@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts

@@ -0,0 +1,177 @@
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../shared-ts/src/utils/emailOtpDomain';
+import { type ChallengeSubjectId, type EmailOtpChallengeId, type EmailOtpRegistrationAttemptId, type OrgId, type ProviderSubject, type WalletId } from '../../../../shared-ts/src/utils/domainIds';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../EmailOtpStores';
+export type EmailOtpRegistrationEnrollmentPersistence = {
+    previousProviderWalletId?: string;
+    enrollment: EmailOtpWalletEnrollmentRecord;
+    authState: EmailOtpAuthStateRecord;
+};
+export type EmailOtpRegistrationChallengePurpose = {
+    kind: 'registration';
+    action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
+    operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+} | {
+    kind: 'registration_reroll';
+    action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+    operation: typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+};
+export type EmailOtpRegistrationChallengeProof = {
+    kind: 'registration_attempt';
+    providerSubject: ProviderSubject;
+    challengeSubjectId: ChallengeSubjectId;
+    proofEmail: string;
+    registrationAttemptId: EmailOtpRegistrationAttemptId;
+    challengeId: EmailOtpChallengeId;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+} | {
+    kind: 'direct_proof_email';
+    providerSubject: ProviderSubject;
+    challengeSubjectId: ChallengeSubjectId;
+    proofEmail: string;
+    registrationAttemptId?: never;
+    challengeId: EmailOtpChallengeId;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+};
+export type VerifiedEmailOtpRegistrationChallengeProofShared = {
+    providerSubject: ProviderSubject;
+    challengeSubjectId: ChallengeSubjectId;
+    challengeEmail: string;
+    challengeId: EmailOtpChallengeId;
+    originalWalletId: WalletId;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+    purpose: EmailOtpRegistrationChallengePurpose;
+};
+export type VerifiedEmailOtpRegistrationChallengeProof = (VerifiedEmailOtpRegistrationChallengeProofShared & {
+    kind: 'registration_attempt';
+    registrationAttemptId: EmailOtpRegistrationAttemptId;
+}) | (VerifiedEmailOtpRegistrationChallengeProofShared & {
+    kind: 'direct_proof_email';
+    registrationAttemptId?: never;
+});
+export type EmailOtpChallengeVerificationIntent = {
+    kind: 'registration';
+    binding: EmailOtpRegistrationChallengeProof;
+    allowWalletReroll: boolean;
+} | {
+    kind: 'wallet_unlock';
+} | {
+    kind: 'transaction_sign';
+} | {
+    kind: 'export_key';
+};
+export type EmailOtpStoredChallengePurpose = {
+    kind: 'registration';
+    action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
+    operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+} | {
+    kind: 'wallet_unlock';
+    action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+    operation: typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+} | {
+    kind: 'transaction_sign';
+    action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+    operation: typeof WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+} | {
+    kind: 'export_key';
+    action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+    operation: typeof WALLET_EMAIL_OTP_EXPORT_OPERATION;
+};
+export type EmailOtpChallengeBindingMismatchCode = 'challenge_id_mismatch' | 'challenge_purpose_mismatch' | 'challenge_subject_mismatch' | 'challenge_email_mismatch' | 'challenge_wallet_mismatch' | 'challenge_session_mismatch' | 'challenge_org_mismatch' | 'challenge_channel_mismatch' | 'registration_reroll_disallowed';
