@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts

@@ -1,6 +1,5 @@
 import type { NormalizedLogger } from './logger';
 import type { ThresholdRuntimePolicyScope, ThresholdStoreConfigInput } from './types';
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletEmailOtpChannel, WalletEmailOtpLoginOperation, WalletEmailOtpOperation } from '../../../shared-ts/src/utils/emailOtpDomain';
 import { WALLET_EMAIL_OTP_ACTIONS } from '../../../shared-ts/src/utils/emailOtpDomain';
 export type EmailOtpChannel = WalletEmailOtpChannel;
@@ -132,7 +131,6 @@ export interface EmailOtpUnlockChallengeStore {
     consume(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
     del(challengeId: string): Promise<void>;
 }
-export type GoogleEmailOtpRegistrationAttemptState = 'started' | 'key_finalized' | 'active' | 'abandoned' | 'failed' | 'expired';
 export type GoogleEmailOtpRegistrationOfferCandidateRecord = {
     candidateId: string;
     walletId: string;
@@ -163,50 +161,51 @@ type GoogleEmailOtpRegistrationAttemptBaseRecord = {
     expiresAtMs: number;
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
 };
-export type StartedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type StartedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'started';
     finalizedPublicKey?: never;
     failureCode?: never;
 };
-export type KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'key_finalized';
     finalizedPublicKey: string;
     failureCode?: never;
 };
-export type ActiveGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type ActiveGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'active';
     finalizedPublicKey?: string;
     failureCode?: never;
 };
-export type AbandonedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type AbandonedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'abandoned';
     finalizedPublicKey?: string;
     failureCode: string;
 };
-export type FailedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type FailedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'failed';
     finalizedPublicKey?: string;
     failureCode: string;
 };
-export type ExpiredGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type ExpiredGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'expired';
     finalizedPublicKey?: string;
     failureCode?: string;
 };
 export type GoogleEmailOtpRegistrationAttemptRecord = StartedGoogleEmailOtpRegistrationAttemptRecord | KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord | ActiveGoogleEmailOtpRegistrationAttemptRecord | AbandonedGoogleEmailOtpRegistrationAttemptRecord | FailedGoogleEmailOtpRegistrationAttemptRecord | ExpiredGoogleEmailOtpRegistrationAttemptRecord;
 export type PendingGoogleEmailOtpRegistrationAttemptRecord = StartedGoogleEmailOtpRegistrationAttemptRecord | KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord;
-export type GoogleEmailOtpRegistrationAttemptWithFinalizedPublicKey = KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord | ActiveGoogleEmailOtpRegistrationAttemptRecord | AbandonedGoogleEmailOtpRegistrationAttemptRecord | FailedGoogleEmailOtpRegistrationAttemptRecord | ExpiredGoogleEmailOtpRegistrationAttemptRecord;
+/** A registration's subject, email, owner binding and runtime scope, as of `nowMs`. */
+export type GoogleEmailOtpRegistrationAttemptScopeInput = {
+    providerSubject: string;
+    email: string;
+    orgId: string;
+    ownerProofBindingDigest: string;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    nowMs: number;
+};
 export interface EmailOtpRegistrationAttemptStore {
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
     get(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
-    findStartedBySubjectEmail(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-    }): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
+    findStartedBySubjectEmail(input: GoogleEmailOtpRegistrationAttemptScopeInput): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
     abandonStartedBySubjectEmailExceptBinding(input: {
         providerSubject: string;
         email: string;
@@ -227,105 +226,6 @@ type EmailOtpStoreFactoryInput = {
     logger?: NormalizedLogger;
     isNode?: boolean;
 };
-export interface D1EmailOtpStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
-}
-export interface D1EmailOtpStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
-}
-type D1EmailOtpScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
