@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts

@@ -0,0 +1,359 @@
+import { type WebAuthnCredentialIdB64u, type WebAuthnRpId, type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type AddAuthMethodIntentGrant, type AddAuthMethodIntentV1, type AddSignerIntentV1, type RegistrationAuthority, type RegistrationIntentV1, type WalletId, type WalletAuthMethodRevocationProof, type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+import type { StoredWalletAddAuthMethodCeremony } from '../../../../core/RegistrationCeremonyStore';
+import type { WalletAddAuthMethodFinalizeResponse, WalletAddAuthMethodStartRequest, WalletAddAuthMethodStartResponse, WalletAddSignerStartRequest, WalletRegistrationAuthorityInput, WalletRevokeAuthMethodResponse } from '../../../../core/registrationContracts';
+import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import { CloudflareD1EmailOtpChallengeVerifier } from '../emailOtp/d1EmailOtpChallengeVerifier';
+import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import { CloudflareD1RegistrationCeremonyIntentStore } from '../registration/d1RegistrationCeremonyStore';
+import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+import { type D1FreshRevokeWebAuthnVerifierV1, type D1AddAuthMethodExistingAuthResolution, type D1AddSignerExistingAuthResolution } from './d1WalletAuthMethodBoundary';
+import type { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
+import type { WalletEd25519SignerRecord } from '../../../../core/WalletStore';
+/** The wallet's Ed25519 signers, the only server record of its NEAR identity. */
+type ListWalletEd25519SignersV1 = (walletId: WalletId) => Promise<readonly WalletEd25519SignerRecord[]>;
+import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../passkeyCustody/d1PasskeyCustodyEnvelopeStore';
+import type { D1WalletAuthorityStore } from './d1WalletAuthorityStore';
+import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import { type WalletExecutionLaneAuthSource } from '../../../../core/signingLanes/WalletExecutionLaneProjection';
+import type { ActiveWalletSessionAuthorityResolution, FinalizeWalletAddAuthMethodCommand, RevokeWalletAuthMethodCommand, StartWalletAddAuthMethodCommand, WalletAuthMethodRevokeProofVerificationResult, WalletUnlockEmailOtpAuthorityResolution, WalletUnlockPasskeyAuthorityResolution } from '../../../framework/authServicePort';
+type StartWalletAddAuthMethodInput = StartWalletAddAuthMethodCommand;
+type StartWalletAddAuthMethodResult = WalletAddAuthMethodStartResponse;
+type FinalizeWalletAddAuthMethodInput = FinalizeWalletAddAuthMethodCommand;
+type FinalizeWalletAddAuthMethodResult = WalletAddAuthMethodFinalizeResponse;
+type RevokeWalletAuthMethodInput = RevokeWalletAuthMethodCommand;
+type RevokeWalletAuthMethodResult = WalletRevokeAuthMethodResponse;
+type OwnerWalletSessionRevocationStatementsV1 = (input: {
+    readonly walletId: WalletId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly requestedAtMs: number;
+}) => readonly D1PreparedStatementLike[];
+/** Issues a one-time code against the wallet's existing enrollment. */
+type EmailOtpSourceChallengeIssuerV1 = (input: {
+    readonly userId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly otpChannel: typeof EMAIL_OTP_CHANNEL;
+    readonly ownerProofBindingDigest: string;
+    readonly operation: string;
+    readonly reuseActiveChallenge: boolean;
+}) => Promise<{
+    readonly ok: true;
+    readonly challenge: {
+        readonly challengeId: string;
+        readonly expiresAtMs: number;
+    };
+    readonly delivery?: {
+        readonly emailHint?: string;
+    };
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+}>;
+/** Issues the one-time enrollment code, bound to a digest the caller supplies. */
+type EmailOtpEnrollmentChallengeIssuerV1 = (input: {
+    readonly userId: string;
+    readonly walletId: string;
