@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/config.d.ts

@@ -0,0 +1,13 @@
+import type { AuthServiceConfig, AuthServiceConfigInput } from './types';
+export declare const AUTH_SERVICE_CONFIG_DEFAULTS: {
+    readonly nearRpcUrlTestnet: "https://test.rpc.fastnear.com";
+    readonly nearRpcUrlMainnet: "https://rpc.mainnet.near.org";
+    readonly networkId: "testnet";
+    readonly accountInitialBalance: "30000000000000000000000";
+    readonly createAccountAndRegisterGas: "85000000000000";
+};
+export declare function createAuthServiceConfig(input: AuthServiceConfigInput): AuthServiceConfig;
+export declare function validateConfigs(config: AuthServiceConfig): void;
+export declare function parseBool(v: unknown): boolean;
+export declare function requireEnvVar<T extends object, K extends keyof T & string>(env: T, name: K): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts

@@ -0,0 +1,44 @@
+import type { D1DatabaseLike } from '../storage/tenantRoute';
+import type { IdentityStore, LinkIdentityResult, UnlinkIdentityResult } from './IdentityStore';
+export interface D1IdentityStoreSchemaOptions {
+    readonly database: D1DatabaseLike;
+}
+export interface D1IdentityStoreOptions {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly ensureSchema?: boolean;
+    readonly now?: () => Date;
+}
+export declare const IDENTITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS identity_links (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, subject),\n      CHECK (length(namespace) > 0),\n      CHECK (length(org_id) > 0),\n      CHECK (length(project_id) > 0),\n      CHECK (length(env_id) > 0),\n      CHECK (length(subject) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'identity_subject_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.subject') = subject, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.userId') = user_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS identity_links_user_idx\n      ON identity_links (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
+export declare function ensureIdentityStoreD1Schema(options: D1IdentityStoreSchemaOptions): Promise<void>;
+export declare class D1IdentityStore implements IdentityStore {
+    readonly adapterKind = "d1";
+    private readonly database;
+    private readonly scope;
+    private readonly ensureSchemaOnUse;
+    private readonly now;
+    private schemaReady;
+    constructor(input: D1IdentityStoreOptions);
+    private ensureSchema;
+    private bindScope;
+    getUserIdBySubject(subject: string): Promise<string | null>;
+    listSubjectsByUserId(userId: string): Promise<string[]>;
+    linkSubjectToUserId(input: {
+        userId: string;
+        subject: string;
+        allowMoveIfSoleIdentity?: boolean;
+    }): Promise<LinkIdentityResult>;
+    unlinkSubjectFromUserId(input: {
+        userId: string;
+        subject: string;
+    }): Promise<UnlinkIdentityResult>;
+    deleteSubjectLinkForDevCleanup(input: {
+        userId: string;
+        subject: string;
+    }): Promise<UnlinkIdentityResult>;
+    private deleteIdentityLink;
+}
+//# sourceMappingURL=d1IdentityStore.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -0,0 +1,214 @@
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import { type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/registrationIntent';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+export type WalletAuthMethodRecord = SharedWalletAuthMethodRecord;
+/**
+ * R103E's auth-method row. The v1 record remains exported for the older
+ * registration/add-factor surface while the authority cutover is composed.
+ * New authority-owned writes use this type and the V2 statements below.
