@seams/wallet-server 0.15.4 → 0.17.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js

@@ -2,6 +2,7 @@ import { emailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpWallet
 import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.ts
 var CloudflareD1EmailOtpEnrollmentStore = class {
+	prepare;
 	constructor(input) {
 		this.prepare = input.prepare;
 	}

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -2,6 +2,7 @@ import { parseEmailOtpGrantRow } from "./d1EmailOtpRecords.js";
 import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.ts
 var CloudflareD1EmailOtpGrantStore = class {
+	prepare;
 	constructor(input) {
 		this.prepare = input.prepare;
 	}

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -73,6 +73,10 @@ function emailOtpEnrollmentTenantMismatch() {
 	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 var CloudflareD1EmailOtpRecoveryService = class {
+	emailOtpChallenges;
+	emailOtpEnrollments;
+	emailOtpGrants;
+	emailOtpRateLimits;
 	constructor(input) {
 		this.emailOtpChallenges = input.emailOtpChallenges;
 		this.emailOtpEnrollments = input.emailOtpEnrollments;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -15,6 +15,8 @@ function parseEmailOtpEnrollmentMaterialBoundaryInput(value) {
 	};
 }
 var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
+	emailOtpEnrollments;
+	googleEmailOtpSessions;
 	constructor(input) {
 		this.emailOtpEnrollments = input.emailOtpEnrollments;
 		this.googleEmailOtpSessions = input.googleEmailOtpSessions;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js

@@ -13,6 +13,7 @@ const removeEmailOtpServerSealOperation = {
 	failureMessage: "Failed to remove Email OTP server seal"
 };
 var CloudflareD1EmailOtpServerSealRuntime = class {
+	cipherResult;
 	constructor(config) {
 		this.config = config;
 		this.cipherResult = this.createCipher();

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -7,6 +7,9 @@ import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Stat
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
+	prepare;
+	orgId;
+	batch;
 	constructor(input) {
 		this.prepare = input.prepare;
 		this.orgId = input.orgId;

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -9,6 +9,12 @@ import { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtp
 import { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject } from "../identity/d1IdentityRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.ts
 var CloudflareD1GoogleEmailOtpSessionResolver = class {
+	emailOtpEnrollments;
+	emailOtpRateLimits;
+	identityStore;
+	linkIdentity;
+	production;
+	registrationAttempts;
 	constructor(input) {
 		this.emailOtpEnrollments = input.emailOtpEnrollments;
 		this.emailOtpRateLimits = input.emailOtpRateLimits;

package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js

@@ -5,6 +5,7 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1IdentityService = class {
+	identityStore;
 	constructor(input) {
 		this.identityStore = input.identityStore;
 	}

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -41,10 +41,8 @@ function parseGoogleJwks(input) {
 	return keysByKid.size > 0 ? keysByKid : null;
 }
 var CloudflareD1OidcJwksCache = class {
-	constructor() {
-		this.googleJwksCache = null;
-		this.googleJwksFetchPromise = null;
-	}
+	googleJwksCache = null;
+	googleJwksFetchPromise = null;
 	async getGoogleJwks() {
 		const nowMs = Date.now();
 		if (this.googleJwksCache && nowMs < this.googleJwksCache.expiresAtMs) return this.googleJwksCache;

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -7,6 +7,10 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1OidcVerificationService = class {
+	googleOidcClientId;
+	githubOAuth;
+	identityStore;
+	linkIdentity;
 	constructor(input) {
 		this.googleOidcClientId = input.googleOidcClientId;
 		this.githubOAuth = input.githubOAuth;

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js

@@ -134,6 +134,10 @@ function passkeyCustodyEnvelopeLocatorOf(envelope) {
 	return envelopeLocator(envelope);
 }
 var CloudflareD1PasskeyCustodyEnvelopeStore = class {
+	records;
+	activityRecords;
+	database;
+	scope;
 	constructor(options) {
 		this.database = options.database;
 		this.scope = options.scope;

