@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts

@@ -0,0 +1,256 @@
+import { type WalletRecoveryBackupAcknowledgementV1 } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodes';
+import { type WalletRecoveryEnvelopeSetRecord } from '../../../../../../shared-ts/src/wallet-recovery';
+import { type PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
+import { type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import { type RecoveryCodeLocatorV1 } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeLocator';
+import { type DerivedWalletRecoveryKeyId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryKeyId';
+import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type CloudflareD1VersionedJsonRecordScopeV1 } from '../versionedJson/d1VersionedJsonRecordStore';
+import type { WebAuthnAuthenticatorRecord } from '../webauthn/d1WebAuthnRecords';
+import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
+import { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
+import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import { type WalletRecoveryGoogleEmailOtpFinalizationInput } from './d1WalletRecoveryGoogleEmailOtpRecords';
+type ActivePasskeyWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
+    readonly kind: 'passkey';
+    readonly status: 'active';
+}>;
+type ActiveEmailOtpWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
+    readonly kind: 'email_otp';
+    readonly status: 'active';
+}>;
+export type CloudflareD1WalletCustodyCommitStoreOptions = {
+    readonly database: D1DatabaseLike;
+    readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
+    readonly walletAuthMethodStore?: D1WalletAuthMethodStore;
+    readonly walletAuthorityStore?: Pick<D1WalletAuthorityStore, 'readById'>;
+};
+export type WalletCustodyRegistrationCommit = {
+    readonly envelope: PasskeyCustodyEnvelopeRecord;
+    readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
+    readonly recoveryBackupAcknowledgement: WalletRecoveryBackupAcknowledgementV1;
+    readonly recoveryCodeLocators: readonly WalletRecoveryCodeLocatorRecord[];
+};
+export type WalletRecoveryCodeLocatorRecord = {
+    readonly locatorB64u: RecoveryCodeLocatorV1;
+    readonly walletId: WalletId;
+    readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
+};
+export type WalletCustodyRegistrationCommitResult = {
+    readonly kind: 'committed';
+    readonly envelopeStoreVersion: string;
+    readonly recoverySetStoreVersion: string;
+}
+/**
+ * This ceremony's own envelope is already stored: the commit was applied
+ * before, and the caller holding this result is done. Never an overwrite —
+ * replacing stored custody would strand every key the existing seed controls.
+ */
+ | {
+    readonly kind: 'already_exists';
+    readonly key: string;
+}
+/**
+ * The wallet already has custody, established by a *different* ceremony —
+ * its recovery-set key is occupied while this ceremony's envelope key is
+ * free. This is the losing side of the establish race: two key sets each
+ * believed they were the wallet's first. The caller must discard this run's
+ * seed and re-enter as a join of the existing envelope, committing only its
+ * key set's manifest.
+ *
+ * Distinct from `already_exists` because the correct reactions are opposite:
+ * a repeat is finished, a lost race has a key set still to provision.