+    readonly orgId: string;
+    readonly email: string;
+    readonly otpChannel: typeof EMAIL_OTP_CHANNEL;
+    readonly ownerProofBindingDigest: string;
+}) => Promise<{
+    readonly ok: true;
+    readonly challenge: {
+        readonly challengeId: string;
+        readonly expiresAtMs: number;
+    };
+    readonly delivery?: {
+        readonly emailHint?: string;
+    };
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+}>;
+type WalletAuthMethodError = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+type WalletAuthMethodAuthorityResult = {
+    readonly ok: true;
+    readonly authority: RegistrationAuthority;
+} | WalletAuthMethodError;
+type Sha256Bytes = (input: Uint8Array) => Promise<Uint8Array>;
+type RegistrationCeremonyStoreProvider = () => CloudflareD1RegistrationCeremonyIntentStore;
+type WalletAuthMethodStoreProvider = () => D1WalletAuthMethodStore;
+export declare class CloudflareD1WalletAuthMethodService {
+    private readonly emailOtpChallengeVerifier;
+    private readonly emailOtpEnrollmentChallengeIssuer;
+    private readonly emailOtpSourceChallengeIssuer;
+    private readonly emailOtpEnrollmentFinalizer;
+    private readonly getRegistrationCeremonyIntentStore;
+    private readonly getWalletAuthMethodStore;
+    private readonly googleEmailOtpRegistrationAttempts;
+    private readonly passkeyCustodyEnvelopes;
+    private readonly sha256Bytes;
+    private readonly webAuthnStore;
+    private readonly listWalletEd25519Signers;
+    private readonly walletAuthorityStore;
+    private readonly orgId;
+    private readonly verifyWebAuthnAuthenticationLite;
+    private readonly prepareOwnerWalletSessionRevocation;
+    constructor(input: {
+        readonly emailOtpChallengeVerifier: CloudflareD1EmailOtpChallengeVerifier;
+        readonly emailOtpEnrollmentChallengeIssuer: EmailOtpEnrollmentChallengeIssuerV1;
+        readonly emailOtpSourceChallengeIssuer: EmailOtpSourceChallengeIssuerV1;
+        readonly emailOtpEnrollmentFinalizer: CloudflareD1EmailOtpRegistrationEnrollmentFinalizer;
+        readonly getRegistrationCeremonyIntentStore: RegistrationCeremonyStoreProvider;
+        readonly getWalletAuthMethodStore: WalletAuthMethodStoreProvider;
+        readonly googleEmailOtpRegistrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly passkeyCustodyEnvelopes: CloudflareD1PasskeyCustodyEnvelopeStore;
+        readonly sha256Bytes: Sha256Bytes;
+        readonly webAuthnStore: CloudflareD1WebAuthnStore;
+        readonly listWalletEd25519Signers: ListWalletEd25519SignersV1;
+        readonly walletAuthorityStore: D1WalletAuthorityStore;
+        readonly orgId: string;
+        readonly verifyWebAuthnAuthenticationLite: D1FreshRevokeWebAuthnVerifierV1;
+        readonly prepareOwnerWalletSessionRevocation: OwnerWalletSessionRevocationStatementsV1;
+    });
+    /**
+     * Sends the enrollment code for an Email OTP addition.
+     *
+     * The challenge is bound to the add-auth-method intent digest, because that
+     * is the value the start's verification checks the code against — the same
+     * digest the source proof signs. Binding it to anything else would issue a
+     * code the ceremony cannot accept.
+     *
+     * The address is the intent's, never the request's. A caller who could name
+     * the recipient would be able to send a wallet's enrollment code anywhere,
+     * and the intent grant is what proves this addition was authorized at all.
+     */
+    /**
+     * The active methods on the authority this intent was issued against.
+     *
+     * The intent's own source names the authority, so admission can be answered
+     * before any factor is verified. A linked-device ceremony names no source;
+     * there the wallet's active methods are the honest answer, because the
+     * question is only whether the family already exists.