-export declare const EMAIL_OTP_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS email_otp_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_subject_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      otp_channel TEXT NOT NULL,\n      owner_proof_binding_digest TEXT NOT NULL,\n      action TEXT NOT NULL,\n      operation TEXT NOT NULL,\n      otp_code TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (length(challenge_subject_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (otp_channel = 'email_otp'),\n      CHECK (length(owner_proof_binding_digest) > 0),\n      CHECK (length(action) > 0),\n      CHECK (length(operation) > 0),\n      CHECK (length(otp_code) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_challenges_context_idx\n      ON email_otp_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_subject_id,\n        wallet_id,\n        record_org_id,\n        otp_channel,\n        owner_proof_binding_digest,\n        action,\n        operation,\n        expires_at_ms\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_challenges_expires_idx\n      ON email_otp_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        expires_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_grants (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      grant_token TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      action TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      issued_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, grant_token),\n      CHECK (length(grant_token) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(challenge_id) > 0),\n      CHECK (length(action) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (issued_at_ms > 0),\n      CHECK (expires_at_ms > issued_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_grants_expires_idx\n      ON email_otp_grants (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        expires_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_wallet_enrollments (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      provider_user_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      verified_email TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(provider_user_id) > 0),\n      CHECK (length(record_org_id) > 0),\n      CHECK (length(verified_email) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_wallet_enrollments_provider_idx\n      ON email_otp_wallet_enrollments (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        record_org_id,\n        provider_user_id,\n        updated_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_auth_states (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      provider_user_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(provider_user_id) > 0),\n      CHECK (length(record_org_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_unlock_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_unlock_challenges_expires_idx\n      ON email_otp_unlock_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        expires_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_registration_attempts (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      attempt_id TEXT NOT NULL,\n      provider_subject TEXT NOT NULL,\n      email TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      state TEXT NOT NULL,\n      owner_proof_binding_digest TEXT NOT NULL,\n      runtime_org_id TEXT NOT NULL,\n      runtime_policy_key TEXT NOT NULL,\n      offer_wallet_ids_json TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),\n      CHECK (length(attempt_id) > 0),\n      CHECK (length(provider_subject) > 0),\n      CHECK (length(email) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (state IN ('started', 'key_finalized', 'active', 'abandoned', 'failed', 'expired')),\n      CHECK (length(owner_proof_binding_digest) > 0),\n      CHECK (json_valid(offer_wallet_ids_json)),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0),\n      CHECK (expires_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_subject_idx\n      ON email_otp_registration_attempts (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        provider_subject,\n        email,\n        state,\n        expires_at_ms,\n        owner_proof_binding_digest,\n        runtime_org_id,\n        runtime_policy_key,\n        updated_at_ms\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_wallet_idx\n      ON email_otp_registration_attempts (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        state,\n        expires_at_ms\n      )\n  "];