+ */
+ | {
+    readonly kind: 'custody_already_established';
+    readonly walletId: WalletId;
+}
+/** The two records describe different wallets. */
+ | {
+    readonly kind: 'inconsistent';
+    readonly reason: string;
+};
+export type WalletCustodyRecoveryAuthorityInstallCommitResult = {
+    readonly kind: 'committed' | 'already_committed';
+    readonly envelopeStoreVersion: string;
+} | {
+    readonly kind: 'conflict';
+} | {
+    readonly kind: 'inconsistent';
+    readonly reason: string;
+};
+export type WalletRecoveryEmailEnrollmentCommit = {
+    readonly kind: 'existing';
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+    readonly statements: readonly [];
+} | {
+    readonly kind: 'create';
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+    readonly statements: readonly D1PreparedStatementLike[];
+};
+export type WalletRecoveryGoogleEmailOtpAuthorityInstallCommit = {
+    readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+    readonly recoveryAttemptStoreVersion: string;
+    readonly continuityAuthority: ActiveWalletAuthorityV1;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
+    readonly expectedRecoverySetVersion: string;
+    readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+    readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
+    readonly walletAuthMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
+    readonly enrollmentCommit: WalletRecoveryEmailEnrollmentCommit;
+};
+/** Recovery sets are wallet-scoped: one set covers the wallet, not one factor. */
+export declare function walletRecoveryBackupAcknowledgementRecordKey(walletId: WalletId): string;
+export type WalletRecoveryAuthenticatorCommit = {
+    readonly userId: string;
+    readonly authenticator: WebAuthnAuthenticatorRecord;
+    readonly binding: WebAuthnCredentialBindingRecord;
+    readonly walletAuthMethod: ActivePasskeyWalletAuthMethodRecordV2;
+    readonly challengeDeleteStatement: D1PreparedStatementLike;
+};
+export declare function walletRecoveryEnvelopeSetRecordKey(walletId: WalletId): string;
+export declare class CloudflareD1WalletCustodyCommitStore {
+    private readonly database;
+    private readonly scope;
+    private readonly records;
+    private readonly walletAuthMethodStore;
+    private readonly walletAuthorityStore;
+    constructor(options: CloudflareD1WalletCustodyCommitStoreOptions);
+    readRecoveryCodeLocator(locatorB64u: RecoveryCodeLocatorV1): Promise<WalletRecoveryCodeLocatorRecord | null>;
+    /** Reads locator metadata without ever materializing a recovery code. */
+    readRecoveryCodeLocatorByRecoveryKey(input: {
+        readonly walletId: WalletId;
+        readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
+    }): Promise<WalletRecoveryCodeLocatorRecord | null>;
+    private prepareRecoveryCodeLocatorInsertStatement;
+    private prepareRecoveryCodeLocatorsDeleteForWalletStatement;
+    private prepareRecoveryCodeLocatorCollisionGuardStatement;
+    /** Retains the locator tombstone while `changes()` proves it existed in the atomic commit. */
+    private prepareRecoveryCodeLocatorConsumeStatement;
+    private prepareWalletRecoveryGoogleEmailOtpAttemptFinalizeStatement;
+    /** The OTP verifier normally consumes this row before finalization. */
+    private prepareWalletRecoveryGoogleEmailOtpChallengeDeleteStatement;
+    private readEmailOtpEnrollment;
+    private walletRecoveryGoogleEmailOtpFinalizedAttemptMatches;
+    private walletRecoveryGoogleEmailOtpChallengeExists;
+    /**
+     * Writes the envelope and the recovery set in one transaction.
+     *
+     * Both are inserts, never updates: `expectedVersion: null` fails if either
+     * key already holds a row, so a repeated registration cannot silently replace
+     * an established wallet's custody.
+     */
+    commitRegistration(commit: WalletCustodyRegistrationCommit): Promise<WalletCustodyRegistrationCommitResult>;
+    /**
+     * Reads a wallet's recovery envelope set. Returns null when absent, and also
+     * when the stored row is not a recovery set — a row that fails its own parser
+     * is unusable, and reporting it as present would invite a caller to act on a
+     * record nothing validated.
+     */
+    readRecoveryEnvelopeSet(walletId: WalletId): Promise<{
+        record: WalletRecoveryEnvelopeSetRecord;
+        storeVersion: string;
+    } | null>;
+    listWalletAuthMethods(walletId: WalletId): Promise<readonly WalletAuthMethodRecordV2[]>;
+    readWalletAuthMethodById(walletAuthMethodId: WalletAuthMethodId): Promise<WalletAuthMethodRecordV2 | null>;
+    readPasskeyWalletAuthMethod(input: {
+        readonly rpId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<Extract<WalletAuthMethodRecordV2, {
+        readonly kind: 'passkey';
+    }> | null>;
+    /**
+     * Reads the wallet's backup acknowledgement, if any.
+     *
+     * Absent is the normal state for a wallet whose owner has not confirmed
+     * saving their codes, so it is `null` rather than an error.
+     */
+    readBackupAcknowledgement(walletId: WalletId): Promise<WalletRecoveryBackupAcknowledgementV1 | null>;
+    /**
+     * Records that the owner confirmed saving their codes.