+export type VerifiedEmailOtpChallengeCodeSuccessBase = {
+    challengeId: EmailOtpChallengeId;
+    challengeSubjectId: ChallengeSubjectId;
+    walletId: WalletId;
+    orgId: OrgId;
+    email?: string;
+    otpChannel: typeof EMAIL_OTP_CHANNEL;
+};
+export type VerifiedEmailOtpChallengeCodeSuccess = (VerifiedEmailOtpChallengeCodeSuccessBase & {
+    intent: 'registration';
+    registrationChallengeProof: VerifiedEmailOtpRegistrationChallengeProof;
+}) | (VerifiedEmailOtpChallengeCodeSuccessBase & {
+    intent: 'wallet_unlock' | 'transaction_sign' | 'export_key';
+    registrationChallengeProof?: never;
+});
+export type VerifiedEmailOtpChallengeCodeResult = ({
+    ok: true;
+} & VerifiedEmailOtpChallengeCodeSuccess) | {
+    ok: false;
+    code: string;
+    message: string;
+    attemptsRemaining?: number;
+    lockedUntilMs?: number;
+};
+export declare function emailOtpChallengeVerificationIntentFromRequest(input: {
+    expectedAction: EmailOtpChallengeAction;
+    expectedOperation?: EmailOtpChallengeOperation;
+    registrationChallengeProof?: EmailOtpRegistrationChallengeProof;
+    allowRegistrationChallengeReroll?: boolean;
+}): EmailOtpChallengeVerificationIntent;
+export declare function expectedEmailOtpStoredChallengePurpose(intent: EmailOtpChallengeVerificationIntent): EmailOtpStoredChallengePurpose;
+export declare function readEmailOtpStoredChallengePurpose(record: Pick<EmailOtpChallengeRecord, 'action' | 'operation'>): EmailOtpStoredChallengePurpose | null;
+export declare function emailOtpStoredChallengePurposeMatches(input: {
+    expected: EmailOtpStoredChallengePurpose;
+    actual: EmailOtpStoredChallengePurpose | null;
+}): boolean;
+export declare function emailOtpRegistrationChallengePurposeForRecord(input: {
+    storedPurpose: EmailOtpStoredChallengePurpose | null;
+    allowWalletReroll: boolean;
+}): EmailOtpRegistrationChallengePurpose | null;
+export declare function buildVerifiedEmailOtpRegistrationChallengeProof(input: {
+    record: EmailOtpChallengeRecord;
+    challengeSubjectId: ChallengeSubjectId;
+    proof: EmailOtpRegistrationChallengeProof;
+    storedPurpose: EmailOtpStoredChallengePurpose | null;
+    allowWalletReroll: boolean;
+}): VerifiedEmailOtpRegistrationChallengeProof | null;
+export type EmailOtpRegistrationChallengeProofResult = {
+    ok: true;
+    proof: EmailOtpRegistrationChallengeProof;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EmailOtpRegistrationChallengeProofInput = {
+    kind: 'google_registration_attempt';
+    providerSubject: ProviderSubject;
+    challengeSubjectId: ChallengeSubjectId;
+    walletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+    registrationAttemptId: EmailOtpRegistrationAttemptId;
+    challengeId: EmailOtpChallengeId;
+} | {
+    kind: 'direct_proof_email';
+    providerSubject: ProviderSubject;
+    challengeSubjectId: ChallengeSubjectId;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+    proofEmail: string;
+    challengeId: EmailOtpChallengeId;
+};
+export type EmailOtpRegistrationChallengeProofInputResult = {
+    ok: true;
+    input: EmailOtpRegistrationChallengeProofInput;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function parseRawEmailOtpRegistrationChallengeProofInput(request: {
+    providerSubject: unknown;
+    walletId: unknown;
+    orgId: unknown;
+    ownerProofBindingDigest: unknown;
+    challengeId: unknown;
+    proofEmail?: unknown;
+    googleEmailOtpRegistrationAttemptId?: unknown;
+}): EmailOtpRegistrationChallengeProofInputResult;
+//# sourceMappingURL=emailOtpChallengeProof.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts

@@ -0,0 +1,46 @@
