@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts

@@ -1,6 +1,6 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
+import type { StoreFactoryInput } from './storeBackends';
+import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnLoginChallengeRecord = {
     version: 'webauthn_login_challenge_v1';
     challengeId: string;
@@ -10,41 +10,16 @@ export type WebAuthnLoginChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnLoginChallengeStore {
-    put(record: WebAuthnLoginChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnLoginChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
+export interface WebAuthnLoginChallengeStore extends WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
 }
-export interface D1WebAuthnLoginChallengeStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WebAuthnLoginChallengeStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WebAuthnLoginChallengeStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
-    readonly now?: () => Date;
+export interface D1WebAuthnLoginChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
 }
 export declare const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare function ensureWebAuthnLoginChallengeStoreD1Schema(options: D1WebAuthnLoginChallengeStoreSchemaOptions): Promise<void>;
-export declare class D1WebAuthnLoginChallengeStore implements WebAuthnLoginChallengeStore {
-    readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private readonly now;
-    private schemaReady;
+export declare const ensureWebAuthnLoginChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
+export declare class D1WebAuthnLoginChallengeStore extends D1WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
     constructor(input: D1WebAuthnLoginChallengeStoreOptions);
-    private ensureSchema;
-    put(record: WebAuthnLoginChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnLoginChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
 }
-export declare function createWebAuthnLoginChallengeStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WebAuthnLoginChallengeStore;
+export declare function createWebAuthnLoginChallengeStore(input: StoreFactoryInput): WebAuthnLoginChallengeStore;
 //# sourceMappingURL=WebAuthnLoginChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts

@@ -1,6 +1,6 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
+import type { StoreFactoryInput } from './storeBackends';
+import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnSyncChallengeRecord = {
     version: 'webauthn_sync_challenge_v1';
     challengeId: string;
@@ -10,41 +10,16 @@ export type WebAuthnSyncChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnSyncChallengeStore {
-    put(record: WebAuthnSyncChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnSyncChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
+export interface WebAuthnSyncChallengeStore extends WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
 }
-export interface D1WebAuthnSyncChallengeStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WebAuthnSyncChallengeStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WebAuthnSyncChallengeStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
-    readonly now?: () => Date;
+export interface D1WebAuthnSyncChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
 }
 export declare const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare function ensureWebAuthnSyncChallengeStoreD1Schema(options: D1WebAuthnSyncChallengeStoreSchemaOptions): Promise<void>;
-export declare class D1WebAuthnSyncChallengeStore implements WebAuthnSyncChallengeStore {
-    readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private readonly now;
-    private schemaReady;
+export declare const ensureWebAuthnSyncChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
+export declare class D1WebAuthnSyncChallengeStore extends D1WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
     constructor(input: D1WebAuthnSyncChallengeStoreOptions);
-    private ensureSchema;
-    put(record: WebAuthnSyncChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnSyncChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
 }
-export declare function createWebAuthnSyncChallengeStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WebAuthnSyncChallengeStore;
+export declare function createWebAuthnSyncChallengeStore(input: StoreFactoryInput): WebAuthnSyncChallengeStore;
 //# sourceMappingURL=WebAuthnSyncChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/authService/AuthService.d.ts

@@ -61,7 +61,6 @@ export declare class AuthService {
         runtimePolicyScope?: ThresholdRuntimePolicyScope;
         restartRegistrationOffer?: unknown;
     }): Promise<string>;
-    private cleanupGoogleEmailOtpRegistrationAttempts;
     consumeGoogleEmailOtpRegistrationAttemptRateLimit(input: {
         providerSubject?: unknown;
         email?: unknown;
@@ -198,7 +197,6 @@ export declare class AuthService {
      */
     createAccount(request: AccountCreationRequest): Promise<AccountCreationResult>;
     fundImplicitNearAccount(request: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
-    private verifyRegistrationCredentialForIntent;
     /**
      * Standard WebAuthn assertion verification for lite flows.
      *
@@ -297,7 +295,6 @@ export declare class AuthService {
         code: string;
         message: string;
     }>;
-    private pruneExpiredEmailOtpChallenges;
     private readEmailOtpAuthStateForEnrollment;
     private putEmailOtpAuthStateForEnrollment;
     private createEmailOtpChallengeWithAction;