+ */
+export type WalletAuthMethodRecordV2Owned = WalletAuthMethodRecordV2;
+type ActiveWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
+    readonly status: 'active';
+}>;
+export type WalletAuthMethodV2Store = {
+    putV2(record: WalletAuthMethodRecordV2): Promise<void>;
+    insertActiveV2Atomically(input: {
+        readonly record: ActiveWalletAuthMethodRecordV2;
+        readonly prerequisiteStatements: readonly D1PreparedStatementLike[];
+    }): Promise<boolean>;
+    prepareV2InsertStatements(record: ActiveWalletAuthMethodRecordV2): readonly D1PreparedStatementLike[];
+    prepareActiveV2SourceGuardStatements(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly authorityDigestB64u: DigestB64u;
+        readonly authorityRevocationEpoch: number;
+    }): readonly D1PreparedStatementLike[];
+    readByIdV2(input: {
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+    getPasskeyV2(input: {
+        readonly rpId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+    getEmailOtpV2(input: {
+        readonly walletId: string;
+        readonly emailHashHex: string;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+    listForWalletV2(input: {
+        readonly walletId: string;
+        readonly walletAuthorityId?: WalletAuthorityId;
+        readonly rpId?: string;
+    }): Promise<WalletAuthMethodRecordV2[]>;
+};
+export interface WalletAuthMethodStore {
+    put(record: WalletAuthMethodRecord): Promise<void>;
+    getPasskey(input: {
+        rpId: string;
+        credentialIdB64u: string;
+    }): Promise<WalletAuthMethodRecord | null>;
+    getEmailOtp(input: {
+        walletId: string;
+        emailHashHex: string;
+    }): Promise<WalletAuthMethodRecord | null>;
+    listForWallet(input: {
+        walletId: string;
+        rpId?: string;
+    }): Promise<WalletAuthMethodRecord[]>;
+}
+export interface D1WalletAuthMethodStoreSchemaOptions {
+    readonly database: D1DatabaseLike;
+}
+export interface D1WalletAuthMethodStoreOptions {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly ensureSchema?: boolean;
+}
+export type D1WalletAuthMethodStoreScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (\n          kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u\n          AND wallet_auth_method_id = 'passkey:' || rp_id || ':' || credential_id_b64u\n        )\n        OR\n        (\n          kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex\n          AND wallet_auth_method_id = 'email_otp:' || wallet_id || ':' || email_hash_hex\n        )\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        rp_id,\n        status\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_identifier_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        kind,\n        auth_identifier_key\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_email_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        email_hash_hex\n      )\n      WHERE kind = 'email_otp' AND email_hash_hex IS NOT NULL\n  "];
+/**
+ * The authority-owned table shape is kept separate from the historical
+ * create-if-missing schema above. Deployments apply 0007 before using these
+ * statements; keeping the SQL here lets focused D1 tests provision the V2
+ * table without copying migration text into a test.
+ */
+export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      wallet_authority_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      FOREIGN KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_authority_id\n      ) REFERENCES wallet_authorities(\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        authority_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(wallet_authority_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (\n        (kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u)\n        OR\n        (kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex)\n      ),\n      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),\n      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),\n      CHECK (json_extract(record_json, '$.kind') = kind),\n      CHECK (json_extract(record_json, '$.status') = status),\n      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),\n      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),\n      CHECK (\n        (kind = 'passkey'\n          AND json_extract(record_json, '$.rpId') = rp_id\n          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u\n          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u\n          AND json_extract(record_json, '$.counter') >= 0)\n        OR\n        (kind = 'email_otp'\n          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex\n          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        wallet_authority_id,\n        status\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  "];
+export declare function ensureWalletAuthMethodStoreD1Schema(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
+export declare function ensureWalletAuthMethodStoreD1SchemaV2(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
+export declare function walletAuthMethodId(record: WalletAuthMethodRecord): WalletAuthMethodId;
+export declare function normalizeWalletAuthMethod(raw: unknown): WalletAuthMethodRecord | null;
+export declare function normalizeWalletAuthMethodV2(raw: unknown): WalletAuthMethodRecordV2 | null;
+export declare function walletAuthMethodV2Id(record: WalletAuthMethodRecordV2): WalletAuthMethodId;
+export declare function bindWalletAuthMethodIdentityV2(record: WalletAuthMethodRecordV2): {
+    readonly rpId: string;
+    readonly authIdentifierKey: string;
+    readonly credentialIdB64u: string | null;
+    readonly credentialPublicKeyB64u: string | null;
+    readonly emailHashHex: string | null;
+    readonly registrationAuthorityId: string | null;
+    readonly activatedAtMs: number | null;
+    readonly revokedAtMs: number | null;
+};
+export declare function prepareD1WalletAuthMethodV2PutStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthMethodStoreScope;
+    readonly record: WalletAuthMethodRecordV2;
+    readonly insertOnly?: boolean;
+}): D1PreparedStatementLike;
+export declare function bindWalletAuthMethodIdentity(record: WalletAuthMethodRecord): {
+    readonly rpId: string;
+    readonly authIdentifierKey: string;
+    readonly credentialIdB64u: string | null;
+    readonly credentialPublicKeyB64u: string | null;
+    readonly emailHashHex: string | null;
+    readonly registrationAuthorityId: string | null;
+};
+export declare function prepareD1WalletAuthMethodPutStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthMethodStoreScope;
+    readonly record: WalletAuthMethodRecord;
+}): D1PreparedStatementLike;
+/** Insert-only auth-method write used when a new factor and its envelope are
+ * committed together. A credential collision must abort the enclosing D1
+ * batch instead of updating an existing factor's identity. */
+export declare function prepareD1WalletAuthMethodInsertStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthMethodStoreScope;
+    readonly record: WalletAuthMethodRecord;
+}): D1PreparedStatementLike;
+export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, WalletAuthMethodV2Store {
+    readonly adapterKind = "d1";
+    private readonly database;
+    private readonly scope;
+    private readonly ensureSchemaOnUse;
+    private schemaReady;
+    private v2SchemaReady;
+    constructor(input: D1WalletAuthMethodStoreOptions);
+    private ensureSchema;
+    private ensureV2Schema;
+    put(record: WalletAuthMethodRecord): Promise<void>;
+    /**
+     * Prepares the insert-only wallet auth-method mutation used by custody
+     * linking. The statement intentionally has no conflict handler; the unique
+     * credential index is part of the transaction's fail-closed boundary.