-export declare function ensureEmailOtpStoreD1Schema(options: D1EmailOtpStoreSchemaOptions): Promise<void>;
-export declare function resolveEmailOtpStoreNamespace(config: Record<string, unknown>): string;
-declare abstract class D1EmailOtpStoreBase {
-    protected readonly database: D1DatabaseLike;
-    protected readonly scope: D1EmailOtpScope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
-    constructor(input: D1EmailOtpStoreOptions);
-    protected ensureSchema(): Promise<void>;
-    protected bindScope(statement: string, values?: readonly unknown[]): D1PreparedStatementLike;
-}
-export declare class D1EmailOtpChallengeStore extends D1EmailOtpStoreBase implements EmailOtpChallengeStore {
-    readonly adapterKind = "d1";
-    put(record: EmailOtpChallengeRecord): Promise<void>;
-    get(challengeId: string): Promise<EmailOtpChallengeRecord | null>;
-    deleteExpired(nowMs: number): Promise<EmailOtpChallengeRecord[]>;
-    countActiveByContext(input: EmailOtpChallengeContextInput): Promise<number>;
-    findLatestActiveByContext(input: EmailOtpChallengeContextInput): Promise<EmailOtpChallengeRecord | null>;
-    deleteOldestActiveByContext(input: EmailOtpChallengeContextInput): Promise<EmailOtpChallengeRecord | null>;
-    findActiveByContext(input: EmailOtpChallengeContextInput & {
-        otpCode: string;
-    }): Promise<EmailOtpChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
-}
-export declare class D1EmailOtpGrantStore extends D1EmailOtpStoreBase implements EmailOtpGrantStore {
-    readonly adapterKind = "d1";
-    put(record: EmailOtpGrantRecord): Promise<void>;
-    get(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    consume(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    del(grantToken: string): Promise<void>;
-}
-export declare class D1EmailOtpWalletEnrollmentStore extends D1EmailOtpStoreBase implements EmailOtpWalletEnrollmentStore {
-    readonly adapterKind = "d1";
-    get(walletId: string): Promise<EmailOtpWalletEnrollmentRecord | null>;
-    getByProviderUserId(input: {
-        providerUserId: string;
-        orgId: string;
-    }): Promise<EmailOtpWalletEnrollmentRecord | null>;
-    put(record: EmailOtpWalletEnrollmentRecord): Promise<void>;
-    del(walletId: string): Promise<void>;
-}
-export declare class D1EmailOtpAuthStateStore extends D1EmailOtpStoreBase implements EmailOtpAuthStateStore {
-    readonly adapterKind = "d1";
-    get(walletId: string): Promise<EmailOtpAuthStateRecord | null>;
-    put(record: EmailOtpAuthStateRecord): Promise<void>;
-    del(walletId: string): Promise<void>;
-}
-export declare class D1EmailOtpUnlockChallengeStore extends D1EmailOtpStoreBase implements EmailOtpUnlockChallengeStore {
-    readonly adapterKind = "d1";
-    put(record: EmailOtpUnlockChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
-}
-export declare class D1EmailOtpRegistrationAttemptStore extends D1EmailOtpStoreBase implements EmailOtpRegistrationAttemptStore {
-    readonly adapterKind = "d1";
-    put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
-    get(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
-    findStartedBySubjectEmail(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-    }): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
-    abandonStartedBySubjectEmailExceptBinding(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-        failureCode: 'owner_proof_binding_replaced';
-    }): Promise<number>;
-    hasLiveStartedWalletAttempt(input: {
-        walletId: string;
-        nowMs: number;
-    }): Promise<boolean>;
-    deleteExpired(nowMs: number): Promise<number>;
-    private deleteAttempt;
-}
 export declare function createEmailOtpChallengeStore(input?: EmailOtpStoreFactoryInput): EmailOtpChallengeStore;
 export declare function createEmailOtpGrantStore(input?: EmailOtpStoreFactoryInput): EmailOtpGrantStore;
 export declare function createEmailOtpWalletEnrollmentStore(input?: EmailOtpStoreFactoryInput): EmailOtpWalletEnrollmentStore;

package/dist/types/wallet-server/src/core/IdentityStore.d.ts

@@ -1,5 +1,4 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
+import { type StoreFactoryInput } from './storeBackends';
 export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema, } from './d1IdentityStore';