+     */
+    private activeMethodsOnIntentAuthority;
+    createAddAuthMethodEmailOtpChallenge(input: {
+        readonly walletId: WalletId;
+        readonly addAuthMethodIntentGrant: AddAuthMethodIntentGrant;
+        readonly addAuthMethodIntentDigestB64u: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly challengeId: string;
+        readonly expiresAtMs: number;
+        readonly emailHint: string;
+    } | WalletAuthMethodError>;
+    /**
+     * Sends the code that proves the wallet's existing Email OTP method.
+     *
+     * The recipient is the address the wallet already verified, resolved from
+     * its active Email authority — never named by the caller. Bound to the
+     * addition's intent digest, so a code taken for any other operation cannot
+     * start this ceremony.
+     */
+    private createAddAuthMethodEmailOtpSourceChallenge;
+    /**
+     * Verifies the fresh Email OTP source proof and resolves who it proved.
+     *
+     * The caller supplies a code and the digest it was taken over; every identity
+     * the ceremony then trusts — provider subject, enrollment, authority — comes
+     * from the verified challenge. A body that could name them would let a caller
+     * authorize an addition with someone else's method.
+     */
+    verifyAddAuthMethodEmailOtpSourceProof(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly challengeId: string;
+        readonly otpCode: string;
+        readonly expectedDigestB64u: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly auth: Extract<StoredWalletAddAuthMethodCeremony['auth'], {
+            readonly kind: 'email_otp';
+        }>;
+    } | WalletAuthMethodError>;
+    startWalletAddAuthMethod(request: StartWalletAddAuthMethodInput, _context?: {
+        readonly userAgent?: string;
+    }): Promise<StartWalletAddAuthMethodResult>;
+    /**
+     * What an exact retry has to match: the ceremony, the request as sent, and
+     * the authorization branch with any linked admission.
+     *
+     * Substituting a credential, an envelope, or any admitted identity — wallet,
+     * device, enrollment, key manifest — changes this digest, so one comparison
+     * separates a retry from a different finalize wearing the same ceremony id.
+     */
+    private finalizeReplayDigestB64u;
+    /**
+     * `atomicCompanionStatements` ride in the same batch as the credential, the
+     * custody envelope, and the owner binding.
+     *
+     * Device 2's linked finalize is the reason this exists. Its link session has
+     * to advance exactly when the credential commits, and a caller cannot get
+     * that by making two calls: finalize is irreversible, so a cancel or an expiry
+     * winning in between would leave a terminal session holding a live owner
+     * credential. Statements passed here either commit with it or the whole
+     * finalize fails, which is the only pair of outcomes that keeps those two
+     * facts in agreement.
+     *
+     * They are a separate argument rather than part of the command because the
+     * command is the wire contract every caller shares, and no wire request may
+     * describe database writes.
+     */
+    finalizeWalletAddAuthMethod(request: FinalizeWalletAddAuthMethodInput, atomicCompanionStatements?: readonly D1PreparedStatementLike[]): Promise<FinalizeWalletAddAuthMethodResult>;
+    private revalidateAddAuthMethodSource;
+    /**
+     * The factor whose envelope a revoked method owned.
+     *
+     * Selected by the owning method the envelope itself records, so an Email
+     * method's envelope is removable without touching its sibling's even though
+     * both share one provider enrollment. Legacy unbound envelopes match nothing
+     * and survive until an open has upgraded them.
+     */
+    /**
+     * Resolves which enrollment an added Email OTP method binds to.
+     *
+     * The wallet's Email OTP enrollment is per provider identity, not per method:
+     * every Email method on the wallet reads its factor secret through the same
+     * record, and its seal key version is inside each of their envelopes' AAD. So
+     * re-enrolling on a wallet that already has one would leave the existing
+     * methods holding ciphertext that no longer opens.
+     *
+     * The caller states which case it believes it is in and is refused when live
+     * state disagrees, rather than being silently switched to the other branch —
+     * a client that thought it was enrolling a new address, and was quietly bound
+     * to an existing one, would report the wrong email as verified.
