@seams/wallet-server 0.6.2 → 0.7.1

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts

@@ -18,7 +18,7 @@ type EmailOtpChallengeIssueBaseInput = {
     readonly reuseActiveChallenge?: unknown;
     readonly requestOrigin?: unknown;
 };
-export type EmailOtpChallengeIssueInput = (EmailOtpChallengeIssueBaseInput & {
+type EmailOtpChallengeIssueInput = (EmailOtpChallengeIssueBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
     readonly operation: EmailOtpLoginChallengeOperation;
 }) | (EmailOtpChallengeIssueBaseInput & {

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts

@@ -1,7 +1,7 @@
 import type { EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpUnlockChallengeRecord } from '../../../../core/EmailOtpStores';
-import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type EmailOtpRegistrationVerificationReceiptV1, type EmailOtpChallengeIssueAction } from './d1EmailOtpRecords';
-export type EmailOtpRegistrationVerificationReceiptConsumeResult = {
+type EmailOtpRegistrationVerificationReceiptConsumeResult = {
     readonly kind: 'stored';
     readonly receipt: EmailOtpRegistrationVerificationReceiptV1;
 } | {
@@ -49,6 +49,15 @@ export declare class CloudflareD1EmailOtpChallengeStore {
     updateAttemptCount(record: EmailOtpChallengeRecord, attemptCount: number): Promise<void>;
     delete(challengeId: string): Promise<void>;
     consume(challengeId: string): Promise<EmailOtpChallengeRecord | null>;
+    /**
+     * The statements that consume one verified challenge inside a caller's
+     * batch. The delete matches the exact record, code and expiry the caller
+     * verified, and the guard aborts the whole batch when nothing matched: a
+     * challenge another request consumed first, or one that expired meanwhile.
+     * The guard collides with a row a migration seeds, so it aborts from the
+     * first time it fires.
+     */
+    prepareConsumeInBatchStatements(challenge: EmailOtpChallengeRecord, nowMs: number): readonly D1PreparedStatementLike[];
     readRegistrationVerificationReceipt(challengeId: string, nowMs: number): Promise<EmailOtpRegistrationVerificationReceiptV1 | null>;
     consumeRegistrationWithReceipt(input: {
         readonly challenge: EmailOtpChallengeRecord;
@@ -58,7 +67,8 @@ export declare class CloudflareD1EmailOtpChallengeStore {
     consumeUnlock(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
     private countActive;
     private deleteOldestActive;
-    private prepare;
+    private readonly prepare;
     private scopeValues;
 }
+export {};
 //# sourceMappingURL=d1EmailOtpChallengeStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts

@@ -4,7 +4,7 @@ import type { EmailOtpLoginChallengeOperation, EmailOtpWalletEnrollmentRecord }
 import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
-export type EmailOtpExistingChallengeVerifyBaseInput = {
+type EmailOtpExistingChallengeVerifyBaseInput = {
     readonly userId?: unknown;
     readonly walletId?: unknown;
     readonly orgId?: unknown;
@@ -39,7 +39,18 @@ export type EmailOtpExistingChallengeVerifyResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export type EmailOtpRegistrationChallengeVerifyInput = {
+/**
+ * A verified existing challenge that is not yet consumed: the statements
+ * consume it inside the caller's batch, or abort that batch.
+ */
+export type EmailOtpExistingChallengeBatchVerifyResult = (Extract<EmailOtpExistingChallengeVerifyResult, {
+    ok: true;
+}> & {
+    readonly consumeInBatch: readonly D1PreparedStatementLike[];
+}) | Extract<EmailOtpExistingChallengeVerifyResult, {
+    ok: false;
+}>;
+type EmailOtpRegistrationChallengeVerifyInput = {
     readonly providerSubject?: unknown;
     readonly walletId?: unknown;
     readonly orgId?: unknown;
@@ -50,11 +61,11 @@ export type EmailOtpRegistrationChallengeVerifyInput = {
     readonly proofEmail?: unknown;
     readonly clientIp?: unknown;
 };
-export type EmailOtpRegistrationChallengeResumableVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
+type EmailOtpRegistrationChallengeResumableVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
     readonly operationId: unknown;
     readonly receiptExpiresAtMs: unknown;
 };
-export type EmailOtpRegistrationChallengeVerifyResult = {
+type EmailOtpRegistrationChallengeVerifyResult = {
     ok: true;
     readonly challengeId: string;
     readonly challengeSubjectId: string;
@@ -86,7 +97,7 @@ export type ActiveEmailOtpEnrollmentResult = {
  * to; an existing enrollment is still checked by the recovery coordinator
  * before this verifier is called.
  */
-export type EmailOtpRecoveryBootstrapChallengeVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
+type EmailOtpRecoveryBootstrapChallengeVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap;
     readonly operation: typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 };
@@ -114,6 +125,13 @@ export declare class CloudflareD1EmailOtpChallengeVerifier {
      */
     prepareDeleteEnrollmentIfUnreferencedStatement(walletId: string): D1PreparedStatementLike;
     verifyExisting(input: EmailOtpExistingChallengeVerifyInput): Promise<EmailOtpExistingChallengeVerifyResult>;
+    /**
+     * Verifies an existing challenge for an operation that commits its
+     * consumption with its own writes. Nothing is consumed here: a batch that
+     * never commits leaves the challenge usable for an exact retry.
+     */
+    verifyExistingForBatch(input: EmailOtpExistingChallengeVerifyInput): Promise<EmailOtpExistingChallengeBatchVerifyResult>;
+    private verifyExistingChallenge;
     verifyRegistration(input: EmailOtpRegistrationChallengeVerifyInput): Promise<EmailOtpRegistrationChallengeVerifyResult>;
     verifyRegistrationResumable(input: EmailOtpRegistrationChallengeResumableVerifyInput): Promise<EmailOtpRegistrationChallengeVerifyResult>;
     verifyRecoveryBootstrap(input: EmailOtpRecoveryBootstrapChallengeVerifyInput): Promise<EmailOtpRegistrationChallengeVerifyResult>;
@@ -123,4 +141,5 @@ export declare class CloudflareD1EmailOtpChallengeVerifier {
     private recordInvalidAttempt;
     private recordInvalidRegistrationAttempt;
 }
+export {};
 //# sourceMappingURL=d1EmailOtpChallengeVerifier.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts

@@ -1,7 +1,7 @@
 import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type EmailOtpAuthStatePatch } from './d1EmailOtpRecords';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
 export type EmailOtpAuthStateReadResult = {
     readonly ok: true;
     readonly state: EmailOtpAuthStateRecord | null;
@@ -26,7 +26,7 @@ export declare class CloudflareD1EmailOtpEnrollmentStore {
      * Deletes the shared provider enrollment only once nothing references it.
      *
      * The enrollment is deliberately shared: every Email method on a wallet
-     * unwraps through it, and R109D keeps active and pending methods pointing at
+     * unwraps through it, and both active and pending methods keep pointing at
      * one row. So revoking a method must not remove it — only the disappearance
      * of its last reference may.
      *
@@ -64,5 +64,4 @@ export declare class CloudflareD1EmailOtpEnrollmentStore {
     private putAuthState;
     private preparePutAuthStateStatement;
 }
-export {};
 //# sourceMappingURL=d1EmailOtpEnrollmentStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts

@@ -1,6 +1,5 @@
 import type { EmailOtpGrantRecord } from '../../../../core/EmailOtpStores';
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1EmailOtpGrantStore {
     private readonly prepare;
     constructor(input: {
@@ -11,5 +10,4 @@ export declare class CloudflareD1EmailOtpGrantStore {
     read(grantToken: string): Promise<EmailOtpGrantRecord | null>;
     delete(grantToken: string): Promise<void>;
 }
-export {};
 //# sourceMappingURL=d1EmailOtpGrantStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -1,11 +1,10 @@
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { EmailOtpRateLimitPolicy } from '../auth/d1RouterApiAuthConfig';
 import { type EmailOtpRateLimitScope } from './d1EmailOtpRecords';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
 type EmailOtpRateLimitPolicies = {
     readonly [K in EmailOtpRateLimitScope]: EmailOtpRateLimitPolicy;
 };
-export type EmailOtpRateLimitConsumeInput = {
+type EmailOtpRateLimitConsumeInput = {
     readonly scope: EmailOtpRateLimitScope;
     readonly action?: string;
     readonly userId?: string;
@@ -14,7 +13,7 @@ export type EmailOtpRateLimitConsumeInput = {
     readonly orgId?: string;
     readonly clientIp?: string;
 };
-export type EmailOtpRateLimitConsumeResult = {
+type EmailOtpRateLimitConsumeResult = {
     readonly ok: true;
 } | {
     readonly ok: false;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -9,14 +9,14 @@ export type EmailOtpAuthStatePatch = {
     readonly lastEmailOtpLoginAtMs?: number | null;
     readonly lastStrongAuthAtMs?: number | null;
 };
-export type EmailOtpPublicKey33Validator = (input: Uint8Array) => Promise<unknown>;
+type EmailOtpPublicKey33Validator = (input: Uint8Array) => Promise<unknown>;
 export type EmailOtpEnrollmentMaterialBoundaryInput = {
     readonly enrollmentSealKeyVersion?: unknown;
     readonly clientUnlockPublicKeyB64u?: unknown;
     readonly unlockKeyVersion?: unknown;
     readonly serverSealedFactorCiphertextB64u?: unknown;
 };
-export type EmailOtpEnrollmentMaterialValidationResult = {
+type EmailOtpEnrollmentMaterialValidationResult = {
     readonly ok: true;
     readonly enrollmentSealKeyVersion: string;
     readonly clientUnlockPublicKeyB64u: string;
@@ -91,16 +91,16 @@ export declare function emailOtpRateLimitExceeded(row: D1EmailOtpRateLimitRow |
     readonly retryAfterMs?: number;
     readonly resetAtMs?: number;
 };
-export declare function parseEmailOtpWalletEnrollmentRecord(input: unknown): EmailOtpWalletEnrollmentRecord | null;
 export declare function parseEmailOtpWalletEnrollmentRow(row: D1EmailOtpEnrollmentRow | null): EmailOtpWalletEnrollmentRecord | null;
-export declare function parseEmailOtpAuthStateRecord(input: unknown): EmailOtpAuthStateRecord | null;
 export declare function parseEmailOtpAuthStateRow(row: D1EmailOtpAuthStateRow | null): EmailOtpAuthStateRecord | null;
-export declare function parseEmailOtpChallengeOperation(input: unknown): EmailOtpChallengeOperation | null;
 export declare function parseEmailOtpLoginOperation(input: unknown): EmailOtpLoginChallengeOperation;
-export declare function parseEmailOtpChallengeRecord(input: unknown): EmailOtpChallengeRecord | null;
+/**
+ * Reads a challenge row with the core parser and holds it to more: the operation must fit the
+ * action and the challenge must expire after it was created. The email is lowercased.
+ */
 export declare function parseEmailOtpChallengeRow(row: D1EmailOtpChallengeRow | null): EmailOtpChallengeRecord | null;
 export declare function parseEmailOtpRegistrationVerificationReceiptV1(input: unknown): EmailOtpRegistrationVerificationReceiptV1 | null;
-export declare function parseEmailOtpUnlockChallengeRecord(input: unknown): EmailOtpUnlockChallengeRecord | null;
+/** An unlock challenge row as the core parser reads it, which must also expire after creation. */
 export declare function parseEmailOtpUnlockChallengeRow(row: D1EmailOtpUnlockChallengeRow | null): EmailOtpUnlockChallengeRecord | null;
 export declare function emailOtpChallengeContextValues(input: {
     readonly challengeSubjectId: string;
@@ -167,7 +167,7 @@ export declare function emailOtpUnlockChallengeRecord(input: {
     readonly createdAtMs: number;
     readonly expiresAtMs: number;
 }): EmailOtpUnlockChallengeRecord;
-export declare function parseEmailOtpGrantRecord(input: unknown): EmailOtpGrantRecord | null;
+/** A grant row as the core parser reads it, which must also expire after it was issued. */
 export declare function parseEmailOtpGrantRow(row: D1EmailOtpGrantRow | null): EmailOtpGrantRecord | null;
 export declare function validateEmailOtpEnrollmentMaterial(input: {
     readonly material: EmailOtpEnrollmentMaterialBoundaryInput;
@@ -183,4 +183,5 @@ export declare function emailOtpChallengePurposeIsValid(input: {
     readonly action: EmailOtpChallengeIssueAction;
     readonly operation: EmailOtpChallengeOperation;
 }): boolean;
+export {};
 //# sourceMappingURL=d1EmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.d.ts