+     *
+     * Written with no expected version, unlike the recovery set: this row is
+     * cosmetic, a repeat acknowledgement is not a conflict worth surfacing to
+     * someone pressing a button, and it shares no record with the wraps a spend
+     * updates — which is exactly why it is a separate key.
+     */
+    writeBackupAcknowledgement(record: WalletRecoveryBackupAcknowledgementV1): Promise<{
+        kind: 'stored';
+    } | {
+        kind: 'conflict';
+    }>;
+    /**
+     * Writes a recovery set back, refusing if it changed underneath.
+     *
+     * The expected version is the whole point. Burning a recovery code is a
+     * read-modify-write on one shared record, so two concurrent attempts that
+     * both read the same set would otherwise each write their own view — and
+     * the second write would silently restore the first attempt's consumed code
+     * to the active pool. A single-use code that survives its use is the one
+     * failure this record must not have.
+     */
+    writeRecoveryEnvelopeSet(input: {
+        readonly record: WalletRecoveryEnvelopeSetRecord;
+        readonly expectedStoreVersion: string;
+    }): Promise<{
+        kind: 'stored';
+        storeVersion: string;
+    } | {
+        kind: 'conflict';
+    }>;
+    /**
+     * Replaces a complete recovery set and carries the backup-ack row through
+     * the same CAS. The acknowledgement still names the previous issuance, so
+     * status naturally reports the fresh set as outstanding until the UI calls
+     * the explicit acknowledge route. Both rows are guarded against races.
+     */
+    replaceRecoveryEnvelopeSetAndPreserveBackupAcknowledgement(input: {
+        readonly record: WalletRecoveryEnvelopeSetRecord;
+        readonly expectedRecoverySetVersion: string;
+        readonly recoveryCodeLocators: readonly WalletRecoveryCodeLocatorRecord[];
+    }): Promise<{
+        kind: 'stored';
+        storeVersion: string;
+    } | {
+        kind: 'conflict';
+    } | {
+        kind: 'collision';
+    }>;
+    /**
+     * Installs a fresh recovered-device authority and Passkey target while
+     * consuming its held code in one D1 transaction. The continuity authority,
+     * methods, envelopes, and sessions are deliberately never updated here.
+     * Current recovery activation output has no fresh Ed25519 reference, so the
+     * first functional slice requires the target authority to reuse the exact
+     * anchor signer activation set.
+     */
+    commitRecoveryAuthorityInstall(input: {
+        readonly continuityAuthority: ActiveWalletAuthorityV1;
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
+        readonly expectedRecoverySetVersion: string;
+        readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+        readonly reservationId: RecoveryCodeReservationId;
+        readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
+        readonly authenticatorCommit: WalletRecoveryAuthenticatorCommit;
+    }): Promise<WalletCustodyRecoveryAuthorityInstallCommitResult>;
+    /**
+     * Exact readback for a retry after the recovery attempt was deleted. The
+     * target rows and the consumed reservation are the durable receipt; no
+     * source authority, method, envelope, or session is consulted for mutation.
+     */
+    resolveRecoveryGoogleEmailOtpReplay(input: {
+        readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+        readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+        readonly enrollment: EmailOtpWalletEnrollmentRecord;
+    }): Promise<WalletCustodyRecoveryAuthorityInstallCommitResult>;
+    /** Installs a fresh Email OTP authority and envelope in one D1 transaction. */
+    commitRecoveryGoogleEmailOtpAuthorityInstall(input: WalletRecoveryGoogleEmailOtpAuthorityInstallCommit): Promise<WalletCustodyRecoveryAuthorityInstallCommitResult>;
+}
+export {};
+//# sourceMappingURL=d1WalletCustodyCommitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpAttemptStore.d.ts

@@ -0,0 +1,32 @@
+import type { VersionedJsonRecordReadResult } from '../../../framework/versionedJsonRecordStore';
+import { type CloudflareD1VersionedJsonRecordScopeV1 } from '../versionedJson/d1VersionedJsonRecordStore';
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import { type WalletRecoveryGoogleEmailOtpAttemptRecord } from './d1WalletRecoveryGoogleEmailOtpRecords';
+import type { WalletRecoveryOperationId } from '../../../../../../shared-ts/src/utils/domainIds';
+/**
+ * D1 persistence for the recovery-scoped Google/Email state machine. The
+ * recovery code, Google credential, OTP, and factor secret never belong in
+ * this record; only the server-issued operation identities and verified
+ * challenge binding do.