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js

@@ -125,6 +125,13 @@ function isRecoveryCodeLocatorCollision(error) {
 	return message.includes("wallet_recovery_code_locators") && /unique|constraint/i.test(message);
 }
 var CloudflareD1WalletCustodyCommitStore = class {
+	recoveryRouting;
+	credentialClaims;
+	database;
+	scope;
+	records;
+	walletAuthMethodStore;
+	walletAuthorityStore;
 	constructor(options) {
 		this.credentialClaims = options.credentialClaims;
 		this.recoveryRouting = options.recoveryRouting;

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.js

@@ -11,6 +11,7 @@ function encodeAttempt(record) {
 * challenge binding do.
 */
 var CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore = class {
+	records;
 	constructor(input) {
 		this.records = createCloudflareD1VersionedJsonRecordStore({
 			database: input.database,

package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js

@@ -19,6 +19,14 @@ import { buildConsumedRecoverySet, buildRecoveredWalletAuthority, parseRecoveryA
 * and factor unsealing stay in their existing services.
 */
 var CloudflareD1WalletRecoveryGoogleEmailOtpService = class {
+	attempts;
+	google;
+	issuer;
+	verifier;
+	enrollments;
+	serverSeal;
+	orgId;
+	nowMs;
 	constructor(input) {
 		this.attempts = input.attempts;
 		this.google = input.google;

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js

@@ -27,6 +27,9 @@ var D1RegistrationCeremonyRecordConflictError = class extends Error {
 	}
 };
 var D1RegistrationCeremonyRecordStore = class {
+	database;
+	tenantScope;
+	keyPrefix;
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Registration ceremony D1 database is required");
 		this.database = options.database;

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -6,6 +6,7 @@ import { parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerIntent, parseD1
 import { retryTransientD1 } from "../../../../storage/d1Retry.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.ts
 var CloudflareD1RegistrationCeremonyIntentStore = class {
+	storage;
 	constructor(input) {
 		this.input = input;
 		this.storage = new D1RegistrationCeremonyRecordStore(input);

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -12,6 +12,7 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1RegistrationIntentService = class {
+	getRegistrationCeremonyIntentStore;
 	constructor(input) {
 		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
 	}

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.js

@@ -1,10 +1,10 @@
 //#region src/router/cloudflare/d1/registration/d1RegistrationSessionTransaction.ts
 /** The wallet's version checks and the session's winner read share one batch. */
 var D1RegistrationSessionTransaction = class {
+	sessionResults = null;
 	constructor(database, commitWallet) {
 		this.database = database;
 		this.commitWallet = commitWallet;
-		this.sessionResults = null;
 	}
 	async execute(sessionStatements) {
 		await this.commitWallet(this.commit.bind(this, sessionStatements));

package/dist/esm/router/cloudflare/d1/registration/d1WalletOperationStore.js

@@ -3,6 +3,8 @@ import { D1WalletCeremonyActivity } from "../ed25519Yao/d1WalletCeremonyActivity
 import { lifecycleWriteFenceStatements } from "../ed25519Yao/d1Ed25519YaoStateWriteFence.js";
 //#region src/router/cloudflare/d1/registration/d1WalletOperationStore.ts
 var D1WalletOperationStore = class {
+	records;
+	activity;
 	constructor(options, walletId) {
 		this.options = options;
 		this.walletId = walletId;

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -239,6 +239,9 @@ function heldClaimCovers(held, authority) {
 	return held !== null && held.walletId === authority.walletId && held.rpId === authority.rpId && held.credentialIdB64u === authority.credentialIdB64u;
 }
 var CloudflareD1WalletRegistrationCommitStore = class {
+	database;
+	scope;
+	credentialClaims;
 	constructor(input) {
 		this.credentialClaims = input.credentialClaims;
 		this.database = input.database;

