@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/core/authService/googleEmailOtpRegistration.d.ts

@@ -39,7 +39,7 @@ export type GoogleEmailOtpResolutionResult = {
     email?: string;
     message: string;
 };
-export type GoogleEmailOtpRegistrationRateLimitRequest = {
+type GoogleEmailOtpRegistrationRateLimitRequest = {
     providerSubject?: unknown;
     email?: unknown;
     accountMode?: unknown;
@@ -65,7 +65,7 @@ export type GoogleEmailOtpRegistrationRateLimitConsumer = (input: {
     orgId: string;
     clientIp?: string;
 }) => Promise<GoogleEmailOtpRegistrationRateLimitResult>;
-export type GoogleEmailOtpSessionResolveRequest = {
+type GoogleEmailOtpSessionResolveRequest = {
     providerSubject?: string;
     sub?: string;
     email?: string;
@@ -74,7 +74,7 @@ export type GoogleEmailOtpSessionResolveRequest = {
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
     restartRegistrationOffer?: unknown;
 };
-export type GoogleEmailOtpHostedWalletDeriver = (input: {
+type GoogleEmailOtpHostedWalletDeriver = (input: {
     providerSubject: string;
     sub?: string;
     email?: string;
@@ -83,11 +83,7 @@ export type GoogleEmailOtpHostedWalletDeriver = (input: {
     collisionCounter?: number;
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
 }) => Promise<string>;
-export type GoogleEmailOtpHostedWalletPredicate = (walletId: string) => boolean;
-export declare function cleanupGoogleEmailOtpRegistrationAttemptsWithStore(input: {
-    readonly registrationAttemptStore: EmailOtpRegistrationAttemptStore;
-    readonly nowMs: number;
-}): Promise<void>;
+type GoogleEmailOtpHostedWalletPredicate = (walletId: string) => boolean;
 export declare function consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps(input: {
     readonly request: GoogleEmailOtpRegistrationRateLimitRequest;
     readonly consumeRateLimit: GoogleEmailOtpRegistrationRateLimitConsumer;
@@ -169,4 +165,5 @@ export declare function cleanupGoogleEmailOtpDevRegistrationStateWithStores(inpu
     code: string;
     message: string;
 }>;
+export {};
 //# sourceMappingURL=googleEmailOtpRegistration.d.ts.map

package/dist/types/wallet-server/src/core/authService/nearPrivateKeySigning.d.ts

@@ -1,8 +1,8 @@
-export type NearTxUnsignedBorshOutput = {
+type NearTxUnsignedBorshOutput = {
     unsignedTransactionBorshB64u: string;
     signingDigestB64u: string;
 };
-export type FinalizeNearTxFromSignatureOutput = {
+type FinalizeNearTxFromSignatureOutput = {
     signedTransactionBorshB64u: string;
     transactionHash: string;
 };
@@ -13,4 +13,5 @@ export declare function signNearDigestWithSecretKey(args: {
     signingDigestB64u: string;
     expectedSignerPublicKey: string;
 }): Promise<string>;
+export {};
 //# sourceMappingURL=nearPrivateKeySigning.d.ts.map

package/dist/types/wallet-server/src/core/authService/nearPublicKeyMetadata.d.ts

@@ -7,7 +7,7 @@ export type RecordNearPublicKeyMetadataResult = {
     code: string;
     message: string;
 };
-export type NearPublicKeyListEntry = {
+type NearPublicKeyListEntry = {
     publicKey: string;
     kind: NearPublicKeyKind;
     signerSlot?: number;
@@ -40,4 +40,5 @@ export declare function listNearPublicKeysForUserWithStore(input: {
     store: NearPublicKeyStore;
     userId: string;
 }): Promise<ListNearPublicKeysResult>;
+export {};
 //# sourceMappingURL=nearPublicKeyMetadata.d.ts.map