+ */
+export declare class CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore {
+    private readonly records;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
+    });
+    read(recoveryOperationId: WalletRecoveryOperationId): Promise<VersionedJsonRecordReadResult<WalletRecoveryGoogleEmailOtpAttemptRecord>>;
+    create(attempt: WalletRecoveryGoogleEmailOtpAttemptRecord): Promise<{
+        readonly kind: 'stored';
+        readonly version: string;
+    } | {
+        readonly kind: 'conflict';
+    }>;
+    update(attempt: WalletRecoveryGoogleEmailOtpAttemptRecord, expectedVersion: string): Promise<{
+        readonly kind: 'stored';
+        readonly version: string;
+    } | {
+        readonly kind: 'conflict';
+    }>;
+}
+//# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpAttemptStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.d.ts

@@ -0,0 +1,116 @@
+import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type WalletAuthMethodId, type WalletAuthorityBindingDigest, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import type { WebAuthnRecoveryContinuityAnchorRecord } from '../webauthn/d1WebAuthnRecords';
+export type WalletRecoveryGoogleEmailOtpTargetV1 = {
+    readonly kind: 'google_email_otp';
+    readonly googleProvider: 'google';
+};
+export type WalletRecoveryGoogleEmailOtpTargetEnrollmentV1 = {
+    readonly kind: 'existing';
+    readonly enrollmentId: string;
+    readonly enrollmentSealKeyVersion: string;
+} | {
+    readonly kind: 'create';
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+};
+type WalletRecoveryGoogleEmailOtpAttemptCommonV1 = {
+    readonly version: 'wallet_recovery_google_email_otp_attempt_v1';
+    readonly walletId: WalletId;
+    readonly orgId: string;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly recoveryOperationId: WalletRecoveryOperationId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetAuthorityId: WalletAuthorityId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly target: WalletRecoveryGoogleEmailOtpTargetV1;
+    readonly continuityAnchor: WebAuthnRecoveryContinuityAnchorRecord;
+    readonly recoverySetVersion: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type WalletRecoveryGoogleEmailOtpAttemptRecord = (WalletRecoveryGoogleEmailOtpAttemptCommonV1 & {
+    readonly state: 'prepared';
+    readonly providerSubject?: never;
+    readonly verifiedEmail?: never;
+    readonly challengeId?: never;
+    readonly ownerProofBindingDigest?: never;
+    readonly targetEnrollment?: never;
+}) | (WalletRecoveryGoogleEmailOtpAttemptCommonV1 & {
+    readonly state: 'otp_issued';
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+    readonly challengeId: string;
+    readonly ownerProofBindingDigest: DigestB64u;
+    readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
+}) | (WalletRecoveryGoogleEmailOtpAttemptCommonV1 & {
+    readonly state: 'otp_verified';
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+    readonly challengeId: string;
+    readonly ownerProofBindingDigest: DigestB64u;
+    readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
+}) | (WalletRecoveryGoogleEmailOtpAttemptCommonV1 & {
+    readonly state: 'finalized';
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+    readonly challengeId: string;
+    readonly ownerProofBindingDigest: DigestB64u;
+    readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
+});
+export type PreparedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+    readonly state: 'prepared';
+}>;
+export type OtpIssuedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+    readonly state: 'otp_issued';
+}>;
+export type OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+    readonly state: 'otp_verified';
+}>;
+export type FinalizableWalletRecoveryGoogleEmailOtpAttempt = Extract<WalletRecoveryGoogleEmailOtpAttemptRecord, {
+    readonly state: 'otp_verified' | 'finalized';
+}>;
+export type WalletRecoveryGoogleEmailOtpFinalizationInput = {
+    readonly kind: 'wallet_recovery_google_email_otp_finalization_v1';
