@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/authService/AuthService.d.ts

@@ -0,0 +1,493 @@
+import { type AccessKeyList } from '../rpcClients/near/NearClient';
+import type { FinalExecutionOutcome } from '@near-js/types';
+import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from '../../../../shared-ts/src/utils/emailOtpDomain';
+import type { RouterAbNormalSigningRuntime } from '../routerAbSigning/RouterAbNormalSigningRuntime';
+import type { RouterAbEcdsaPresignRuntime } from '../routerAbSigning/RouterAbEcdsaPresignRuntime';
+import type { AuthServiceConfigInput, AccountCreationRequest, AccountCreationResult, FundImplicitNearAccountRequest, FundImplicitNearAccountResult, ThresholdRuntimePolicyScope, WebAuthnAuthenticationCredential } from '../types';
+import type { GoogleEmailOtpResolutionResult } from './googleEmailOtpRegistration';
+export type { GoogleEmailOtpRegistrationOffer, GoogleEmailOtpRegistrationOfferCandidate, GoogleEmailOtpResolutionMode, GoogleEmailOtpResolutionResult, } from './googleEmailOtpRegistration';
+import { type GoogleProviderSubject, type VerifiedGoogleEmail, type WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
+import { type DelegateActionPolicy, type ExecuteSignedDelegateResult, type RelayedSignedDelegate } from '../../delegateAction';
+import { type WebAuthnAuthenticatorListResult, type WebAuthnSyncAccountVerificationRequest, type WebAuthnSyncAccountVerificationResult, type WebAuthnSyncAccountOptionsResult, type WebAuthnLoginVerificationResult } from './webauthn';
+import { type EmailOtpOutboxReadResult } from './emailOtpDelivery';
+import { type EmailOtpServerSealRequest, type EmailOtpServerSealResult } from './emailOtpSeal';
+import { type EmailOtpEnrollmentReadResult, type EmailOtpStrongAuthRequiredResult, type EmailOtpStrongAuthSatisfiedResult } from './emailOtpEnrollment';
+import { type EmailOtpGrantConsumeRequest, type EmailOtpGrantConsumeResult } from './emailOtpGrant';
+import { type GoogleLoginFacadeResult } from './oidcVerification';
+import { type GithubOAuthCodeFacadeResult, type GithubOAuthPublicConfig } from './githubOAuth';
+import type { ListIdentitiesResult } from './identity';
+import { type EmailOtpChannel, type EmailOtpLoginChallengeOperation } from '../EmailOtpStores';
+import { type NearPublicKeyKind } from '../NearPublicKeyStore';
+import { type ListNearPublicKeysResult, type RecordNearPublicKeyMetadataResult } from './nearPublicKeyMetadata';
+import { type LinkIdentityResult, type UnlinkIdentityResult } from '../IdentityStore';
+/**
+ * Framework-agnostic NEAR account service
+ * Core business logic for account creation and registration operations
+ */
+export declare class AuthService {
+    private config;
+    private nearClient;
+    private runtimeState;
+    private readonly logger;
+    private readonly stores;
+    private readonly nearAccounts;
+    private routerAbSigningRuntimeState;
+    private readonly emailOtpMemoryOutbox;
+    private registrationRuntimeWarmPromise;
+    private readonly googleJwksState;
+    constructor(config: AuthServiceConfigInput);
+    getRelayerAccount(): Promise<{
+        accountId: string;
+        publicKey: string;
+    }>;
+    /**
+     * Lightweight config accessor (no RPC) for diagnostics and well-known endpoints.
+     * This is safe to call even when the relayer account has not been warmed/validated yet.
