@seams/wallet-server 0.6.2 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (790) hide show
  1. package/THIRD_PARTY_NOTICES.md +1 -105
  2. package/artifact-manifest.json +147 -32
  3. package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -0
  4. package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
  5. package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
  6. package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -0
  7. package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
  8. package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
  9. package/cloudflare-router-ab/build/local-tools/darwin-arm64/router_ab_local_init +0 -0
  10. package/cloudflare-router-ab/build/local-tools/darwin-x64/router_ab_local_init +0 -0
  11. package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
  12. package/cloudflare-router-ab/build/router/build-stamp.json +1 -0
  13. package/cloudflare-router-ab/build/router/index.js +2 -2
  14. package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
  15. package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -0
  16. package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
  17. package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
  18. package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -0
  19. package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
  20. package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
  21. package/cloudflare-router-ab/migrations/deriver-a/0012_tenant_root_creation_tombstones.sql +20 -0
  22. package/cloudflare-router-ab/migrations/deriver-a/0013_tenant_root_root_use_admissions.sql +32 -0
  23. package/cloudflare-router-ab/migrations/deriver-a/0014_tenant_root_refresh_supersessions.sql +24 -0
  24. package/cloudflare-router-ab/migrations/deriver-a/0015_tenant_root_root_use_attempts.sql +56 -0
  25. package/cloudflare-router-ab/migrations/deriver-a/0016_tenant_root_root_use_admission_settlement.sql +5 -0
  26. package/cloudflare-router-ab/migrations/deriver-a/0017_tenant_root_root_use_admission_claims.sql +64 -0
  27. package/cloudflare-router-ab/migrations/deriver-a/0018_tenant_root_recovery_retention_keys.sql +12 -0
  28. package/cloudflare-router-ab/migrations/deriver-b/0012_tenant_root_creation_tombstones.sql +20 -0
  29. package/cloudflare-router-ab/migrations/deriver-b/0013_tenant_root_root_use_admissions.sql +32 -0
  30. package/cloudflare-router-ab/migrations/deriver-b/0014_tenant_root_refresh_supersessions.sql +24 -0
  31. package/cloudflare-router-ab/migrations/deriver-b/0015_tenant_root_root_use_attempts.sql +56 -0
  32. package/cloudflare-router-ab/migrations/deriver-b/0016_tenant_root_root_use_admission_settlement.sql +5 -0
  33. package/cloudflare-router-ab/migrations/deriver-b/0017_tenant_root_root_use_admission_claims.sql +64 -0
  34. package/cloudflare-router-ab/migrations/deriver-b/0018_tenant_root_recovery_retention_keys.sql +12 -0
  35. package/cloudflare-router-ab/scripts/bootstrap-local-tenant-root.mjs +81 -16
  36. package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs +102 -9
  37. package/cloudflare-router-ab/scripts/start-local-role-workers.mjs +4 -1
  38. package/cloudflare-router-ab/wrangler.deriver-a.toml +24 -0
  39. package/cloudflare-router-ab/wrangler.router.toml +13 -0
  40. package/dist/esm/authorization/capabilityPolicy.js +1 -1
  41. package/dist/esm/authorization/domain.js +2 -2
  42. package/dist/esm/authorization/factorEvidence.js +6 -100
  43. package/dist/esm/authorization/service.js +42 -2
  44. package/dist/esm/authorization/vaultProxyUse.js +5 -10
  45. package/dist/esm/cloud-host.js +17 -12
  46. package/dist/esm/core/EmailOtpRecords.js +19 -1
  47. package/dist/esm/core/EmailOtpStores.js +323 -924
  48. package/dist/esm/core/IdentityStore.js +67 -345
  49. package/dist/esm/core/NearPublicKeyStore.js +21 -63
  50. package/dist/esm/core/RegistrationCeremonyStore.js +3 -1793
  51. package/dist/esm/core/SessionService.js +7 -30
  52. package/dist/esm/core/ThresholdService/config.js +1 -82
  53. package/dist/esm/core/ThresholdService/kv.js +3 -3
  54. package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js +37 -5
  55. package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.js +4 -74
  56. package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js +3 -10
  57. package/dist/esm/core/ThresholdService/stores/CloudflareDurableObjectStore.js +15 -51
  58. package/dist/esm/core/ThresholdService/stores/KeyStore.js +3 -3
  59. package/dist/esm/core/ThresholdService/stores/SessionStore.js +5 -81
  60. package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js +191 -372
  61. package/dist/esm/core/ThresholdService/stores/exportReplayGuard.js +7 -0
  62. package/dist/esm/core/ThresholdService/validation.js +18 -230
  63. package/dist/esm/core/WalletAuthMethodStore.js +22 -79
  64. package/dist/esm/core/WalletStore.js +62 -191
  65. package/dist/esm/core/WebAuthnAuthenticatorStore.js +57 -340
  66. package/dist/esm/core/WebAuthnCredentialBindingStore.js +90 -369
  67. package/dist/esm/core/WebAuthnLoginChallengeStore.js +17 -397
  68. package/dist/esm/core/WebAuthnSyncChallengeStore.js +17 -397
  69. package/dist/esm/core/authService/AuthService.js +2 -19
  70. package/dist/esm/core/authService/bytes.js +1 -4
  71. package/dist/esm/core/authService/emailOtpChallengeOperations.js +2 -5
  72. package/dist/esm/core/authService/emailOtpChallengeProof.js +10 -41
  73. package/dist/esm/core/authService/emailOtpChallengeVerification.js +19 -90
  74. package/dist/esm/core/authService/emailOtpChallenges.js +11 -46
  75. package/dist/esm/core/authService/emailOtpConfig.js +1 -32
  76. package/dist/esm/core/authService/emailOtpDelivery.js +10 -45