+import type { EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeStore, EmailOtpWalletEnrollmentRecord, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
+import type { NormalizedLogger } from '../logger';
+import { type EmailOtpRegistrationChallengeProof, type VerifiedEmailOtpChallengeCodeResult } from './emailOtpChallengeProof';
+import type { EmailOtpAuthStatePatch, EmailOtpAuthStateReadResult, EmailOtpEnrollmentReadResult } from './emailOtpEnrollment';
+import type { EmailOtpConfig } from './emailOtpConfig';
+import type { EmailOtpMemoryOutbox } from './emailOtpDelivery';
+import type { RateLimitResult } from './rateLimits';
+export type VerifyEmailOtpChallengeCodeRequest = {
+    challengeSubjectId?: unknown;
+    walletId?: unknown;
+    orgId?: unknown;
+    challengeId?: unknown;
+    otpCode?: unknown;
+    otpChannel?: unknown;
+    ownerProofBindingDigest?: unknown;
+    registrationChallengeProof?: EmailOtpRegistrationChallengeProof;
+    allowRegistrationChallengeReroll?: boolean;
+    clientIp?: unknown;
+    expectedAction: EmailOtpChallengeAction;
+    expectedOperation?: EmailOtpChallengeOperation;
+};
+export type EmailOtpVerificationRateLimitConsumer = (input: {
+    scope: 'verify';
+    action: EmailOtpChallengeAction;
+    userId: string;
+    walletId: string;
+    orgId: string;
+    clientIp?: string;
+}) => Promise<RateLimitResult>;
+export type VerifyEmailOtpChallengeCodeInput = {
+    request: VerifyEmailOtpChallengeCodeRequest;
+    challengeStore: EmailOtpChallengeStore;
+    walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    memoryOutbox: EmailOtpMemoryOutbox;
+    logger: NormalizedLogger;
+    readActiveEnrollment: (input: {
+        walletId: string;
+        orgId: string;
+    }) => Promise<EmailOtpEnrollmentReadResult>;
+    readEnrollmentAuthState: (enrollment: EmailOtpWalletEnrollmentRecord) => Promise<EmailOtpAuthStateReadResult>;
+    putEnrollmentAuthState: (enrollment: EmailOtpWalletEnrollmentRecord, patch: EmailOtpAuthStatePatch) => Promise<unknown>;
+    consumeRateLimit: EmailOtpVerificationRateLimitConsumer;
+    resolveConfig: () => EmailOtpConfig;
+};
+export declare function verifyEmailOtpChallengeCode(input: VerifyEmailOtpChallengeCodeInput): Promise<VerifiedEmailOtpChallengeCodeResult>;
+//# sourceMappingURL=emailOtpChallengeVerification.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts

@@ -0,0 +1,110 @@
+import type { EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpChallengeStore, EmailOtpChannel, EmailOtpWalletEnrollmentRecord } from '../EmailOtpStores';
+import { type EmailOtpConfig } from './emailOtpConfig';
+import type { EmailOtpAuthStateReadResult } from './emailOtpEnrollment';
+import type { EmailOtpDeliveryResult, EmailOtpMemoryOutbox } from './emailOtpDelivery';
+import type { RateLimitResult } from './rateLimits';
+export type EmailOtpChallengeStoreContext = {
+    challengeSubjectId: string;
+    walletId: string;
+    orgId: string;
+    otpChannel: EmailOtpChannel;
+    ownerProofBindingDigest: string;
+    action: EmailOtpChallengeAction;
+    operation: EmailOtpChallengeOperation;
+    nowMs: number;
+};
+export type PruneExpiredEmailOtpChallengesInput = {
+    challengeStore: EmailOtpChallengeStore;
+    memoryOutbox: EmailOtpMemoryOutbox;
+    nowMs: number;
+};
+export type EnforceEmailOtpActiveChallengeLimitInput = {
+    challengeStore: EmailOtpChallengeStore;
+    memoryOutbox: EmailOtpMemoryOutbox;
+    context: EmailOtpChallengeStoreContext;
+    maxActiveChallenges: number;
+};
+export type CreateEmailOtpChallengeWithActionRequest = {
+    challengeSubjectId?: unknown;
+    walletId?: unknown;