+     */
+    private resolveAddedEmailOtpEnrollment;
+    private prepareRevokedMethodEnvelopeStatements;
+    private prepareAddAuthMethodSourceGuard;
+    resolveAddSignerExistingAuth(input: {
+        readonly auth: WalletAddSignerStartRequest['auth'];
+        readonly walletId: WalletId;
+        readonly intent: AddSignerIntentV1;
+        readonly nowMs: number;
+    }): Promise<D1AddSignerExistingAuthResolution>;
+    resolveAddAuthMethodExistingAuth(input: {
+        readonly auth: WalletAddAuthMethodStartRequest['auth'];
+        readonly walletId: WalletId;
+        readonly orgId: string;
+        readonly intent: AddAuthMethodIntentV1;
+        readonly nowMs: number;
+    }): Promise<D1AddAuthMethodExistingAuthResolution>;
+    verifyRegistrationAuthorityForIntent(input: {
+        readonly orgId: string;
+        readonly authority: WalletRegistrationAuthorityInput;
+        readonly expectedDigestB64u: string;
+        readonly expectedOrigin: string;
+        readonly intent: RegistrationIntentV1;
+        readonly verificationOperationId: string;
+        readonly verificationReceiptExpiresAtMs: number;
+        readonly userAgent?: string;
+    }): Promise<WalletAuthMethodAuthorityResult>;
+    verifyActivePasskeyAuthority(authority: PasskeyWalletAuthAuthority): Promise<{
+        readonly ok: true;
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+            readonly kind: 'passkey';
+            readonly status: 'active';
+        }>;
+    } | WalletAuthMethodError>;
+    resolveActiveWalletSessionAuthority(input: {
+        readonly walletId: WalletId;
+        readonly authorityRef: WalletAuthAuthorityRef;
+        readonly authSource: WalletExecutionLaneAuthSource;
+    }): Promise<ActiveWalletSessionAuthorityResolution>;
+    resolveActivePasskeyAuthorityForVerifiedCredential(input: {
+        readonly walletId: WalletId;
+        readonly rpId: WebAuthnRpId;
+        readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    }): Promise<{
+        readonly ok: true;
+        readonly authority: PasskeyWalletAuthAuthority;
+        readonly walletAuthority: ActiveWalletAuthorityV1;
+        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+            readonly kind: 'passkey';
+            readonly status: 'active';
+        }>;
+    } | WalletAuthMethodError>;
+    resolveActivePasskeyAuthorityForUnlock(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly walletAuthorityId: WalletAuthorityId;
+        readonly rpId: WebAuthnRpId;
+        readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    }): Promise<WalletUnlockPasskeyAuthorityResolution>;
+    resolveActiveEmailOtpAuthorityForUnlock(input: {
+        readonly walletId: WalletId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly providerUserId: string;
+        readonly emailHashHex: string;
+    }): Promise<WalletUnlockEmailOtpAuthorityResolution>;
+    verifyActiveEmailOtpAuthority(authority: EmailOtpWalletAuthAuthority): Promise<{
+        readonly ok: true;
+    } | WalletAuthMethodError>;
+    resolveActiveEmailOtpAuthorityForVerifiedSubject(input: {
+        readonly walletId: string;
+        readonly providerUserId: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly authority: EmailOtpWalletAuthAuthority;
+    } | WalletAuthMethodError>;
+    /**
+     * The exact active Email OTP authority a caller names. Several methods can
+     * share one wallet's verified email once a device is linked, so an operation
+     * that knows its method must resolve by that identity instead of asking for
+     * the wallet's only one.