+     */
+    getConfiguredRelayerAccount(): string;
+    isGoogleOidcConfigured(): boolean;
+    getGoogleOidcPublicConfig(): {
+        configured: boolean;
+        clientId?: string;
+    };
+    getGithubOAuthPublicConfig(): GithubOAuthPublicConfig;
+    private consumeGoogleEmailOtpRegistrationRateLimitScope;
+    private googleEmailOtpOperationsInput;
+    resolveOidcWalletId(input: {
+        providerSubject?: string;
+        sub?: string;
+        email?: string;
+        accountMode?: unknown;
+        runtimePolicyScope?: ThresholdRuntimePolicyScope;
+        restartRegistrationOffer?: unknown;
+    }): Promise<string>;
+    private cleanupGoogleEmailOtpRegistrationAttempts;
+    consumeGoogleEmailOtpRegistrationAttemptRateLimit(input: {
+        providerSubject?: unknown;
+        email?: unknown;
+        accountMode?: unknown;
+        runtimePolicyScope?: ThresholdRuntimePolicyScope;
+        clientIp?: string;
+        providerUserId?: string;
+        restartRegistrationOffer?: unknown;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: 'invalid_body' | 'rate_limited';
+        message: string;
+        retryAfterMs?: number;
+        resetAtMs?: number;
+    }>;
+    resolveGoogleEmailOtpSession(input: {
+        providerSubject?: string | GoogleProviderSubject;
+        sub?: string;
+        email?: string | VerifiedGoogleEmail;
+        accountMode?: unknown;
+        runtimePolicyScope?: ThresholdRuntimePolicyScope;
+        restartRegistrationOffer?: unknown;
+    }): Promise<GoogleEmailOtpResolutionResult>;
+    completeGoogleEmailOtpRegistrationAttempt(input: {
+        registrationAttemptId?: unknown;
+        walletId?: unknown;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    validateGoogleEmailOtpRegistrationCandidateWallet(input: {
+        registrationAttemptId: string;
+        walletId: string;
+        ownerProofBindingDigest: string;
+        providerSubject: string;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    recordGoogleEmailOtpRegistrationAttemptPublicKey(input: {
+        registrationAttemptId?: unknown;
+        walletId?: unknown;
+        finalizedPublicKey?: unknown;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    failGoogleEmailOtpRegistrationAttempt(input: {
+        registrationAttemptId?: unknown;
+        walletId?: unknown;
+        failureCode?: unknown;
+    }): Promise<void>;
+    cleanupGoogleEmailOtpDevRegistrationState(input: {
+        providerSubject?: unknown;
+        walletId?: unknown;
+        orgId?: unknown;
+        nowMs?: unknown;
+    }): Promise<{
+        ok: true;
+        providerSubject: string;
+        expiredRegistrationAttemptsDeleted: number;
+        linkedWalletId?: string;
+        orphanedWalletMappingRemoved: boolean;
+        orphanedWalletMappingSkippedReason?: 'no_linked_wallet' | 'wallet_id_mismatch' | 'not_relayer_subaccount' | 'active_email_otp_enrollment' | 'mismatched_email_otp_enrollment';
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    warmRegistrationRuntime(): Promise<void>;
+    viewAccessKeyList(accountId: string): Promise<AccessKeyList>;
+    dispatchNearSignedTransactionBorsh(input: {
+        signedTransactionBorshB64u: string;
+    }): Promise<{
+        rpcResult: FinalExecutionOutcome;
+    }>;
+    getRouterAbNormalSigningRuntime(): RouterAbNormalSigningRuntime | null;
+    getRouterAbEcdsaPresignRuntime(): RouterAbEcdsaPresignRuntime | null;
+    private getRouterAbSigningRuntimeState;
+    private isProductionEnvironment;
+    private readConfigValue;
+    private resolveEmailOtpRateLimitPolicies;
+    private consumeEmailOtpRateLimit;
+    private resolveEmailOtpConfig;
+    private createEmailOtpShamirCipher;
+    private deliverEmailOtpCode;
+    private identityOperations;
+    listIdentities(input: {
+        userId: string;
+    }): Promise<ListIdentitiesResult>;
+    linkIdentity(input: {
+        userId: string;
+        subject: string;
+        allowMoveIfSoleIdentity?: boolean;
+    }): Promise<LinkIdentityResult>;
+    unlinkIdentity(input: {
+        userId: string;
+        subject: string;
+    }): Promise<UnlinkIdentityResult>;
+    recordNearPublicKeyMetadata(input: {
+        userId?: unknown;
+        publicKey?: unknown;
+        kind: NearPublicKeyKind;
+        signerSlot?: unknown;
+        credentialIdB64u?: unknown;
+        rpId?: unknown;
+        addedTxHash?: unknown;
+        removedAtMs?: unknown;
+        source?: string;
+    }): Promise<RecordNearPublicKeyMetadataResult>;
+    txStatus(txHash: string, senderAccountId: string): Promise<FinalExecutionOutcome>;
+    private _ensureSignerAndRelayerAccount;
+    private ensureSignerWasm;
+    private isNodeEnvironment;
+    /**
+     * ===== Registration & authentication =====
+     *
+     * Helpers for creating accounts, registering WebAuthn credentials,
+     * and verifying authentication responses.
