@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -0,0 +1,186 @@
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+export type EmailOtpChallengeIssueAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
+export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
+export type EmailOtpAuthStatePatch = {
+    readonly otpFailureCount?: number | null;
+    readonly lastOtpFailureAtMs?: number | null;
+    readonly otpLockedUntilMs?: number | null;
+    readonly lastEmailOtpLoginAtMs?: number | null;
+    readonly lastStrongAuthAtMs?: number | null;
+};
+export type EmailOtpPublicKey33Validator = (input: Uint8Array) => Promise<unknown>;
+export type EmailOtpEnrollmentMaterialBoundaryInput = {
+    readonly enrollmentSealKeyVersion?: unknown;
+    readonly clientUnlockPublicKeyB64u?: unknown;
+    readonly unlockKeyVersion?: unknown;
+    readonly serverSealedFactorCiphertextB64u?: unknown;
+};
+export type EmailOtpEnrollmentMaterialValidationResult = {
+    readonly ok: true;
+    readonly enrollmentSealKeyVersion: string;
+    readonly clientUnlockPublicKeyB64u: string;
+    readonly unlockKeyVersion: string;
+    readonly serverSealedFactorCiphertextB64u: string;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export type D1EmailOtpEnrollmentRow = {
+    readonly record_json?: unknown;
+    readonly updated_at_ms?: unknown;
+};
+export type D1EmailOtpAuthStateRow = {
+    readonly record_json?: unknown;
+    readonly updated_at_ms?: unknown;
+};
+export type D1EmailOtpChallengeRow = {
+    readonly challenge_id?: unknown;
+    readonly record_json?: unknown;
+    readonly expires_at_ms?: unknown;
+};
+export type EmailOtpRegistrationVerificationReceiptV1 = {
+    readonly version: 'email_otp_registration_verification_receipt_v1';
+    readonly requestFingerprint: string;
+    readonly verified: {
+        readonly challengeId: string;
+        readonly challengeSubjectId: string;
+        readonly walletId: string;
+        readonly orgId: string;
+        readonly email: string;
+        readonly otpChannel: typeof EMAIL_OTP_CHANNEL;
+    };
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type D1EmailOtpGrantRow = {
+    readonly record_json?: unknown;
+    readonly expires_at_ms?: unknown;
+};
+export type D1EmailOtpUnlockChallengeRow = {
+    readonly record_json?: unknown;
+    readonly expires_at_ms?: unknown;
+};
+export type D1EmailOtpRateLimitRow = {
+    readonly consumed_count?: unknown;
+    readonly reset_at_ms?: unknown;
+};
+export declare function maskEmail(email: string): string;
+export declare function generateNumericOtp(length: number): string;
+export declare function clampedEmailOtpUnlockTtlMs(input: unknown): number;
+export declare function decodeFixedBase64Url(input: string, byteLength: number): Uint8Array | null;
+export declare function bytesEqual(left: Uint8Array, right: Uint8Array): boolean;
+export declare function emailOtpRateLimitKeys(input: {
+    readonly scope: EmailOtpRateLimitScope;
+    readonly action?: string;
+    readonly policy: {
+        readonly limit: number;
+        readonly windowMs: number;
+    };
+    readonly userId?: string;
+    readonly walletId?: string;
+    readonly providerSubject?: string;
+    readonly orgId?: string;
+    readonly clientIp?: string;
+}): readonly string[];
+export declare function emailOtpRateLimitExceeded(row: D1EmailOtpRateLimitRow | null): {
+    readonly ok: false;
+    readonly code: 'rate_limited';
+    readonly message: string;
+    readonly retryAfterMs?: number;
+    readonly resetAtMs?: number;
+};
+export declare function parseEmailOtpWalletEnrollmentRecord(input: unknown): EmailOtpWalletEnrollmentRecord | null;
+export declare function parseEmailOtpWalletEnrollmentRow(row: D1EmailOtpEnrollmentRow | null): EmailOtpWalletEnrollmentRecord | null;