+     */
+    resolveActiveEmailOtpAuthorityForVerifiedMethod(input: {
+        readonly walletId: string;
+        readonly walletAuthMethodId: string;
+        readonly providerUserId: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly authority: EmailOtpWalletAuthAuthority;
+    } | WalletAuthMethodError>;
+    findDuplicateAuthority(authority: RegistrationAuthority): Promise<WalletAuthMethodError | null>;
+    /**
+     * Mixed registration finalization runs in two requests. The ECDSA leg
+     * persists the founding authority and auth method before the deferred
+     * Ed25519 leg arrives, so that leg must address the same rows.
+     */
+    readActiveRegistrationIdentity(authority: RegistrationAuthority): Promise<{
+        readonly walletAuthorityId: WalletAuthMethodRecordV2['walletAuthorityId'];
+        readonly walletAuthMethodId: WalletAuthMethodRecordV2['walletAuthMethodId'];
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+            readonly status: 'active';
+        }>;
+    } | null>;
+    readActiveRegistrationAuthority(authority: RegistrationAuthority): Promise<{
+        readonly authority: ActiveWalletAuthorityV1;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    } | null>;
+    verifyWalletAuthMethodRevokeProof(input: {
+        readonly walletId: WalletId;
+        readonly targetWalletAuthMethodId: WalletAuthMethodId;
+        readonly requestedAtMs: number;
+        readonly sourceProof: WalletAuthMethodRevocationProof;
+        readonly expectedOrigin: string;
+    }): Promise<WalletAuthMethodRevokeProofVerificationResult>;
+    private createPasskeyRegistrationOptions;
+    revokeWalletAuthMethod(input: RevokeWalletAuthMethodInput): Promise<RevokeWalletAuthMethodResult>;
+    private verifyRegistrationCredentialForIntent;
+    private verifyRegistrationPasskeyAuthority;
+    private verifyRegistrationEmailOtpAuthority;
+    private verifyAddAuthMethodEmailOtpAuthority;
+    private emailHashHex;
+}
+export {};
+//# sourceMappingURL=d1WalletAuthMethodService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts

@@ -0,0 +1,143 @@
+import { type ActiveWalletAuthorityV1, type PendingWalletAuthorityV1, type WalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+export type D1WalletAuthorityStoreScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export type WalletAuthorityPageCursorV1 = {
+    readonly updatedAtMs: number;
+    readonly authorityId: WalletAuthorityId;
+};
+export type WalletAuthorityPageV1 = {
+    readonly records: readonly WalletAuthorityV1[];
+    readonly nextCursor: WalletAuthorityPageCursorV1 | null;
+};
+export type CommittedWalletAuthorityV1 = {
+    readonly kind: 'committed_wallet_authority_v1';
+    readonly authority: PendingWalletAuthorityV1;
+    readonly authMethod: WalletAuthMethodRecordV2;
+};
+export type WalletAuthorityCommitResultV1 = CommittedWalletAuthorityV1 | {
+    readonly kind: 'replayed';
+    readonly authority: PendingWalletAuthorityV1;
+    readonly authMethod: WalletAuthMethodRecordV2;
+} | {
+    readonly kind: 'conflict';
+    readonly authorityId: WalletAuthorityId;
+};
+export type WalletAuthorityActivationResultV1 = {
+    readonly kind: 'activated';
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+} | {
+    readonly kind: 'replayed';
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+} | {
+    readonly kind: 'conflict';
+    readonly authorityId: WalletAuthorityId;
+};
+export type WalletAuthorityRevocationResultV1 = {
+    readonly kind: 'revoked_method';
+    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'revoked';
+    }>;
+    readonly authority: WalletAuthorityV1;
+} | {
+    readonly kind: 'would_remove_last_wallet_auth_method';
+} | {
+    readonly kind: 'conflict';
+};
