@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts

@@ -0,0 +1,258 @@
+import { type DeviceId } from '../../../../shared-ts/src/authorization/capabilityKinds';
+import type { LinkPrecommitFailureV1, LinkSessionStateV1, LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 as LinkedDeviceClaimV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceApprovedTargetFactorV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../shared-ts/src/device-linking/contracts';
+import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type DomainIdParseResult, type WalletAuthorityId } from '../../../../shared-ts/src/utils/domainIds';
+import { type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+import { type ExactAdministeredSignerV1, type ExactAdministeredSignerManifestV1 } from '../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+import type { ReadonlyExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
+type LinkedDeviceClaimTranscriptV1 = {
+    readonly digestB64u: DigestB64u;
+    readonly value: LinkedDeviceClaimV1;
+};
+export type LinkedDeviceSourceKeyManifestDigestsV1 = ReadonlyExclusiveUnion<{
+    readonly ed25519: DigestB64u;
+} | {
+    readonly ecdsa_secp256k1: DigestB64u;
+} | {
+    readonly ed25519: DigestB64u;
+    readonly ecdsa_secp256k1: DigestB64u;
+}>;
+type LinkedDeviceApprovalTranscriptV1 = {
+    readonly digestB64u: DigestB64u;
+    readonly value: LinkedDeviceApprovalV1;
+    readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
+    readonly sourceKeyManifestDigestsB64u: LinkedDeviceSourceKeyManifestDigestsV1;
+    /** Authority digest at approval time; rotation advances it, so use must re-approve. */
+    readonly sourceAuthorityDigestB64u: DigestB64u;
+};
+export declare function sourceKeyManifestDigestForFamilyV1(digests: LinkedDeviceSourceKeyManifestDigestsV1, keyFamily: ExactAdministeredSignerV1['keyFamily']): DigestB64u | null;
+type LinkedDeviceSourceContributionTranscriptV1 = LinkedDeviceApprovalTranscriptV1;
+type LinkedDeviceEmailOtpChallengeV1 = {
+    readonly state: 'available';
+    readonly maskedEmailHint: string;
+} | {
+    readonly state: 'sent';
+    readonly challengeId: string;
+    readonly workerEphemeralPublicKey65B64u: string;
+    readonly maskedEmailHint: string;
+    readonly expiresAtMs: number;
+    readonly resendAvailableAtMs: number;
+};
+type LinkedDeviceTargetFactorRecordV1 = {
+    readonly targetFactor: Extract<LinkedDeviceApprovedTargetFactorV1, {
+        readonly kind: 'passkey_prf';
+    }>;
+    readonly emailOtpChallenge?: never;
+} | {
+    readonly targetFactor: Extract<LinkedDeviceApprovedTargetFactorV1, {
+        readonly kind: 'email_otp';
+    }>;
+    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
+};
+type LinkedDeviceSessionRecordBaseV1 = {
+    readonly version: 'linked_device_session_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly qrPayload: QrLinkedDeviceSessionPayloadV5;
+    readonly revision: number;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+type LinkedDeviceSessionUnclaimedRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'displaying_qr';
+    }>;
+    readonly claimTranscript?: never;
+    readonly approvalTranscript?: never;
+    readonly targetFactor?: never;
+    readonly emailOtpChallenge?: never;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+    readonly sourceContributionPreparation?: never;
+    readonly sourceContributionTranscript?: never;
+};
+type LinkedDeviceSessionClaimedRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'claimed';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript?: never;
+    readonly targetFactor?: never;
+    readonly emailOtpChallenge?: never;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+    readonly sourceContributionPreparation?: never;
+    readonly sourceContributionTranscript?: never;
+};
+type LinkedDeviceSessionApprovedRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'awaiting_target_factor';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+    readonly sourceContributionPreparation?: never;
+    readonly sourceContributionTranscript?: never;
+};
+type LinkedDeviceSessionSourceContributionRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'awaiting_source_contribution';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript?: never;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+};
+type LinkedDeviceSessionProvisioningRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'provisioning';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+};
+type LinkedDeviceSessionPendingRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'authority_pending_local_install';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+};
+type LinkedDeviceSessionActiveRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'active';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+};
+type LinkedDeviceSessionTerminalRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'failed_before_commit' | 'cancelled' | 'expired';
+    }>;
+    readonly claimTranscript?: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript?: LinkedDeviceApprovalTranscriptV1;
+    readonly targetFactor?: LinkedDeviceApprovedTargetFactorV1;
+    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
+    readonly sourceContributionPreparation?: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript?: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+};
+export type LinkedDeviceSessionRecordV1 = LinkedDeviceSessionUnclaimedRecordV1 | LinkedDeviceSessionClaimedRecordV1 | LinkedDeviceSessionApprovedRecordV1 | LinkedDeviceSessionSourceContributionRecordV1 | LinkedDeviceSessionProvisioningRecordV1 | LinkedDeviceSessionPendingRecordV1 | LinkedDeviceSessionActiveRecordV1 | LinkedDeviceSessionTerminalRecordV1;
+export type LinkedDeviceSessionMutationResultV1 = {
+    readonly outcome: 'applied' | 'replayed';
+    readonly record: LinkedDeviceSessionRecordV1;
+} | {
+    readonly outcome: 'conflict';
+    readonly expectedRevision: number;
+    readonly actualRevision: number | null;
+    readonly record: LinkedDeviceSessionRecordV1 | null;
+} | {
+    readonly outcome: 'expired';
+    readonly record: LinkedDeviceSessionRecordV1;
+} | {
+    readonly outcome: 'deleted';
+    readonly record: null;
+} | {
+    readonly outcome: 'invalid_state';
+    readonly state: LinkSessionStateV1['state'];
+    readonly record: LinkedDeviceSessionRecordV1;
+} | {
+    readonly outcome: 'integrity_error';
+    readonly reason: 'authority_id_mismatch' | 'package_set_digest_mismatch';
+    readonly record: LinkedDeviceSessionRecordV1;
+};
+export declare function buildUnclaimedSessionRecordV1(payload: QrLinkedDeviceSessionPayloadV5, nowMs: number): LinkedDeviceSessionRecordV1;
+export declare function parseLinkedDeviceSessionRecordV1(raw: unknown): LinkedDeviceSessionRecordV1;
+export declare function parseQrLinkedDeviceSessionPayloadV1(raw: unknown): QrLinkedDeviceSessionPayloadV5;
+/** Durable facts a session record gains as it advances; each state requires its own subset. */
+type LinkedDeviceSessionRecordFactsV1 = {
+    readonly claimTranscript?: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript?: LinkedDeviceApprovalTranscriptV1;
+    readonly targetFactor?: LinkedDeviceApprovedTargetFactorV1;
+    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
+    readonly sourceContributionPreparation?: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript?: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId?: WalletAuthorityId;
+    readonly packageSetDigestB64u?: DigestB64u;
+};
+export declare function replaceSessionRecordV1(record: LinkedDeviceSessionRecordV1, patch: LinkedDeviceSessionRecordFactsV1 & {
+    readonly state?: LinkSessionStateV1;
+    readonly revision: number;
+    readonly updatedAtMs: number;
+}): LinkedDeviceSessionRecordV1;
+/** Builds the next linear session record for the authority commit transaction. */
+export declare function buildAuthorityPendingLocalInstallSessionRecordV1(input: {
+    readonly record: LinkedDeviceSessionRecordV1;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly nowMs: number;
+}): LinkedDeviceSessionRecordV1;
+/** Builds the next linear session record for the authority activation transaction. */