+     */
+    preparePasskeyRegistrationStatements(record: WalletAuthMethodRecord): readonly D1PreparedStatementLike[];
+    getPasskey(input: {
+        rpId: string;
+        credentialIdB64u: string;
+    }): Promise<WalletAuthMethodRecord | null>;
+    getEmailOtp(input: {
+        walletId: string;
+        emailHashHex: string;
+    }): Promise<WalletAuthMethodRecord | null>;
+    listForWallet(input: {
+        walletId: string;
+        rpId?: string;
+    }): Promise<WalletAuthMethodRecord[]>;
+    putV2(record: WalletAuthMethodRecordV2): Promise<void>;
+    insertActiveV2Atomically(input: {
+        readonly record: ActiveWalletAuthMethodRecordV2;
+        readonly prerequisiteStatements: readonly D1PreparedStatementLike[];
+    }): Promise<boolean>;
+    prepareActiveV2SourceGuardStatements(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly authorityDigestB64u: DigestB64u;
+        readonly authorityRevocationEpoch: number;
+    }): readonly D1PreparedStatementLike[];
+    /**
+     * Aborts the surrounding batch if the authority already holds an active
+     * method of this family.
+     *
+     * Refactor 109C's admission answers `already_configured` before a ceremony
+     * starts, but an admission read cannot close a race: two ceremonies can pass
+     * it concurrently and both insert. The auth-method insert's own guard covers
+     * only the allocated method id, and migration `0011` deliberately dropped
+     * the Email uniqueness index so linked devices could share one address, so
+     * nothing else in the batch enforces this.
+     *
+     * The idiom is the repo's existing CAS guard read backwards: the sibling
+     * SELECT normally matches nothing and the INSERT is a no-op, and when a
+     * sibling does exist it inserts `guard_id = 1` into a singleton table and
+     * collides, which aborts the batch.
+     */
+    prepareActiveV2TargetFamilyAbsentGuardStatements(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly kind: WalletAuthMethodRecordV2['kind'];
+    }): readonly D1PreparedStatementLike[];
+    /**
+     * Prepares an insert-only active V2 method mutation. A credential or opaque
+     * method-id collision stays inside the surrounding transaction boundary.