 export type { D1IdentityStoreOptions, D1IdentityStoreSchemaOptions } from './d1IdentityStore';
 export type IdentitySubjectRecord = {
@@ -49,9 +48,5 @@ export interface IdentityStore {
     }): Promise<UnlinkIdentityResult>;
 }
 export declare function resolveIdentityStoreNamespace(config: Record<string, unknown>): string;
-export declare function createIdentityStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): IdentityStore;
+export declare function createIdentityStore(input: StoreFactoryInput): IdentityStore;
 //# sourceMappingURL=IdentityStore.d.ts.map

package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts

@@ -1,6 +1,6 @@
 import type { NormalizedLogger } from './logger';
 import { type WebAuthnRpId } from '../../../shared-ts/src/utils/domainIds';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 export type NearPublicKeyKind = 'threshold' | 'local' | 'backup' | 'ephemeral';
 export type NearPublicKeyAuthBinding = {
     readonly kind: 'passkey';
@@ -25,28 +25,18 @@ export interface NearPublicKeyStore {
     put(record: NearPublicKeyRecord): Promise<void>;
     listByUserId(userId: string): Promise<NearPublicKeyRecord[]>;
 }
-export interface D1NearPublicKeyStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1NearPublicKeyStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1NearPublicKeyStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1NearPublicKeyStoreOptions extends D1TenantStoreOptions {
 }
 export declare const NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS near_public_keys (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      public_key TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      signer_slot INTEGER,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      removed_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, public_key),\n      CHECK (length(user_id) > 0),\n      CHECK (length(public_key) > 0),\n      CHECK (kind IN ('threshold', 'local', 'backup', 'ephemeral')),\n      CHECK (signer_slot IS NULL OR signer_slot >= 1),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0),\n      CHECK (removed_at_ms IS NULL OR removed_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS near_public_keys_user_idx\n      ON near_public_keys (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        signer_slot,\n        created_at_ms\n      )\n  "];
 export declare function ensureNearPublicKeyStoreD1Schema(options: D1NearPublicKeyStoreSchemaOptions): Promise<void>;
+/** A user's NEAR public keys, in signer-slot order; binds the scope, then the user. */
+export declare const NEAR_PUBLIC_KEYS_BY_USER_SQL = "SELECT record_json\n         FROM near_public_keys\n        WHERE namespace = ?\n          AND org_id = ?\n          AND project_id = ?\n          AND env_id = ?\n          AND user_id = ?\n        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC";
 export declare class D1NearPublicKeyStore implements NearPublicKeyStore {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
+    private readonly table;
     constructor(input: D1NearPublicKeyStoreOptions);
-    private ensureSchema;
-    private bindScope;
     put(record: NearPublicKeyRecord): Promise<void>;
     listByUserId(userId: string): Promise<NearPublicKeyRecord[]>;
 }

package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts

@@ -1,10 +1,10 @@
 import type { EcdsaDerivationServerBootstrapResponse } from './types';
-import type { AddAuthMethodIntentGrant, AddAuthMethodIntentV1, AddSignerIntentGrant, AddSignerIntentV1, RegistrationIntentV1, WalletAddSignerStartResponse, WalletAddSignerFinalizeRequest, WalletAddAuthMethodFinalizeResponse, WalletAddSignerFinalizeResponse, WalletAddAuthMethodRegistrationOptions, WalletRegistrationStartResponse, WalletId } from './registrationContracts';
-import type { RegistrationAuthority, RegistrationSignerPlan, RegistrationSignerBranchKey } from '../../../shared-ts/src/utils/registrationIntent';
+import type { AddAuthMethodIntentGrant, AddAuthMethodIntentV1, AddSignerIntentGrant, AddSignerIntentV1, RegistrationIntentV1, WalletAddAuthMethodFinalizeSuccess, WalletAddSignerEcdsaPreparePayload, WalletAddSignerFinalizeRequest, WalletAddAuthMethodRegistrationOptions, WalletAddSignerFinalizeSuccess, WalletRegistrationEcdsaPreparePayload, WalletId } from './registrationContracts';
+import type { RegistrationSignerPlan, RegistrationSignerBranchKey } from '../../../shared-ts/src/utils/registrationSignerPlan';