+export declare const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_authorities (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      authority_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      device_id TEXT NOT NULL,\n      provenance_kind TEXT NOT NULL,\n      enrollment_id TEXT,\n      source_authority_id TEXT,\n      link_session_id TEXT,\n      recovery_operation_id TEXT,\n      continuity_authority_id TEXT,\n      lifecycle_state TEXT NOT NULL,\n      permissions_json TEXT NOT NULL,\n      signer_activations_json TEXT NOT NULL,\n      local_install_package_set_digest_b64u TEXT,\n      signer_activation_set_digest_b64u TEXT NOT NULL,\n      authority_digest_b64u TEXT NOT NULL,\n      revocation_epoch INTEGER NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, authority_id),\n      CHECK (length(authority_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(device_id) > 0),\n      CHECK (provenance_kind IN ('wallet_registration', 'device_link', 'wallet_recovery')),\n      CHECK (lifecycle_state IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(permissions_json) > 0 AND json_valid(permissions_json)),\n      CHECK (length(signer_activations_json) > 0 AND json_valid(signer_activations_json)),\n      CHECK (length(record_json) > 0 AND json_valid(record_json)),\n      CHECK (length(signer_activation_set_digest_b64u) > 0),\n      CHECK (length(authority_digest_b64u) > 0),\n      CHECK (revocation_epoch >= 0),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (provenance_kind = 'wallet_registration'\n          AND enrollment_id IS NULL\n          AND source_authority_id IS NULL\n          AND link_session_id IS NULL\n          AND recovery_operation_id IS NULL\n          AND continuity_authority_id IS NULL)\n        OR\n        (provenance_kind = 'device_link'\n          AND enrollment_id IS NOT NULL AND length(enrollment_id) > 0\n          AND source_authority_id IS NOT NULL AND length(source_authority_id) > 0\n          AND link_session_id IS NOT NULL AND length(link_session_id) > 0\n          AND recovery_operation_id IS NULL\n          AND continuity_authority_id IS NULL)\n        OR\n        (provenance_kind = 'wallet_recovery'\n          AND enrollment_id IS NULL\n          AND source_authority_id IS NULL\n          AND link_session_id IS NULL\n          AND recovery_operation_id IS NOT NULL\n          AND length(recovery_operation_id) > 0\n          AND continuity_authority_id IS NOT NULL\n          AND length(continuity_authority_id) > 0)\n      ),\n      CHECK (\n        (lifecycle_state = 'pending_local_install'\n          AND local_install_package_set_digest_b64u IS NOT NULL\n          AND length(local_install_package_set_digest_b64u) > 0\n          AND activated_at_ms IS NULL\n          AND revoked_at_ms IS NULL\n          AND revocation_epoch = 0)\n        OR\n        (lifecycle_state = 'active'\n          AND local_install_package_set_digest_b64u IS NULL\n          AND activated_at_ms IS NOT NULL\n          AND revoked_at_ms IS NULL)\n        OR\n        (lifecycle_state = 'revoked'\n          AND local_install_package_set_digest_b64u IS NULL\n          AND activated_at_ms IS NOT NULL\n          AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (json_extract(record_json, '$.authorityId') = authority_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.state') = lifecycle_state),\n      CHECK (json_extract(record_json, '$.revocationEpoch') = revocation_epoch),\n      CHECK (json_extract(record_json, '$.authorityDigestB64u') = authority_digest_b64u),\n      CHECK (\n        json_extract(record_json, '$.signerActivationSetDigestB64u')\n          = signer_activation_set_digest_b64u\n      )\n    )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_active_device_uidx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, device_id\n      )\n      WHERE lifecycle_state <> 'revoked'\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_authorities_enrollment_uidx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, enrollment_id\n      )\n      WHERE enrollment_id IS NOT NULL\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_authorities_inventory_idx\n      ON wallet_authorities (\n        namespace, org_id, project_id, env_id, wallet_id, lifecycle_state,\n        updated_at_ms, authority_id\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS wallet_authority_cas_guard (\n      guard_id INTEGER PRIMARY KEY CHECK (guard_id = 1)\n    )\n  ", "\n    INSERT OR IGNORE INTO wallet_authority_cas_guard (guard_id) VALUES (1)\n  "];
+export declare function prepareD1WalletAuthorityPutStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WalletAuthorityStoreScope;
+    readonly authority: WalletAuthorityV1;
+}): D1PreparedStatementLike;
+export declare class WalletAuthorityCommitConflictError extends Error {
+    readonly kind = "wallet_authority_commit_conflict";
+    constructor(authorityId: WalletAuthorityId);
+}
+export declare class D1WalletAuthorityStore {
+    private readonly database;
+    private readonly scope;
+    private readonly ensureSchemaOnUse;
+    private schemaReady;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly scope?: D1WalletAuthorityStoreScope;
+        readonly namespace?: string;
+        readonly orgId?: string;
+        readonly projectId?: string;
+        readonly envId?: string;
+        readonly ensureSchema?: boolean;
+    });
+    private ensureSchema;
+    readById(authorityId: WalletAuthorityId): Promise<WalletAuthorityV1 | null>;
+    readByWalletAndDevice(input: {
+        readonly walletId: WalletId;
+        readonly deviceId: DeviceId;
+    }): Promise<WalletAuthorityV1 | null>;
+    commitPendingAuthority(input: {
+        readonly authority: PendingWalletAuthorityV1;
+        readonly authMethod: WalletAuthMethodRecordV2;
+    }): Promise<WalletAuthorityCommitResultV1>;
+    /**
+     * Commits the authority records together with caller-owned D1 statements.
+     * Device linking uses this narrow extension for its package row and linear
+     * link-session CAS, keeping the pending transition one atomic batch.
+     */
+    commitPendingAuthorityWithStatements(input: {
+        readonly authority: PendingWalletAuthorityV1;
+        readonly authMethod: WalletAuthMethodRecordV2;
+    }, additionalStatements: readonly D1PreparedStatementLike[]): Promise<WalletAuthorityCommitResultV1>;
+    activatePendingAuthority(input: {
+        readonly pendingAuthority: PendingWalletAuthorityV1;
+        readonly activeAuthority: ActiveWalletAuthorityV1;
+        readonly pendingAuthMethod: WalletAuthMethodRecordV2;
+        readonly activeAuthMethod: Extract<WalletAuthMethodRecordV2, {
+            readonly status: 'active';
+        }>;
+    }): Promise<WalletAuthorityActivationResultV1>;
+    /**
+     * Activates authority records together with caller-owned D1 statements.
+     * The linked-device activation path uses this to keep the session CAS in the
+     * same transaction as authority and auth-method visibility.
+     */
+    activatePendingAuthorityWithStatements(input: {
+        readonly pendingAuthority: PendingWalletAuthorityV1;
+        readonly activeAuthority: ActiveWalletAuthorityV1;
+        readonly pendingAuthMethod: WalletAuthMethodRecordV2;
+        readonly activeAuthMethod: Extract<WalletAuthMethodRecordV2, {
+            readonly status: 'active';
+        }>;
+    }, additionalStatements: readonly D1PreparedStatementLike[]): Promise<WalletAuthorityActivationResultV1>;
+    listForWallet(input: {
+        readonly walletId: WalletId;
+        readonly lifecycleState?: WalletAuthorityV1['state'];
+        readonly limit: number;