+    readonly walletId: WalletId;
+    readonly orgId: string;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly recoveryOperationId: WalletRecoveryOperationId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetAuthorityId: WalletAuthorityId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly challengeId: string;
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+    readonly ownerProofBindingDigest: DigestB64u;
+    readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
+};
+export declare function walletRecoveryGoogleEmailOtpAttemptKey(recoveryOperationId: WalletRecoveryOperationId): string;
+export declare function buildPreparedWalletRecoveryGoogleEmailOtpAttempt(input: {
+    readonly walletId: WalletId;
+    readonly orgId: string;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly recoveryOperationId: WalletRecoveryOperationId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetAuthorityId: WalletAuthorityId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly continuityAnchor: WebAuthnRecoveryContinuityAnchorRecord;
+    readonly recoverySetVersion: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+}): PreparedWalletRecoveryGoogleEmailOtpAttempt;
+export declare function markWalletRecoveryGoogleEmailOtpAttemptIssued(input: {
+    readonly attempt: PreparedWalletRecoveryGoogleEmailOtpAttempt;
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+    readonly challengeId: string;
+    readonly ownerProofBindingDigest: DigestB64u;
+    readonly targetEnrollment: WalletRecoveryGoogleEmailOtpTargetEnrollmentV1;
+}): OtpIssuedWalletRecoveryGoogleEmailOtpAttempt;
+export declare function markWalletRecoveryGoogleEmailOtpAttemptVerified(attempt: OtpIssuedWalletRecoveryGoogleEmailOtpAttempt): OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt;
+export declare function walletRecoveryGoogleEmailOtpFinalizationInput(attempt: FinalizableWalletRecoveryGoogleEmailOtpAttempt): WalletRecoveryGoogleEmailOtpFinalizationInput;
+export declare function parseWalletRecoveryGoogleEmailOtpAttemptRecord(raw: unknown): WalletRecoveryGoogleEmailOtpAttemptRecord | null;
+export type { WalletAuthMethodId, WalletAuthorityBindingDigest, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId, };
+//# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.d.ts

@@ -0,0 +1,180 @@
+import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization';
+import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
+import type { EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import type { D1WalletStore } from '../../../../core/d1WalletStore';
+import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
+import type { CloudflareD1PasskeyCustodyEnvelopeStore } from './d1PasskeyCustodyEnvelopeStore';
+import type { CloudflareD1WalletCustodyCommitStore } from './d1WalletCustodyCommitStore';
+import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import type { EmailOtpEnrollmentMaterialBoundaryInput } from '../emailOtp/d1EmailOtpRecords';
+import { type WalletRecoveryEcdsaMaterialPossessionProofInputV1 } from '../../../domains/passkeyCustody/walletRecoveryKeyManifest';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { CloudflareD1EmailOtpChallengeIssuer } from '../emailOtp/d1EmailOtpChallengeIssuer';
+import type { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { CloudflareD1EmailOtpEnrollmentStore } from '../emailOtp/d1EmailOtpEnrollmentStore';
+import type { CloudflareD1EmailOtpServerSealRuntime } from '../emailOtp/d1EmailOtpServerSealRuntime';
+import type { CloudflareD1OidcVerificationService } from '../oidc/d1OidcVerificationService';
+import type { EmailOtpChallengeDelivery } from '../../../framework/authServicePort';
+import type { OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt, WalletRecoveryGoogleEmailOtpFinalizationInput, WalletRecoveryGoogleEmailOtpAttemptRecord } from './d1WalletRecoveryGoogleEmailOtpRecords';
+import type { CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore } from './d1WalletRecoveryGoogleEmailOtpAttemptStore';