+import type { RegistrationAuthority } from '../../../shared-ts/src/utils/registrationAuthMethodInput';
 import { type PasskeyCustodyEnvelopeRecord } from '../../../shared-ts/src/passkey-custody';
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../shared-ts/src/authorization/capabilityKinds';
-import type { NormalizedLogger } from './logger';
 import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
@@ -25,7 +25,7 @@ export type StoredAddSignerIntent = {
     expiresAtMs: number;
     consumedAtMs?: never;
 };
-export type ConsumedAddSignerIntent = Omit<StoredAddSignerIntent, 'kind' | 'consumedAtMs'> & {
+type ConsumedAddSignerIntent = Omit<StoredAddSignerIntent, 'kind' | 'consumedAtMs'> & {
     kind: 'add_signer_intent_consumed';
     consumedAtMs: number;
 };
@@ -41,30 +41,20 @@ export type StoredAddAuthMethodIntent = {
     expiresAtMs: number;
     consumedAtMs?: never;
 };
-export type ConsumedAddAuthMethodIntent = Omit<StoredAddAuthMethodIntent, 'kind' | 'consumedAtMs'> & {
+type ConsumedAddAuthMethodIntent = Omit<StoredAddAuthMethodIntent, 'kind' | 'consumedAtMs'> & {
     kind: 'add_auth_method_intent_consumed';
     consumedAtMs: number;
 };
-export type StoredRegistrationWebAuthnCredential = {
-    credentialIdB64u: string;
-    credentialPublicKeyB64u: string;
-    counter: number;
-};
 export type StoredRegistrationAuthority = RegistrationAuthority;
-type WalletRegistrationEcdsaStartPayload = NonNullable<Extract<WalletRegistrationStartResponse, {
-    ok: true;
-}>['ecdsa']>;
-type WalletAddSignerEcdsaStartPayload = Omit<NonNullable<Extract<WalletAddSignerStartResponse, {
-    ok: true;
-}>['ecdsa']>, 'custodyEnvelope'>;
-export type StoredWalletRegistrationRuntimePolicyContext = {
+type WalletAddSignerEcdsaStartPayload = Omit<WalletAddSignerEcdsaPreparePayload, 'custodyEnvelope'>;
+type StoredWalletRegistrationRuntimePolicyContext = {
     kind: 'runtime_policy_scope';
     scope: RuntimePolicyScope;
 } | {
     kind: 'signing_root_only';
     scope?: never;
 };
-export type StoredWalletRegistrationEcdsaPreparedContext = {
+type StoredWalletRegistrationEcdsaPreparedContext = {
     kind: 'evm_family_ecdsa_requested';
     chainTargets: readonly ThresholdEcdsaChainTarget[];
 } | {
@@ -84,10 +74,9 @@ export declare function buildStoredWalletRegistrationPreparedContext(input: {
     runtimePolicyScope: RuntimePolicyScope | null;
     ecdsaChainTargets: readonly ThresholdEcdsaChainTarget[] | null;
 }): StoredWalletRegistrationPreparedContext;
-export declare function storedWalletRegistrationPreparedContextsMatch(left: StoredWalletRegistrationPreparedContext, right: StoredWalletRegistrationPreparedContext): boolean;
 export declare function storedRegistrationAuthoritiesMatch(left: StoredRegistrationAuthority, right: StoredRegistrationAuthority): boolean;
-type StoredEcdsaRegistrationBase = Omit<WalletRegistrationEcdsaStartPayload, 'kind'> & {
-    derivationKind: WalletRegistrationEcdsaStartPayload['kind'];
+type StoredEcdsaRegistrationBase = Omit<WalletRegistrationEcdsaPreparePayload, 'kind'> & {
+    derivationKind: WalletRegistrationEcdsaPreparePayload['kind'];
     strictRegistrationBindingJson: string;
 };
 export type StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch = StoredEcdsaRegistrationBase & {
@@ -105,6 +94,9 @@ export type StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch = Stored
     kind: 'evm_family_ecdsa_response_claimed';
     branchKey: RegistrationSignerBranchKey;
     registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    projectEnvironmentId: string;
+    tenantRootIdentityDigestB64u: string;
+    tenantRootCustodyLineageB64u: string;
 };
 export type StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch = StoredEcdsaRegistrationBase & {
     kind: 'evm_family_ecdsa_activation_claimed';
@@ -137,9 +129,8 @@ export type StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch = StoredEcdsaR
 /**
  * The ECDSA signer is durable and the wallet is usable. Reached only on a plan
  * that also has an Ed25519 branch: registration returns ECDSA-ready here and
- * the ceremony stays open for the Ed25519 finalize (Refactor 94 Phase 4+5).
- * On an ECDSA-only plan the ceremony is deleted instead, so this state never
- * appears.
+ * the ceremony stays open for the Ed25519 finalize. On an ECDSA-only plan the
+ * ceremony is deleted instead, so this state never appears.