+    orgId?: unknown;
+    email?: unknown;
+    otpChannel?: unknown;
+    ownerProofBindingDigest?: unknown;
+    clientIp?: unknown;
+    operation?: unknown;
+    reuseActiveChallenge?: unknown;
+    action: EmailOtpChallengeAction;
+};
+export type CreatedEmailOtpChallenge = {
+    challengeId: string;
+    issuedAtMs: number;
+    expiresAtMs: number;
+    challengeSubjectId: string;
+    walletId: string;
+    orgId: string;
+    otpChannel: EmailOtpChannel;
+    ownerProofBindingDigest: string;
+    action: EmailOtpChallengeAction;
+    operation: EmailOtpChallengeOperation;
+};
+export type CreateEmailOtpChallengeWithActionResult = {
+    ok: true;
+    challenge: CreatedEmailOtpChallenge;
+    delivery: {
+        status: 'sent' | 'reused';
+        mode: 'email_provider' | 'log' | 'memory';
+        emailHint: string;
+    };
+} | {
+    ok: false;
+    code: string;
+    message: string;
+    lockedUntilMs?: number;
+    retryAfterMs?: number;
+    resetAtMs?: number;
+};
+export type EmailOtpChallengeEnrollmentReadResult = {
+    ok: true;
+    enrollment: EmailOtpWalletEnrollmentRecord;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EmailOtpChallengeRateLimitConsumer = (input: {
+    scope: 'challenge';
+    action: EmailOtpChallengeAction;
+    userId: string;
+    walletId: string;
+    orgId: string;
+    clientIp?: string;
+}) => Promise<RateLimitResult>;
+export type EmailOtpChallengeDeliverySender = (input: {
+    challengeId: string;
+    walletId: string;
+    userId: string;
+    otpChannel: EmailOtpChannel;
+    action: EmailOtpChallengeAction;
+    operation: EmailOtpChallengeOperation;
+    email: string;
+    otpCode: string;
+    expiresAtMs: number;
+}) => Promise<EmailOtpDeliveryResult>;
+export type CreateEmailOtpChallengeWithActionInput = {
+    request: CreateEmailOtpChallengeWithActionRequest;
+    challengeStore: EmailOtpChallengeStore;
+    memoryOutbox: EmailOtpMemoryOutbox;
+    readActiveEnrollment: (input: {
+        walletId: string;
+        orgId: string;
+    }) => Promise<EmailOtpChallengeEnrollmentReadResult>;
+    readEnrollmentAuthState: (enrollment: EmailOtpWalletEnrollmentRecord) => Promise<EmailOtpAuthStateReadResult>;
+    consumeRateLimit: EmailOtpChallengeRateLimitConsumer;
+    resolveConfig: () => EmailOtpConfig;
+    deliverCode: EmailOtpChallengeDeliverySender;
+};
+export declare function pruneExpiredEmailOtpChallengesWithStore(input: PruneExpiredEmailOtpChallengesInput): Promise<readonly EmailOtpChallengeRecord[]>;
+export declare function enforceEmailOtpActiveChallengeLimitWithStore(input: EnforceEmailOtpActiveChallengeLimitInput): Promise<void>;
+export declare function createEmailOtpChallengeWithAction(input: CreateEmailOtpChallengeWithActionInput): Promise<CreateEmailOtpChallengeWithActionResult>;
+//# sourceMappingURL=emailOtpChallenges.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts

@@ -0,0 +1,34 @@
+import type { AuthServiceConfigSource } from './configValues';
+export type EmailOtpDeliveryMode = 'email_provider' | 'log' | 'memory';
+export declare const EMAIL_OTP_CODE_LENGTH: 6;
+export type EmailOtpConfig = {
+    deliveryMode: EmailOtpDeliveryMode;
+    challengeTtlMs: number;
+    grantTtlMs: number;
+    maxAttempts: number;
+    lockoutTtlMs: number;
+    codeLength: typeof EMAIL_OTP_CODE_LENGTH;
+    devOutboxEnabled: boolean;
+    maxActiveChallengesPerContext: number;
+};
+export type AuthRateLimitPolicy = {
+    limit: number;
+    windowMs: number;
+};
+export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
+export type EmailOtpRateLimitPolicies = Record<EmailOtpRateLimitScope, AuthRateLimitPolicy>;