+export declare function buildAuthorityActiveSessionRecordV1(input: {
+    readonly record: LinkedDeviceSessionRecordV1;
+    readonly activatedAtMs: number;
+    readonly nowMs: number;
+}): LinkedDeviceSessionRecordV1;
+export declare function claimedStateV1(record: LinkedDeviceSessionRecordV1, claim: LinkedDeviceClaimV1): Extract<LinkSessionStateV1, {
+    readonly state: 'claimed';
+}>;
+export declare function awaitingTargetFactorStateV1(record: LinkedDeviceSessionRecordV1): Extract<LinkSessionStateV1, {
+    readonly state: 'awaiting_target_factor';
+}>;
+export declare function provisioningStateV1(record: LinkedDeviceSessionRecordV1): Extract<LinkSessionStateV1, {
+    readonly state: 'provisioning';
+}>;
+export declare function awaitingSourceContributionStateV1(record: LinkedDeviceSessionRecordV1): Extract<LinkSessionStateV1, {
+    readonly state: 'awaiting_source_contribution';
+}>;
+export declare function authorityPendingStateV1(record: LinkedDeviceSessionRecordV1, authorityId: WalletAuthorityId, packageSetDigestB64u: DigestB64u): Extract<LinkSessionStateV1, {
+    readonly state: 'authority_pending_local_install';
+}>;
+export declare function activeStateV1(record: LinkedDeviceSessionRecordV1, activatedAtMs: number): Extract<LinkSessionStateV1, {
+    readonly state: 'active';
+}>;
+export declare function isPrecommitState(state: LinkSessionStateV1): state is Extract<LinkSessionStateV1, {
+    readonly state: 'displaying_qr' | 'claimed' | 'awaiting_target_factor' | 'awaiting_source_contribution' | 'provisioning';
+}>;
+export declare function sessionExpiryMsV1(record: LinkedDeviceSessionRecordV1): number;
+export declare function awaitingTargetDeadlineMsV1(record: LinkedDeviceSessionRecordV1): number;
+export declare function awaitingSourceContributionDeadlineMsV1(record: LinkedDeviceSessionRecordV1): number;
+export declare function linkedDeviceQrPayloadsEqualV1(left: QrLinkedDeviceSessionPayloadV5, right: QrLinkedDeviceSessionPayloadV5): boolean;
+export declare function claimTranscriptMatchesDigest(record: LinkedDeviceSessionRecordV1, digest: DigestB64u): boolean;
+export declare function approvalTranscriptMatchesDigest(record: LinkedDeviceSessionRecordV1, digest: DigestB64u): boolean;
+export declare function sourceContributionTranscriptMatchesDigest(record: LinkedDeviceSessionRecordV1, digest: DigestB64u): boolean;
+export declare function linkedDeviceEmailOtpChallengesEqualV1(left: LinkedDeviceEmailOtpChallengeV1, right: LinkedDeviceEmailOtpChallengeV1): boolean;
+export declare function linkedDevicePrecommitFailuresEqualV1(left: LinkPrecommitFailureV1, right: LinkPrecommitFailureV1): boolean;
+/**
+ * A stored transcript no longer parses under the current schema. This class
+ * marks exactly the failures a deployment boundary produces - transcript
+ * shapes are what refactors move - so a store can delete-and-recover them
+ * while every value-consistency failure (tampering) keeps throwing raw.
+ */
+export declare class LinkedDeviceRetiredSessionShapeErrorV1 extends Error {
+    constructor(transcript: string, cause: unknown);
+}
+export declare function parseEmailOtpChallengeV1(raw: unknown): LinkedDeviceEmailOtpChallengeV1;
+export declare function parseDeviceIdValue(raw: unknown): DeviceId;
+export declare function parseId<T>(raw: unknown, parser: (value: unknown) => DomainIdParseResult<T>, field: string): T;
+export declare function requireDigest(raw: unknown, field: string): DigestB64u;
+export declare function requireTimestamp(raw: unknown, field: string): number;
+export declare function conflictResult(expectedRevision: number, record: LinkedDeviceSessionRecordV1 | null): LinkedDeviceSessionMutationResultV1;
+export declare function invalidStateResult(record: LinkedDeviceSessionRecordV1): LinkedDeviceSessionMutationResultV1;
+export declare function integrityResult(record: LinkedDeviceSessionRecordV1, reason: 'authority_id_mismatch' | 'package_set_digest_mismatch'): LinkedDeviceSessionMutationResultV1;
+export {};
+//# sourceMappingURL=linkedDeviceSessionRecord.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts

@@ -2,7 +2,7 @@ import { type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lane
 import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type LinkedDeviceRequestProofV1 } from '../../../../shared-ts/src/device-linking/requestProof';
 export { computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1, LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, type LinkedDeviceRequestProofV1, } from '../../../../shared-ts/src/device-linking/requestProof';
-export type LinkedDeviceRequestProofVerificationInputV1 = {
+type LinkedDeviceRequestProofVerificationInputV1 = {
     readonly proof: LinkedDeviceRequestProofV1;
     readonly expectedDevicePublicKeyB64u: string;
     readonly expectedDevicePublicKeyDigestB64u: DigestB64u;
@@ -26,7 +26,7 @@ export type LinkedDeviceRequestProofNonceStoreV1 = {
         readonly outcome: 'already_used';
     }>;
 };
-export type LinkedDeviceRequestProofVerificationResultV1 = {
+type LinkedDeviceRequestProofVerificationResultV1 = {
     readonly kind: 'authorized';
     readonly proofDigestB64u: DigestB64u;
 } | {

package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts

@@ -0,0 +1,19 @@
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStoreScope } from './d1WalletStore';
+export declare const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS: readonly ["link_session_id", "authority_id", "wallet_id", "auth_method_id", "device_id", "package_set_digest_b64u", "target_factor_verification_digest_b64u", "target_factor_verified_at_ms", "source_manifest_digest_b64u", "delivery_recipient_public_key_b64u", "packages_json", "server_reservation_ids_json", "installed_record_set_digest_b64u", "activated_at_ms"];
+type SqlCondition = {
+    readonly sql: string;
+    readonly bindings: readonly unknown[];
+};
+type StoredRow = Readonly<Record<string, unknown>>;
+/** Request-local evidence of the exact records a material resolver examined. */
+export declare class EcdsaMaterialReadSnapshot {
+    #private;
+    readonly walletId: WalletId;
+    private constructor();
+    static canonical(scope: D1WalletStoreScope, walletId: WalletId, activationId: string, rows: readonly StoredRow[]): EcdsaMaterialReadSnapshot;
+    static linked(scope: D1WalletStoreScope, walletId: WalletId, installations: readonly StoredRow[], signers: readonly StoredRow[]): EcdsaMaterialReadSnapshot;
+    condition(scope: D1WalletStoreScope): SqlCondition;
+}
+export {};
+//# sourceMappingURL=ecdsaMaterialReadSnapshot.d.ts.map