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts

@@ -10,7 +10,7 @@ export type EmailOtpChallengeOperationsInput = {
     readonly grantStore: EmailOtpGrantStore;
     readonly resolveConfig: () => EmailOtpConfig;
 };
-export type CreateEmailOtpLoginChallengeRequest = {
+type CreateEmailOtpLoginChallengeRequest = {
     userId?: unknown;
     walletId?: unknown;
     orgId?: unknown;
@@ -21,7 +21,7 @@ export type CreateEmailOtpLoginChallengeRequest = {
     operation?: unknown;
     reuseActiveChallenge?: unknown;
 };
-export type CreateEmailOtpLoginChallengeResult = {
+type CreateEmailOtpLoginChallengeResult = {
     ok: true;
     challenge: {
         challengeId: string;
@@ -45,7 +45,7 @@ export type CreateEmailOtpLoginChallengeResult = {
     code: string;
     message: string;
 };
-export type CreateEmailOtpEnrollmentChallengeRequest = {
+type CreateEmailOtpEnrollmentChallengeRequest = {
     userId?: unknown;
     walletId?: unknown;
     orgId?: unknown;
@@ -78,7 +78,7 @@ export type CreateEmailOtpEnrollmentChallengeResult = {
     code: string;
     message: string;
 };
-export type VerifyEmailOtpLoginChallengeRequest = {
+type VerifyEmailOtpLoginChallengeRequest = {
     userId?: unknown;
     walletId?: unknown;
     orgId?: unknown;
@@ -89,7 +89,7 @@ export type VerifyEmailOtpLoginChallengeRequest = {
     clientIp?: unknown;
     operation?: unknown;
 };
-export type VerifyEmailOtpLoginChallengeResult = {
+type VerifyEmailOtpLoginChallengeResult = {
     ok: true;
     challengeId: string;
     loginGrant: string;
@@ -105,4 +105,5 @@ export type VerifyEmailOtpLoginChallengeResult = {
 export declare function createEmailOtpChallenge(input: EmailOtpChallengeOperationsInput, request: CreateEmailOtpLoginChallengeRequest): Promise<CreateEmailOtpLoginChallengeResult>;
 export declare function createEmailOtpEnrollmentChallenge(input: EmailOtpChallengeOperationsInput, request: CreateEmailOtpEnrollmentChallengeRequest): Promise<CreateEmailOtpEnrollmentChallengeResult>;
 export declare function verifyEmailOtpChallenge(input: EmailOtpChallengeOperationsInput, request: VerifyEmailOtpLoginChallengeRequest): Promise<VerifyEmailOtpLoginChallengeResult>;
+export {};
 //# sourceMappingURL=emailOtpChallengeOperations.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts

@@ -1,12 +1,7 @@
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import { type ChallengeSubjectId, type EmailOtpChallengeId, type EmailOtpRegistrationAttemptId, type OrgId, type ProviderSubject, type WalletId } from '../../../../shared-ts/src/utils/domainIds';
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../EmailOtpStores';
-export type EmailOtpRegistrationEnrollmentPersistence = {
-    previousProviderWalletId?: string;
-    enrollment: EmailOtpWalletEnrollmentRecord;
-    authState: EmailOtpAuthStateRecord;
-};
-export type EmailOtpRegistrationChallengePurpose = {
+import type { EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord } from '../EmailOtpStores';
+type EmailOtpRegistrationChallengePurpose = {
     kind: 'registration';
     action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
     operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
@@ -36,7 +31,7 @@ export type EmailOtpRegistrationChallengeProof = {
     orgId: OrgId;
     ownerProofBindingDigest: string;
 };
-export type VerifiedEmailOtpRegistrationChallengeProofShared = {
+type VerifiedEmailOtpRegistrationChallengeProofShared = {
     providerSubject: ProviderSubject;
     challengeSubjectId: ChallengeSubjectId;
     challengeEmail: string;
@@ -47,14 +42,14 @@ export type VerifiedEmailOtpRegistrationChallengeProofShared = {
     ownerProofBindingDigest: string;
     purpose: EmailOtpRegistrationChallengePurpose;
 };
-export type VerifiedEmailOtpRegistrationChallengeProof = (VerifiedEmailOtpRegistrationChallengeProofShared & {
+type VerifiedEmailOtpRegistrationChallengeProof = (VerifiedEmailOtpRegistrationChallengeProofShared & {
     kind: 'registration_attempt';
     registrationAttemptId: EmailOtpRegistrationAttemptId;
 }) | (VerifiedEmailOtpRegistrationChallengeProofShared & {
     kind: 'direct_proof_email';
     registrationAttemptId?: never;
 });
-export type EmailOtpChallengeVerificationIntent = {
+type EmailOtpChallengeVerificationIntent = {
     kind: 'registration';
     binding: EmailOtpRegistrationChallengeProof;
     allowWalletReroll: boolean;
@@ -65,7 +60,7 @@ export type EmailOtpChallengeVerificationIntent = {
 } | {
     kind: 'export_key';
 };
-export type EmailOtpStoredChallengePurpose = {
+type EmailOtpStoredChallengePurpose = {
     kind: 'registration';
     action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
     operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
@@ -91,7 +86,7 @@ export type VerifiedEmailOtpChallengeCodeSuccessBase = {
     email?: string;
     otpChannel: typeof EMAIL_OTP_CHANNEL;
 };
-export type VerifiedEmailOtpChallengeCodeSuccess = (VerifiedEmailOtpChallengeCodeSuccessBase & {
+type VerifiedEmailOtpChallengeCodeSuccess = (VerifiedEmailOtpChallengeCodeSuccessBase & {
     intent: 'registration';
     registrationChallengeProof: VerifiedEmailOtpRegistrationChallengeProof;
 }) | (VerifiedEmailOtpChallengeCodeSuccessBase & {
@@ -119,10 +114,6 @@ export declare function emailOtpStoredChallengePurposeMatches(input: {
     expected: EmailOtpStoredChallengePurpose;
     actual: EmailOtpStoredChallengePurpose | null;
 }): boolean;
-export declare function emailOtpRegistrationChallengePurposeForRecord(input: {
-    storedPurpose: EmailOtpStoredChallengePurpose | null;
-    allowWalletReroll: boolean;
-}): EmailOtpRegistrationChallengePurpose | null;
 export declare function buildVerifiedEmailOtpRegistrationChallengeProof(input: {
     record: EmailOtpChallengeRecord;
     challengeSubjectId: ChallengeSubjectId;
@@ -157,7 +148,7 @@ export type EmailOtpRegistrationChallengeProofInput = {
     proofEmail: string;
     challengeId: EmailOtpChallengeId;
 };
-export type EmailOtpRegistrationChallengeProofInputResult = {
+type EmailOtpRegistrationChallengeProofInputResult = {
     ok: true;
     input: EmailOtpRegistrationChallengeProofInput;
 } | {
@@ -174,4 +165,5 @@ export declare function parseRawEmailOtpRegistrationChallengeProofInput(request:
     proofEmail?: unknown;
     googleEmailOtpRegistrationAttemptId?: unknown;
 }): EmailOtpRegistrationChallengeProofInputResult;
+export {};
 //# sourceMappingURL=emailOtpChallengeProof.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts

@@ -19,7 +19,7 @@ export type VerifyEmailOtpChallengeCodeRequest = {
     expectedAction: EmailOtpChallengeAction;
     expectedOperation?: EmailOtpChallengeOperation;
 };
-export type EmailOtpVerificationRateLimitConsumer = (input: {
+type EmailOtpVerificationRateLimitConsumer = (input: {
     scope: 'verify';
     action: EmailOtpChallengeAction;
     userId: string;
@@ -27,7 +27,7 @@ export type EmailOtpVerificationRateLimitConsumer = (input: {
     orgId: string;
     clientIp?: string;
 }) => Promise<RateLimitResult>;
-export type VerifyEmailOtpChallengeCodeInput = {
+type VerifyEmailOtpChallengeCodeInput = {
     request: VerifyEmailOtpChallengeCodeRequest;
     challengeStore: EmailOtpChallengeStore;
     walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
@@ -43,4 +43,5 @@ export type VerifyEmailOtpChallengeCodeInput = {
     resolveConfig: () => EmailOtpConfig;
 };
 export declare function verifyEmailOtpChallengeCode(input: VerifyEmailOtpChallengeCodeInput): Promise<VerifiedEmailOtpChallengeCodeResult>;
+export {};
 //# sourceMappingURL=emailOtpChallengeVerification.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts

@@ -3,27 +3,11 @@ import { type EmailOtpConfig } from './emailOtpConfig';
 import type { EmailOtpAuthStateReadResult } from './emailOtpEnrollment';
 import type { EmailOtpDeliveryResult, EmailOtpMemoryOutbox } from './emailOtpDelivery';
 import type { RateLimitResult } from './rateLimits';
-export type EmailOtpChallengeStoreContext = {
-    challengeSubjectId: string;
-    walletId: string;
-    orgId: string;
-    otpChannel: EmailOtpChannel;
-    ownerProofBindingDigest: string;
-    action: EmailOtpChallengeAction;
-    operation: EmailOtpChallengeOperation;
-    nowMs: number;
-};
-export type PruneExpiredEmailOtpChallengesInput = {
+type PruneExpiredEmailOtpChallengesInput = {
     challengeStore: EmailOtpChallengeStore;
     memoryOutbox: EmailOtpMemoryOutbox;
     nowMs: number;
 };
-export type EnforceEmailOtpActiveChallengeLimitInput = {
-    challengeStore: EmailOtpChallengeStore;
-    memoryOutbox: EmailOtpMemoryOutbox;
-    context: EmailOtpChallengeStoreContext;
-    maxActiveChallenges: number;
-};
 export type CreateEmailOtpChallengeWithActionRequest = {
     challengeSubjectId?: unknown;
     walletId?: unknown;
@@ -36,7 +20,7 @@ export type CreateEmailOtpChallengeWithActionRequest = {
     reuseActiveChallenge?: unknown;
     action: EmailOtpChallengeAction;
 };
-export type CreatedEmailOtpChallenge = {
+type CreatedEmailOtpChallenge = {
     challengeId: string;
     issuedAtMs: number;
     expiresAtMs: number;
@@ -64,7 +48,7 @@ export type CreateEmailOtpChallengeWithActionResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export type EmailOtpChallengeEnrollmentReadResult = {
+type EmailOtpChallengeEnrollmentReadResult = {
     ok: true;
     enrollment: EmailOtpWalletEnrollmentRecord;
 } | {
@@ -72,7 +56,7 @@ export type EmailOtpChallengeEnrollmentReadResult = {
     code: string;
     message: string;
 };
-export type EmailOtpChallengeRateLimitConsumer = (input: {
+type EmailOtpChallengeRateLimitConsumer = (input: {
     scope: 'challenge';
     action: EmailOtpChallengeAction;
     userId: string;
@@ -80,7 +64,7 @@ export type EmailOtpChallengeRateLimitConsumer = (input: {
     orgId: string;
     clientIp?: string;
 }) => Promise<RateLimitResult>;
-export type EmailOtpChallengeDeliverySender = (input: {
+type EmailOtpChallengeDeliverySender = (input: {
     challengeId: string;
     walletId: string;
     userId: string;
@@ -91,7 +75,7 @@ export type EmailOtpChallengeDeliverySender = (input: {
     otpCode: string;
     expiresAtMs: number;
 }) => Promise<EmailOtpDeliveryResult>;
-export type CreateEmailOtpChallengeWithActionInput = {
+type CreateEmailOtpChallengeWithActionInput = {
     request: CreateEmailOtpChallengeWithActionRequest;
     challengeStore: EmailOtpChallengeStore;
     memoryOutbox: EmailOtpMemoryOutbox;
@@ -105,6 +89,6 @@ export type CreateEmailOtpChallengeWithActionInput = {
     deliverCode: EmailOtpChallengeDeliverySender;
 };
 export declare function pruneExpiredEmailOtpChallengesWithStore(input: PruneExpiredEmailOtpChallengesInput): Promise<readonly EmailOtpChallengeRecord[]>;
-export declare function enforceEmailOtpActiveChallengeLimitWithStore(input: EnforceEmailOtpActiveChallengeLimitInput): Promise<void>;
 export declare function createEmailOtpChallengeWithAction(input: CreateEmailOtpChallengeWithActionInput): Promise<CreateEmailOtpChallengeWithActionResult>;
+export {};
 //# sourceMappingURL=emailOtpChallenges.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts

@@ -11,24 +11,17 @@ export type EmailOtpConfig = {
     devOutboxEnabled: boolean;
     maxActiveChallengesPerContext: number;
 };
-export type AuthRateLimitPolicy = {
+type AuthRateLimitPolicy = {
     limit: number;
     windowMs: number;
 };
 export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
 export type EmailOtpRateLimitPolicies = Record<EmailOtpRateLimitScope, AuthRateLimitPolicy>;
-export type EmailOtpConfigInput = {
+type EmailOtpConfigInput = {
     thresholdStore: AuthServiceConfigSource;
     production: boolean;
 };
-export declare function parseConfiguredInteger(input: {
-    name: string;
-    raw: string;
-    defaultValue: number;
-    min: number;
-    max: number;
-}): number;
-export declare function resolveRegistrationPrepareRateLimitPolicy(input: EmailOtpConfigInput): AuthRateLimitPolicy;
 export declare function resolveEmailOtpRateLimitPolicies(input: EmailOtpConfigInput): EmailOtpRateLimitPolicies;
 export declare function resolveEmailOtpConfig(input: EmailOtpConfigInput): EmailOtpConfig;
+export {};
 //# sourceMappingURL=emailOtpConfig.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts

@@ -1,7 +1,7 @@
 import type { EmailOtpChannel, EmailOtpChallengeAction, EmailOtpChallengeOperation } from '../EmailOtpStores';
 import type { NormalizedLogger } from '../logger';
 import type { EmailOtpConfig, EmailOtpDeliveryMode } from './emailOtpConfig';
-export type EmailOtpMemoryOutboxEntry = {
+type EmailOtpMemoryOutboxEntry = {
     walletId: string;
     userId: string;
     otpChannel: EmailOtpChannel;
@@ -11,7 +11,7 @@ export type EmailOtpMemoryOutboxEntry = {
     expiresAtMs: number;
 };
 export type EmailOtpMemoryOutbox = Map<string, EmailOtpMemoryOutboxEntry>;
-export type EmailOtpDeliveryInput = {
+type EmailOtpDeliveryInput = {
     config: EmailOtpConfig;
     production: boolean;
     logger: NormalizedLogger;
@@ -36,7 +36,7 @@ export type EmailOtpDeliveryResult = {
     message: string;
     lockedUntilMs?: number;
 };
-export type EmailOtpOutboxReadRequest = {
+type EmailOtpOutboxReadRequest = {
     challengeId?: unknown;
     userId?: unknown;
     walletId?: unknown;
@@ -62,4 +62,5 @@ export declare function readEmailOtpOutboxEntry(input: {
     readonly request: EmailOtpOutboxReadRequest;
     readonly nowMs: number;
 }): EmailOtpOutboxReadResult;
+export {};
 //# sourceMappingURL=emailOtpDelivery.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts

@@ -16,14 +16,14 @@ export type EmailOtpGrantConsumeResult = {
     code: string;
     message: string;
 };
-export type EmailOtpGrantRateLimitInput = {
+type EmailOtpGrantRateLimitInput = {
     scope: 'grant';
     userId: string;
     walletId: string;
     orgId: string;
     clientIp?: string;
 };
-export type EmailOtpGrantRateLimitResult = {
+type EmailOtpGrantRateLimitResult = {
     ok: true;
 } | {
     ok: false;
@@ -32,11 +32,12 @@ export type EmailOtpGrantRateLimitResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export type EmailOtpGrantRateLimitConsumer = (input: EmailOtpGrantRateLimitInput) => Promise<EmailOtpGrantRateLimitResult>;
+type EmailOtpGrantRateLimitConsumer = (input: EmailOtpGrantRateLimitInput) => Promise<EmailOtpGrantRateLimitResult>;
 export declare function consumeEmailOtpGrantWithStore(input: {
     readonly request: EmailOtpGrantConsumeRequest;
     readonly grantStore: EmailOtpGrantStore;
     readonly consumeRateLimit: EmailOtpGrantRateLimitConsumer;
     readonly nowMs: number;
 }): Promise<EmailOtpGrantConsumeResult>;
+export {};
 //# sourceMappingURL=emailOtpGrant.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts

@@ -1,22 +1,8 @@
-import { type WalletId } from '../../../../shared-ts/src/utils/domainIds';
-import type { RegistrationAuthority } from '../../../../shared-ts/src/utils/registrationIntent';
 import type { EmailOtpAuthStateStore, EmailOtpChannel, EmailOtpRegistrationAttemptStore, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
 import type { IdentityStore } from '../IdentityStore';
 import type { WalletStore } from '../WalletStore';
-import type { WalletRegistrationFinalizeRequest } from '../registrationContracts';
-import { type EmailOtpRegistrationChallengeProofInput, type EmailOtpRegistrationChallengeProofResult, type EmailOtpRegistrationEnrollmentPersistence, type VerifiedEmailOtpChallengeCodeResult } from './emailOtpChallengeProof';
+import { type VerifiedEmailOtpChallengeCodeResult } from './emailOtpChallengeProof';
 import type { VerifyEmailOtpChallengeCodeRequest } from './emailOtpChallengeVerification';
-export type EmailOtpEnrollmentMaterialValidationResult = {
-    ok: true;
-    enrollmentSealKeyVersion: string;
-    serverSealedFactorCiphertextB64u: string;
-    clientUnlockPublicKeyB64u: string;
-    unlockKeyVersion: string;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
 export type VerifyEmailOtpEnrollmentInput = {
     request: VerifyEmailOtpEnrollmentRequest;
     walletStore: WalletStore;
@@ -26,7 +12,7 @@ export type VerifyEmailOtpEnrollmentInput = {
     identityStore: IdentityStore;
     verifyChallengeCode: (request: VerifyEmailOtpChallengeCodeRequest) => Promise<VerifiedEmailOtpChallengeCodeResult>;
 };
-export type VerifyEmailOtpEnrollmentRequest = {
+type VerifyEmailOtpEnrollmentRequest = {
     providerSubject: unknown;
     walletId: unknown;
     orgId: unknown;
@@ -42,60 +28,6 @@ export type VerifyEmailOtpEnrollmentRequest = {
     unlockKeyVersion?: unknown;
     googleEmailOtpRegistrationAttemptId?: unknown;
 };
-export declare function validateEmailOtpEnrollmentMaterial(request: {
-    enrollmentSealKeyVersion?: unknown;
-    clientUnlockPublicKeyB64u?: unknown;
-    unlockKeyVersion?: unknown;
-    serverSealedFactorCiphertextB64u?: unknown;
-}): Promise<{
-    ok: true;
-    enrollmentSealKeyVersion: string;
-    clientUnlockPublicKeyB64u: string;
-    unlockKeyVersion: string;
-    serverSealedFactorCiphertextB64u: string;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-}>;
-export declare function buildEmailOtpRegistrationEnrollmentPersistence(input: {
-    walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    authStateStore: EmailOtpAuthStateStore;
-    walletId: string;
-    orgId: string;
-    authSubjectId: string;
-    verifiedEmail: string;
-    material: NonNullable<WalletRegistrationFinalizeRequest['emailOtpEnrollment']>;
-    nowMs: number;
-}): Promise<{
-    ok: true;
-    persistence: EmailOtpRegistrationEnrollmentPersistence;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-}>;
-export declare function emailOtpEnrollmentPersistenceForRegistrationFinalize(input: {
-    walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    authStateStore: EmailOtpAuthStateStore;
-    authority: RegistrationAuthority;
-    request: WalletRegistrationFinalizeRequest;
-    walletId: WalletId;
-    orgId: string;
-    nowMs: number;
-}): Promise<{
-    ok: true;
-    persistence?: EmailOtpRegistrationEnrollmentPersistence;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-}>;
-export declare function resolveEmailOtpRegistrationChallengeProof(input: {
-    proofInput: EmailOtpRegistrationChallengeProofInput;
-    registrationAttemptStore: EmailOtpRegistrationAttemptStore;
-    nowMs: number;
-}): Promise<EmailOtpRegistrationChallengeProofResult>;
 export declare function verifyEmailOtpEnrollment(input: VerifyEmailOtpEnrollmentInput): Promise<{
     ok: true;
     walletId: string;
@@ -113,4 +45,5 @@ export declare function verifyEmailOtpEnrollment(input: VerifyEmailOtpEnrollment
     attemptsRemaining?: number;
     lockedUntilMs?: number;
 }>;
+export {};
 //# sourceMappingURL=emailOtpRegistrationEnrollment.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts

@@ -1,10 +1,10 @@
 import type { SigningSessionSealCipherAdapter } from '../../threshold/session/signingSessionSeal/signingSessionSeal.types';
-export type EmailOtpShamirCipherConfig = {
+type EmailOtpShamirCipherConfig = {
     readonly rootSecretB64u: string;
     readonly currentKeyVersion: string;
     readonly acceptedWarmKeyVersions: readonly string[];
 };
-export type EmailOtpShamirCipherResult = {
+type EmailOtpShamirCipherResult = {
     readonly ok: true;
     readonly keyVersion: string;
     readonly cipher: SigningSessionSealCipherAdapter;
@@ -32,4 +32,5 @@ export declare function runEmailOtpServerSealOperation(input: {
     readonly request: EmailOtpServerSealRequest;
     readonly shamir: EmailOtpShamirCipherResult;
 }): Promise<EmailOtpServerSealResult>;
+export {};
 //# sourceMappingURL=emailOtpSeal.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts

@@ -1,5 +1,5 @@
 import type { EmailOtpAuthStateRecord, EmailOtpUnlockChallengeStore, EmailOtpWalletEnrollmentRecord } from '../EmailOtpStores';
-export type EmailOtpUnlockEnrollmentReadResult = {
+type EmailOtpUnlockEnrollmentReadResult = {
     ok: true;
     enrollment: EmailOtpWalletEnrollmentRecord;
 } | {
@@ -7,7 +7,7 @@ export type EmailOtpUnlockEnrollmentReadResult = {
     code: string;
     message: string;
 };
-export type CreateEmailOtpUnlockChallengeRequest = {
+type CreateEmailOtpUnlockChallengeRequest = {
     walletId?: unknown;
     orgId?: unknown;
     ttlMs?: unknown;
@@ -26,7 +26,7 @@ export type CreateEmailOtpUnlockChallengeResult = {
     message: string;
     lockedUntilMs?: number;
 };
-export type VerifyEmailOtpUnlockProofRequest = {
+type VerifyEmailOtpUnlockProofRequest = {
     walletId?: unknown;
     orgId?: unknown;
     challengeId?: unknown;
@@ -67,4 +67,5 @@ export type VerifyEmailOtpUnlockProofInput = {
 };
 export declare function createEmailOtpUnlockChallenge(input: CreateEmailOtpUnlockChallengeInput): Promise<CreateEmailOtpUnlockChallengeResult>;
 export declare function verifyEmailOtpUnlockProof(input: VerifyEmailOtpUnlockProofInput): Promise<VerifyEmailOtpUnlockProofResult>;
+export {};
 //# sourceMappingURL=emailOtpUnlock.d.ts.map