+        readonly cursor: WalletAuthorityPageCursorV1 | null;
+    }): Promise<WalletAuthorityPageV1>;
+    revokeWalletAuthMethod(input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly expectedAuthorityRevocationEpoch: number;
+        readonly requestedAtMs: number;
+        readonly sessionRevocationStatements?: readonly D1PreparedStatementLike[];
+    }): Promise<WalletAuthorityRevocationResultV1>;
+    private readAuthMethodById;
+}
+export declare class D1WalletAuthorityStoreV1 extends D1WalletAuthorityStore {
+}
+export type CloudflareD1WalletAuthorityStore = D1WalletAuthorityStore;
+//# sourceMappingURL=d1WalletAuthorityStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.d.ts

@@ -0,0 +1,42 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { RouterApiWebAuthnService } from '../../../framework/authServicePort';
+import { CloudflareD1WebAuthnStore } from './d1WebAuthnStore';
+import { D1WalletAuthMethodStore } from '../../../../core/d1WalletAuthMethodStore';
+export type D1WebAuthnWalletManifestSource = {
+    getEd25519KeyManifestBySlot(input: {
+        readonly walletId: WalletId;
+        readonly signerSlot: number;
+    }): Promise<{
+        readonly custodyKeyManifestDigestB64u: string;
+    } | null>;
+};
+type ListWebAuthnAuthenticatorsInput = Parameters<RouterApiWebAuthnService['listWebAuthnAuthenticatorsForUser']>[0];
+type ListWebAuthnAuthenticatorsResult = Awaited<ReturnType<RouterApiWebAuthnService['listWebAuthnAuthenticatorsForUser']>>;
+type CreateWebAuthnLoginOptionsInput = Parameters<RouterApiWebAuthnService['createWebAuthnLoginOptions']>[0];
+type CreateWebAuthnLoginOptionsResult = Awaited<ReturnType<RouterApiWebAuthnService['createWebAuthnLoginOptions']>>;
+type CreateWebAuthnSyncAccountOptionsInput = Parameters<RouterApiWebAuthnService['createWebAuthnSyncAccountOptions']>[0];
+type CreateWebAuthnSyncAccountOptionsResult = Awaited<ReturnType<RouterApiWebAuthnService['createWebAuthnSyncAccountOptions']>>;
+type VerifyWebAuthnAuthenticationLiteInput = Parameters<RouterApiWebAuthnService['verifyWebAuthnAuthenticationLite']>[0];
+type VerifyWebAuthnAuthenticationLiteResult = Awaited<ReturnType<RouterApiWebAuthnService['verifyWebAuthnAuthenticationLite']>>;
+type VerifyWebAuthnLoginInput = Parameters<RouterApiWebAuthnService['verifyWebAuthnLogin']>[0];
+type VerifyWebAuthnLoginResult = Awaited<ReturnType<RouterApiWebAuthnService['verifyWebAuthnLogin']>>;
+type VerifyWebAuthnSyncAccountInput = Parameters<RouterApiWebAuthnService['verifyWebAuthnSyncAccount']>[0];
+type VerifyWebAuthnSyncAccountResult = Awaited<ReturnType<RouterApiWebAuthnService['verifyWebAuthnSyncAccount']>>;
+export declare class CloudflareD1WebAuthnAuthService {
+    private readonly webAuthnStore;
+    private readonly walletManifestSource;
+    private readonly walletAuthMethodStore;
+    constructor(input: {
+        readonly webAuthnStore: CloudflareD1WebAuthnStore;
+        readonly walletManifestSource: D1WebAuthnWalletManifestSource;
+        readonly walletAuthMethodStore: D1WalletAuthMethodStore;
+    });
+    listWebAuthnAuthenticatorsForUser(input: ListWebAuthnAuthenticatorsInput): Promise<ListWebAuthnAuthenticatorsResult>;
+    createWebAuthnLoginOptions(input: CreateWebAuthnLoginOptionsInput): Promise<CreateWebAuthnLoginOptionsResult>;
+    createWebAuthnSyncAccountOptions(input: CreateWebAuthnSyncAccountOptionsInput): Promise<CreateWebAuthnSyncAccountOptionsResult>;
+    verifyWebAuthnAuthenticationLite(input: VerifyWebAuthnAuthenticationLiteInput): Promise<VerifyWebAuthnAuthenticationLiteResult>;
+    verifyWebAuthnLogin(input: VerifyWebAuthnLoginInput): Promise<VerifyWebAuthnLoginResult>;
+    verifyWebAuthnSyncAccount(input: VerifyWebAuthnSyncAccountInput): Promise<VerifyWebAuthnSyncAccountResult>;
+}
+export {};
+//# sourceMappingURL=d1WebAuthnAuthService.d.ts.map