+export type EmailOtpConfigInput = {
+    thresholdStore: AuthServiceConfigSource;
+    production: boolean;
+};
+export declare function parseConfiguredInteger(input: {
+    name: string;
+    raw: string;
+    defaultValue: number;
+    min: number;
+    max: number;
+}): number;
+export declare function resolveRegistrationPrepareRateLimitPolicy(input: EmailOtpConfigInput): AuthRateLimitPolicy;
+export declare function resolveEmailOtpRateLimitPolicies(input: EmailOtpConfigInput): EmailOtpRateLimitPolicies;
+export declare function resolveEmailOtpConfig(input: EmailOtpConfigInput): EmailOtpConfig;
+//# sourceMappingURL=emailOtpConfig.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts

@@ -0,0 +1,65 @@
+import type { EmailOtpChannel, EmailOtpChallengeAction, EmailOtpChallengeOperation } from '../EmailOtpStores';
+import type { NormalizedLogger } from '../logger';
+import type { EmailOtpConfig, EmailOtpDeliveryMode } from './emailOtpConfig';
+export type EmailOtpMemoryOutboxEntry = {
+    walletId: string;
+    userId: string;
+    otpChannel: EmailOtpChannel;
+    email: string;
+    emailHint: string;
+    otpCode: string;
+    expiresAtMs: number;
+};
+export type EmailOtpMemoryOutbox = Map<string, EmailOtpMemoryOutboxEntry>;
+export type EmailOtpDeliveryInput = {
+    config: EmailOtpConfig;
+    production: boolean;
+    logger: NormalizedLogger;
+    memoryOutbox: EmailOtpMemoryOutbox;
+    challengeId: string;
+    walletId: string;
+    userId: string;
+    otpChannel: EmailOtpChannel;
+    action: EmailOtpChallengeAction;
+    operation: EmailOtpChallengeOperation;
+    email: string;
+    otpCode: string;
+    expiresAtMs: number;
+};
+export type EmailOtpDeliveryResult = {
+    ok: true;
+    deliveryMode: EmailOtpDeliveryMode;
+    emailHint: string;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+    lockedUntilMs?: number;
+};
+export type EmailOtpOutboxReadRequest = {
+    challengeId?: unknown;
+    userId?: unknown;
+    walletId?: unknown;
+};
+export type EmailOtpOutboxReadResult = {
+    ok: true;
+    challengeId: string;
+    walletId: string;
+    userId: string;
+    otpChannel: EmailOtpChannel;
+    emailHint: string;
+    otpCode: string;
+    expiresAtMs: number;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function deliverEmailOtpCode(input: EmailOtpDeliveryInput): Promise<EmailOtpDeliveryResult>;
+export declare function readEmailOtpOutboxEntry(input: {
+    readonly config: EmailOtpConfig;
+    readonly memoryOutbox: EmailOtpMemoryOutbox;
+    readonly request: EmailOtpOutboxReadRequest;
+    readonly nowMs: number;
+}): EmailOtpOutboxReadResult;
+//# sourceMappingURL=emailOtpDelivery.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpEnrollment.d.ts

@@ -0,0 +1,79 @@
+import type { EmailOtpAuthStateRecord, EmailOtpAuthStateStore, EmailOtpWalletEnrollmentRecord, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
+export type EmailOtpEnrollmentReadResult = {
+    ok: true;
+    enrollment: EmailOtpWalletEnrollmentRecord;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EmailOtpAuthStateReadResult = {
+    ok: true;
+    state: EmailOtpAuthStateRecord | null;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EmailOtpAuthStatePatch = Partial<Pick<EmailOtpAuthStateRecord, 'otpFailureCount' | 'lastOtpFailureAtMs' | 'otpLockedUntilMs' | 'lastEmailOtpLoginAtMs' | 'lastStrongAuthAtMs'>>;
+export type EmailOtpStrongAuthRequiredResult = {
+    ok: true;
+    required: boolean;
+    walletId: string;
+    lastEmailOtpLoginAtMs?: number;
+    lastStrongAuthAtMs?: number;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EmailOtpStrongAuthSatisfiedResult = {