+type GoogleRecoveryFailure = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+type ActiveEmailOtpWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
+    readonly kind: 'email_otp';
+    readonly status: 'active';
+}>;
+export type WalletRecoveryGoogleEmailOtpFinalizationEnrollment = {
+    readonly kind: 'existing';
+    readonly enrollmentId: string;
+    readonly enrollmentSealKeyVersion: string;
+    readonly material?: never;
+} | {
+    readonly kind: 'create';
+    readonly providerSubject: string;
+    readonly verifiedEmail: string;
+    readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
+};
+export type WalletRecoveryGoogleEmailOtpFinalizationDependencies = {
+    readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
+    readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;
+    readonly walletAuthorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly walletStore: D1WalletStore;
+    readonly enrollmentFinalizer: Pick<CloudflareD1EmailOtpRegistrationEnrollmentFinalizer, 'prepareLinkedDeviceEnrollment'>;
+};
+export type WalletRecoveryGoogleEmailOtpFinalizationResult = {
+    readonly kind: 'promoted';
+    readonly storeVersion: string;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
+    readonly enrollment: EmailOtpWalletEnrollmentRecord;
+} | {
+    readonly kind: 'conflict';
+    readonly reason: string;
+} | {
+    readonly kind: 'refused';
+    readonly reason: string;
+} | {
+    readonly kind: 'envelope_rejected';
+    readonly reason: string;
+} | {
+    readonly kind: 'enrollment_rejected';
+    readonly reason: string;
+};
+export type WalletRecoveryGoogleEmailOtpFinalizationRequest = {
+    readonly kind: 'finalize';
+    readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+    readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+    readonly emailOtpEnrollment: WalletRecoveryGoogleEmailOtpFinalizationEnrollment;
+    readonly ecdsaMaterialPossessionProofs: readonly WalletRecoveryEcdsaMaterialPossessionProofInputV1[];
+    readonly dependencies: WalletRecoveryGoogleEmailOtpFinalizationDependencies;
+} | {
+    readonly kind: 'replay';
+    readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+    readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+    readonly dependencies: WalletRecoveryGoogleEmailOtpFinalizationDependencies;
+};
+export type WalletRecoveryGoogleEmailOtpChallengeResult = {
+    readonly ok: true;
+    readonly recoveryOperationId: string;
+    readonly walletId: WalletId;
+    readonly reservationId: string;
+    readonly challengeId: string;
+    readonly verifiedEmail: string;
+    readonly delivery: EmailOtpChallengeDelivery;
+    readonly expiresAtMs: number;
+} | GoogleRecoveryFailure;
+export type WalletRecoveryGoogleEmailOtpFactorReleaseResult = {
+    readonly ok: true;
+    readonly kind: 'email_otp_factor_release_v1';
+    readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+    readonly enrollment: {
+        readonly kind: 'existing';
+        readonly enrollmentId: string;
+        readonly enrollmentSealKeyVersion: string;
+    };
+    readonly serverEphemeralPublicKey65B64u: string;
+    readonly nonce12B64u: string;
+    readonly ciphertextB64u: string;
+} | {
+    readonly ok: true;
+    readonly kind: 'wallet_recovery_google_email_otp_new_enrollment_v1';
+    readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+    readonly enrollment: {
+        readonly kind: 'create';
+        readonly providerSubject: string;
+        readonly verifiedEmail: string;
+    };
+} | GoogleRecoveryFailure;
+export type WalletRecoveryGoogleEmailOtpVerificationResult = {
+    readonly ok: true;
+    readonly recovery: WalletRecoveryGoogleEmailOtpFinalizationInput;
+    readonly attempt: OtpVerifiedWalletRecoveryGoogleEmailOtpAttempt;
+} | GoogleRecoveryFailure;
+/**
+ * Recovery-scoped Google and Email OTP coordinator. It owns only the
+ * recovery operation binding; Google verification, OTP issuance/consumption,
+ * and factor unsealing stay in their existing services.