+     */
+    prepareV2InsertStatements(record: ActiveWalletAuthMethodRecordV2): readonly D1PreparedStatementLike[];
+    readByIdV2(input: {
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+    getPasskeyV2(input: {
+        rpId: string;
+        credentialIdB64u: string;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+    getEmailOtpV2(input: {
+        walletId: string;
+        emailHashHex: string;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+    listForWalletV2(input: {
+        walletId: string;
+        walletAuthorityId?: WalletAuthorityId;
+        rpId?: string;
+    }): Promise<WalletAuthMethodRecordV2[]>;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthMethodStore.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -0,0 +1,108 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+import type { WalletId, WalletRegistrationEcdsaWalletKey } from './registrationContracts';
+import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
+import type { EcdsaClientRootPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import { type RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
+import type { RouterAbEcdsaDerivationPublicCapabilityV1, RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { WalletEcdsaPendingSessionActivationRecord, WalletEcdsaPostRegistrationPublicRequest, WalletEd25519SignerRecord, WalletEcdsaSignerRecord, WalletRecord, WalletSignerRecord, WalletStore } from './WalletStore';
+export type { WalletEcdsaSignerRecord, WalletRecord, WalletSignerRecord, WalletStore, } from './WalletStore';
+export interface D1WalletStoreSchemaOptions {
+    readonly database: D1DatabaseLike;
+}
+export interface D1WalletStoreOptions {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly ensureSchema?: boolean;
+}
+export type D1WalletStoreScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export declare const WALLET_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallets (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'wallet_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0))\n    )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_signers (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      signer_family TEXT NOT NULL,\n      signer_id TEXT NOT NULL,\n      chain_target_key TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        signer_family,\n        signer_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (signer_family IN ('ed25519', 'ecdsa')),\n      CHECK (length(signer_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.signerId') = signer_id, 0)),\n      CHECK (\n        (\n          signer_family = 'ed25519'\n          AND chain_target_key IS NULL\n          AND substr(signer_id, 1, 8) = 'ed25519:'\n          AND COALESCE(\n            json_extract(record_json, '$.version') = 'wallet_signer_ed25519_v1',\n            0\n          )\n        )\n        OR\n        (\n          signer_family = 'ecdsa'\n          AND chain_target_key IS NOT NULL\n          AND length(chain_target_key) > 0\n          AND signer_id = 'ecdsa:' || chain_target_key\n          AND COALESCE(\n            json_extract(record_json, '$.version') = 'wallet_signer_ecdsa_v1',\n            0\n          )\n          AND COALESCE(json_extract(record_json, '$.chainTargetKey') = chain_target_key, 0)\n        )\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_signers_wallet_idx\n      ON wallet_signers (namespace, org_id, project_id, env_id, wallet_id, signer_family)\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_signers_chain_target_idx\n      ON wallet_signers (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        signer_family,\n        chain_target_key\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_ecdsa_pending_session_activations (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      lifecycle_id TEXT NOT NULL,\n      request_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        lifecycle_id,\n        request_id\n      ),\n      CHECK (json_valid(record_json)),\n      CHECK (expires_at_ms > 0)\n    )\n  "];
+export declare function ensureWalletStoreD1Schema(options: D1WalletStoreSchemaOptions): Promise<void>;
+export declare function parseWalletEd25519SignerRecord(raw: unknown): WalletEd25519SignerRecord | null;
+export declare function prepareD1WalletPutSubjectStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletStoreScope;
+    readonly record: WalletRecord;
+}): D1PreparedStatementLike;
+export declare function prepareD1WalletPutSignerStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletStoreScope;
+    readonly record: WalletSignerRecord;
+}): D1PreparedStatementLike;
+export declare function buildWalletEcdsaSignerRecord(input: {
+    readonly walletId: WalletId;
+    readonly walletKey: WalletRegistrationEcdsaWalletKey;
+    readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly custodyKeyManifestDigestB64u: string;
+    readonly custodyClientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+}): WalletEcdsaSignerRecord;
+export declare class D1WalletStore implements WalletStore {
+    readonly adapterKind = "d1";
+    private readonly database;
+    private readonly scope;
+    private readonly ensureSchemaOnUse;
+    private schemaReady;
+    constructor(input: D1WalletStoreOptions);
+    private ensureSchema;
+    getWallet(input: {
+        walletId: WalletId;
+    }): Promise<WalletRecord | null>;
+    getEcdsaSignerByKeyHandle(input: {
+        walletId: WalletId;
+        keyHandle: string;