package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts

@@ -2,7 +2,7 @@ import type { AccessKeyList, FinalExecutionOutcome } from '@near-js/types';
 import type { NearTransactionActionArgsWasm } from '../../../../shared-ts/src/near/actions';
 import { MinimalNearClient, SignedTransaction } from '../rpcClients/near/NearClient';
 import type { NormalizedLogger } from '../logger';
-export type NearTxContext = {
+type NearTxContext = {
     nextNonce: string;
     blockHash: string;
 };
@@ -46,4 +46,5 @@ export declare function verifyAccountAccessKeysPresentWithClient(input: {
     readonly expectedPublicKeys: readonly string[];
     readonly options?: AccountAccessKeyVisibilityOptions;
 }): Promise<boolean>;
+export {};
 //# sourceMappingURL=nearTransactions.d.ts.map

package/dist/types/wallet-server/src/core/authService/oidcVerification.d.ts

@@ -1,14 +1,14 @@
 import type { GoogleOidcConfig } from '../types';
 import type { IdentityStore } from '../IdentityStore';
-export type JwksCacheValue = {
+type JwksCacheValue = {
     keysByKid: Map<string, JsonWebKey>;
     expiresAtMs: number;
 };
-export type GoogleJwksState = {
+type GoogleJwksState = {
     cache: JwksCacheValue | null;
     fetchPromise: Promise<JwksCacheValue> | null;
 };
-export type GoogleLoginVerificationResult = {
+type GoogleLoginVerificationResult = {
     ok: true;
     verified: true;
     providerSubject: string;
@@ -62,4 +62,5 @@ export declare function verifyGoogleLoginWithIdentityStore(input: {
     jwksState: GoogleJwksState;
     identityStore: IdentityStore;
 }): Promise<GoogleLoginFacadeResult>;
+export {};
 //# sourceMappingURL=oidcVerification.d.ts.map

package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts

@@ -10,9 +10,6 @@ export type RateLimitResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export declare function createRegistrationPrepareRateLimiter(input: {
-    thresholdStore: AuthServiceConfigSource;
-}): SigningSessionSealRateLimiter;
 export declare function createEmailOtpRateLimiter(input: {
     thresholdStore: AuthServiceConfigSource;
 }): SigningSessionSealRateLimiter;

package/dist/types/wallet-server/src/core/authService/registrationThresholdHelpers.d.ts

@@ -1,9 +1,4 @@
 import { type ActionArgsWasm } from '../../../../shared-ts/src/near/actions';
-import type { RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { EcdsaDerivationClientBootstrapRequest, EcdsaDerivationServerBootstrapResponse, ThresholdRuntimePolicyScope } from '../types';
-import type { WalletRegistrationEcdsaClientBootstrap, WalletRegistrationEcdsaPrepareContext, WalletRegistrationEcdsaWalletKey } from '../registrationContracts';
-import type { WebAuthnCredentialBindingStore } from '../WebAuthnCredentialBindingStore';
-import type { ThresholdEcdsaChainTarget } from '../thresholdEcdsaChainTarget';
 export declare function buildFullAccessAddKeyAction(publicKey: string): ActionArgsWasm;
 export declare function normalizeBootstrapPublicKeys(args: {
     publicKey: string;
@@ -13,25 +8,4 @@ export declare function normalizeBootstrapPublicKeys(args: {
     recoveryPublicKey?: string;
     expectedPublicKeys: string[];
 };
-export declare function resolveBoundThresholdRuntimePolicyScope(args: {
-    bindingStore: WebAuthnCredentialBindingStore;
-    userId: string;
-    rpId: string;
-}): Promise<ThresholdRuntimePolicyScope | undefined>;
-export type EcdsaWalletKeyBuildResult = {
-    ok: true;
-    walletKeys: WalletRegistrationEcdsaWalletKey[];
-} | {
-    ok: false;
-    code: 'incomplete_ecdsa_wallet_key';
-    message: string;
-};
-export declare function buildEcdsaWalletKeysFromBootstrap(args: {
-    bootstrap: EcdsaDerivationServerBootstrapResponse;
-    chainTargets: readonly ThresholdEcdsaChainTarget[];
-    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
-    errorContext: string;
-}): EcdsaWalletKeyBuildResult;
-export declare function isMatchingEcdsaClientBootstrap(expected: WalletRegistrationEcdsaPrepareContext, actual: WalletRegistrationEcdsaClientBootstrap): boolean;
-export declare function toEcdsaDerivationClientBootstrapRequest(clientBootstrap: WalletRegistrationEcdsaClientBootstrap): EcdsaDerivationClientBootstrapRequest;
 //# sourceMappingURL=registrationThresholdHelpers.d.ts.map