  */
 export type StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch = StoredEcdsaRegistrationBase & {
     kind: 'evm_family_ecdsa_finalized';
@@ -161,7 +152,7 @@ export type StoredWalletRegistrationSignerSetState = {
     kind: 'signer_set_registration';
     branches: readonly StoredWalletRegistrationSignerBranch[];
 };
-export type StoredWalletRegistrationEvmFamilyEcdsaBranch = StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch | StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch | StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch | StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
+type StoredWalletRegistrationEvmFamilyEcdsaBranch = StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch | StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch | StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch | StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
 export declare function buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch(input: {
     readonly activated: StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch;
     readonly finalizedAtMs: number;
@@ -186,7 +177,7 @@ export declare function replaceStoredWalletRegistrationSignerBranch(input: {
     readonly state: StoredWalletRegistrationSignerSetState;
     readonly replacement: StoredWalletRegistrationSignerBranch;
 }): StoredWalletRegistrationSignerSetState;
-export type StoredWalletRegistrationFailed = {
+type StoredWalletRegistrationFailed = {
     kind: 'registration_failed';
     failedAtMs: number;
     failure: {
@@ -201,10 +192,9 @@ export type StoredWalletRegistrationFailed = {
     responded?: never;
     completed?: never;
 };
-export type StoredWalletRegistrationSignerState = StoredWalletRegistrationSignerSetState | StoredWalletRegistrationFailed;
+type StoredWalletRegistrationSignerState = StoredWalletRegistrationSignerSetState | StoredWalletRegistrationFailed;
 /**
- * Refactor 94C. A registration ceremony now exists before its authority proof
- * does.
+ * A registration ceremony exists before its authority proof does.
  *
  * `/wallets/register/setup` issues the challenge the client's WebAuthn create
  * must sign, so the ceremony — and the Router preparation work bound to it —
@@ -254,7 +244,6 @@ export type StoredWalletRegistrationCeremony = StoredWalletRegistrationCeremonyB
 export declare function verifiedRegistrationCeremonyAuthority(ceremony: {
     readonly authorityState: StoredWalletRegistrationCeremonyAuthorityState;
 }): StoredRegistrationAuthority | null;
-export declare function registrationCeremonyAuthorityRpId(authorityState: StoredWalletRegistrationCeremonyAuthorityState): string | null;
 export type TerminalRegistrationCeremonyCancellationResult = {
     kind: 'cancelled';
     ceremonyDeleted: true;
@@ -262,11 +251,10 @@ export type TerminalRegistrationCeremonyCancellationResult = {
     kind: 'not_found';
     ceremonyDeleted: false;
 };
-export declare function parseTerminalRegistrationCeremonyCancellationResult(value: unknown): TerminalRegistrationCeremonyCancellationResult | null;
 type StoredEcdsaAddSignerBase = Omit<WalletAddSignerEcdsaStartPayload, 'kind'> & {
     derivationKind: WalletAddSignerEcdsaStartPayload['kind'];
 };
-export type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
+type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
     kind: 'ecdsa_add_signer_prepared';
     pendingActivation?: never;
     publicResponse?: never;
@@ -274,7 +262,7 @@ export type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
     activation?: never;
     bootstrap?: never;
 };
-export type StoredEcdsaAddSignerPendingActivation = StoredEcdsaAddSignerBase & {
+type StoredEcdsaAddSignerPendingActivation = StoredEcdsaAddSignerBase & {
     kind: 'ecdsa_add_signer_pending_activation';
     registrationRequest: RouterAbEcdsaRegistrationRequestV1;
     pendingActivation: RouterAbEcdsaPendingActivationV1;
@@ -313,7 +301,7 @@ export type StoredEcdsaAddSignerActivated = StoredEcdsaAddSignerBase & {
     publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
     bootstrap: EcdsaDerivationServerBootstrapResponse;
 };
-export type StoredEd25519YaoAddSignerAuthorized = {
+type StoredEd25519YaoAddSignerAuthorized = {