+        chainTarget: ThresholdEcdsaChainTarget;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    getEcdsaSignerByPublicCapability(input: {
+        walletId: WalletId;
+        publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    getEcdsaSignerByMaterialActivation(input: {
+        walletId: WalletId;
+        materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    getEcdsaSignerByPostRegistrationRequest(input: {
+        walletId: WalletId;
+        request: WalletEcdsaPostRegistrationPublicRequest;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    listEcdsaSignersForWallet(input: {
+        walletId: WalletId;
+    }): Promise<readonly WalletEcdsaSignerRecord[]>;
+    listEcdsaPendingSessionActivationsForLifecycle(input: {
+        walletId: WalletId;
+        lifecycleId: string;
+    }): Promise<readonly WalletEcdsaPendingSessionActivationRecord[]>;
+    putEcdsaPendingSessionActivation(record: WalletEcdsaPendingSessionActivationRecord): Promise<void>;
+    getEd25519Signer(input: {
+        walletId: WalletId;
+        nearAccountId: string;
+        nearEd25519SigningKeyId: string;
+    }): Promise<WalletEd25519SignerRecord | null>;
+    getEd25519SignerByMaterialActivation(input: {
+        walletId: WalletId;
+        materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<WalletEd25519SignerRecord | null>;
+    getEd25519SignerBySlot(input: {
+        walletId: WalletId;
+        signerSlot: number;
+    }): Promise<WalletEd25519SignerRecord | null>;
+    listEd25519Signers(): Promise<readonly WalletEd25519SignerRecord[]>;
+    listEd25519SignersForWallet(input: {
+        walletId: WalletId;
+    }): Promise<readonly WalletEd25519SignerRecord[]>;
+    putSubject(record: WalletRecord): Promise<void>;
+    putSigner(record: WalletSignerRecord): Promise<void>;
+    putEd25519SignerIfSlotAvailable(record: WalletEd25519SignerRecord): Promise<boolean>;
+    putSigners(records: readonly WalletSignerRecord[]): Promise<void>;
+}
+//# sourceMappingURL=d1WalletStore.d.ts.map

package/dist/types/wallet-server/src/core/defaultConfigsServer.d.ts

@@ -0,0 +1,5 @@
+export declare const THRESHOLD_NODE_ROLE_COORDINATOR: "coordinator";
+export declare const THRESHOLD_NODE_ROLE_DEFAULT: "coordinator";
+export declare const THRESHOLD_DO_OBJECT_NAME_DEFAULT: "threshold-store";
+export declare const THRESHOLD_PREFIX_DEFAULT: "w3a";
+//# sourceMappingURL=defaultConfigsServer.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/index.d.ts

@@ -0,0 +1,5 @@
+export * from './linkedDeviceSession';
+export * from './requestProof';
+export * from './linkedDeviceManagement';
+export * from './linkedDeviceEd25519ExportRoot';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEd25519ExportRoot.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Port for the authenticated linked-device Ed25519 export-root relay.
+ * Storage carries only the recipient registration and encrypted root package;
+ * wallet custody seed material is never a port value.
+ */
+import type { LinkedDeviceEd25519ExportRootPackageV1, LinkedDeviceEd25519ExportRootRecipientV1 } from '../../../../shared-ts/src/device-linking/ed25519ExportRoot';
+import type { LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+export type LinkedDeviceEd25519ExportRootConflictV1 = 'recipient_already_registered_with_another_key' | 'recipient_not_registered' | 'package_addressed_to_another_recipient' | 'package_already_sealed_differently';
+export type LinkedDeviceEd25519ExportRootWriteResultV1 = {
+    readonly outcome: 'applied';
+} | {
+    readonly outcome: 'replayed';
+} | {
+    readonly outcome: 'conflict';
+    readonly reason: LinkedDeviceEd25519ExportRootConflictV1;
+};
+export type LinkedDeviceEd25519ExportRootRecordV1 = {
+    readonly state: 'recipient_registered';
+    readonly recipient: LinkedDeviceEd25519ExportRootRecipientV1;
+    readonly package?: never;
+} | {
+    readonly state: 'sealed';
+    readonly recipient: LinkedDeviceEd25519ExportRootRecipientV1;
+    readonly package: LinkedDeviceEd25519ExportRootPackageV1;
+};
+export type LinkedDeviceEd25519ExportRootPortV1 = {
+    readonly registerRecipientV1: (input: {
+        readonly recipient: LinkedDeviceEd25519ExportRootRecipientV1;
+    }) => Promise<LinkedDeviceEd25519ExportRootWriteResultV1>;
+    readonly submitPackageV1: (input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly package: LinkedDeviceEd25519ExportRootPackageV1;
+    }) => Promise<LinkedDeviceEd25519ExportRootWriteResultV1>;
+    readonly readTransferV1: (linkSessionId: LinkDeviceSessionId) => Promise<LinkedDeviceEd25519ExportRootRecordV1 | null>;
+};
+//# sourceMappingURL=linkedDeviceEd25519ExportRoot.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEmailOtpGrant.d.ts

@@ -0,0 +1,87 @@
+import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type WalletAuthMethodId, type WalletId, type VerifiedEmailAddress, type WebAuthnCredentialIdB64u } from '../../../../shared-ts/src/utils/domainIds';
+import { type LinkDeviceSessionId, type LinkedDeviceEnrollmentId, type LinkedDeviceId } from '../../../../shared-ts/src/signing-lanes/ids';
+import type { LinkedDeviceEmailOtpEnrollmentSelectionV1 } from '../../../../shared-ts/src/device-linking/contracts';
+/**
+ * The `ownerProofBindingDigest` a linked-device Email OTP challenge is issued
+ * and verified under. It covers the whole device-link context, so a code
+ * mailed for this enrollment verifies for nothing else — not a login, not
+ * another session, device, enrollment, or preparation — and no other flow's
+ * challenge can verify here.