package/dist/types/wallet-server/src/core/authService/storeRegistry.d.ts

@@ -3,7 +3,6 @@ import type { NormalizedLogger } from '../logger';
 import { type EmailOtpAuthStateStore, type EmailOtpChallengeStore, type EmailOtpGrantStore, type EmailOtpRegistrationAttemptStore, type EmailOtpUnlockChallengeStore, type EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
 import { type IdentityStore } from '../IdentityStore';
 import { type NearPublicKeyStore } from '../NearPublicKeyStore';
-import { type RegistrationCeremonyStore } from '../RegistrationCeremonyStore';
 import { type WalletAuthMethodStore } from '../WalletAuthMethodStore';
 import { type WalletStore } from '../WalletStore';
 import { type WebAuthnAuthenticatorStore } from '../WebAuthnAuthenticatorStore';
@@ -29,10 +28,8 @@ export declare class AuthServiceStoreRegistry {
     private emailOtpUnlockChallengeStore;
     private emailOtpRegistrationAttemptStore;
     private emailOtpRateLimiter;
-    private registrationPrepareRateLimiter;
     private nearPublicKeyStore;
     private identityStore;
-    private registrationCeremonyStore;
     private walletStore;
     private walletAuthMethodStore;
     constructor(input: AuthServiceStoreRegistryInput);
@@ -40,7 +37,6 @@ export declare class AuthServiceStoreRegistry {
     getWebAuthnLoginChallengeStore(): WebAuthnLoginChallengeStore;
     getWebAuthnCredentialBindingStore(): WebAuthnCredentialBindingStore;
     getWebAuthnSyncChallengeStore(): WebAuthnSyncChallengeStore;
-    getRegistrationCeremonyStore(): RegistrationCeremonyStore;
     getWalletStore(): WalletStore;
     getWalletAuthMethodStore(): WalletAuthMethodStore;
     getEmailOtpChallengeStore(): EmailOtpChallengeStore;
@@ -49,7 +45,6 @@ export declare class AuthServiceStoreRegistry {
     getEmailOtpAuthStateStore(): EmailOtpAuthStateStore;
     getEmailOtpUnlockChallengeStore(): EmailOtpUnlockChallengeStore;
     getEmailOtpRegistrationAttemptStore(): EmailOtpRegistrationAttemptStore;
-    getRegistrationPrepareRateLimiter(): SigningSessionSealRateLimiter;
     getEmailOtpRateLimiter(): SigningSessionSealRateLimiter;
     getIdentityStore(): IdentityStore;
     getNearPublicKeyStore(): NearPublicKeyStore;

package/dist/types/wallet-server/src/core/authService/thresholdEcdsaKeyInventory.d.ts