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -856,6 +856,30 @@ function mergeRouterServerTiming(target, header) {
 	}
 }
 var CloudflareD1WalletRegistrationService = class {
+	executionAuthority;
+	registrationAuthority;
+	authorizationService;
+	registrationSessionStore;
+	authorizationTenantId;
+	createSponsoredNamedNearAccount;
+	emailOtpRegistrationEnrollmentFinalizer;
+	getRegistrationCeremonyIntentStore;
+	getEd25519YaoProductRegistration;
+	ecdsaStrictRegistration;
+	tenantRootCustodyLineage;
+	getWalletStore;
+	/** The single Gateway operation row for activate-with-finalize. */
+	activateSideEffects;
+	/** Registration admission and state loaded in one database snapshot. */
+	registrationRead;
+	walletRegistrationCommitStore;
+	/** Where a ceremony's sealed custody seed and its recovery set land. */
+	walletCustodyCommitStore;
+	walletAuthMethods;
+	getLinkedDeviceEd25519AuthorityReader;
+	yaoLifecycleDecisions;
+	home;
+	startRegistrationWallets;
 	constructor(input) {
 		this.home = input.home;
 		this.executionAuthority = input.executionAuthority;

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -6,6 +6,9 @@ import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signi
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
 var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
+	database;
+	storageNamespace;
+	now;
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Router A/B normal-signing admission D1 database is required");
 		this.database = options.database;

package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js

@@ -6,6 +6,7 @@ import { containsControlCharacter } from "../../durableObjects/versionedJsonReco
 const TABLE_NAME = "router_ab_yao_versioned_json_records";
 const CAS_GUARD_SQL = D1_BATCH_CAS_GUARD_SQL;
 var CloudflareD1VersionedJsonRecordStoreError = class extends Error {
+	code;
 	constructor(code, message) {
 		super(message);
 		this.name = "CloudflareD1VersionedJsonRecordStoreError";
@@ -13,6 +14,11 @@ var CloudflareD1VersionedJsonRecordStoreError = class extends Error {
 	}
 };
 var CloudflareD1VersionedJsonRecordStore = class {
+	database;
+	scope;
+	encode;
+	parse;
+	keyPrefix;
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Cloudflare D1 versioned JSON database is required");
 		this.database = options.database;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -372,6 +372,17 @@ function sameEcdsaSignerActivation(left, right) {
 	return left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
 }
 var CloudflareD1WalletAddSignerService = class {
+	executionAuthority;
+	getRegistrationCeremonyIntentStore;
+	getEd25519YaoProductRegistration;
+	ecdsaStrictRegistration;
+	tenantRootCustodyLineage;
+	getWalletStore;
+	walletAuthMethods;
+	passkeyCustodyEnvelopes;
+	startSideEffects;
+	finalizeSideEffects;
+	yaoLifecycleDecisions;
 	constructor(input) {
 		this.executionAuthority = input.executionAuthority;
 		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js

@@ -17,6 +17,8 @@ async function computeWalletAuthMethodRevocationProofDigestV1(proof) {
 * row is inserted in the batch that revokes the method, and never changes.
 */
 var D1WalletAuthMethodRevocationReplayStoreV1 = class {
+	database;
+	scope;
 	constructor(input) {
 		this.database = input.database;
 		this.scope = input.scope;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -247,6 +247,22 @@ async function buildAddedPasskeyCredentialBinding(input) {
 	return binding;
 }
 var CloudflareD1WalletAuthMethodService = class {
+	emailOtpChallengeVerifier;
+	emailOtpEnrollmentChallengeIssuer;
+	emailOtpSourceChallengeIssuer;
+	emailOtpEnrollmentFinalizer;
+	getRegistrationCeremonyIntentStore;
+	getWalletAuthMethodStore;
+	googleEmailOtpRegistrationAttempts;
+	passkeyCustodyEnvelopes;
+	sha256Bytes;
+	webAuthnStore;
+	listWalletEd25519Signers;
+	walletAuthorityStore;
+	orgId;
+	verifyWebAuthnAuthenticationLite;
+	prepareOwnerWalletSessionRevocation;
+	revocationReplays;
 	constructor(input) {
 		this.emailOtpChallengeVerifier = input.emailOtpChallengeVerifier;
 		this.emailOtpEnrollmentChallengeIssuer = input.emailOtpEnrollmentChallengeIssuer;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -275,13 +275,15 @@ function prepareD1WalletAuthorityExtensionCasGuard(database) {
   `);
 }
 var WalletAuthorityCommitConflictError = class extends Error {
+	kind = "wallet_authority_commit_conflict";
 	constructor(authorityId) {
 		super(`wallet authority ${String(authorityId)} commit conflicts with an existing record`);
-		this.kind = "wallet_authority_commit_conflict";
 		this.name = "WalletAuthorityCommitConflictError";
 	}
 };
 var D1WalletAuthorityStore = class {
+	database;
+	scope;
 	constructor(input) {
 		this.database = input.database;
 		this.scope = normalizeScope(input.scope ?? {