+export declare function parseEmailOtpAuthStateRecord(input: unknown): EmailOtpAuthStateRecord | null;
+export declare function parseEmailOtpAuthStateRow(row: D1EmailOtpAuthStateRow | null): EmailOtpAuthStateRecord | null;
+export declare function parseEmailOtpChallengeOperation(input: unknown): EmailOtpChallengeOperation | null;
+export declare function parseEmailOtpLoginOperation(input: unknown): EmailOtpLoginChallengeOperation;
+export declare function parseEmailOtpChallengeRecord(input: unknown): EmailOtpChallengeRecord | null;
+export declare function parseEmailOtpChallengeRow(row: D1EmailOtpChallengeRow | null): EmailOtpChallengeRecord | null;
+export declare function parseEmailOtpRegistrationVerificationReceiptV1(input: unknown): EmailOtpRegistrationVerificationReceiptV1 | null;
+export declare function parseEmailOtpUnlockChallengeRecord(input: unknown): EmailOtpUnlockChallengeRecord | null;
+export declare function parseEmailOtpUnlockChallengeRow(row: D1EmailOtpUnlockChallengeRow | null): EmailOtpUnlockChallengeRecord | null;
+export declare function emailOtpChallengeContextValues(input: {
+    readonly challengeSubjectId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly ownerProofBindingDigest: string;
+    readonly action: EmailOtpChallengeIssueAction;
+    readonly operation: EmailOtpChallengeOperation;
+}): readonly unknown[];
+export declare function emailOtpChallengeRecord(input: {
+    readonly challengeId: string;
+    readonly challengeSubjectId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly email: string;
+    readonly otpCode: string;
+    readonly ownerProofBindingDigest: string;
+    readonly action: EmailOtpChallengeIssueAction;
+    readonly operation: EmailOtpChallengeOperation;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+    readonly maxAttempts: number;
+}): EmailOtpChallengeRecord;
+export declare function emailOtpChallengeWithAttemptCount(record: EmailOtpChallengeRecord, attemptCount: number): EmailOtpChallengeRecord;
+export declare function emailOtpChallengeBindingMismatchCode(input: {
+    readonly record: EmailOtpChallengeRecord;
+    readonly userId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly ownerProofBindingDigest: string;
+    readonly action: EmailOtpChallengeIssueAction;
+    readonly operation: EmailOtpChallengeOperation;
+}): string | null;
+export declare function emailOtpRegistrationChallengeBindingMismatchCode(input: {
+    readonly record: EmailOtpChallengeRecord;
+    readonly providerSubject: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly ownerProofBindingDigest: string;
+    readonly proofEmail: string;
+}): string | null;
+export declare function emailOtpChallengeInvalidOrExpired(): {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function emailOtpGrantRecord(input: {
+    readonly grantToken: string;
+    readonly userId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly challengeId: string;
+    readonly ownerProofBindingDigest: string;
+    readonly action: EmailOtpGrantAction;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+}): EmailOtpGrantRecord;
+export declare function emailOtpUnlockChallengeRecord(input: {
+    readonly challengeId: string;
+    readonly walletId: string;
+    readonly userId: string;
+    readonly orgId: string;
+    readonly challengeB64u: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+}): EmailOtpUnlockChallengeRecord;
+export declare function parseEmailOtpGrantRecord(input: unknown): EmailOtpGrantRecord | null;
+export declare function parseEmailOtpGrantRow(row: D1EmailOtpGrantRow | null): EmailOtpGrantRecord | null;
+export declare function validateEmailOtpEnrollmentMaterial(input: {
+    readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
+    readonly validateSecp256k1PublicKey33: EmailOtpPublicKey33Validator;