@@ -10,16 +10,6 @@ export type ThresholdEcdsaKeyInventoryDiagnostics = {
     publicCapabilityStorePresent: boolean;
     rejected: Record<string, number>;
 };
-export type ThresholdEcdsaKeyInventorySelector = {
-    kind: 'key_handle';
-    keyHandle: string;
-    ecdsaThresholdKeyId?: never;
-};
-export type ThresholdEcdsaKeyInventoryTarget = {
-    keySelector: ThresholdEcdsaKeyInventorySelector;
-    selectorKey: string;
-    chainTarget: ThresholdEcdsaChainTarget;
-};
 export type ThresholdEcdsaKeyInventoryRecord = {
     keyHandle: string;
     ecdsaThresholdKeyId: string;
@@ -42,19 +32,6 @@ export type ThresholdEcdsaKeyInventoryRecord = {
         thresholdOwnerAddress: string;
     };
 };
-export declare function incrementCount(bucket: Record<string, number>, reason: string): void;
-export declare function thresholdEcdsaKeyInventorySelectorMatchesIdentity(selector: ThresholdEcdsaKeyInventorySelector, identity: {
-    keyHandle: string;
-    ecdsaThresholdKeyId: string;
-}): boolean;
-export declare function parseThresholdEcdsaKeyInventoryTarget(raw: unknown): {
-    ok: true;
-    value: ThresholdEcdsaKeyInventoryTarget;
-} | {
-    ok: false;
-    reason: string;
-};
-export declare function normalizeEvmAddress(value: unknown): string;
 export declare function listThresholdEcdsaKeyIdentityTargetsForUser(input: {
     userId: string;
     rpId: string;

package/dist/types/wallet-server/src/core/authService/webauthn.d.ts

@@ -11,7 +11,8 @@ import type { WebAuthnAuthenticationCredential } from '../types';
 import { type ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
-export type WebAuthnCredentialVerificationResult = {
+import { type WebAuthnLoginEd25519 } from './webauthnVerificationOutcomes';
+type WebAuthnCredentialVerificationResult = {
     ok: true;
     credential: {
         credentialIdB64u: string;
@@ -23,7 +24,7 @@ export type WebAuthnCredentialVerificationResult = {
     code: string;
     message: string;
 };
-export type WebAuthnAuthenticationLiteResult = {
+type WebAuthnAuthenticationLiteResult = {
     success: boolean;
     verified: boolean;
     code?: string;
@@ -34,7 +35,7 @@ export type WebAuthnAuthenticationLiteResult = {
  * contract declares it, and a binding with no authenticator row still gets the
  * `Unknown device` fallback rather than an absent field.
  */
-export type WebAuthnAuthenticatorListEntry = {
+type WebAuthnAuthenticatorListEntry = {
     credentialIdB64u: string;
     signerSlot?: number;
     publicKey?: string;
@@ -48,7 +49,7 @@ export type WebAuthnAuthenticatorListResult = {
     message?: string;
     authenticators?: WebAuthnAuthenticatorListEntry[];
 };
-export type WebAuthnLoginOptionsResult = {
+type WebAuthnLoginOptionsResult = {
     ok: boolean;
     challengeId?: string;
     challengeB64u?: string;
@@ -112,17 +113,7 @@ export type WebAuthnLoginVerificationResult = {
     userId: string;
     rpId: string;
     credentialIdB64u: string;
-    ed25519: {
-        readonly kind: 'absent';
-    } | {
-        readonly kind: 'active';
-        readonly nearAccountId: string;
-        readonly nearEd25519SigningKeyId: string;
-        readonly signerSlot: number;
-        readonly publicKey: string;
-        readonly relayerKeyId: string;
-        readonly participantIds: readonly [number, number];
-    };
+    ed25519: WebAuthnLoginEd25519;
 } | {
     ok: false;
     verified?: false;
@@ -175,7 +166,7 @@ export declare function createWebAuthnSyncAccountOptionsWithStores(input: {
  * The one signer read sync needs. Shaped as the wallet store's own reader so
  * the existing store satisfies it structurally, with no adapter.
  */
-export type SyncAccountEd25519SignerReader = {
+type SyncAccountEd25519SignerReader = {
     getEd25519SignerBySlot(input: {
         walletId: WalletId;
         signerSlot: number;
@@ -204,4 +195,5 @@ export declare function verifyWebAuthnLoginWithStores(input: {
     identityStore: IdentityStore;
     logger: NormalizedLogger;
 }): Promise<WebAuthnLoginVerificationResult>;
+export {};
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts

@@ -1,5 +1,5 @@
 import type { WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
-export type SimpleWebAuthnRegistrationVerification = {
+type SimpleWebAuthnRegistrationVerification = {
     verified?: boolean;
     registrationInfo?: {
         credential?: {
@@ -9,22 +9,22 @@ export type SimpleWebAuthnRegistrationVerification = {
         };
     };
 };
-export type SimpleWebAuthnAuthenticationVerification = {
+type SimpleWebAuthnAuthenticationVerification = {
     verified?: boolean;
     authenticationInfo?: {
         newCounter?: number;
     };
 };
-export type SimpleWebAuthnRegistrationVerifier = (args: SimpleWebAuthnRegistrationVerificationInput) => Promise<SimpleWebAuthnRegistrationVerification>;
-export type SimpleWebAuthnAuthenticationVerifier = (args: SimpleWebAuthnAuthenticationVerificationInput) => Promise<SimpleWebAuthnAuthenticationVerification>;
-export type SimpleWebAuthnRegistrationVerificationInput = {
+type SimpleWebAuthnRegistrationVerifier = (args: SimpleWebAuthnRegistrationVerificationInput) => Promise<SimpleWebAuthnRegistrationVerification>;
+type SimpleWebAuthnAuthenticationVerifier = (args: SimpleWebAuthnAuthenticationVerificationInput) => Promise<SimpleWebAuthnAuthenticationVerification>;
+type SimpleWebAuthnRegistrationVerificationInput = {
     response: unknown;
     expectedChallenge: string;
     expectedOrigin: string;
     expectedRPID: string;
     requireUserVerification: boolean;
 };
-export type SimpleWebAuthnAuthenticationVerificationInput = {
+type SimpleWebAuthnAuthenticationVerificationInput = {
     response: unknown;
     expectedChallenge: string;
     expectedOrigin: string;
@@ -46,7 +46,7 @@ export declare function parseClientDataJsonBase64url(clientDataJSONB64u: string)
 export declare function originHostnameOrEmpty(origin: string): string;
 export declare function isHostWithinRpId(host: string, rpId: WebAuthnRpId): boolean;
 export declare function parseCacheControlMaxAgeSec(cacheControl: string | null): number | null;
-export declare function normalizeOidcIssuer(input: string): string;
 export declare function parseJwtSegmentJson(input: string): Record<string, unknown> | null;
 export declare function parseJwtAud(input: unknown): string[];
+export {};
 //# sourceMappingURL=webauthnOidcHelpers.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts

@@ -0,0 +1,43 @@
+import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
+import type { ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
+type WebAuthnVerificationFailure = {
+    ok: false;
+    verified: false;
+    code: string;
+    message: string;
+};
+export type WebAuthnLoginEd25519 = {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'active';
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly signerSlot: number;
+    readonly publicKey: string;
+    readonly relayerKeyId: string;
+    readonly participantIds: readonly [number, number];
+};
+/** The failure a login or sync returns when its assertion did not verify; null when it did. */
+export declare function webAuthnAuthenticationFailure(verification: {
+    readonly success: boolean;
+    readonly verified: boolean;
+    readonly code?: string;
+    readonly message?: string;
+}): WebAuthnVerificationFailure | null;
+/**
+ * The logged-in credential's Ed25519 signer. It is active only when the binding carries every
+ * fact signing needs, and absent while the wallet's Ed25519 signer has not settled.
+ */
+export declare function webAuthnLoginEd25519(binding: WebAuthnCredentialBindingRecord | null, walletBinding: Pick<ResolvedEd25519WalletBinding, 'nearAccountId' | 'nearEd25519SigningKeyId' | 'signerSlot'> | null): {
+    ok: true;
+    ed25519: WebAuthnLoginEd25519;
+} | WebAuthnVerificationFailure;
+/** The sync credential's binding, if it exists and belongs to the account the challenge expects. */
+export declare function webAuthnSyncCredentialBinding(binding: WebAuthnCredentialBindingRecord | null, challenge: {
+    readonly expectedUserId?: string;
+}): {
+    ok: true;
+    binding: WebAuthnCredentialBindingRecord;
+} | WebAuthnVerificationFailure;
+export {};
+//# sourceMappingURL=webauthnVerificationOutcomes.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts

@@ -1,11 +1,4 @@
-import type { WebAuthnCredentialBindingRecord, WebAuthnCredentialBindingStore } from '../WebAuthnCredentialBindingStore';
-import type { Ed25519SessionPolicy, ThresholdRuntimePolicyScope } from '../types';
-import { type WalletAuthMethodId } from '../../../../shared-ts/src/utils/domainIds';
-export declare function resolveExistingThresholdEd25519Binding(args: {
-    bindingStore: WebAuthnCredentialBindingStore;
-    userId: string;
-    rpId: string;
-}): Promise<WebAuthnCredentialBindingRecord | undefined>;
+import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
 export declare function parseBoundaryWalletId(raw: unknown): string | null;
 export type ResolvedEd25519WalletBinding = {
     walletId: string;
@@ -25,24 +18,4 @@ export declare function resolvedEd25519WalletBindingFromCredentialBinding(args:
     binding: WebAuthnCredentialBindingRecord;
     signerSlot?: number;
 }): ResolvedEd25519WalletBinding | null;
-export declare function resolveThresholdEd25519SessionPolicyForBinding(args: {
-    requestedSessionPolicy: Record<string, unknown>;
-    binding: ResolvedEd25519WalletBinding;
-    walletAuthMethodId: WalletAuthMethodId;
-    relayerKeyId: string;
-    persistedRuntimePolicyScope?: ThresholdRuntimePolicyScope;
-}): {
-    sessionPolicy: Ed25519SessionPolicy;
-    runtimePolicyScope?: ThresholdRuntimePolicyScope;
-};
-export declare function resolveRecoveryThresholdEd25519SessionPolicyForBinding(args: {
-    requestedSessionPolicy: Record<string, unknown>;
-    binding: ResolvedEd25519WalletBinding;
-    walletAuthMethodId: WalletAuthMethodId;
-    relayerKeyId: string;
-    persistedRuntimePolicyScope?: ThresholdRuntimePolicyScope;
-}): {
-    sessionPolicy: Ed25519SessionPolicy;
-    runtimePolicyScope?: ThresholdRuntimePolicyScope;
-};
 //# sourceMappingURL=webauthnWalletBinding.d.ts.map

package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts

@@ -1,29 +1,19 @@
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 import type { IdentityStore, LinkIdentityResult, UnlinkIdentityResult } from './IdentityStore';
-export interface D1IdentityStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1IdentityStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1IdentityStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1IdentityStoreOptions extends D1TenantStoreOptions {
     readonly now?: () => Date;
 }
+/** Names the identity store in D1 scope errors. */
+export declare const IDENTITY_D1_STORE = "identity store";
 export declare const IDENTITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS identity_links (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, subject),\n      CHECK (length(namespace) > 0),\n      CHECK (length(org_id) > 0),\n      CHECK (length(project_id) > 0),\n      CHECK (length(env_id) > 0),\n      CHECK (length(subject) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'identity_subject_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.subject') = subject, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.userId') = user_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS identity_links_user_idx\n      ON identity_links (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureIdentityStoreD1Schema(options: D1IdentityStoreSchemaOptions): Promise<void>;
 export declare class D1IdentityStore implements IdentityStore {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
+    private readonly table;
     private readonly now;
-    private schemaReady;
     constructor(input: D1IdentityStoreOptions);
-    private ensureSchema;
-    private bindScope;
     getUserIdBySubject(subject: string): Promise<string | null>;
     listSubjectsByUserId(userId: string): Promise<string[]>;
     linkSubjectToUserId(input: {