+ */
+export declare function computeLinkedDeviceEmailOtpChallengeBindingDigestV1(input: {
+    readonly walletId: WalletId;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly targetPreparationDigestB64u: DigestB64u;
+    readonly targetEmail: VerifiedEmailAddress;
+    readonly enrollment: LinkedDeviceEmailOtpEnrollmentSelectionV1;
+    readonly baseWalletAuthMethodId?: WalletAuthMethodId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): Promise<DigestB64u>;
+export type LinkedDeviceEmailOtpGrantStateV1 = {
+    readonly kind: 'issued';
+    readonly consumedAtMs?: never;
+} | {
+    readonly kind: 'consumed';
+    readonly consumedAtMs: number;
+};
+export type LinkedDeviceEmailOtpGrantRecordV1 = {
+    readonly kind: 'linked_device_email_otp_grant_record_v1';
+    readonly grantId: string;
+    readonly grantTokenDigestB64u: DigestB64u;
+    readonly walletId: WalletId;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly targetFactor: {
+        readonly kind: 'email_otp';
+    };
+    readonly targetPreparationDigestB64u: DigestB64u;
+    readonly targetEmail: VerifiedEmailAddress;
+    readonly enrollment: LinkedDeviceEmailOtpEnrollmentSelectionV1;
+    readonly emailHashHex: string;
+    readonly registrationAuthorityId: string;
+    readonly providerUserId: string;
+    readonly baseWalletAuthMethodId?: WalletAuthMethodId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly authorityDigestB64u: DigestB64u;
+    readonly challengeId: string;
+    readonly state: LinkedDeviceEmailOtpGrantStateV1;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export declare function parseLinkedDeviceEmailOtpGrantRecordV1(raw: unknown): LinkedDeviceEmailOtpGrantRecordV1;
+/** True while the grant may authorize exactly one completion. */
+export declare function linkedDeviceEmailOtpGrantAdmitsUseV1(record: LinkedDeviceEmailOtpGrantRecordV1, nowMs: number): boolean;
+/**
+ * The stored form of the bearer token. Only the digest is durable, so reading
+ * every grant row ever written yields nothing that verifies as a token.
+ */
+export declare function computeLinkedDeviceEmailOtpGrantTokenDigestV1(grantToken: string): Promise<DigestB64u>;
+/**
+ * The digest every Wallet Session and admission surface compares to name this
+ * one target authority. It covers the full identity chain —
+ * wallet, enrollment, device, derived principal, base factor — so two devices
+ * sharing an email produce different digests, and a digest computed against a
+ * substituted base factor matches nothing.
+ */
+export declare function computeLinkedDeviceEmailOtpAuthorityDigestV1(input: {
+    readonly walletId: WalletId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly targetEmail: string;
+    readonly enrollment: LinkedDeviceEmailOtpEnrollmentSelectionV1;
+    readonly baseWalletAuthMethodId?: WalletAuthMethodId;
+}): Promise<DigestB64u>;
+/**
+ * The target-deployment descriptor binds each child to the target credential
+ * by a credential id. The Email OTP branch creates no WebAuthn credential, so
+ * its descriptor binding is a deterministic digest of the target
+ * authority — the credential-equivalent principal this enrollment activates.
+ * Deterministic, so replays reproduce byte-identical descriptor requests.
+ */
+export declare function linkedDeviceEmailOtpDescriptorCredentialIdV1(walletAuthMethodId: WalletAuthMethodId): Promise<WebAuthnCredentialIdB64u>;
+//# sourceMappingURL=linkedDeviceEmailOtpGrant.d.ts.map