+}): Promise<EmailOtpEnrollmentMaterialValidationResult>;
+export declare function emailOtpAuthStateRecord(input: {
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+    readonly existing: EmailOtpAuthStateRecord | null;
+    readonly updatedAtMs: number;
+    readonly patch: EmailOtpAuthStatePatch;
+}): EmailOtpAuthStateRecord;
+export declare function emailOtpChallengePurposeIsValid(input: {
+    readonly action: EmailOtpChallengeIssueAction;
+    readonly operation: EmailOtpChallengeOperation;
+}): boolean;
+//# sourceMappingURL=d1EmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.d.ts

@@ -0,0 +1,45 @@
+import type { RouterApiEmailOtpRouteService, RouterApiWalletUnlockService } from '../../../framework/authServicePort';
+import { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
+import { CloudflareD1EmailOtpChallengeVerifier } from './d1EmailOtpChallengeVerifier';
+import { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
+import { CloudflareD1EmailOtpGrantStore } from './d1EmailOtpGrantStore';
+import { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
+type ReadActiveEmailOtpEnrollmentInput = Parameters<RouterApiEmailOtpRouteService['readActiveEmailOtpEnrollment']>[0];
+type ReadActiveEmailOtpEnrollmentResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['readActiveEmailOtpEnrollment']>>;
+type ReadEmailOtpEnrollmentInput = Parameters<RouterApiEmailOtpRouteService['readEmailOtpEnrollment']>[0];
+type ReadEmailOtpEnrollmentResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['readEmailOtpEnrollment']>>;
+type IsEmailOtpStrongAuthRequiredInput = Parameters<RouterApiEmailOtpRouteService['isEmailOtpStrongAuthRequired']>[0];
+type IsEmailOtpStrongAuthRequiredResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['isEmailOtpStrongAuthRequired']>>;
+type MarkEmailOtpStrongAuthSatisfiedInput = Parameters<RouterApiEmailOtpRouteService['markEmailOtpStrongAuthSatisfied']>[0];
+type MarkEmailOtpStrongAuthSatisfiedResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['markEmailOtpStrongAuthSatisfied']>>;
+type CreateEmailOtpUnlockChallengeInput = Parameters<RouterApiWalletUnlockService['createEmailOtpUnlockChallenge']>[0];
+type CreateEmailOtpUnlockChallengeResult = Awaited<ReturnType<RouterApiWalletUnlockService['createEmailOtpUnlockChallenge']>>;
+type VerifyEmailOtpUnlockProofInput = Parameters<RouterApiWalletUnlockService['verifyEmailOtpUnlockProof']>[0];
+type VerifyEmailOtpUnlockProofResult = Awaited<ReturnType<RouterApiWalletUnlockService['verifyEmailOtpUnlockProof']>>;
+type ConsumeEmailOtpGrantInput = Parameters<RouterApiEmailOtpRouteService['consumeEmailOtpGrant']>[0];
+type ConsumeEmailOtpGrantResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['consumeEmailOtpGrant']>>;
+export declare class CloudflareD1EmailOtpRecoveryService {
+    private readonly challengeVerifier;
+    private readonly emailOtpChallenges;
+    private readonly emailOtpEnrollments;
+    private readonly emailOtpGrants;
+    private readonly emailOtpRateLimits;
+    private readonly grantTtlMs;
+    constructor(input: {
+        readonly challengeVerifier: CloudflareD1EmailOtpChallengeVerifier;
+        readonly emailOtpChallenges: CloudflareD1EmailOtpChallengeStore;
+        readonly emailOtpEnrollments: CloudflareD1EmailOtpEnrollmentStore;
+        readonly emailOtpGrants: CloudflareD1EmailOtpGrantStore;
+        readonly emailOtpRateLimits: CloudflareD1EmailOtpRateLimitStore;
+        readonly grantTtlMs: number;
+    });
+    readEmailOtpEnrollment(input: ReadEmailOtpEnrollmentInput): Promise<ReadEmailOtpEnrollmentResult>;
+    readActiveEmailOtpEnrollment(input: ReadActiveEmailOtpEnrollmentInput): Promise<ReadActiveEmailOtpEnrollmentResult>;