package/dist/types/wallet-server/src/core/d1TenantStore.d.ts

@@ -0,0 +1,51 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+/**
+ * A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
+ * `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
+ */
+export declare function resolveStorePrefix(config: Record<string, unknown>, explicitKeys: readonly string[], segment: string): string;
+/** The tenant scope that leads the key of every D1 table. */
+export type D1TenantScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export interface D1SchemaOptions {
+    readonly database: D1DatabaseLike;
+}
+export interface D1TenantStoreOptions {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly ensureSchema?: boolean;
+}
+/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
+export declare function d1TenantScopeFromConfig(config: Record<string, unknown>, namespace: string, store: string): D1TenantScope;
+export declare function ensureD1Schema(database: D1DatabaseLike, statements: readonly string[]): Promise<void>;
+/** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
+export declare class D1Schema {
+    private readonly database;
+    private readonly statements;
+    private readonly enabled;
+    private ready;
+    constructor(database: D1DatabaseLike, statements: readonly string[], enabled?: boolean);
+    ensure(): Promise<void>;
+}
+/** Prepares `sql` with the scope bound to its first four parameters and `values` after them. */
+export declare function prepareD1TenantStatement(database: D1DatabaseLike, scope: D1TenantScope, sql: string, values?: readonly unknown[]): D1PreparedStatementLike;
+/**
+ * A store's tables in one tenant scope. `store` names it in scope errors, e.g. `identity store`,
+ * and the schema is created on first use unless the caller manages it (`ensureSchema: false`).
+ */
+export declare class D1TenantTable {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1TenantScope;
+    private readonly schema;
+    constructor(input: D1TenantStoreOptions, store: string, schema: readonly string[]);
+    ensureSchema(): Promise<void>;
+    prepare(sql: string, values?: readonly unknown[]): D1PreparedStatementLike;
+}
+//# sourceMappingURL=d1TenantStore.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -1,17 +1,15 @@
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/registrationIntent';
+import { type ActiveWalletAuthMethodRecordV2, type WalletAuthMethodRecord as SharedWalletAuthMethodRecord, type WalletAuthMethodRecordV2 } from '../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+import { type D1SchemaOptions, type D1TenantScope, type D1TenantStoreOptions } from './d1TenantStore';
 export type WalletAuthMethodRecord = SharedWalletAuthMethodRecord;
 /**
- * R103E's auth-method row. The v1 record remains exported for the older
+ * The V2 auth-method row. The v1 record remains exported for the older
  * registration/add-factor surface while the authority cutover is composed.
  * New authority-owned writes use this type and the V2 statements below.
  */
 export type WalletAuthMethodRecordV2Owned = WalletAuthMethodRecordV2;
-type ActiveWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'active';
-}>;
 export type WalletAuthMethodV2Store = {
     putV2(record: WalletAuthMethodRecordV2): Promise<void>;
     insertActiveV2Atomically(input: {
@@ -58,23 +56,13 @@ export interface WalletAuthMethodStore {
         rpId?: string;
     }): Promise<WalletAuthMethodRecord[]>;
 }
-export interface D1WalletAuthMethodStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WalletAuthMethodStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WalletAuthMethodStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1WalletAuthMethodStoreOptions extends D1TenantStoreOptions {
 }
-export type D1WalletAuthMethodStoreScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+export type D1WalletAuthMethodStoreScope = D1TenantScope;
+/** Names the wallet auth-method store in D1 scope errors. */
+export declare const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";
 export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (\n          kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u\n          AND wallet_auth_method_id = 'passkey:' || rp_id || ':' || credential_id_b64u\n        )\n        OR\n        (\n          kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex\n          AND wallet_auth_method_id = 'email_otp:' || wallet_id || ':' || email_hash_hex\n        )\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        rp_id,\n        status\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_identifier_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        kind,\n        auth_identifier_key\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_email_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        email_hash_hex\n      )\n      WHERE kind = 'email_otp' AND email_hash_hex IS NOT NULL\n  "];
 /**
  * The authority-owned table shape is kept separate from the historical
@@ -128,14 +116,9 @@ export declare function prepareD1WalletAuthMethodInsertStatement(input: {
 }): D1PreparedStatementLike;
 export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, WalletAuthMethodV2Store {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
-    private v2SchemaReady;
+    private readonly table;
+    private readonly v2Schema;
     constructor(input: D1WalletAuthMethodStoreOptions);
-    private ensureSchema;
-    private ensureV2Schema;
     put(record: WalletAuthMethodRecord): Promise<void>;
     /**
      * Prepares the insert-only wallet auth-method mutation used by custody
@@ -171,7 +154,7 @@ export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, W
      * Aborts the surrounding batch if the authority already holds an active
      * method of this family.
      *
-     * Refactor 109C's admission answers `already_configured` before a ceremony
+     * Add-auth-method admission answers `already_configured` before a ceremony
      * starts, but an admission read cannot close a race: two ceremonies can pass
      * it concurrently and both insert. The auth-method insert's own guard covers
      * only the allocated method id, and migration `0011` deliberately dropped
@@ -210,5 +193,4 @@ export declare class D1WalletAuthMethodStore implements WalletAuthMethodStore, W
         rpId?: string;
     }): Promise<WalletAuthMethodRecordV2[]>;
 }
-export {};
 //# sourceMappingURL=d1WalletAuthMethodStore.d.ts.map