  77. package/dist/esm/core/authService/emailOtpEnrollment.js +9 -40
  78. package/dist/esm/core/authService/emailOtpGrant.js +9 -40
  79. package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js +15 -193
  80. package/dist/esm/core/authService/emailOtpSeal.js +5 -20
  81. package/dist/esm/core/authService/emailOtpUnlock.js +20 -110
  82. package/dist/esm/core/authService/googleEmailOtpRegistration.js +29 -116
  83. package/dist/esm/core/authService/identity.js +5 -20
  84. package/dist/esm/core/authService/nearPrivateKeySigning.js +7 -15
  85. package/dist/esm/core/authService/nearPublicKeyMetadata.js +6 -25
  86. package/dist/esm/core/authService/nearTransactions.js +2 -1
  87. package/dist/esm/core/authService/oidcVerification.js +25 -38
  88. package/dist/esm/core/authService/rateLimits.js +3 -36
  89. package/dist/esm/core/authService/registrationThresholdHelpers.js +2 -103
  90. package/dist/esm/core/authService/storeRegistry.js +2 -13
  91. package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js +6 -6
  92. package/dist/esm/core/authService/webauthn.js +52 -241
  93. package/dist/esm/core/authService/webauthnOidcHelpers.js +1 -6
  94. package/dist/esm/core/authService/webauthnVerificationOutcomes.js +41 -0
  95. package/dist/esm/core/authService/webauthnWalletBinding.js +2 -122
  96. package/dist/esm/core/d1EcdsaSignerRead.js +76 -0
  97. package/dist/esm/core/d1IdentityStore.js +46 -139
  98. package/dist/esm/core/d1TenantStore.js +82 -0
  99. package/dist/esm/core/d1WalletAuthMethodStore.js +92 -143
  100. package/dist/esm/core/d1WalletStore.js +28 -36
  101. package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js +10 -12
  102. package/dist/esm/core/deviceLinking/linkedDeviceManagement.js +25 -3
  103. package/dist/esm/core/deviceLinking/linkedDeviceSession.js +6 -895
  104. package/dist/esm/core/deviceLinking/linkedDeviceSessionApproval.js +100 -0
  105. package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js +662 -0
  106. package/dist/esm/core/deviceLinking/requestProof.js +13 -4
  107. package/dist/esm/core/ecdsaMaterialReadSnapshot.js +85 -0
  108. package/dist/esm/core/emailOtpD1Statements.js +383 -0
  109. package/dist/esm/core/hostedAccountIds.js +2 -2
  110. package/dist/esm/core/keyMaterialBrands.js +2 -48
  111. package/dist/esm/core/nearRelayerAccountProvisioning.js +27 -155
  112. package/dist/esm/core/nearSignerWasmRuntime.js +1 -4
  113. package/dist/esm/core/rpcClients/near/NearClient.js +15 -218
  114. package/dist/esm/core/signingLanes/LaneEnrollmentActivation.js +1 -1
  115. package/dist/esm/core/signingLanes/LaneLifecycleApplicationService.js +2 -4
  116. package/dist/esm/core/signingLanes/LaneLifecycleStore.js +0 -24
  117. package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js +8 -11
  118. package/dist/esm/core/signingLanes/ecdsaServerRetirement.js +3 -8
  119. package/dist/esm/core/signingLanes/ed25519ServerRetirement.js +1 -4
  120. package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js +2 -5
  121. package/dist/esm/core/storeBackends.js +208 -0
  122. package/dist/esm/core/thresholdEcdsaChainTarget.js +2 -10
  123. package/dist/esm/core/webAuthnD1Statements.js +92 -0
  124. package/dist/esm/core/webAuthnStoreBackends.js +198 -0
  125. package/dist/esm/hosted-wallet-gateway.js +34 -17
  126. package/dist/esm/index.js +2 -2
  127. package/dist/esm/local-hosted-wallet-gateway-worker.js +2 -23
  128. package/dist/esm/localHostedWalletGatewayHandler.js +312 -0
  129. package/dist/esm/localIntendedEcdsaFinalizeFault.js +85 -0
  130. package/dist/esm/localIntendedLinkExecuteFault.js +140 -0
  131. package/dist/esm/localIntendedMaterialAdmissionFault.js +176 -0
  132. package/dist/esm/localIntendedPresignCancellation.js +44 -0
  133. package/dist/esm/localIntendedRevokeFault.js +106 -0
  134. package/dist/esm/localIntendedSessionAdmissionFault.js +139 -0
  135. package/dist/esm/localIntendedYaoExportFault.js +117 -0
  136. package/dist/esm/localIntendedYaoFault.js +13 -16
  137. package/dist/esm/localIntendedYaoFinalizeFault.js +99 -0
  138. package/dist/esm/localIntendedYaoRecoveryFault.js +102 -0
  139. package/dist/esm/localIntendedYaoSigningFault.js +127 -0
  140. package/dist/esm/router/auth/authRequestValidation.js +1 -1
  141. package/dist/esm/router/auth/commonRouterUtils.js +34 -12
  142. package/dist/esm/router/auth/walletSessionFailure.js +3 -19
  143. package/dist/esm/router/auth/webAuthnCredentialCodecs.js +4 -15
  144. package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js +24 -0
  145. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.js +2 -6
  146. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +87 -89
  147. package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js +76 -0
  148. package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js +215 -0
  149. package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js +423 -308
  150. package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js +8 -12
  151. package/dist/esm/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.js +14 -0
  152. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js +107 -66
  153. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js +3 -6
  154. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js +1 -19
  155. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.js +4 -3
  156. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +52 -9
  157. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js +3 -6
  158. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.js +100 -0
  159. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js +7 -10
  160. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js +33 -124
  161. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js +2 -2