+    isEmailOtpStrongAuthRequired(input: IsEmailOtpStrongAuthRequiredInput): Promise<IsEmailOtpStrongAuthRequiredResult>;
+    markEmailOtpStrongAuthSatisfied(input: MarkEmailOtpStrongAuthSatisfiedInput): Promise<MarkEmailOtpStrongAuthSatisfiedResult>;
+    createEmailOtpUnlockChallenge(input: CreateEmailOtpUnlockChallengeInput): Promise<CreateEmailOtpUnlockChallengeResult>;
+    verifyEmailOtpUnlockProof(input: VerifyEmailOtpUnlockProofInput): Promise<VerifyEmailOtpUnlockProofResult>;
+    consumeEmailOtpGrant(input: ConsumeEmailOtpGrantInput): Promise<ConsumeEmailOtpGrantResult>;
+}
+export {};
+//# sourceMappingURL=d1EmailOtpRecoveryService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.d.ts

@@ -0,0 +1,124 @@
+import type { RegistrationAuthority, WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
+import type { CloudflareD1GoogleEmailOtpSessionResolver } from './d1GoogleEmailOtpSessionResolver';
+import { type EmailOtpEnrollmentMaterialBoundaryInput } from './d1EmailOtpRecords';
+export type D1EmailOtpRegistrationEnrollmentPersistence = {
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+    readonly existingAuthState: EmailOtpAuthStateRecord | null;
+};
+export type D1EmailOtpRegistrationCommitPlan = {
+    readonly kind: 'd1_email_otp_registration_commit_plan_v1';
+    readonly statements: readonly D1PreparedStatementLike[];
+};
+type EnrollmentResult = {
+    readonly ok: true;
+    readonly persistence?: D1EmailOtpRegistrationEnrollmentPersistence;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export declare class CloudflareD1EmailOtpRegistrationEnrollmentFinalizer {
+    private readonly emailOtpEnrollments;
+    private readonly googleEmailOtpSessions;
+    constructor(input: {
+        readonly emailOtpEnrollments: CloudflareD1EmailOtpEnrollmentStore;
+        readonly googleEmailOtpSessions: CloudflareD1GoogleEmailOtpSessionResolver;
+    });
+    prepareRegistrationFinalize(input: {
+        readonly authority: RegistrationAuthority;
+        readonly request: {
+            readonly emailOtpEnrollment?: unknown;
+        };
+        readonly walletId: WalletId;
+        readonly orgId: string;
+        readonly nowMs: number;
+    }): Promise<EnrollmentResult>;
+    persistPrepared(persistence: D1EmailOtpRegistrationEnrollmentPersistence): Promise<{
+        readonly ok: true;
+    }>;
+    prepareRegistrationCommitPlan(persistence: D1EmailOtpRegistrationEnrollmentPersistence): D1EmailOtpRegistrationCommitPlan;
+    completeRegistrationIdentity(input: {
+        readonly authority: RegistrationAuthority;
+        readonly walletId: WalletId;
+    }): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    persistVerifiedEnrollment(input: {
+        readonly walletId: string;
+        readonly orgId: string;
+        readonly authSubjectId: string;
+        readonly verifiedEmail: string;
+        readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
+        readonly registrationAttemptId?: string;
+        readonly nowMs: number;
+    }): Promise<{
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    } | {
+        ok: true;
+        enrollment: {
+            createdAtMs: number;
+            updatedAtMs: number;
+            enrollmentSealKeyVersion: string;
+            unlockKeyVersion: string;
+        };
+    }>;
+    /**
+     * Refactor 109C: the enrollment statements for a wallet's first Email OTP
+     * method, to commit in the batch that inserts that method.
+     *
+     * Same construction as registration's, deliberately — the shared enrollment
+     * is one record whichever operation creates it, and a second builder would
+     * be a second answer to what a wallet's verified email is. What differs is
+     * only the batch it lands in: here it must commit or fail together with the
+     * auth method and the envelope sealed against it.
