@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.d.ts

@@ -1,5 +1,5 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, VerifiedTargetFactorV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { LinkedDeviceOwnerSourceChildResolverV1 } from './d1LinkedDeviceTargetPlanner';
 import type { LinkedDeviceSourceContributionPreparationPlannerV1, VerifiedLinkedDeviceTargetFactorEvidenceV1 } from './d1LinkedDeviceTargetCredentialProvider';
 import type { VerifiedLinkSourceReadV1 } from './d1LinkedDeviceVerifiedLinkBuilder';

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts

@@ -2,10 +2,11 @@ import type { LinkedDeviceApprovalV1, LinkedDevicePasskeyTargetConfigurationFiel
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type WalletAuthMethodId, type WebAuthnCredentialIdB64u } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { DeviceLinkingTargetCredentialProviderV1, LinkedDeviceTargetPreparationResultV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
-import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
+import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 import { type VerifiedLinkSourceReadV1, type VerifiedLinkSourceReaderV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type VerifiedLinkedDeviceWebAuthnCredentialV1 = {
     readonly credentialIdB64u: string;
     readonly credentialPublicKeyB64u: string;
@@ -36,15 +37,13 @@ export type VerifiedLinkedDeviceEmailOtpGrantV1 = (VerifiedLinkedDeviceEmailOtpG
  * per target factor. A Passkey commit cannot carry a grant and an Email OTP
  * commit cannot carry WebAuthn material.
  */
-export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = {
+export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey_prf';
     readonly credential: VerifiedLinkedDeviceWebAuthnCredentialV1;
-    readonly grant?: never;
 } | {
     readonly kind: 'email_otp';
     readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
-    readonly credential?: never;
-};
+}>;
 /**
  * The complete registered-target replay record. It is kept as one payload so
  * a retry can finish the session CAS without rereading mutable source state.
@@ -171,15 +170,13 @@ export declare class D1LinkedDeviceTargetCredentialProviderV1 implements DeviceL
         readonly session: LinkedDeviceSessionRecordV1;
         readonly approval: LinkedDeviceApprovalV1;
         readonly requestedAtMs: number;
-    } & ({
+    } & ReadonlyExclusiveUnion<{
         readonly access: 'create_or_replay';
         readonly expectedOrigin: string;
         readonly deliveryRecipientPublicKey65B64u: string;
     } | {
         readonly access: 'replay_only';
-        readonly expectedOrigin?: never;
-        readonly deliveryRecipientPublicKey65B64u?: never;
-    })): Promise<LinkedDeviceTargetPreparationResultV1>;
+    }>): Promise<LinkedDeviceTargetPreparationResultV1>;
     registerTargetCredentialV1(input: {
         readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
         readonly preparation: LinkedDeviceTargetPreparationV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts

@@ -1,15 +1,15 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
-import type { WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { MpcMaterialActivationRef, WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { ActiveLaneProtocolSourceV1, EcdsaTargetCapabilityBindingV1, LaneTargetSigningWorkerV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
 import type { LaneHolderParticipantId } from '../../../../../../shared-ts/src/signing-lanes/participants';
 import type { EvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId';
 import type { KeyCreationSignerSlot } from '../../../../../../shared-ts/src/passkey-custody/primitives';
 import type { Ed25519PublicKeyB64u } from '../../../../../../shared-ts/src/passkey-custody/primitives';
-import type { RouterAbEd25519YaoActivationBindingV1, RouterAbEd25519YaoApplicationBindingFactsV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
-import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { RouterAbEd25519YaoActivationBindingV1, RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoCeremonyBindingV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIds';
 import type { WalletKeyId } from '../../../../../../shared-ts/src/signing-lanes/ids';
-import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { ExactAdministeredSignerV1 } from '../../../../../../shared-ts/src/device-linking/delegatedActivationPlan';
 import type { LinkedDeviceTargetPlannerV1 } from './d1LinkedDeviceTargetCredentialProvider';
 type LinkedDeviceOwnerSourceChildResolutionBaseV1 = {
@@ -28,6 +28,8 @@ type LinkedDeviceOwnerEd25519SourceChildResolutionV1 = LinkedDeviceOwnerSourceCh
     readonly stableContextBindingB64u: string;
     readonly sourceBinding: RouterAbEd25519YaoActivationBindingV1<'registration'>;
     readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    /** A linked device's own registration binding, when that device is the source. */
+    readonly linkedSourceBinding?: RouterAbEd25519YaoCeremonyBindingV1;
 };
 type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChildResolutionBaseV1 & {
     readonly keyFamily: 'ecdsa_secp256k1';
@@ -38,6 +40,8 @@ type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChil
     readonly sourceServerVerifyingShare33B64u: string;
     readonly applicationBindingDigestB64u: DigestB64u;
     readonly clientShareRetryCounter: number;
+    /** A linked device's own material, when that device is the source. */
+    readonly linkedSourceMaterialActivation?: MpcMaterialActivationRef;
 };
 export type LinkedDeviceOwnerSourceChildResolutionV1 = LinkedDeviceOwnerEd25519SourceChildResolutionV1 | LinkedDeviceOwnerEcdsaSourceChildResolutionV1;
 export type LinkedDeviceTargetEnrichedChildResolutionV1 = (LinkedDeviceOwnerEd25519SourceChildResolutionV1 & {

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.d.ts

@@ -2,15 +2,13 @@ import { type ExactAdministeredSignerManifestV1 } from '../../../../../../shared
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, VerifiedLinkInputV1, VerifiedTargetFactorV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { PrincipalId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
+import { type LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking/linkedDeviceSessionRecord';
 import type { VerifiedLinkedDeviceTargetFactorEvidenceV1 } from './d1LinkedDeviceTargetCredentialProvider';
 export type VerifiedLinkSourceReadV1 = {
     readonly authority: ActiveWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly signerManifest: ExactAdministeredSignerManifestV1;
     /** The custody manifest recorded on the requested source signer. */
     readonly keyManifestDigestB64u: DigestB64u;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.d.ts

@@ -0,0 +1,7 @@
+import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
+import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, StoredInstallationRow } from './d1LinkedDeviceAuthorityInstallService';
+export declare function findInstalledEcdsaAuthority(rows: readonly StoredInstallationRow[], materialActivation: MpcMaterialActivationRef): InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null;
+/** Every hop observes the same verified installation set from one database read. */
+export declare function installedEcdsaAuthorityChain(rows: readonly StoredInstallationRow[], materialActivation: MpcMaterialActivationRef): readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[];
+export declare function projectInstalledEcdsaAuthority(stored: StoredInstallationRow): InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null;
+//# sourceMappingURL=installedEcdsaAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.d.ts

@@ -18,7 +18,7 @@ export declare class CloudflareD1RouterAbEd25519YaoCapabilityPersistence impleme
     private readonly now;
     private schemaReady;
     constructor(options: CloudflareD1RouterAbEd25519YaoCapabilityPersistenceOptions);
-    replaceActiveCapability(input: {
+    prepareActiveCapabilityReplacement(input: {
         readonly operation: RouterAbEd25519YaoCapabilityReplacementOperationV1;
         readonly previous: WalletEd25519YaoActiveCapabilityRecord;
         readonly next: WalletEd25519YaoActiveCapabilityRecord;
@@ -28,6 +28,5 @@ export declare class CloudflareD1RouterAbEd25519YaoCapabilityPersistence impleme
     private prepareAuthorityReplacementStatement;
     private prepareSessionAuthorityProjectionReplacementStatement;
     private readReceipt;
-    private reconcileAfterUncertainWrite;
 }
 //# sourceMappingURL=d1Ed25519YaoCapabilityPersistence.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts

@@ -0,0 +1,33 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { RouterAbEd25519YaoLifecycleDecisionV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision';
+/**
+ * The Gateway's Ed25519 Yao lifecycle decisions, in the signer database. A
+ * decision is inserted once, in the batch that makes its finalization
+ * visible, and never changes.
+ */
+export declare class CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 {
+    private readonly database;
+    private readonly scope;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly namespace: string;
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly envId: string;
+    });
+    read(lifecycleId: string): Promise<RouterAbEd25519YaoLifecycleDecisionV1 | null>;
+    /**
+     * The statements that record `decision`, for a batch whose other statements
+     * make its finalization visible. The batch aborts unless they insert the
+     * decision: a lifecycle already decided, even the same way, commits nothing
+     * more.
+     */
+    prepareDecideStatements(decision: RouterAbEd25519YaoLifecycleDecisionV1, decidedAtMs: number): readonly D1PreparedStatementLike[];
+    /**
+     * Commits `decision` and the statements that make its finalization visible
+     * in one batch. A guard among `visibility`, or a decision already recorded,
+     * aborts it and nothing commits: the caller reads what holds instead.
+     */
+    decide(decision: RouterAbEd25519YaoLifecycleDecisionV1, visibility: readonly D1PreparedStatementLike[], decidedAtMs: number): Promise<void>;
+}
+//# sourceMappingURL=d1Ed25519YaoLifecycleDecisionStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts

@@ -18,7 +18,7 @@ type EmailOtpChallengeIssueBaseInput = {
     readonly reuseActiveChallenge?: unknown;
     readonly requestOrigin?: unknown;
 };
-export type EmailOtpChallengeIssueInput = (EmailOtpChallengeIssueBaseInput & {
+type EmailOtpChallengeIssueInput = (EmailOtpChallengeIssueBaseInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
     readonly operation: EmailOtpLoginChallengeOperation;
 }) | (EmailOtpChallengeIssueBaseInput & {

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts

@@ -1,7 +1,7 @@
 import type { EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpUnlockChallengeRecord } from '../../../../core/EmailOtpStores';
-import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import { type EmailOtpRegistrationVerificationReceiptV1, type EmailOtpChallengeIssueAction } from './d1EmailOtpRecords';
-export type EmailOtpRegistrationVerificationReceiptConsumeResult = {
+type EmailOtpRegistrationVerificationReceiptConsumeResult = {
     readonly kind: 'stored';
     readonly receipt: EmailOtpRegistrationVerificationReceiptV1;
 } | {
@@ -49,6 +49,15 @@ export declare class CloudflareD1EmailOtpChallengeStore {
     updateAttemptCount(record: EmailOtpChallengeRecord, attemptCount: number): Promise<void>;
     delete(challengeId: string): Promise<void>;
     consume(challengeId: string): Promise<EmailOtpChallengeRecord | null>;
+    /**
+     * The statements that consume one verified challenge inside a caller's
+     * batch. The delete matches the exact record, code and expiry the caller
+     * verified, and the guard aborts the whole batch when nothing matched: a
+     * challenge another request consumed first, or one that expired meanwhile.
+     * The guard collides with a row a migration seeds, so it aborts from the
+     * first time it fires.
+     */
+    prepareConsumeInBatchStatements(challenge: EmailOtpChallengeRecord, nowMs: number): readonly D1PreparedStatementLike[];
     readRegistrationVerificationReceipt(challengeId: string, nowMs: number): Promise<EmailOtpRegistrationVerificationReceiptV1 | null>;
     consumeRegistrationWithReceipt(input: {
         readonly challenge: EmailOtpChallengeRecord;
@@ -58,7 +67,8 @@ export declare class CloudflareD1EmailOtpChallengeStore {
     consumeUnlock(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
     private countActive;
     private deleteOldestActive;
-    private prepare;
+    private readonly prepare;
     private scopeValues;
 }
+export {};
 //# sourceMappingURL=d1EmailOtpChallengeStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts

@@ -4,7 +4,7 @@ import type { EmailOtpLoginChallengeOperation, EmailOtpWalletEnrollmentRecord }
 import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeStore';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1EmailOtpRateLimitStore } from './d1EmailOtpRateLimitStore';
-export type EmailOtpExistingChallengeVerifyBaseInput = {
+type EmailOtpExistingChallengeVerifyBaseInput = {
     readonly userId?: unknown;
     readonly walletId?: unknown;
     readonly orgId?: unknown;
@@ -39,7 +39,18 @@ export type EmailOtpExistingChallengeVerifyResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export type EmailOtpRegistrationChallengeVerifyInput = {
+/**
+ * A verified existing challenge that is not yet consumed: the statements
+ * consume it inside the caller's batch, or abort that batch.
+ */
+export type EmailOtpExistingChallengeBatchVerifyResult = (Extract<EmailOtpExistingChallengeVerifyResult, {
+    ok: true;
+}> & {
+    readonly consumeInBatch: readonly D1PreparedStatementLike[];
+}) | Extract<EmailOtpExistingChallengeVerifyResult, {
+    ok: false;
+}>;
+type EmailOtpRegistrationChallengeVerifyInput = {
     readonly providerSubject?: unknown;
     readonly walletId?: unknown;
     readonly orgId?: unknown;
@@ -50,11 +61,11 @@ export type EmailOtpRegistrationChallengeVerifyInput = {
     readonly proofEmail?: unknown;
     readonly clientIp?: unknown;
 };
-export type EmailOtpRegistrationChallengeResumableVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
+type EmailOtpRegistrationChallengeResumableVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
     readonly operationId: unknown;
     readonly receiptExpiresAtMs: unknown;
 };
-export type EmailOtpRegistrationChallengeVerifyResult = {
+type EmailOtpRegistrationChallengeVerifyResult = {
     ok: true;
     readonly challengeId: string;
     readonly challengeSubjectId: string;
@@ -86,7 +97,7 @@ export type ActiveEmailOtpEnrollmentResult = {
  * to; an existing enrollment is still checked by the recovery coordinator
  * before this verifier is called.
  */
-export type EmailOtpRecoveryBootstrapChallengeVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
+type EmailOtpRecoveryBootstrapChallengeVerifyInput = EmailOtpRegistrationChallengeVerifyInput & {
     readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap;
     readonly operation: typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 };
@@ -114,6 +125,13 @@ export declare class CloudflareD1EmailOtpChallengeVerifier {
      */
     prepareDeleteEnrollmentIfUnreferencedStatement(walletId: string): D1PreparedStatementLike;
     verifyExisting(input: EmailOtpExistingChallengeVerifyInput): Promise<EmailOtpExistingChallengeVerifyResult>;
+    /**
+     * Verifies an existing challenge for an operation that commits its
+     * consumption with its own writes. Nothing is consumed here: a batch that
+     * never commits leaves the challenge usable for an exact retry.
+     */
+    verifyExistingForBatch(input: EmailOtpExistingChallengeVerifyInput): Promise<EmailOtpExistingChallengeBatchVerifyResult>;
+    private verifyExistingChallenge;
     verifyRegistration(input: EmailOtpRegistrationChallengeVerifyInput): Promise<EmailOtpRegistrationChallengeVerifyResult>;
     verifyRegistrationResumable(input: EmailOtpRegistrationChallengeResumableVerifyInput): Promise<EmailOtpRegistrationChallengeVerifyResult>;
     verifyRecoveryBootstrap(input: EmailOtpRecoveryBootstrapChallengeVerifyInput): Promise<EmailOtpRegistrationChallengeVerifyResult>;
@@ -123,4 +141,5 @@ export declare class CloudflareD1EmailOtpChallengeVerifier {
     private recordInvalidAttempt;
     private recordInvalidRegistrationAttempt;
 }
+export {};
 //# sourceMappingURL=d1EmailOtpChallengeVerifier.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts

@@ -1,15 +1,9 @@
 import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { EmailOtpAuthStateReadResult as CoreEmailOtpAuthStateReadResult } from '../../../../core/authService/emailOtpEnrollment';
 import { type EmailOtpAuthStatePatch } from './d1EmailOtpRecords';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
-export type EmailOtpAuthStateReadResult = {
-    readonly ok: true;
-    readonly state: EmailOtpAuthStateRecord | null;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+export type EmailOtpAuthStateReadResult = Readonly<CoreEmailOtpAuthStateReadResult>;
 export declare class CloudflareD1EmailOtpEnrollmentStore {
     private readonly prepare;
     constructor(input: {
@@ -26,7 +20,7 @@ export declare class CloudflareD1EmailOtpEnrollmentStore {
      * Deletes the shared provider enrollment only once nothing references it.
      *
      * The enrollment is deliberately shared: every Email method on a wallet
-     * unwraps through it, and R109D keeps active and pending methods pointing at
+     * unwraps through it, and both active and pending methods keep pointing at
      * one row. So revoking a method must not remove it — only the disappearance
      * of its last reference may.
      *
@@ -64,5 +58,4 @@ export declare class CloudflareD1EmailOtpEnrollmentStore {
     private putAuthState;
     private preparePutAuthStateStatement;
 }
-export {};
 //# sourceMappingURL=d1EmailOtpEnrollmentStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts

@@ -1,6 +1,5 @@
 import type { EmailOtpGrantRecord } from '../../../../core/EmailOtpStores';
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1EmailOtpGrantStore {
     private readonly prepare;
     constructor(input: {
@@ -11,5 +10,4 @@ export declare class CloudflareD1EmailOtpGrantStore {
     read(grantToken: string): Promise<EmailOtpGrantRecord | null>;
     delete(grantToken: string): Promise<void>;
 }
-export {};
 //# sourceMappingURL=d1EmailOtpGrantStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -1,11 +1,11 @@
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+import type { RateLimitResult } from '../../../../core/authService/rateLimits';
 import type { EmailOtpRateLimitPolicy } from '../auth/d1RouterApiAuthConfig';
 import { type EmailOtpRateLimitScope } from './d1EmailOtpRecords';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
 type EmailOtpRateLimitPolicies = {
     readonly [K in EmailOtpRateLimitScope]: EmailOtpRateLimitPolicy;
 };
-export type EmailOtpRateLimitConsumeInput = {
+type EmailOtpRateLimitConsumeInput = {
     readonly scope: EmailOtpRateLimitScope;
     readonly action?: string;
     readonly userId?: string;
@@ -14,15 +14,7 @@ export type EmailOtpRateLimitConsumeInput = {
     readonly orgId?: string;
     readonly clientIp?: string;
 };
-export type EmailOtpRateLimitConsumeResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly code: 'rate_limited';
-    readonly message: string;
-    readonly retryAfterMs?: number;
-    readonly resetAtMs?: number;
-};
+type EmailOtpRateLimitConsumeResult = Readonly<RateLimitResult>;
 export declare class CloudflareD1EmailOtpRateLimitStore {
     private readonly prepare;
     private readonly rateLimits;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -1,7 +1,8 @@
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
-export type EmailOtpChallengeIssueAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
-export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
+import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import type { EmailOtpRateLimitScope } from '../../../../core/authService/emailOtpConfig';
+export type EmailOtpChallengeIssueAction = EmailOtpChallengeAction;
+export type { EmailOtpRateLimitScope };
 export type EmailOtpAuthStatePatch = {
     readonly otpFailureCount?: number | null;
     readonly lastOtpFailureAtMs?: number | null;
@@ -9,14 +10,14 @@ export type EmailOtpAuthStatePatch = {
     readonly lastEmailOtpLoginAtMs?: number | null;
     readonly lastStrongAuthAtMs?: number | null;
 };
-export type EmailOtpPublicKey33Validator = (input: Uint8Array) => Promise<unknown>;
+type EmailOtpPublicKey33Validator = (input: Uint8Array) => Promise<unknown>;
 export type EmailOtpEnrollmentMaterialBoundaryInput = {
     readonly enrollmentSealKeyVersion?: unknown;
     readonly clientUnlockPublicKeyB64u?: unknown;
     readonly unlockKeyVersion?: unknown;
     readonly serverSealedFactorCiphertextB64u?: unknown;
 };
-export type EmailOtpEnrollmentMaterialValidationResult = {
+type EmailOtpEnrollmentMaterialValidationResult = {
     readonly ok: true;
     readonly enrollmentSealKeyVersion: string;
     readonly clientUnlockPublicKeyB64u: string;
@@ -91,16 +92,16 @@ export declare function emailOtpRateLimitExceeded(row: D1EmailOtpRateLimitRow |
     readonly retryAfterMs?: number;
     readonly resetAtMs?: number;
 };
-export declare function parseEmailOtpWalletEnrollmentRecord(input: unknown): EmailOtpWalletEnrollmentRecord | null;
 export declare function parseEmailOtpWalletEnrollmentRow(row: D1EmailOtpEnrollmentRow | null): EmailOtpWalletEnrollmentRecord | null;
-export declare function parseEmailOtpAuthStateRecord(input: unknown): EmailOtpAuthStateRecord | null;
 export declare function parseEmailOtpAuthStateRow(row: D1EmailOtpAuthStateRow | null): EmailOtpAuthStateRecord | null;
-export declare function parseEmailOtpChallengeOperation(input: unknown): EmailOtpChallengeOperation | null;
 export declare function parseEmailOtpLoginOperation(input: unknown): EmailOtpLoginChallengeOperation;
-export declare function parseEmailOtpChallengeRecord(input: unknown): EmailOtpChallengeRecord | null;
+/**
+ * Reads a challenge row with the core parser and holds it to more: the operation must fit the
+ * action and the challenge must expire after it was created. The email is lowercased.
+ */
 export declare function parseEmailOtpChallengeRow(row: D1EmailOtpChallengeRow | null): EmailOtpChallengeRecord | null;
 export declare function parseEmailOtpRegistrationVerificationReceiptV1(input: unknown): EmailOtpRegistrationVerificationReceiptV1 | null;
-export declare function parseEmailOtpUnlockChallengeRecord(input: unknown): EmailOtpUnlockChallengeRecord | null;
+/** An unlock challenge row as the core parser reads it, which must also expire after creation. */
 export declare function parseEmailOtpUnlockChallengeRow(row: D1EmailOtpUnlockChallengeRow | null): EmailOtpUnlockChallengeRecord | null;
 export declare function emailOtpChallengeContextValues(input: {
     readonly challengeSubjectId: string;
@@ -167,7 +168,7 @@ export declare function emailOtpUnlockChallengeRecord(input: {
     readonly createdAtMs: number;
     readonly expiresAtMs: number;
 }): EmailOtpUnlockChallengeRecord;
-export declare function parseEmailOtpGrantRecord(input: unknown): EmailOtpGrantRecord | null;
+/** A grant row as the core parser reads it, which must also expire after it was issued. */
 export declare function parseEmailOtpGrantRow(row: D1EmailOtpGrantRow | null): EmailOtpGrantRecord | null;
 export declare function validateEmailOtpEnrollmentMaterial(input: {
     readonly material: EmailOtpEnrollmentMaterialBoundaryInput;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.d.ts

@@ -19,12 +19,10 @@ type VerifyEmailOtpUnlockProofResult = Awaited<ReturnType<RouterApiWalletUnlockS
 type ConsumeEmailOtpGrantInput = Parameters<RouterApiEmailOtpRouteService['consumeEmailOtpGrant']>[0];
 type ConsumeEmailOtpGrantResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['consumeEmailOtpGrant']>>;
 export declare class CloudflareD1EmailOtpRecoveryService {
-    private readonly challengeVerifier;
     private readonly emailOtpChallenges;
     private readonly emailOtpEnrollments;
     private readonly emailOtpGrants;
     private readonly emailOtpRateLimits;
-    private readonly grantTtlMs;
     constructor(input: {
         readonly challengeVerifier: CloudflareD1EmailOtpChallengeVerifier;
         readonly emailOtpChallenges: CloudflareD1EmailOtpChallengeStore;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.d.ts