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -14,6 +14,10 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 var CloudflareD1WebAuthnAuthService = class {
+	lifecycleRouting;
+	webAuthnStore;
+	walletManifestSource;
+	walletAuthMethodStore;
 	constructor(input) {
 		this.lifecycleRouting = input.lifecycleRouting;
 		this.webAuthnStore = input.webAuthnStore;

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js

@@ -18,8 +18,11 @@ function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
 	return prepareAuthenticatorStatement(INSERT_WEBAUTHN_AUTHENTICATOR_SQL, input);
 }
 var CloudflareD1WebAuthnStore = class {
+	syncChallenges;
+	database;
+	scope;
+	credentialClaims;
 	constructor(input) {
-		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
 		this.credentialClaims = input.credentialClaims;
 		this.syncChallenges = input.syncChallenges;
 		this.database = input.database;
@@ -179,6 +182,7 @@ var CloudflareD1WebAuthnStore = class {
 	async consumeChallenge(input) {
 		return await webAuthnChallengeRows.consume(this.prepare, input.challengeId, input.challengeKind, Date.now()).first();
 	}
+	prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
 };
 //#endregion
 export { CloudflareD1WebAuthnStore, prepareD1WebAuthnAuthenticatorInsertStatement, prepareD1WebAuthnAuthenticatorPutStatement };

package/dist/esm/router/cloudflare/durableObjects/versionedJsonRecordStore.js

@@ -2,6 +2,7 @@ import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/nor
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 //#region src/router/cloudflare/durableObjects/versionedJsonRecordStore.ts
 var CloudflareVersionedJsonRecordStoreError = class extends Error {
+	code;
 	constructor(code, message) {
 		super(message);
 		this.name = "CloudflareVersionedJsonRecordStoreError";
@@ -9,6 +10,11 @@ var CloudflareVersionedJsonRecordStoreError = class extends Error {
 	}
 };
 var CloudflareDurableObjectVersionedJsonRecordStore = class {
+	namespace;
+	objectNameForKey;
+	encode;
+	parse;
+	keyPrefix;
 	constructor(options) {
 		if (!isDurableObjectNamespaceLike(options.namespace)) throw new Error("Cloudflare Durable Object namespace is required");
 		if (typeof options.objectNameForKey !== "function") throw new Error("Cloudflare versioned JSON object-name resolver is required");

package/dist/esm/router/cloudflare/runtime/ed25519SessionAdapter.js

@@ -4,6 +4,12 @@ import { SessionService } from "../../../core/SessionService.js";
 import { CrossSiteSessionCookieAdapter, encodeSessionJsonSegment, normalizeSessionString, normalizeSessionTtlSeconds, parseSessionJwt, requireNormalizedSessionString, sessionJwtTimeClaims, toSessionArrayBufferCopy } from "./sessionAdapterRuntime.js";
 //#region src/router/cloudflare/runtime/ed25519SessionAdapter.ts
 var Ed25519SessionJwtAdapter = class {
+	issuer;
+	audience;
+	keyId;
+	ttlSeconds;
+	signingKey;
+	verifyingKey;
 	constructor(options) {
 		this.options = options;
 		this.issuer = requireNormalizedSessionString(options.issuer, "Ed25519 session issuer");