+     */
+    prepareAddedAuthMethodEnrollment(input: {
+        readonly walletId: string;
+        readonly orgId: string;
+        readonly authSubjectId: string;
+        readonly verifiedEmail: string;
+        readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
+        readonly nowMs: number;
+    }): Promise<{
+        readonly ok: true;
+        readonly enrollment: EmailOtpWalletEnrollmentRecord;
+        readonly statements: readonly D1PreparedStatementLike[];
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    /**
+     * Prepares the first Email OTP enrollment for a linked target. The insert is
+     * intentionally strict: a concurrent enrollment must abort the authority
+     * batch instead of silently replacing material that another operation owns.
+     */
+    prepareLinkedDeviceEnrollment(input: {
+        readonly walletId: string;
+        readonly orgId: string;
+        readonly authSubjectId: string;
+        readonly verifiedEmail: string;
+        readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
+        readonly nowMs: number;
+    }): Promise<{
+        readonly ok: true;
+        readonly enrollment: EmailOtpWalletEnrollmentRecord;
+        readonly statements: readonly D1PreparedStatementLike[];
+    } | {
+        readonly ok: false;
+        readonly code: string;
+        readonly message: string;
+    }>;
+    private buildPersistence;
+}
+export {};
+//# sourceMappingURL=d1EmailOtpRegistrationEnrollmentFinalizer.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts

@@ -0,0 +1,24 @@
+import type { EmailOtpServerSealRuntimeConfig } from '../auth/d1RouterApiAuthConfig';
+type EmailOtpServerSealInput = {
+    readonly wrappedCiphertext?: unknown;
+};
+type EmailOtpServerSealResult = {
+    readonly ok: true;
+    readonly ciphertext: string;
+    readonly enrollmentSealKeyVersion: string;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export declare class CloudflareD1EmailOtpServerSealRuntime {
+    private readonly config;
+    private readonly cipherResult;
+    constructor(config: EmailOtpServerSealRuntimeConfig);
+    removeEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
+    applyEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
+    private runServerSealOperation;
+    private createCipher;
+}
+export {};
+//# sourceMappingURL=d1EmailOtpServerSealRuntime.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts

@@ -0,0 +1,51 @@
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
+    private readonly prepare;
+    private readonly orgId;
+    constructor(input: {
+        readonly prepare: ScopedD1Prepare;
+        readonly orgId: string;
+    });
+    cleanupExpired(nowMs: number): Promise<number>;
+    create(input: {
+        readonly providerSubject: string;
+        readonly email: string;
+        readonly walletId: string;
+        readonly offerId: string;
+        readonly offerCandidates: NonEmptyGoogleEmailOtpRegistrationOfferCandidates;
+        readonly selectedCandidateId: string;
+        readonly ownerProofBindingDigest: string;
+        readonly authProvider: string;
+        readonly walletIdDerivationNonce: string;
+        readonly collisionCounter: number;
+        readonly runtimePolicyScope: RuntimePolicyScope;
+    }): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord>;
+    findStarted(input: {
+        readonly providerSubject: string;
+        readonly email: string;
+        readonly orgId: string;
+        readonly ownerProofBindingDigest: string;
+        readonly runtimePolicyScope: RuntimePolicyScope;
+    }): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
+    abandonStartedExceptBinding(input: {
+        readonly providerSubject: string;
+        readonly email: string;
+        readonly orgId: string;
+        readonly ownerProofBindingDigest: string;
+        readonly runtimePolicyScope: RuntimePolicyScope;
+        readonly nowMs: number;
+        readonly failureCode: 'owner_proof_binding_replaced';
+    }): Promise<void>;
+    hasLiveStartedWalletAttempt(input: {
+        readonly walletId: string;
+        readonly nowMs: number;
+    }): Promise<boolean>;