package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts

@@ -0,0 +1,54 @@
+import type { D1PreparedStatementLike } from '../storage/tenantRoute';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput } from './EmailOtpStores';
+/** Prepares `sql` with the tenant scope bound to its first four parameters and `values` after. */
+export type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+/** Statements on `email_otp_challenges`. */
+export declare const emailOtpChallengeRows: {
+    insert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
+    upsert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
+    delete: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
+};
+/** Statements on `email_otp_grants`. */
+export declare const emailOtpGrantRows: {
+    insert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
+    upsert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
+    select: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
+    consume: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
+    delete: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
+};
+/** Statements on `email_otp_wallet_enrollments`. */
+export declare const emailOtpWalletEnrollmentRows: {
+    insert: (prepare: ScopedD1Prepare, record: EmailOtpWalletEnrollmentRecord) => D1PreparedStatementLike;
+    upsert: (prepare: ScopedD1Prepare, record: EmailOtpWalletEnrollmentRecord) => D1PreparedStatementLike;
+    delete: (prepare: ScopedD1Prepare, walletId: string) => D1PreparedStatementLike;
+};
+/** Statements on `email_otp_auth_states`. */
+export declare const emailOtpAuthStateRows: {
+    select: (prepare: ScopedD1Prepare, walletId: string) => D1PreparedStatementLike;
+    upsert: (prepare: ScopedD1Prepare, record: EmailOtpAuthStateRecord) => D1PreparedStatementLike;
+};
+/** Statements on `email_otp_unlock_challenges`. */
+export declare const emailOtpUnlockChallengeRows: {
+    insert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
+    upsert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
+    consume: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
+};
+/** Statements on `email_otp_registration_attempts`. */
+export declare const emailOtpRegistrationAttemptRows: {
+    upsert: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    select: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
+    /** The latest live attempt for the subject, email, owner binding and runtime scope. */
+    selectStarted: (prepare: ScopedD1Prepare, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>) => D1PreparedStatementLike;
+    /** Every live attempt for the subject and email, whatever its binding. */
+    selectPending: (prepare: ScopedD1Prepare, input: {
+        readonly providerSubject: string;
+        readonly email: string;
+        readonly nowMs: number;
+    }) => D1PreparedStatementLike;
+    /** Deletes the attempts that have expired or were marked expired. */
+    deleteExpired: (prepare: ScopedD1Prepare, nowMs: number) => D1PreparedStatementLike;
+    /** Finds a live attempt that selected or offered the wallet. */
+    selectLiveForWallet: (prepare: ScopedD1Prepare, walletId: string, nowMs: number) => D1PreparedStatementLike;
+    delete: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
+};
+//# sourceMappingURL=emailOtpD1Statements.d.ts.map

package/dist/types/wallet-server/src/core/hostedAccountIds.d.ts

@@ -1,18 +1,3 @@
-import { type WalletId } from '../../../shared-ts/src/utils/domainIds';
-export type HostedHmacReadableRelayerWalletId = WalletId & {
-    readonly __hostedHmacReadableRelayerWalletIdBrand: 'HostedHmacReadableRelayerWalletId';
-};
-export type HostedHmacReadableRelayerWalletIdParseResult = {
-    readonly ok: true;
-    readonly value: HostedHmacReadableRelayerWalletId;
-} | {
-    readonly ok: false;
-    readonly code: 'invalid_wallet_id' | 'invalid_relayer_account' | 'not_near_account' | 'not_relayer_subaccount' | 'not_hmac_readable';
-};
-export declare function parseHostedHmacReadableRelayerWalletId(input: {
-    readonly walletId: unknown;
-    readonly relayerAccount: unknown;
-}): HostedHmacReadableRelayerWalletIdParseResult;
 export declare function isHostedHmacReadableRelayerWalletId(input: {
     readonly walletId: unknown;
     readonly relayerAccount: unknown;