  162. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js +10 -18
  163. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js +6 -6
  164. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js +3 -1
  165. package/dist/esm/router/cloudflare/d1/deviceLinking/index.js +4 -4
  166. package/dist/esm/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.js +69 -0
  167. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js +39 -68
  168. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js +69 -0
  169. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js +2 -2
  170. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js +12 -55
  171. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js +17 -80
  172. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js +26 -71
  173. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js +20 -3
  174. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.js +6 -25
  175. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js +7 -94
  176. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js +5 -47
  177. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js +38 -170
  178. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +24 -87
  179. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js +9 -32
  180. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js +5 -20
  181. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js +15 -134
  182. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js +54 -260
  183. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +24 -111
  184. package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js +1 -28
  185. package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js +9 -40
  186. package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js +5 -18
  187. package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js +18 -91
  188. package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js +6 -30
  189. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js +1 -1
  190. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js +7 -18
  191. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js +25 -80
  192. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js +24 -15
  193. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js +23 -253
  194. package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js +5 -20
  195. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +20 -39
  196. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js +31 -73
  197. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +4 -1
  198. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js +10 -31
  199. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +6 -30
  200. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +286 -220
  201. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js +5 -3
  202. package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js +2 -2
  203. package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js +4 -7
  204. package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js +139 -27
  205. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js +0 -1
  206. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js +1 -1
  207. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js +2 -1
  208. package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js +2 -60
  209. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +158 -19
  210. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.js +19 -49
  211. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js +100 -0
  212. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +132 -33
  213. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js +83 -4
  214. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +45 -217
  215. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js +10 -13
  216. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js +22 -116
  217. package/dist/esm/router/cloudflare/durableObjects/thresholdStore.js +59 -66
  218. package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js +1 -2
  219. package/dist/esm/router/cloudflare/runtime/routerAbPrewarm.js +2 -2
  220. package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js +5 -20
  221. package/dist/esm/router/cloudflare/runtime/tenantRootCreationGrant.js +2 -9
  222. package/dist/esm/router/cloudflare/runtime/walletConsoleTenantRootLineage.js +11 -2
  223. package/dist/esm/router/cloudflare/runtime/walletControlOps.js +2 -1
  224. package/dist/esm/router/cloudflare/runtime/walletGateway.js +1 -1
  225. package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js +7 -7
  226. package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js +4 -3
  227. package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js +48 -21
  228. package/dist/esm/router/cloudflare.js +13343 -14372
  229. package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js +16 -5
  230. package/dist/esm/router/domains/ecdsa/thresholdEcdsaRequestValidation.js +2 -8
  231. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js +33 -0
  232. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +17 -9
  233. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js +29 -431
  234. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js +7 -2
  235. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js +5 -8
  236. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js +2 -1
  237. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js +70 -2
  238. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js +134 -169
  239. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js +77 -162
  240. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js +205 -51
  241. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js +29 -11