     kind: 'near_ed25519_yao_add_signer_authorized';
     admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
 };
@@ -327,14 +315,12 @@ export type StoredEd25519YaoAddSignerActivation = {
         result: RouterAbEd25519YaoActivationResultV1<'registration'>;
     };
 };
-export type StoredEd25519YaoAddSignerActivated = StoredEd25519YaoAddSignerActivation & {
+type StoredEd25519YaoAddSignerActivated = StoredEd25519YaoAddSignerActivation & {
     kind: 'near_ed25519_yao_add_signer_activated';
 };
-export type StoredEd25519YaoAddSignerFinalizing = StoredEd25519YaoAddSignerActivation & {
+type StoredEd25519YaoAddSignerFinalizing = StoredEd25519YaoAddSignerActivation & {
     kind: 'near_ed25519_yao_add_signer_finalizing';
-    response: Extract<Extract<WalletAddSignerFinalizeResponse, {
-        ok: true;
-    }>, {
+    response: Extract<WalletAddSignerFinalizeSuccess, {
         kind: 'near_ed25519';
     }>;
     signer: WalletEd25519SignerRecord;
@@ -361,14 +347,12 @@ export type StoredWalletAddSignerFinalizeReplay = {
     addSignerCeremonyId: string;
     idempotencyKey: string;
     request: StoredWalletAddSignerFinalizeRequest;
-    response: Extract<WalletAddSignerFinalizeResponse, {
-        ok: true;
-    }>;
+    response: WalletAddSignerFinalizeSuccess;
     createdAtMs: number;
     expiresAtMs: number;
 };
 /**
- * Refactor 103 Phase 8: an add-auth-method finalize that already succeeded.
+ * An add-auth-method finalize that already succeeded.
  *
  * Finalize consumes its ceremony, so a client that lost the response has no way
  * to ask again — the ceremony is gone and the credential is already registered.
@@ -385,9 +369,7 @@ export type StoredWalletAddAuthMethodFinalizeReplay = {
     kind: 'wallet_add_auth_method_finalize_replay_v1';
     addAuthMethodCeremonyId: string;
     requestDigestB64u: string;
-    response: Extract<WalletAddAuthMethodFinalizeResponse, {
-        ok: true;
-    }>;
+    response: WalletAddAuthMethodFinalizeSuccess;
     createdAtMs: number;
     expiresAtMs: number;
 };
@@ -453,7 +435,7 @@ export type StoredWalletAddAuthMethodCeremony = (StoredWalletAddAuthMethodCeremo
      * The SOURCE method's envelope, exactly as the passkey branch below
      * carries it.
      *
-     * Refactor 109C adds Email OTP to a wallet that already holds its custody
+     * This ceremony adds Email OTP to a wallet that already holds its custody
      * seed, so the browser has to open this envelope with the source factor
      * and reseal the same seed under the new Email OTP factor. Without it the
      * ceremony could only ever create an auth method that unlocks nothing.
@@ -499,51 +481,8 @@ export interface RegistrationCeremonyStore {
     updateAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
     takeAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
 }
-export declare class MemoryRegistrationCeremonyStore implements RegistrationCeremonyStore {
-    private readonly addAuthMethodIntents;
-    private readonly addSignerIntents;
-    private readonly ceremonies;
-    private readonly addSignerFinalizeReplays;
-    private readonly addSignerFinalizeReplayClaims;
-    private readonly addAuthMethodCeremonies;
-    private readonly addSignerCeremonies;
-    putAddAuthMethodIntent(intent: StoredAddAuthMethodIntent): Promise<void>;
-    getAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<StoredAddAuthMethodIntent | null>;
-    takeAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<ConsumedAddAuthMethodIntent | null>;
-    putAddSignerIntent(intent: StoredAddSignerIntent): Promise<void>;
-    getAddSignerIntent(grant: AddSignerIntentGrant): Promise<StoredAddSignerIntent | null>;
-    takeAddSignerIntent(grant: AddSignerIntentGrant): Promise<ConsumedAddSignerIntent | null>;
-    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
-    getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
-    updateCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
-    takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
-    cancelTerminalCeremony(input: {
-        registrationCeremonyId: string;
-        walletId: WalletId;
-    }): Promise<TerminalRegistrationCeremonyCancellationResult>;
-    putAddSignerFinalizeReplay(replay: StoredWalletAddSignerFinalizeReplay): Promise<void>;