@@ -1,10 +1,11 @@
-import type { RegistrationAuthority, WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { CloudflareD1EmailOtpEnrollmentStore } from './d1EmailOtpEnrollmentStore';
 import type { CloudflareD1GoogleEmailOtpSessionResolver } from './d1GoogleEmailOtpSessionResolver';
 import { type EmailOtpEnrollmentMaterialBoundaryInput } from './d1EmailOtpRecords';
-export type D1EmailOtpRegistrationEnrollmentPersistence = {
+type D1EmailOtpRegistrationEnrollmentPersistence = {
     readonly enrollment: EmailOtpWalletEnrollmentRecord;
     readonly existingAuthState: EmailOtpAuthStateRecord | null;
 };
@@ -72,8 +73,8 @@ export declare class CloudflareD1EmailOtpRegistrationEnrollmentFinalizer {
         };
     }>;
     /**
-     * Refactor 109C: the enrollment statements for a wallet's first Email OTP
-     * method, to commit in the batch that inserts that method.
+     * The enrollment statements for a wallet's first Email OTP method, to commit
+     * in the batch that inserts that method.
      *
      * Same construction as registration's, deliberately — the shared enrollment
      * is one record whichever operation creates it, and a second builder would

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts

@@ -1,22 +1,12 @@
 import type { EmailOtpServerSealRuntimeConfig } from '../auth/d1RouterApiAuthConfig';
-type EmailOtpServerSealInput = {
-    readonly wrappedCiphertext?: unknown;
-};
-type EmailOtpServerSealResult = {
-    readonly ok: true;
-    readonly ciphertext: string;
-    readonly enrollmentSealKeyVersion: string;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+import type { EmailOtpServerSealRequest, EmailOtpServerSealResult as CoreEmailOtpServerSealResult } from '../../../../core/authService/emailOtpSeal';
+type EmailOtpServerSealResult = Readonly<CoreEmailOtpServerSealResult>;
 export declare class CloudflareD1EmailOtpServerSealRuntime {
     private readonly config;
     private readonly cipherResult;
     constructor(config: EmailOtpServerSealRuntimeConfig);
-    removeEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
-    applyEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
+    removeEmailOtpServerSeal(input: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
+    applyEmailOtpServerSeal(input: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
     private runServerSealOperation;
     private createCipher;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts

@@ -1,7 +1,6 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
+import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     private readonly prepare;
     private readonly orgId;
@@ -47,5 +46,4 @@ export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
     delete(attemptId: string): Promise<void>;
 }
-export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationAttemptStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts

@@ -1,12 +1,12 @@
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
-import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
+import type { GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationOfferCandidateRecord, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 export type D1EmailOtpRegistrationAttemptRow = {
     readonly attempt_id?: unknown;
     readonly record_json?: unknown;
     readonly expires_at_ms?: unknown;
     readonly updated_at_ms?: unknown;
 };
-export type GoogleEmailOtpRegistrationOfferForResponse = {
+type GoogleEmailOtpRegistrationOfferForResponse = {
     readonly offerId: string;
     readonly selectedCandidateId: string;
     readonly candidates: readonly [
@@ -21,7 +21,6 @@ export type GoogleEmailOtpRegistrationOfferForResponse = {
     ];
 };
 export declare function requireRuntimePolicyScope(input: unknown): RuntimePolicyScope;
-export declare function runtimePolicyScopeKey(scope: RuntimePolicyScope | undefined): string;
 export declare function activeGoogleEmailOtpRegistrationAttemptRecord(input: {
     readonly record: PendingGoogleEmailOtpRegistrationAttemptRecord;
     readonly updatedAtMs: number;
@@ -35,25 +34,7 @@ export declare function failedGoogleEmailOtpRegistrationAttemptWithCode(input: {
     readonly failureCode: string;
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
-export declare function parseGoogleEmailOtpRegistrationAttemptRecord(input: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
 export declare function parseGoogleEmailOtpRegistrationAttemptRow(row: D1EmailOtpRegistrationAttemptRow | null): GoogleEmailOtpRegistrationAttemptRecord | null;
-export declare function registrationAttemptMatchesStartedScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: {
-    readonly providerSubject: string;
-    readonly email: string;
-    readonly orgId: string;
-    readonly ownerProofBindingDigest: string;
-    readonly runtimePolicyScope?: RuntimePolicyScope;
-    readonly nowMs: number;
-}): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function registrationAttemptMatchesReplacementScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: {
-    readonly providerSubject: string;
-    readonly email: string;
-    readonly orgId: string;
-    readonly ownerProofBindingDigest: string;
-    readonly runtimePolicyScope?: RuntimePolicyScope;
-    readonly nowMs: number;
-}): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function googleEmailOtpRegistrationOfferWalletIdsJson(candidates: NonEmptyGoogleEmailOtpRegistrationOfferCandidates): string;
 export declare function googleEmailOtpRegistrationOfferForResponse(input: Pick<PendingGoogleEmailOtpRegistrationAttemptRecord, 'offerId' | 'offerCandidates' | 'selectedCandidateId'>): GoogleEmailOtpRegistrationOfferForResponse;
 export declare function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record: PendingGoogleEmailOtpRegistrationAttemptRecord, updatedAtMs: number): PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input: {
@@ -66,4 +47,5 @@ export declare function abandonedGoogleEmailOtpRegistrationAttemptRecord(input:
     readonly failureCode: 'owner_proof_binding_replaced' | 'offer_restarted_by_user';
     readonly updatedAtMs: number;
 }): GoogleEmailOtpRegistrationAttemptRecord;
+export {};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityRecords.d.ts

@@ -1,19 +1,5 @@
-import type { LinkIdentityResult } from '../../../../core/IdentityStore';
 import type { RouterApiIdentityService } from '../../../framework/authServicePort';
 type ResolveGoogleEmailOtpSessionResult = Awaited<ReturnType<RouterApiIdentityService['resolveGoogleEmailOtpSession']>>;
-export type D1IdentityRow = {
-    readonly subject?: unknown;
-    readonly user_id?: unknown;
-    readonly created_at_ms?: unknown;
-    readonly subject_count?: unknown;
-};
-type IdentitySubjectRecord = {
-    readonly version: 'identity_subject_v1';
-    readonly subject: string;
-    readonly userId: string;
-    readonly createdAtMs: number;
-    readonly updatedAtMs: number;
-};
 export declare function hasDifferentWalletIdentitySubject(input: {
     readonly subjects: readonly string[];
     readonly expectedIdentitySubject: string;
@@ -25,14 +11,5 @@ export declare function googleEmailOtpStaleIdentityMapping(input: {
 }): Extract<ResolveGoogleEmailOtpSessionResult, {
     readonly ok: false;
 }>;
-export declare function parseIdentityCreatedAt(input: unknown, fallback: number): number;
-export declare function identitySubjectRecord(input: {
-    readonly subject: string;
-    readonly userId: string;
-    readonly createdAtMs: number;
-    readonly updatedAtMs: number;
-}): IdentitySubjectRecord;
-export declare function identityAlreadyLinked(): LinkIdentityResult;
-export declare function identityMoveDisallowed(): LinkIdentityResult;
 export {};
 //# sourceMappingURL=d1IdentityRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts

@@ -1,6 +1,5 @@
-import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import { type NearPublicKeyRecord } from '../webauthn/d1WebAuthnRecords';
-type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1PreparedStatementLike;
 type D1NearPublicKeyListResult = {
     readonly ok: true;
     readonly keys: {