || defaultNearRpcUrl(networkId),
-		networkId,
-		accountInitialBalance: normalizeTrimmedString(input.accountInitialBalance) || AUTH_SERVICE_CONFIG_DEFAULTS.accountInitialBalance,
-		createAccountAndRegisterGas: normalizeTrimmedString(input.createAccountAndRegisterGas) || AUTH_SERVICE_CONFIG_DEFAULTS.createAccountAndRegisterGas,
-		signerWasm: input.signerWasm,
-		thresholdStore: normalizeThresholdStoreConfig(input.thresholdStore),
-		logger: input.logger,
-		googleOidc: normalizeGoogleOidcConfig(input.googleOidc),
-		githubOAuth: normalizeGithubOAuthConfig(input.githubOAuth)
-	};
-	validateConfigs(config);
-	return config;
-}
-function validateConfigs(config) {
-	for (const key of ["relayerAccount", "relayerPrivateKey"]) if (!config[key]) throw new Error(`Missing required config variable: ${key}`);
-	if (!config.relayerPrivateKey?.startsWith("ed25519:")) throw new Error("Relayer private key must be in format \"ed25519:base58privatekey\"");
-}
 function parseBool(v) {
 	const s = String(v ?? "").trim().toLowerCase();
 	return s === "1" || s === "true" || s === "yes" || s === "on";
@@ -105,6 +11,6 @@ function requireEnvVar(env, name) {
 	return v;
 }
 //#endregion
-export { AUTH_SERVICE_CONFIG_DEFAULTS, createAuthServiceConfig, parseBool, requireEnvVar, validateConfigs };
+export { parseBool, requireEnvVar };
 
 //# sourceMappingURL=config.js.map

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -1,8 +1,8 @@
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
-import { parseD1JsonColumn } from "../storage/d1Sql.js";
 import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
 //#region src/core/d1EcdsaSignerRead.ts
 function prepareWalletEcdsaSignersRead(database, scope, walletId) {
 	return database.prepare(`SELECT record_json FROM wallet_signers

package/dist/esm/core/d1Ed25519SignerRead.js

@@ -0,0 +1,55 @@
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { selectWalletEd25519Signer } from "./d1WalletStore.js";
+import { resolveRouterAbEd25519YaoActiveCapability } from "../router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
+import { parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1 } from "../router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+//#region src/core/d1Ed25519SignerRead.ts
+/** Signer rows read with a Wallet Session; a failure surfaces after session validation. */
+var Ed25519SignerRead = class Ed25519SignerRead {
+	#result;
+	constructor(walletId, activation, result, capabilities) {
+		this.walletId = walletId;
+		this.activation = activation;
+		this.capabilities = capabilities;
+		this.#result = result;
+	}
+	static fromRows(walletId, activation, rows, capabilityPartition) {
+		let result;
+		let capabilities = null;
+		try {
+			if (!Array.isArray(rows) || !rows.every(isPlainObject)) throw new Error("Ed25519 material rows are invalid");
+			result = {
+				ok: true,
+				signer: selectWalletEd25519Signer(rows, walletId, activation)
+			};
+			if (capabilityPartition !== null) {
+				const partition = parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(capabilityPartition);
+				if (partition?.kind !== "router_ab_ed25519_yao_product_registration_shared_record_v1") throw new Error("Ed25519 capability partition is invalid");
+				capabilities = partition.value.recoveryCapabilities;
+			}
+		} catch (error) {
+			result = {
+				ok: false,
+				message: error instanceof Error ? error.message : "Ed25519 material read failed"
+			};
+		}
+		return new Ed25519SignerRead(walletId, activation, result, capabilities);
+	}
+	resolveActiveCapability(input) {
+		if (input.walletId !== this.walletId) throw new Error("Ed25519 capability read belongs to another wallet");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		if (!this.capabilities) return null;
+		const result = resolveRouterAbEd25519YaoActiveCapability(this.capabilities, input);
+		return !result.ok && result.code === "unknown_capability" ? null : result;
+	}
+	/** The session wallet's signer for the activation this read selected, or null. */
+	resolve(walletId, activation) {
+		if (walletId !== this.walletId || !sameRouterAbMpcMaterialActivationRef(activation, this.activation)) throw new Error("Ed25519 material read does not match the requested activation");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		return this.#result.signer;
+	}
+};
+//#endregion
+export { Ed25519SignerRead };
+
+//# sourceMappingURL=d1Ed25519SignerRead.js.map