+    ok: true;
+    walletId: string;
+    lastStrongAuthAtMs?: number;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function readEmailOtpEnrollmentWithStore(input: {
+    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    readonly request: {
+        walletId?: unknown;
+        orgId: unknown;
+    };
+}): Promise<EmailOtpEnrollmentReadResult>;
+export declare function readActiveEmailOtpEnrollmentWithStore(input: {
+    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    readonly request: {
+        walletId?: unknown;
+        orgId: unknown;
+        providerUserId?: unknown;
+    };
+}): Promise<EmailOtpEnrollmentReadResult>;
+export declare function readEmailOtpAuthStateForEnrollmentWithStore(input: {
+    readonly authStateStore: EmailOtpAuthStateStore;
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+}): Promise<EmailOtpAuthStateReadResult>;
+export declare function putEmailOtpAuthStateForEnrollmentWithStore(input: {
+    readonly authStateStore: EmailOtpAuthStateStore;
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+    readonly patch: EmailOtpAuthStatePatch;
+    readonly nowMs: number;
+}): Promise<EmailOtpAuthStateRecord>;
+export declare function isEmailOtpStrongAuthRequiredWithStores(input: {
+    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    readonly authStateStore: EmailOtpAuthStateStore;
+    readonly request: {
+        walletId?: unknown;
+    };
+}): Promise<EmailOtpStrongAuthRequiredResult>;
+export declare function markEmailOtpStrongAuthSatisfiedWithStores(input: {
+    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    readonly authStateStore: EmailOtpAuthStateStore;
+    readonly request: {
+        walletId?: unknown;
+    };
+    readonly nowMs: number;
+}): Promise<EmailOtpStrongAuthSatisfiedResult>;
+//# sourceMappingURL=emailOtpEnrollment.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts

@@ -0,0 +1,42 @@
+import type { EmailOtpChannel, EmailOtpGrantStore } from '../EmailOtpStores';
+export type EmailOtpGrantConsumeRequest = {
+    loginGrant?: unknown;
+    userId?: unknown;
+    walletId?: unknown;
+    orgId?: unknown;
+    otpChannel?: unknown;
+    clientIp?: unknown;
+};
+export type EmailOtpGrantConsumeResult = {
+    ok: true;
+    challengeId: string;
+    otpChannel: EmailOtpChannel;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type EmailOtpGrantRateLimitInput = {
+    scope: 'grant';
+    userId: string;
+    walletId: string;
+    orgId: string;
+    clientIp?: string;
+};
+export type EmailOtpGrantRateLimitResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+    retryAfterMs?: number;
+    resetAtMs?: number;
+};
+export type EmailOtpGrantRateLimitConsumer = (input: EmailOtpGrantRateLimitInput) => Promise<EmailOtpGrantRateLimitResult>;
+export declare function consumeEmailOtpGrantWithStore(input: {
+    readonly request: EmailOtpGrantConsumeRequest;
+    readonly grantStore: EmailOtpGrantStore;
+    readonly consumeRateLimit: EmailOtpGrantRateLimitConsumer;
+    readonly nowMs: number;
+}): Promise<EmailOtpGrantConsumeResult>;
+//# sourceMappingURL=emailOtpGrant.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts

@@ -0,0 +1,116 @@
+import { type WalletId } from '../../../../shared-ts/src/utils/domainIds';
+import type { RegistrationAuthority } from '../../../../shared-ts/src/utils/registrationIntent';
+import type { EmailOtpAuthStateStore, EmailOtpChannel, EmailOtpRegistrationAttemptStore, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
+import type { IdentityStore } from '../IdentityStore';
+import type { WalletStore } from '../WalletStore';