+    read(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
+    put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
+    delete(attemptId: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=d1GoogleEmailOtpRegistrationAttemptStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts

@@ -0,0 +1,69 @@
+import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
+import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+export type D1EmailOtpRegistrationAttemptRow = {
+    readonly attempt_id?: unknown;
+    readonly record_json?: unknown;
+    readonly expires_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+};
+export type GoogleEmailOtpRegistrationOfferForResponse = {
+    readonly offerId: string;
+    readonly selectedCandidateId: string;
+    readonly candidates: readonly [
+        {
+            readonly candidateId: string;
+            readonly walletId: string;
+        },
+        ...{
+            readonly candidateId: string;
+            readonly walletId: string;
+        }[]
+    ];
+};
+export declare function requireRuntimePolicyScope(input: unknown): RuntimePolicyScope;
+export declare function runtimePolicyScopeKey(scope: RuntimePolicyScope | undefined): string;
+export declare function activeGoogleEmailOtpRegistrationAttemptRecord(input: {
+    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
+    readonly updatedAtMs: number;
+}): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function expiredGoogleEmailOtpRegistrationAttemptRecord(input: {
+    readonly record: GoogleEmailOtpRegistrationAttemptRecord;
+    readonly updatedAtMs: number;
+}): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function failedGoogleEmailOtpRegistrationAttemptWithCode(input: {
+    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
+    readonly failureCode: string;
+    readonly updatedAtMs: number;
+}): GoogleEmailOtpRegistrationAttemptRecord;
+export declare function parseGoogleEmailOtpRegistrationAttemptRecord(input: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
+export declare function parseGoogleEmailOtpRegistrationAttemptRow(row: D1EmailOtpRegistrationAttemptRow | null): GoogleEmailOtpRegistrationAttemptRecord | null;
+export declare function registrationAttemptMatchesStartedScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: {
+    readonly providerSubject: string;
+    readonly email: string;
+    readonly orgId: string;
+    readonly ownerProofBindingDigest: string;
+    readonly runtimePolicyScope?: RuntimePolicyScope;
+    readonly nowMs: number;
+}): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
+export declare function registrationAttemptMatchesReplacementScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: {
+    readonly providerSubject: string;
+    readonly email: string;
+    readonly orgId: string;
+    readonly ownerProofBindingDigest: string;
+    readonly runtimePolicyScope?: RuntimePolicyScope;
+    readonly nowMs: number;
+}): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
+export declare function googleEmailOtpRegistrationOfferWalletIdsJson(candidates: NonEmptyGoogleEmailOtpRegistrationOfferCandidates): string;
+export declare function googleEmailOtpRegistrationOfferForResponse(input: Pick<PendingGoogleEmailOtpRegistrationAttemptRecord, 'offerId' | 'offerCandidates' | 'selectedCandidateId'>): GoogleEmailOtpRegistrationOfferForResponse;
+export declare function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record: PendingGoogleEmailOtpRegistrationAttemptRecord, updatedAtMs: number): PendingGoogleEmailOtpRegistrationAttemptRecord;
+export declare function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input: {
+    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
+    readonly candidate: GoogleEmailOtpRegistrationOfferCandidateRecord;
+    readonly updatedAtMs: number;
+}): PendingGoogleEmailOtpRegistrationAttemptRecord;
+export declare function abandonedGoogleEmailOtpRegistrationAttemptRecord(input: {
+    readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
+    readonly failureCode: 'owner_proof_binding_replaced' | 'offer_restarted_by_user';
+    readonly updatedAtMs: number;
+}): GoogleEmailOtpRegistrationAttemptRecord;