@@ -19,12 +19,10 @@ type VerifyEmailOtpUnlockProofResult = Awaited<ReturnType<RouterApiWalletUnlockS
 type ConsumeEmailOtpGrantInput = Parameters<RouterApiEmailOtpRouteService['consumeEmailOtpGrant']>[0];
 type ConsumeEmailOtpGrantResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['consumeEmailOtpGrant']>>;
 export declare class CloudflareD1EmailOtpRecoveryService {
-    private readonly challengeVerifier;
     private readonly emailOtpChallenges;
     private readonly emailOtpEnrollments;
     private readonly emailOtpGrants;
     private readonly emailOtpRateLimits;
-    private readonly grantTtlMs;
     constructor(input: {
         readonly challengeVerifier: CloudflareD1EmailOtpChallengeVerifier;
         readonly emailOtpChallenges: CloudflareD1EmailOtpChallengeStore;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.d.ts

@@ -1,10 +1,11 @@
-import type { RegistrationAuthority, WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1GoogleEmailOtpSessionResolver } from './d1GoogleEmailOtpSessionResolver';
 import { type EmailOtpEnrollmentMaterialBoundaryInput } from './d1EmailOtpRecords';
-export type D1EmailOtpRegistrationEnrollmentPersistence = {
+type D1EmailOtpRegistrationEnrollmentPersistence = {
     readonly enrollment: EmailOtpWalletEnrollmentRecord;
     readonly existingAuthState: EmailOtpAuthStateRecord | null;
 };
@@ -72,8 +73,8 @@ export declare class CloudflareD1EmailOtpRegistrationEnrollmentFinalizer {
         };
     }>;
     /**
-     * Refactor 109C: the enrollment statements for a wallet's first Email OTP
-     * method, to commit in the batch that inserts that method.
+     * The enrollment statements for a wallet's first Email OTP method, to commit
+     * in the batch that inserts that method.
      *
      * Same construction as registration's, deliberately — the shared enrollment
      * is one record whichever operation creates it, and a second builder would

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts

@@ -1,7 +1,6 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     private readonly prepare;
     private readonly orgId;
@@ -47,5 +46,4 @@ export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
     delete(attemptId: string): Promise<void>;
 }
-export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationAttemptStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts

@@ -1,12 +1,12 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 export type D1EmailOtpRegistrationAttemptRow = {
     readonly attempt_id?: unknown;
     readonly record_json?: unknown;
     readonly expires_at_ms?: unknown;
     readonly updated_at_ms?: unknown;
 };
-export type GoogleEmailOtpRegistrationOfferForResponse = {
+type GoogleEmailOtpRegistrationOfferForResponse = {
     readonly offerId: string;
     readonly selectedCandidateId: string;
     readonly candidates: readonly [
@@ -21,7 +21,6 @@ export type GoogleEmailOtpRegistrationOfferForResponse = {
     ];
 };
 export declare function requireRuntimePolicyScope(input: unknown): RuntimePolicyScope;
-export declare function runtimePolicyScopeKey(scope: RuntimePolicyScope | undefined): string;
 export declare function activeGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
     readonly updatedAtMs: number;
@@ -35,25 +34,7 @@ export declare function failedGoogleEmailOtpRegistrationAttemptWithCode(input: {
     readonly failureCode: string;
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
-export declare function parseGoogleEmailOtpRegistrationAttemptRecord(input: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function parseGoogleEmailOtpRegistrationAttemptRow(row: D1EmailOtpRegistrationAttemptRow | null): GoogleEmailOtpRegistrationAttemptRecord | null;
-export declare function registrationAttemptMatchesStartedScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: {
-    readonly providerSubject: string;
-    readonly email: string;
-    readonly orgId: string;
-    readonly ownerProofBindingDigest: string;
-    readonly runtimePolicyScope?: RuntimePolicyScope;
-    readonly nowMs: number;
-}): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function registrationAttemptMatchesReplacementScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: {
-    readonly providerSubject: string;
-    readonly email: string;
-    readonly orgId: string;
-    readonly ownerProofBindingDigest: string;
-    readonly runtimePolicyScope?: RuntimePolicyScope;
-    readonly nowMs: number;
-}): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function googleEmailOtpRegistrationOfferWalletIdsJson(candidates: NonEmptyGoogleEmailOtpRegistrationOfferCandidates): string;
 export declare function googleEmailOtpRegistrationOfferForResponse(input: Pick<PendingGoogleEmailOtpRegistrationAttemptRecord, 'offerId' | 'offerCandidates' | 'selectedCandidateId'>): GoogleEmailOtpRegistrationOfferForResponse;
 export declare function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record: PendingGoogleEmailOtpRegistrationAttemptRecord, updatedAtMs: number): PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input: {
@@ -66,4 +47,5 @@ export declare function abandonedGoogleEmailOtpRegistrationAttemptRecord(input:
     readonly failureCode: 'owner_proof_binding_replaced' | 'offer_restarted_by_user';
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
+export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityRecords.d.ts

@@ -1,19 +1,5 @@
-import type { LinkIdentityResult } from '../../../../core/IdentityStore';
 import type { RouterApiIdentityService } from '../../../framework/authServicePort';
 type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
-export type D1IdentityRow = {
-    readonly subject?: unknown;
-    readonly user_id?: unknown;
-    readonly created_at_ms?: unknown;
-    readonly subject_count?: unknown;
-};
-type IdentitySubjectRecord = {
-    readonly version: 'identity_subject_v1';
-    readonly subject: string;
-    readonly userId: string;
-    readonly createdAtMs: number;
-    readonly updatedAtMs: number;
-};
 export declare function hasDifferentWalletIdentitySubject(input: {
     readonly subjects: readonly string[];
     readonly expectedIdentitySubject: string;
@@ -25,14 +11,5 @@ export declare function googleEmailOtpStaleIdentityMapping(input: {
 }): Extract<ResolveGoogleEmailOtpSessionResult, {
     readonly ok: false;
 }>;
-export declare function parseIdentityCreatedAt(input: unknown, fallback: number): number;
-export declare function identitySubjectRecord(input: {
-    readonly subject: string;
-    readonly userId: string;
-    readonly createdAtMs: number;
-    readonly updatedAtMs: number;
-}): IdentitySubjectRecord;
-export declare function identityAlreadyLinked(): LinkIdentityResult;
-export declare function identityMoveDisallowed(): LinkIdentityResult;
 export {};
 //# sourceMappingURL=d1IdentityRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts

@@ -1,6 +1,5 @@
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import { type NearPublicKeyRecord } from '../webauthn/d1WebAuthnRecords';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
 type D1NearPublicKeyListResult = {
     readonly ok: true;
     readonly keys: {

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.d.ts

@@ -26,7 +26,7 @@ import { type CloudflareD1VersionedJsonRecordScopeV1 } from '../versionedJson/d1
  * `envelopeRevision`.
  */
 export declare const PASSKEY_ENVELOPE_KEY_PREFIX = "passkey-envelope";
-export type CloudflareD1PasskeyCustodyEnvelopeStoreOptions = {
+type CloudflareD1PasskeyCustodyEnvelopeStoreOptions = {
     readonly database: D1DatabaseLike;
     readonly scope: CloudflareD1VersionedJsonRecordScopeV1;
 };
@@ -58,7 +58,7 @@ export declare function envelopeFactorRef(envelope: PasskeyCustodyEnvelopeRecord
  * branch is an explicit failure the caller must handle: none of them may fall
  * back to deriving a fresh custody root.
  */
-export type PasskeyCustodyEnvelopeLookupResult = {
+type PasskeyCustodyEnvelopeLookupResult = {
     readonly kind: 'active';
     readonly envelope: PasskeyCustodyEnvelopeRecord;
     /** CAS token for a follow-up rewrap or lifecycle transition. */
@@ -86,7 +86,7 @@ export type PasskeyCustodyEnvelopeFactorLookupResult = PasskeyCustodyEnvelopeLoo
  * Whether a browser's cached ciphertext may still be used. A cache is usable
  * only at the exact server revision and digest; anything else must be refetched.
  */
-export type PasskeyCustodyEnvelopeCacheValidation = {
+type PasskeyCustodyEnvelopeCacheValidation = {
     readonly kind: 'cache_valid';
     readonly envelope: PasskeyCustodyEnvelopeRecord;
 } | {
@@ -97,7 +97,7 @@ export type PasskeyCustodyEnvelopeCacheValidation = {
     readonly kind: 'cache_unusable';
     readonly lookup: PasskeyCustodyEnvelopeLookupResult;
 };
-export type PasskeyCustodyEnvelopePutResult = {
+type PasskeyCustodyEnvelopePutResult = {
     readonly kind: 'stored';
     readonly storeVersion: string;
     readonly envelopeRevision: number;
@@ -113,25 +113,16 @@ export type PasskeyCustodyEnvelopePutResult = {
     readonly state: 'revoked';
 };
 /** What the caller believes it is replacing, checked before the ciphertext moves. */
-export type ExpectedCustodyEnvelopeState = {
+type ExpectedCustodyEnvelopeState = {
     readonly envelopeId: PasskeyEnvelopeId;
     readonly envelopeRevision: number;
     readonly ownership: WalletCustodyEnvelopeOwnership;
 };
-export type PasskeyCustodyEnvelopeRewrapResult = PasskeyCustodyEnvelopePutResult | {
+type PasskeyCustodyEnvelopeRewrapResult = PasskeyCustodyEnvelopePutResult | {
     readonly kind: 'ownership_conflict';
     readonly reason: string;
 };
-export type PasskeyCustodyEnvelopeRevocationResult = {
-    readonly kind: 'stored';
-    readonly revokedEnvelopeIds: readonly PasskeyEnvelopeId[];
-} | {
-    readonly kind: 'refused';
-    readonly reason: string;
-} | {
-    readonly kind: 'version_mismatch';
-};
-export type PasskeyCustodyEnvelopeLinkResult = {
+type PasskeyCustodyEnvelopeLinkResult = {
     readonly kind: 'stored';
     readonly storeVersion: string;
 } | {
@@ -139,7 +130,7 @@ export type PasskeyCustodyEnvelopeLinkResult = {
 } | {
     readonly kind: 'conflict';
 };
-export type PasskeyFactorWithoutCustodyLinkResult = {
+type PasskeyFactorWithoutCustodyLinkResult = {
     readonly kind: 'stored';
 } | {
     readonly kind: 'conflict';
@@ -148,7 +139,7 @@ export type WalletCredentialActivityProjection = {
     readonly index: PasskeyDeviceEnvelopeIndexRecord;
     readonly activity: WalletCredentialActivityRecordV1;
 };
-export type WalletCredentialActivityMutationResult = {
+type WalletCredentialActivityMutationResult = {
     readonly kind: 'updated';
     readonly projection: WalletCredentialActivityProjection;
 } | {
@@ -276,7 +267,7 @@ export declare class CloudflareD1PasskeyCustodyEnvelopeStore {
      * The envelope row is insert-only, so a repeated envelope identity or any
      * conflicting credential aborts the complete transaction.
      *
-     * The factor kind is the caller's to assert, not this store's. Refactor 109C
+     * The factor kind is the caller's to assert, not this store's. Method addition
      * enrols an Email OTP factor by exactly this route — a new envelope holding
      * the same seed, committed with the auth-method insert — and each branch has
      * already verified the factor it built the envelope for by the time it gets
@@ -332,4 +323,5 @@ export declare class CloudflareD1PasskeyCustodyEnvelopeStore {
      */
     private transitionLifecycle;
 }
+export {};
 //# sourceMappingURL=d1PasskeyCustodyEnvelopeStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts

@@ -5,9 +5,8 @@ import type { CloudflareD1WebAuthnStore } from '../webauthn/d1WebAuthnStore';
 import type { NormalizedLogger } from '../../../../core/logger';
 import type { CloudflareD1WalletCustodyCommitStore, WalletRecoveryCodeLocatorRecord } from './d1WalletCustodyCommitStore';
 import { type WalletRecoveryPreparationResult } from '../../../domains/passkeyCustody/walletRecoveryAttempt';
-import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId, type WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
 import { type WalletRecoveryFinalizationResult } from '../../../domains/passkeyCustody/walletRecoveryFinalization';
 import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
 import type { CloudflareD1WalletRecoveryGoogleEmailOtpService, WalletRecoveryGoogleEmailOtpFinalizationResult } from './d1WalletRecoveryGoogleEmailOtpService';
@@ -18,7 +17,6 @@ import type { RecoveryCodeReservationId } from '../../../../../../shared-ts/src/
 import type { WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
 import type { D1WalletStore } from '../../../../core/d1WalletStore';
 import type { D1WalletAuthorityStore } from '../wallet/d1WalletAuthorityStore';
-import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import type { WalletRecoveryTargetV1 } from '../../../../../../shared-ts/src/wallet-recovery/walletRecoveryTarget';
 import { type WalletRecoveryCommittedProjectionV1 } from '../../../../../../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection';
 import { type PreparedEd25519RecoveryAdmissionV1, type WalletUnlockKeyManifestV1, type WalletRecoveryPreparationKeyManifestV1 } from '../../../domains/passkeyCustody/walletRecoveryKeyManifest';
@@ -70,14 +68,14 @@ export type PasskeyCustodyEnvelopeRetrievalWireRequest = {
     readonly webauthnAuthentication: PasskeyCustodyEnvelopeRetrievalRequest['webauthnAuthentication'];
 };
 /**
- * Refactor 109C: what became of a pre-109C envelope's ownership upgrade.
+ * What became of an unbound envelope's ownership upgrade.
  *
  * `already_owned` is a success, not a near-miss. The upgrade runs on every
  * unlock until it lands, so the second unlock after a successful one finds the
  * work already done — reporting that as a conflict would turn the normal case
  * into an error the client has to special-case anyway.
  */
-export type WalletCustodyEnvelopeOwnershipUpgradeResult = {
+type WalletCustodyEnvelopeOwnershipUpgradeResult = {
     readonly kind: 'upgraded';
     readonly envelopeRevision: number;
 } | {
@@ -166,7 +164,7 @@ export interface RouterApiPasskeyCustodyService {
      */
     retrieveEnvelope(request: PasskeyCustodyEnvelopeRetrievalWireRequest): Promise<PasskeyCustodyEnvelopeRetrievalRouteResponse>;
     /**
-     * Binds a pre-109C custody envelope to the auth method that just opened it.
+     * Binds an unbound custody envelope to the auth method that just opened it.
      *
      * The ciphertext is the client's — the server never holds a factor secret and