+     */
+    /**
+     * Create a new account with the specified balance
+     */
+    createAccount(request: AccountCreationRequest): Promise<AccountCreationResult>;
+    fundImplicitNearAccount(request: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
+    private verifyRegistrationCredentialForIntent;
+    /**
+     * Standard WebAuthn assertion verification for lite flows.
+     *
+     * This verifies:
+     * - the assertion signature against the credential public key stored in relay-private storage,
+     * - the RP ID hash against `rpId`,
+     * - the challenge against `expectedChallenge` (base64url string),
+     * - and that `clientDataJSON.origin` is within the RP ID domain.
+     *
+     * Notes:
+     * - This intentionally does not involve on-chain challenge proofs or `verify_authentication_response`.
+     * - Replay protection is handled by upstream protocol bindings (e.g., unique sessionPolicyDigest32 via sessionId).
+     */
+    verifyWebAuthnAuthenticationLite(input: {
+        userId: string;
+        rpId: WebAuthnRpId;
+        expectedChallenge: string;
+        webauthn_authentication: WebAuthnAuthenticationCredential;
+        expected_origin: string;
+    }): Promise<{
+        success: boolean;
+        verified: boolean;
+        code?: string;
+        message?: string;
+    }>;
+    /**
+     * List WebAuthn authenticators for the given user.
+     *
+     * This is relay-private state (no on-chain authenticator registry).
+     * Intended for UI surfaces like "Linked Devices" in the SDK.
+     */
+    listWebAuthnAuthenticatorsForUser(input: {
+        userId: string;
+        rpId?: string;
+    }): Promise<WebAuthnAuthenticatorListResult>;
+    listNearPublicKeysForUser(input: {
+        userId: string;
+    }): Promise<ListNearPublicKeysResult>;
+    createWebAuthnLoginOptions(request: {
+        userId?: unknown;
+        user_id?: unknown;
+        rpId?: unknown;
+        rp_id?: unknown;
+        ttlMs?: unknown;
+        ttl_ms?: unknown;
+    }): Promise<{
+        ok: boolean;
+        challengeId?: string;
+        challengeB64u?: string;
+        expiresAtMs?: number;
+        code?: string;
+        message?: string;
+    }>;
+    verifyWebAuthnLogin(request: {
+        challengeId?: unknown;
+        challenge_id?: unknown;
+        webauthn_authentication?: unknown;
+        expected_origin?: string;
+    }): Promise<WebAuthnLoginVerificationResult>;
+    createEmailOtpUnlockChallenge(request: {
+        walletId?: unknown;
+        orgId?: unknown;
+        ttlMs?: unknown;
+        ttl_ms?: unknown;
+    }): Promise<{
+        ok: true;
+        walletId: string;
+        challengeId: string;
+        challengeB64u: string;
+        expiresAtMs: number;
+        unlockKeyVersion: string;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+        lockedUntilMs?: number;
+    }>;
+    verifyEmailOtpUnlockProof(request: {
+        walletId?: unknown;
+        orgId?: unknown;
+        challengeId?: unknown;
+        unlockProof?: unknown;
+    }): Promise<{
+        ok: true;
+        verified: true;
+        userId: string;
+        walletId: string;
+        providerUserId: string;
+        orgId: string;
+        enrollmentId: string;
+        enrollmentSealKeyVersion: string;
+        unlockKeyVersion: string;
+    } | {
+        ok: false;
+        verified: false;
+        code: string;
+        message: string;
+    }>;
+    private pruneExpiredEmailOtpChallenges;
+    private readEmailOtpAuthStateForEnrollment;
+    private putEmailOtpAuthStateForEnrollment;
+    private createEmailOtpChallengeWithAction;
+    private emailOtpChallengeOperationsInput;
+    createEmailOtpChallenge(request: {
+        userId?: unknown;
+        walletId?: unknown;
+        orgId?: unknown;