+//# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.d.ts

@@ -0,0 +1,57 @@
+import type { IdentityStore, LinkIdentityResult } from '../../../../core/IdentityStore';
+import type { RouterApiEmailOtpRouteService, RouterApiIdentityService } from '../../../framework/authServicePort';
+import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
+import type { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
+import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
+type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
+type CleanupGoogleEmailOtpDevRegistrationStateInput = Parameters<RouterApiEmailOtpRouteService['cleanupGoogleEmailOtpDevRegistrationState']>[0];
+type CleanupGoogleEmailOtpDevRegistrationStateResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['cleanupGoogleEmailOtpDevRegistrationState']>>;
+type ValidateGoogleEmailOtpRegistrationCandidateWalletInput = Parameters<RouterApiEmailOtpRouteService['validateGoogleEmailOtpRegistrationCandidateWallet']>[0];
+type ValidateGoogleEmailOtpRegistrationCandidateWalletResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['validateGoogleEmailOtpRegistrationCandidateWallet']>>;
+type ConsumeGoogleEmailOtpRegistrationAttemptRateLimitInput = Parameters<RouterApiIdentityService['consumeGoogleEmailOtpRegistrationAttemptRateLimit']>[0];
+type ConsumeGoogleEmailOtpRegistrationAttemptRateLimitResult = Awaited<ReturnType<RouterApiIdentityService['consumeGoogleEmailOtpRegistrationAttemptRateLimit']>>;
+type GoogleEmailOtpIdentityLinker = (input: {
+    readonly userId: string;
+    readonly subject: string;
+    readonly allowMoveIfSoleIdentity?: boolean;
+}) => Promise<LinkIdentityResult>;
+type CompleteGoogleEmailOtpRegistrationAttemptResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export declare class CloudflareD1GoogleEmailOtpSessionResolver {
+    private readonly emailOtpEnrollments;
+    private readonly emailOtpRateLimits;
+    private readonly identityStore;
+    private readonly linkIdentity;
+    private readonly production;
+    private readonly registrationAttempts;
+    constructor(input: {
+        readonly emailOtpEnrollments: CloudflareD1EmailOtpEnrollmentStore;
+        readonly emailOtpRateLimits: CloudflareD1EmailOtpRateLimitStore;
+        readonly identityStore: IdentityStore;
+        readonly linkIdentity: GoogleEmailOtpIdentityLinker;
+        readonly production: boolean;
+        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+    });
+    resolve(input: ResolveGoogleEmailOtpSessionInput): Promise<ResolveGoogleEmailOtpSessionResult>;
+    cleanupDevRegistrationState(input: CleanupGoogleEmailOtpDevRegistrationStateInput): Promise<CleanupGoogleEmailOtpDevRegistrationStateResult>;
+    consumeRegistrationAttemptRateLimit(input: ConsumeGoogleEmailOtpRegistrationAttemptRateLimitInput): Promise<ConsumeGoogleEmailOtpRegistrationAttemptRateLimitResult>;
+    completeRegistrationAttempt(input: {
+        readonly registrationAttemptId?: unknown;
+        readonly walletId?: unknown;
+    }): Promise<CompleteGoogleEmailOtpRegistrationAttemptResult>;
+    validateRegistrationCandidateWallet(input: ValidateGoogleEmailOtpRegistrationCandidateWalletInput): Promise<ValidateGoogleEmailOtpRegistrationCandidateWalletResult>;
+    private resolveLoginSession;
+    private resolveRegistrationSession;
+    private createFreshRegistrationAttempt;
+    private getEnrollmentBySubject;
+    private repairWalletLink;
+    private readActiveEnrollment;
+}
+export {};
+//# sourceMappingURL=d1GoogleEmailOtpSessionResolver.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityRecords.d.ts

@@ -0,0 +1,38 @@
+import type { LinkIdentityResult } from '../../../../core/IdentityStore';
+import type { RouterApiIdentityService } from '../../../framework/authServicePort';
+type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
+export type D1IdentityRow = {
+    readonly subject?: unknown;
+    readonly user_id?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly subject_count?: unknown;
+};
+type IdentitySubjectRecord = {
+    readonly version: 'identity_subject_v1';
+    readonly subject: string;