package/dist/types/wallet-server/src/core/d1WalletStore.d.ts

@@ -102,7 +102,12 @@ export declare class D1WalletStore implements WalletStore {
     }): Promise<readonly WalletEd25519SignerRecord[]>;
     putSubject(record: WalletRecord): Promise<void>;
     putSigner(record: WalletSignerRecord): Promise<void>;
-    putEd25519SignerIfSlotAvailable(record: WalletEd25519SignerRecord): Promise<boolean>;
+    /**
+     * The statements that insert an Ed25519 signer into its slot, for a batch
+     * owned elsewhere. The batch aborts unless the slot was free: slot
+     * uniqueness rests on this check alone.
+     */
+    prepareEd25519SignerIfSlotAvailableStatements(record: WalletEd25519SignerRecord): Promise<readonly D1PreparedStatementLike[]>;
     putSigners(records: readonly WalletSignerRecord[]): Promise<void>;
 }
 //# sourceMappingURL=d1WalletStore.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEd25519ExportRoot.d.ts

@@ -5,7 +5,7 @@
  */
 import type { LinkedDeviceEd25519ExportRootPackageV1, LinkedDeviceEd25519ExportRootRecipientV1 } from '../../../../shared-ts/src/device-linking/ed25519ExportRoot';
 import type { LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
-export type LinkedDeviceEd25519ExportRootConflictV1 = 'recipient_already_registered_with_another_key' | 'recipient_not_registered' | 'package_addressed_to_another_recipient' | 'package_already_sealed_differently';
+type LinkedDeviceEd25519ExportRootConflictV1 = 'recipient_already_registered_with_another_key' | 'recipient_not_registered' | 'package_addressed_to_another_recipient' | 'package_already_sealed_differently';
 export type LinkedDeviceEd25519ExportRootWriteResultV1 = {
     readonly outcome: 'applied';
 } | {
@@ -33,4 +33,5 @@ export type LinkedDeviceEd25519ExportRootPortV1 = {
     }) => Promise<LinkedDeviceEd25519ExportRootWriteResultV1>;
     readonly readTransferV1: (linkSessionId: LinkDeviceSessionId) => Promise<LinkedDeviceEd25519ExportRootRecordV1 | null>;
 };
+export {};
 //# sourceMappingURL=linkedDeviceEd25519ExportRoot.d.ts.map