-    getAddSignerFinalizeReplay(input: {
-        addSignerCeremonyId: string;
-        idempotencyKey: string;
-    }): Promise<StoredWalletAddSignerFinalizeReplay | null>;
-    getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerFinalizeReplay | null>;
-    putAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
-    getAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
-    updateAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
-    takeAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
-    putAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
-    getAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
-    updateAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
-    takeAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
-    private pruneExpired;
-}
 export declare function parseStoredRegistrationSignerPlan(value: unknown): RegistrationSignerPlan | null;
 export declare function parseStoredWalletRegistrationPreparedContext(value: unknown): StoredWalletRegistrationPreparedContext | null;
 export declare function storedRegistrationSignerPlansMatch(left: RegistrationSignerPlan, right: RegistrationSignerPlan): boolean;
-export declare function createRegistrationCeremonyStore(input?: {
-    config?: unknown;
-    logger?: NormalizedLogger;
-    isNode?: boolean;
-}): RegistrationCeremonyStore;
 export {};
 //# sourceMappingURL=RegistrationCeremonyStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts

@@ -1,17 +1,5 @@
 export type ThresholdNodeRole = 'cosigner' | 'coordinator';
 export declare function coerceThresholdNodeRole(input: unknown): ThresholdNodeRole;
-export type ThresholdRelayerCosignerPeer = {
-    cosignerId: number;
-    relayerUrl: string;
-};
-export type ThresholdCoordinatorPeer = {
-    instanceId: string;
-    relayerUrl: string;
-};
-export declare function parseThresholdRelayerCosigners(input: unknown): ThresholdRelayerCosignerPeer[] | null;
-export declare function parseThresholdCoordinatorPeers(input: unknown): ThresholdCoordinatorPeer[] | null;
-export declare function parseThresholdRelayerCosignerThreshold(input: unknown): number | null;
-export declare function parseThresholdCoordinatorSharedSecretBytes(input: unknown): Uint8Array | null;
 export declare function parseThresholdEd25519ParticipantIds2p(input: {
     THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: unknown;
     THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: unknown;

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts

@@ -3,20 +3,28 @@ import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivatio
 import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
 import type { ThresholdNodeRole } from '../config';
 import { type RouterAbEcdsaDerivationPresignaturePoolFillAuth } from './ecdsaDerivationPresignBridge';
-type RouterAbEcdsaDerivationPoolFillBinding = {
+export type RouterAbEcdsaOwnerWalletScope = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly projectEnvironmentId: string;
+    readonly walletId: string;
+};
+export type RouterAbEcdsaDerivationPoolFillBinding = {
     readonly walletId: string;
     readonly relayerKeyId: string;
     readonly keyHandle: string;
     readonly runtimePolicyScope: RuntimePolicyScope;
     readonly participantIds: readonly [number, number];
     readonly thresholdExpiresAtMs: number;
+    readonly routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+    /** The wallet whose pool this fill admits into, for either authority. */
+    readonly ownerWalletScope: RouterAbEcdsaOwnerWalletScope;
     readonly authorization: {
         readonly kind: 'wallet_session';
     } | {
         readonly kind: 'operation_step_up';
         readonly materialExpiresAtMs: number;
     };
-    readonly routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
 };
 export declare function resolveRouterAbEcdsaPresignDeadlines(input: {
     readonly requestedCeremonyExpiresAtMs: number;
@@ -57,5 +65,4 @@ export declare class RouterAbEcdsaDerivationPoolFillHandlers {
         readonly request: RouterAbEcdsaDerivationPoolFillStepRequest;
     }): Promise<RouterAbEcdsaDerivationPoolFillStepResponse>;
 }
-export {};
 //# sourceMappingURL=ecdsaDerivationPoolFillHandlers.d.ts.map