+import type { WalletRegistrationFinalizeRequest } from '../registrationContracts';
+import { type EmailOtpRegistrationChallengeProofInput, type EmailOtpRegistrationChallengeProofResult, type EmailOtpRegistrationEnrollmentPersistence, type VerifiedEmailOtpChallengeCodeResult } from './emailOtpChallengeProof';
+import type { VerifyEmailOtpChallengeCodeRequest } from './emailOtpChallengeVerification';
+export type EmailOtpEnrollmentMaterialValidationResult = {
+    ok: true;
+    enrollmentSealKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type VerifyEmailOtpEnrollmentInput = {
+    request: VerifyEmailOtpEnrollmentRequest;
+    walletStore: WalletStore;
+    walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    authStateStore: EmailOtpAuthStateStore;
+    registrationAttemptStore: EmailOtpRegistrationAttemptStore;
+    identityStore: IdentityStore;
+    verifyChallengeCode: (request: VerifyEmailOtpChallengeCodeRequest) => Promise<VerifiedEmailOtpChallengeCodeResult>;
+};
+export type VerifyEmailOtpEnrollmentRequest = {
+    providerSubject: unknown;
+    walletId: unknown;
+    orgId: unknown;
+    challengeId: unknown;
+    otpCode: unknown;
+    otpChannel: unknown;
+    ownerProofBindingDigest: unknown;
+    proofEmail?: unknown;
+    clientIp?: unknown;
+    enrollmentSealKeyVersion?: unknown;
+    serverSealedFactorCiphertextB64u?: unknown;
+    clientUnlockPublicKeyB64u?: unknown;
+    unlockKeyVersion?: unknown;
+    googleEmailOtpRegistrationAttemptId?: unknown;
+};
+export declare function validateEmailOtpEnrollmentMaterial(request: {
+    enrollmentSealKeyVersion?: unknown;
+    clientUnlockPublicKeyB64u?: unknown;
+    unlockKeyVersion?: unknown;
+    serverSealedFactorCiphertextB64u?: unknown;
+}): Promise<{
+    ok: true;
+    enrollmentSealKeyVersion: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+}>;
+export declare function buildEmailOtpRegistrationEnrollmentPersistence(input: {
+    walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    authStateStore: EmailOtpAuthStateStore;
+    walletId: string;
+    orgId: string;
+    authSubjectId: string;
+    verifiedEmail: string;
+    material: NonNullable<WalletRegistrationFinalizeRequest['emailOtpEnrollment']>;
+    nowMs: number;
+}): Promise<{
+    ok: true;
+    persistence: EmailOtpRegistrationEnrollmentPersistence;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+}>;
+export declare function emailOtpEnrollmentPersistenceForRegistrationFinalize(input: {
+    walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
+    authStateStore: EmailOtpAuthStateStore;
+    authority: RegistrationAuthority;
+    request: WalletRegistrationFinalizeRequest;
+    walletId: WalletId;
+    orgId: string;
+    nowMs: number;
+}): Promise<{
+    ok: true;
+    persistence?: EmailOtpRegistrationEnrollmentPersistence;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+}>;
+export declare function resolveEmailOtpRegistrationChallengeProof(input: {
+    proofInput: EmailOtpRegistrationChallengeProofInput;
+    registrationAttemptStore: EmailOtpRegistrationAttemptStore;
+    nowMs: number;
+}): Promise<EmailOtpRegistrationChallengeProofResult>;
+export declare function verifyEmailOtpEnrollment(input: VerifyEmailOtpEnrollmentInput): Promise<{
+    ok: true;
+    walletId: string;
+    otpChannel: EmailOtpChannel;
+    enrollment: {
+        createdAtMs: number;
+        updatedAtMs: number;
+        enrollmentSealKeyVersion: string;
+        unlockKeyVersion: string;
+    };
+} | {
+    ok: false;
+    code: string;
+    message: string;
+    attemptsRemaining?: number;
+    lockedUntilMs?: number;
+}>;
+//# sourceMappingURL=emailOtpRegistrationEnrollment.d.ts.map