+        email?: unknown;
+        otpChannel?: unknown;
+        ownerProofBindingDigest?: unknown;
+        clientIp?: unknown;
+        operation?: unknown;
+        reuseActiveChallenge?: unknown;
+    }): Promise<{
+        ok: true;
+        challenge: {
+            challengeId: string;
+            issuedAtMs: number;
+            expiresAtMs: number;
+            userId: string;
+            walletId: string;
+            orgId: string;
+            otpChannel: EmailOtpChannel;
+            ownerProofBindingDigest: string;
+            action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+            operation: EmailOtpLoginChallengeOperation;
+        };
+        delivery: {
+            status: 'sent' | 'reused';
+            mode: 'email_provider' | 'log' | 'memory';
+            emailHint: string;
+        };
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    createEmailOtpEnrollmentChallenge(request: {
+        userId?: unknown;
+        walletId?: unknown;
+        orgId?: unknown;
+        email?: unknown;
+        otpChannel?: unknown;
+        ownerProofBindingDigest?: unknown;
+        clientIp?: unknown;
+        operation?: unknown;
+    }): Promise<{
+        ok: true;
+        challenge: {
+            challengeId: string;
+            issuedAtMs: number;
+            expiresAtMs: number;
+            userId: string;
+            walletId: string;
+            orgId: string;
+            otpChannel: EmailOtpChannel;
+            ownerProofBindingDigest: string;
+            action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
+            operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+        };
+        delivery: {
+            mode: 'email_provider' | 'log' | 'memory';
+            emailHint: string;
+        };
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    private verifyEmailOtpChallengeCode;
+    verifyEmailOtpChallenge(request: {
+        userId?: unknown;
+        walletId?: unknown;
+        orgId?: unknown;
+        challengeId?: unknown;
+        otpCode?: unknown;
+        otpChannel?: unknown;
+        ownerProofBindingDigest?: unknown;
+        clientIp?: unknown;
+        operation?: unknown;
+    }): Promise<{
+        ok: true;
+        challengeId: string;
+        loginGrant: string;
+        grantExpiresAtMs: number;
+        otpChannel: EmailOtpChannel;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+        attemptsRemaining?: number;
+        lockedUntilMs?: number;
+    }>;
+    verifyEmailOtpEnrollment(request: {
+        /** Provider subject that requested the registration OTP. */
+        providerSubject: unknown;
+        walletId: unknown;
+        orgId: unknown;
+        challengeId: unknown;
+        otpCode: unknown;
+        otpChannel: unknown;
+        ownerProofBindingDigest: unknown;
+        /** Email asserted by the registration proof. It must match the challenged email. */
+        proofEmail?: unknown;
+        clientIp?: unknown;
+        enrollmentSealKeyVersion?: unknown;
+        serverSealedFactorCiphertextB64u?: unknown;
+        clientUnlockPublicKeyB64u?: unknown;
+        unlockKeyVersion?: unknown;
+        googleEmailOtpRegistrationAttemptId?: unknown;
+    }): Promise<{
+        ok: true;
+        walletId: string;
+        otpChannel: EmailOtpChannel;
+        enrollment: {
+            createdAtMs: number;
+            updatedAtMs: number;
+            enrollmentSealKeyVersion: string;
+            unlockKeyVersion: string;
+        };
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+        attemptsRemaining?: number;
+        lockedUntilMs?: number;
+    }>;
+    readEmailOtpEnrollment(request: {
+        walletId?: unknown;
+        orgId: unknown;
+    }): Promise<EmailOtpEnrollmentReadResult>;