      * cannot verify a reseal. What it can verify, and does, is that the submitted
@@ -310,34 +308,7 @@ export type WalletRecoveryGoogleEmailOtpRouteFinalizationRequest = {
     readonly reservationId: RecoveryCodeReservationId;
     readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
 };
-type ActiveWalletAuthMethodRecordV2 = Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'active';
-}>;
-export type WalletRecoveryContinuityAnchor = {
-    readonly kind: 'wallet_recovery_continuity_anchor_v1';
-    readonly authority: ActiveWalletAuthorityV1;
-    readonly method: ActiveWalletAuthMethodRecordV2;
-    readonly envelope: ActivePasskeyCustodyEnvelopeRecord;
-};
-type ActivePasskeyCustodyEnvelopeRecord = Omit<PasskeyCustodyEnvelopeRecord, 'lifecycle'> & {
-    readonly lifecycle: Extract<PasskeyCustodyEnvelopeRecord['lifecycle'], {
-        readonly state: 'active';
-    }>;
-};
-export type WalletRecoveryAuthoritySelection = ActiveWalletAuthorityV1;
-/**
- * Finds the one existing custody path that can authenticate a recovery code.
- * The target's RP is deliberately absent: it describes the new credential,
- * while continuity belongs to an already enrolled method and its envelope.
- */
-export declare function selectWalletRecoveryContinuityAnchor(input: {
-    readonly walletId: WalletId;
-    readonly targetFamily: WalletAuthMethodRecordV2['kind'];
-    readonly methods: readonly WalletAuthMethodRecordV2[];
-    readonly envelopes: readonly PasskeyCustodyEnvelopeRecord[];
-    readonly authorities: readonly WalletRecoveryAuthoritySelection[];
-}): WalletRecoveryContinuityAnchor | undefined;
-export type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationResult, {
+type WalletRecoveryRoutePreparationResult = (Extract<WalletRecoveryPreparationResult, {
     readonly kind: 'prepared';
 }> & {
     readonly target: Extract<WalletRecoveryTargetV1, {
@@ -424,25 +395,5 @@ export declare function createD1PasskeyCustodyRouteService(assembly: {
     /** Injected so the reservation window is testable without waiting. */
     readonly nowMs?: () => number;
 }): RouterApiPasskeyCustodyService;
-export declare function createWalletRecoveryRegistrationOptions(input: {
-    readonly webAuthnStore: Pick<CloudflareD1WebAuthnStore, 'writeChallenge'>;
-    readonly walletId: WalletId;
-    readonly reservationId: RecoveryCodeReservationId;
-    readonly recoveryOperationId: WalletRecoveryOperationId;
-    readonly targetDeviceId: DeviceId;
-    readonly targetAuthorityId: WalletAuthorityId;
-    readonly targetWalletAuthMethodId: WalletAuthMethodId;
-    readonly origin: string;
-    readonly rpId: WebAuthnRpId;
-    readonly continuityAnchor: WalletRecoveryContinuityAnchor;
-    readonly expiresAtMs: number;
-    readonly nowMs: number;
-}): Promise<{
-    readonly kind: 'ready';
-    readonly options: WalletRecoveryRegistrationOptions;
-} | {
-    readonly kind: 'unavailable';
-    readonly reason: string;
-}>;
 export {};
 //# sourceMappingURL=d1PasskeyCustodyRouteService.d.ts.map