package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts

@@ -1,28 +1,8 @@
-export type Brand<T, Name extends string> = T & {
-    readonly __brand: Name;
-};
-export type EcdsaDerivationKeyVersion = Brand<string, 'EcdsaDerivationKeyVersion'>;
-export type SigningSessionSealKeyVersion = Brand<string, 'SigningSessionSealKeyVersion'>;
+import type { EcdsaThresholdKeyId } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import { type Brand } from '../../../shared-ts/src/threshold/keyMaterialBrands';
+export type { EcdsaThresholdKeyId };
+export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaDerivationKeyVersion, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type Ed25519RelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../shared-ts/src/threshold/keyMaterialBrands';
 export type Ed25519ClientVerifyingShareB64u = Brand<string, 'Ed25519ClientVerifyingShareB64u'>;
-export type EcdsaClientVerifyingShareB64u = Brand<string, 'EcdsaClientVerifyingShareB64u'>;
-export type Ed25519RelayerKeyId = Brand<string, 'Ed25519RelayerKeyId'>;
-export type EcdsaRelayerKeyId = Brand<string, 'EcdsaRelayerKeyId'>;
-export type EcdsaThresholdKeyId = Brand<string, 'EcdsaThresholdKeyId'>;
-export type EcdsaKeyHandle = Brand<string, 'EcdsaKeyHandle'>;
-export declare function parseEcdsaDerivationKeyVersion(value: unknown): EcdsaDerivationKeyVersion;
-export declare function parseSigningSessionSealKeyVersion(value: unknown): SigningSessionSealKeyVersion;
-export declare function parseEd25519ClientVerifyingShareB64u(value: unknown): Ed25519ClientVerifyingShareB64u;
-export declare function parseEcdsaClientVerifyingShareB64u(value: unknown): EcdsaClientVerifyingShareB64u;
-export declare function parseEd25519RelayerKeyId(value: unknown): Ed25519RelayerKeyId;
-export declare function parseEcdsaRelayerKeyId(value: unknown): EcdsaRelayerKeyId;
 export declare function parseEcdsaThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
-export declare function parseEcdsaKeyHandle(value: unknown): EcdsaKeyHandle;
-export declare function formatEcdsaDerivationKeyVersionForWire(value: EcdsaDerivationKeyVersion): string;
-export declare function formatSigningSessionSealKeyVersionForWire(value: SigningSessionSealKeyVersion): string;
 export declare function formatEd25519ClientVerifyingShareB64uForWire(value: Ed25519ClientVerifyingShareB64u): string;
-export declare function formatEcdsaClientVerifyingShareB64uForWire(value: EcdsaClientVerifyingShareB64u): string;
-export declare function formatEd25519RelayerKeyIdForWire(value: Ed25519RelayerKeyId): string;
-export declare function formatEcdsaRelayerKeyIdForWire(value: EcdsaRelayerKeyId): string;
-export declare function formatEcdsaThresholdKeyIdForWire(value: EcdsaThresholdKeyId): string;
-export declare function formatEcdsaKeyHandleForWire(value: EcdsaKeyHandle): string;
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts

@@ -34,7 +34,7 @@ export type PreparedSponsoredNearAccountCreationV1 = {
     readonly blockHash: string;
     readonly signedTransactionBorshB64u: string;
 };
-export type PrepareSponsoredNearAccountCreationResultV1 = {
+type PrepareSponsoredNearAccountCreationResultV1 = {
     readonly ok: true;
     readonly prepared: PreparedSponsoredNearAccountCreationV1;
 } | {
@@ -54,7 +54,7 @@ export declare function prepareSponsoredNearAccountCreationWithRelayer(input: Ne
  * transaction that may already be on chain as a terminal failure, so it stays
  * distinct and must never be persisted as a completed outcome.
  */
-export type BroadcastPreparedSponsoredNearAccountResultV1 = {
+type BroadcastPreparedSponsoredNearAccountResultV1 = {
     readonly kind: 'created';
     readonly result: AccountCreationResult;
 } | {
@@ -73,6 +73,5 @@ export declare function broadcastPreparedSponsoredNearAccountCreation(input: {
     /** Set when replaying a persisted transaction whose outcome is unknown. */
     readonly reconcileFirst?: boolean;
 }): Promise<BroadcastPreparedSponsoredNearAccountResultV1>;
-export declare function createNamedNearAccountWithRelayer(input: NearNamedAccountCreationInput): Promise<AccountCreationResult>;
 export {};
 //# sourceMappingURL=nearRelayerAccountProvisioning.d.ts.map

package/dist/types/wallet-server/src/core/nearSignerWasmRuntime.d.ts

@@ -1,3 +1,2 @@
 export declare function ensureNearSignerWasm(): Promise<void>;
-export declare function isNearSignerWasmReady(): boolean;
 //# sourceMappingURL=nearSignerWasmRuntime.d.ts.map