+    readActiveEmailOtpEnrollment(request: {
+        walletId?: unknown;
+        orgId: unknown;
+        providerUserId?: unknown;
+    }): Promise<EmailOtpEnrollmentReadResult>;
+    isEmailOtpStrongAuthRequired(request: {
+        walletId?: unknown;
+    }): Promise<EmailOtpStrongAuthRequiredResult>;
+    markEmailOtpStrongAuthSatisfied(request: {
+        walletId?: unknown;
+    }): Promise<EmailOtpStrongAuthSatisfiedResult>;
+    consumeEmailOtpGrant(request: EmailOtpGrantConsumeRequest): Promise<EmailOtpGrantConsumeResult>;
+    readEmailOtpOutboxEntry(request: {
+        challengeId?: unknown;
+        userId?: unknown;
+        walletId?: unknown;
+    }): Promise<EmailOtpOutboxReadResult>;
+    removeEmailOtpServerSeal(request: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
+    applyEmailOtpServerSeal(request: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
+    verifyGithubOAuthCode(request: {
+        code?: unknown;
+    }): Promise<GithubOAuthCodeFacadeResult>;
+    verifyGoogleLogin(request: {
+        idToken?: unknown;
+        id_token?: unknown;
+    }): Promise<GoogleLoginFacadeResult>;
+    createWebAuthnSyncAccountOptions(request: {
+        rp_id?: unknown;
+        account_id?: unknown;
+        ttl_ms?: unknown;
+        ttlMs?: unknown;
+    }): Promise<WebAuthnSyncAccountOptionsResult>;
+    verifyWebAuthnSyncAccount(request: WebAuthnSyncAccountVerificationRequest): Promise<WebAuthnSyncAccountVerificationResult>;
+    /**
+     * Account existence helper used by registration flows.
+     */
+    checkAccountExists(accountId: string): Promise<boolean>;
+    /**
+     * ===== Delegate actions & transaction execution =====
+     *
+     * Flows that build and submit on-chain transactions, including NEP-461
+     * SignedDelegate meta-transactions.
+     */
+    /**
+     * Execute a NEP-461 SignedDelegate by wrapping it in an outer transaction
+     * from the relayer account. This method is intended to be called by
+     * example relayers (Node/Cloudflare) once a SignedDelegate has been
+     * produced by the signer worker and returned to the application.
+     *
+     * Notes:
+     * - Signature and hash computation are performed by the signer worker.
+     *   This method focuses on expiry/policy enforcement and meta-tx submission.
+     * - Nonce/replay protection is left to the integrator; see docs for guidance.
+     */
+    executeSignedDelegate(input: {
+        hash: string;
+        signedDelegate: RelayedSignedDelegate;
+        policy?: DelegateActionPolicy;
+    }): Promise<ExecuteSignedDelegateResult>;
+}
+//# sourceMappingURL=AuthService.d.ts.map

package/dist/types/wallet-server/src/core/authService/bytes.d.ts

@@ -0,0 +1,4 @@
+export declare function randomBase64Url(bytes: number): string;
+export declare function randomOpaqueId(byteLength?: number): string;
+export declare function randomNumericCode(length: number): string;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/types/wallet-server/src/core/authService/configValues.d.ts

@@ -0,0 +1,7 @@
+export type AuthServiceConfigSource = Record<string, unknown> | null | undefined;
+export declare function isAuthServiceProductionEnvironment(): boolean;
+export declare function readAuthServiceConfigValue(input: {
+    thresholdStore: AuthServiceConfigSource;
+    name: string;
+}): string;
+//# sourceMappingURL=configValues.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts

@@ -0,0 +1,108 @@
+import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from '../../../../shared-ts/src/utils/emailOtpDomain';
+import { type EmailOtpChannel, type EmailOtpGrantStore, type EmailOtpLoginChallengeOperation } from '../EmailOtpStores';
+import type { EmailOtpConfig } from './emailOtpConfig';