+ */
+export declare class CloudflareD1WalletRecoveryGoogleEmailOtpService {
+    private readonly attempts;
+    private readonly google;
+    private readonly issuer;
+    private readonly verifier;
+    private readonly enrollments;
+    private readonly serverSeal;
+    private readonly orgId;
+    private readonly nowMs;
+    constructor(input: {
+        readonly attempts: CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore;
+        readonly google: Pick<CloudflareD1OidcVerificationService, 'verifyGoogleLoginForRecovery'>;
+        readonly issuer: Pick<CloudflareD1EmailOtpChallengeIssuer, 'create'>;
+        readonly verifier: Pick<CloudflareD1EmailOtpChallengeVerifier, 'verifyRecoveryBootstrap'>;
+        readonly enrollments: Pick<CloudflareD1EmailOtpEnrollmentStore, 'readEnrollment'>;
+        readonly serverSeal: Pick<CloudflareD1EmailOtpServerSealRuntime, 'removeEmailOtpServerSeal'>;
+        readonly orgId: string;
+        readonly nowMs?: () => number;
+    });
+    persistPrepared(input: {
+        readonly attempt: WalletRecoveryGoogleEmailOtpAttemptRecord;
+    }): Promise<{
+        readonly kind: 'stored';
+        readonly version: string;
+    } | {
+        readonly kind: 'conflict';
+    }>;
+    readAttempt(recoveryOperationId: Parameters<CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore['read']>[0]): Promise<import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<WalletRecoveryGoogleEmailOtpAttemptRecord>>;
+    /** Verifies the Google token and issues the recovery-bound OTP. */
+    verifyGoogle(input: {
+        readonly recoveryOperationId: Parameters<CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore['read']>[0];
+        readonly reservationId: string;
+        readonly idToken: unknown;
+        readonly requestOrigin: string | null;
+        readonly clientIp?: unknown;
+    }): Promise<WalletRecoveryGoogleEmailOtpChallengeResult>;
+    /** Consumes the recovery-bound OTP; factor release is a separate retryable gate. */
+    verifyOtp(input: {
+        readonly recoveryOperationId: Parameters<CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore['read']>[0];
+        readonly reservationId: string;
+        readonly challengeId: string;
+        readonly otpCode: unknown;
+        readonly clientIp?: unknown;
+    }): Promise<WalletRecoveryGoogleEmailOtpVerificationResult>;
+    /** Releases existing Email material, or returns authorization to create the first enrollment. */
+    releaseFactor(input: {
+        readonly recoveryOperationId: Parameters<CloudflareD1WalletRecoveryGoogleEmailOtpAttemptStore['read']>[0];
+        readonly reservationId: string;
+        readonly workerEphemeralPublicKey65B64u?: unknown;
+    }): Promise<WalletRecoveryGoogleEmailOtpFactorReleaseResult>;
+    /**
+     * Completes the verified Google/Email recovery by installing a fresh target
+     * authority and Email method. The durable commit owns every write; this
+     * coordinator only resolves the continuity anchor and target envelope.
+     */
+    finalizeRecovery(input: WalletRecoveryGoogleEmailOtpFinalizationRequest): Promise<WalletRecoveryGoogleEmailOtpFinalizationResult>;
+}
+export {};
+//# sourceMappingURL=d1WalletRecoveryGoogleEmailOtpService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.d.ts

@@ -0,0 +1,24 @@
+import type { WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { ThresholdEcdsaChainTarget, ThresholdRuntimePolicyScope } from '../../../../core/types';
+import type { RegistrationPreparationId, WalletRegistrationEcdsaPreparePayload } from '../../../../core/registrationContracts';
+import type { RouterAbEcdsaStrictRegistrationPort } from '../../../domains/ecdsa/routerAbEcdsaStrictRegistration';
+export declare function buildD1EvmFamilyEcdsaRegistrationPrepare(input: {
+    readonly registrationPurpose: 'wallet_registration' | 'wallet_add_signer';
+    readonly registrationCeremonyId: string;
+    readonly registrationPreparationId: RegistrationPreparationId;
+    readonly walletId: WalletId;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly chainTargets: readonly ThresholdEcdsaChainTarget[] | null;
+    readonly participantIds: readonly number[];
+    readonly runtimePolicyScope: ThresholdRuntimePolicyScope;
+    readonly strictRegistration: RouterAbEcdsaStrictRegistrationPort;
+}): Promise<{
+    ok: true;
+    ecdsa: WalletRegistrationEcdsaPreparePayload;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+}>;
+//# sourceMappingURL=d1EvmFamilyEcdsaRegistrationBranch.d.ts.map