+    readonly userId: string;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+export declare function hasDifferentWalletIdentitySubject(input: {
+    readonly subjects: readonly string[];
+    readonly expectedIdentitySubject: string;
+}): boolean;
+export declare function googleEmailOtpStaleIdentityMapping(input: {
+    readonly providerSubject: string;
+    readonly linkedWalletId: string;
+    readonly email?: string;
+}): Extract<ResolveGoogleEmailOtpSessionResult, {
+    readonly ok: false;
+}>;
+export declare function parseIdentityCreatedAt(input: unknown, fallback: number): number;
+export declare function identitySubjectRecord(input: {
+    readonly subject: string;
+    readonly userId: string;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+}): IdentitySubjectRecord;
+export declare function identityAlreadyLinked(): LinkIdentityResult;
+export declare function identityMoveDisallowed(): LinkIdentityResult;
+export {};
+//# sourceMappingURL=d1IdentityRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityService.d.ts

@@ -0,0 +1,31 @@
+import type { IdentityStore } from '../../../../core/IdentityStore';
+import type { RouterApiIdentityService } from '../../../framework/authServicePort';
+type ListIdentitiesInput = Parameters<RouterApiIdentityService['listIdentities']>[0];
+type ListIdentitiesResult = Awaited<ReturnType<RouterApiIdentityService['listIdentities']>>;
+type LinkIdentityInput = Parameters<RouterApiIdentityService['linkIdentity']>[0];
+type LinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['linkIdentity']>>;
+type UnlinkIdentityInput = Parameters<RouterApiIdentityService['unlinkIdentity']>[0];
+type UnlinkIdentityResult = Awaited<ReturnType<RouterApiIdentityService['unlinkIdentity']>>;
+type ResolveOidcWalletIdInput = Parameters<RouterApiIdentityService['resolveOidcWalletId']>[0];
+type ResolveOidcWalletIdResult = Awaited<ReturnType<RouterApiIdentityService['resolveOidcWalletId']>>;
+type ResolveGoogleEmailOtpSessionInput = Parameters<RouterApiIdentityService['resolveGoogleEmailOtpSession']>[0];
+type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
+type ResolveGoogleEmailOtpSession = (input: ResolveGoogleEmailOtpSessionInput) => Promise<ResolveGoogleEmailOtpSessionResult>;
+export declare class CloudflareD1IdentityService {
+    private readonly accountIdDerivationSecret;
+    private readonly identityStore;
+    private readonly relayerAccount;
+    private readonly resolveGoogleEmailOtpSession;
+    constructor(input: {
+        readonly accountIdDerivationSecret: unknown;
+        readonly identityStore: IdentityStore;
+        readonly relayerAccount: unknown;
+        readonly resolveGoogleEmailOtpSession: ResolveGoogleEmailOtpSession;
+    });
+    listIdentities(input: ListIdentitiesInput): Promise<ListIdentitiesResult>;
+    linkIdentity(input: LinkIdentityInput): Promise<LinkIdentityResult>;
+    unlinkIdentity(input: UnlinkIdentityInput): Promise<UnlinkIdentityResult>;
+    resolveOidcWalletId(input: ResolveOidcWalletIdInput): Promise<ResolveOidcWalletIdResult>;
+}
+export {};
+//# sourceMappingURL=d1IdentityService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts

@@ -0,0 +1,30 @@
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type NearPublicKeyRecord } from '../webauthn/d1WebAuthnRecords';
+type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+type D1NearPublicKeyListResult = {
+    readonly ok: true;
+    readonly keys: {
+        readonly publicKey: string;
+        readonly kind: NearPublicKeyRecord['kind'];
+        readonly signerSlot?: number;
+        readonly createdAtMs?: number;
+        readonly updatedAtMs?: number;
+        readonly authBinding?: NearPublicKeyRecord['authBinding'];
+    }[];
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_args' | 'internal';
+    readonly message: string;
+};
+export declare class CloudflareD1NearPublicKeyStore {
+    private readonly prepare;
+    constructor(input: {
+        readonly prepare: ScopedD1Prepare;
+    });
+    listForRelayUser(input: {
+        readonly userId?: unknown;
+    }): Promise<D1NearPublicKeyListResult>;
+    listForUser(userId: string): Promise<NearPublicKeyRecord[]>;
+}
+export {};
+//# sourceMappingURL=d1NearPublicKeyStore.d.ts.map