+import { type CreateEmailOtpChallengeWithActionRequest, type CreateEmailOtpChallengeWithActionResult } from './emailOtpChallenges';
+import type { VerifiedEmailOtpChallengeCodeResult } from './emailOtpChallengeProof';
+import type { VerifyEmailOtpChallengeCodeRequest } from './emailOtpChallengeVerification';
+export type EmailOtpChallengeOperationsInput = {
+    readonly createChallengeWithAction: (request: CreateEmailOtpChallengeWithActionRequest) => Promise<CreateEmailOtpChallengeWithActionResult>;
+    readonly verifyChallengeCode: (request: VerifyEmailOtpChallengeCodeRequest) => Promise<VerifiedEmailOtpChallengeCodeResult>;
+    readonly grantStore: EmailOtpGrantStore;
+    readonly resolveConfig: () => EmailOtpConfig;
+};
+export type CreateEmailOtpLoginChallengeRequest = {
+    userId?: unknown;
+    walletId?: unknown;
+    orgId?: unknown;
+    email?: unknown;
+    otpChannel?: unknown;
+    ownerProofBindingDigest?: unknown;
+    clientIp?: unknown;
+    operation?: unknown;
+    reuseActiveChallenge?: unknown;
+};
+export type CreateEmailOtpLoginChallengeResult = {
+    ok: true;
+    challenge: {
+        challengeId: string;
+        issuedAtMs: number;
+        expiresAtMs: number;
+        userId: string;
+        walletId: string;
+        orgId: string;
+        otpChannel: EmailOtpChannel;
+        ownerProofBindingDigest: string;
+        action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+        operation: EmailOtpLoginChallengeOperation;
+    };
+    delivery: {
+        status: 'sent' | 'reused';
+        mode: 'email_provider' | 'log' | 'memory';
+        emailHint: string;
+    };
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type CreateEmailOtpEnrollmentChallengeRequest = {
+    userId?: unknown;
+    walletId?: unknown;
+    orgId?: unknown;
+    email?: unknown;
+    otpChannel?: unknown;
+    ownerProofBindingDigest?: unknown;
+    clientIp?: unknown;
+    operation?: unknown;
+};
+export type CreateEmailOtpEnrollmentChallengeResult = {
+    ok: true;
+    challenge: {
+        challengeId: string;
+        issuedAtMs: number;
+        expiresAtMs: number;
+        userId: string;
+        walletId: string;
+        orgId: string;
+        otpChannel: EmailOtpChannel;
+        ownerProofBindingDigest: string;
+        action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
+        operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+    };
+    delivery: {
+        mode: 'email_provider' | 'log' | 'memory';
+        emailHint: string;
+    };
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type VerifyEmailOtpLoginChallengeRequest = {
+    userId?: unknown;
+    walletId?: unknown;
+    orgId?: unknown;
+    challengeId?: unknown;
+    otpCode?: unknown;
+    otpChannel?: unknown;
+    ownerProofBindingDigest?: unknown;
+    clientIp?: unknown;
+    operation?: unknown;
+};
+export type VerifyEmailOtpLoginChallengeResult = {
+    ok: true;
+    challengeId: string;
+    loginGrant: string;
+    grantExpiresAtMs: number;
+    otpChannel: EmailOtpChannel;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+    attemptsRemaining?: number;
+    lockedUntilMs?: number;
+};
+export declare function createEmailOtpChallenge(input: EmailOtpChallengeOperationsInput, request: CreateEmailOtpLoginChallengeRequest): Promise<CreateEmailOtpLoginChallengeResult>;
+export declare function createEmailOtpEnrollmentChallenge(input: EmailOtpChallengeOperationsInput, request: CreateEmailOtpEnrollmentChallengeRequest): Promise<CreateEmailOtpEnrollmentChallengeResult>;
+export declare function verifyEmailOtpChallenge(input: EmailOtpChallengeOperationsInput, request: VerifyEmailOtpLoginChallengeRequest): Promise<VerifyEmailOtpLoginChallengeResult>;
+//# sourceMappingURL=emailOtpChallengeOperations.d.ts.map