  242. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js +3 -6
  243. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js +182 -55
  244. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js +2 -1
  245. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.js +63 -247
  246. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js +9 -27
  247. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js +87 -132
  248. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js +39 -55
  249. package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js +5 -4
  250. package/dist/esm/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js +45 -0
  251. package/dist/esm/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.js +1 -1
  252. package/dist/esm/router/domains/emailOtp/emailOtpExportPolicy.js +1 -42
  253. package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js +1 -6
  254. package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js +15 -62
  255. package/dist/esm/router/domains/emailOtp/emailOtpSessionRouteHelpers.js +1 -142
  256. package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js +1 -1
  257. package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js +2 -2
  258. package/dist/esm/router/domains/passkeyCustody/walletRecoveryFinalization.js +23 -45
  259. package/dist/esm/router/domains/passkeyCustody/walletRecoveryKeyManifest.js +5 -5
  260. package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js +1 -1
  261. package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js +836 -0
  262. package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js +698 -0
  263. package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js +210 -0
  264. package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js +16 -15
  265. package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js +314 -0
  266. package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js +62 -2159
  267. package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js +1 -4
  268. package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js +8 -14
  269. package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js +18 -22
  270. package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js +3 -4
  271. package/dist/esm/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.js +2 -2
  272. package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js +127 -339
  273. package/dist/esm/router/express.js +7172 -7997
  274. package/dist/esm/router/framework/http.js +5 -4
  275. package/dist/esm/router/framework/ror/normalize.js +1 -1
  276. package/dist/esm/router/framework/routerApiRouteSurface.js +1 -1
  277. package/dist/esm/router/framework/runtimeSnapshotConsumer.js +8 -35
  278. package/dist/esm/router/node/nodeHostedWalletGateway.js +64 -0
  279. package/dist/esm/router/node/nodeHostedWalletGatewayCheck.js +163 -0
  280. package/dist/esm/router/node/nodeHostedWalletGatewayMain.js +120 -0
  281. package/dist/esm/router/node/nodeHttp.js +79 -0
  282. package/dist/esm/router/node/nodeSqlite.js +43 -0
  283. package/dist/esm/router/node/signerSqlMigrations.js +48 -0
  284. package/dist/esm/router/transport/fetch/createFetchRouter.js +4 -7
  285. package/dist/esm/router/transport/fetch/routes/auth.js +9 -41
  286. package/dist/esm/router/transport/fetch/routes/deviceLinking.js +16 -18
  287. package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js +8 -27
  288. package/dist/esm/router/transport/fetch/routes/deviceManagement.js +15 -24
  289. package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js +4 -16
  290. package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js +3 -16
  291. package/dist/esm/router/transport/fetch/routes/passkeyCustody.js +144 -461
  292. package/dist/esm/router/transport/fetch/routes/sessions.js +5 -4
  293. package/dist/esm/router/transport/fetch/routes/syncAccount.js +12 -42
  294. package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js +2 -2
  295. package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js +96 -102
  296. package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js +52 -27
  297. package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js +4 -1
  298. package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js +4 -16
  299. package/dist/esm/shared-ts/src/authorization/capabilityKinds.js +1 -1
  300. package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js +1 -1
  301. package/dist/esm/shared-ts/src/authorization/operationFingerprint.js +1 -2
  302. package/dist/esm/shared-ts/src/authorization/walletAuthority.js +99 -227
  303. package/dist/esm/shared-ts/src/authorization/walletCustodyOperation.js +4 -6
  304. package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js +12 -0
  305. package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js +74 -0
  306. package/dist/esm/shared-ts/src/device-linking/authorityActivation.js +50 -0
  307. package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js +10 -14
  308. package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js +3 -5
  309. package/dist/esm/shared-ts/src/device-linking/deviceManagement.js +55 -0
  310. package/dist/esm/shared-ts/src/device-linking/digests.js +10 -65
  311. package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js +14 -16
  312. package/dist/esm/shared-ts/src/device-linking/index.js +4 -1
  313. package/dist/esm/shared-ts/src/device-linking/parsers.js +510 -1063
  314. package/dist/esm/shared-ts/src/device-linking/requestProof.js +5 -14
  315. package/dist/esm/shared-ts/src/device-linking/sourceContribution.js +10 -16
  316. package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js +9 -9
  317. package/dist/esm/shared-ts/src/device-linking/wireFields.js +59 -0
  318. package/dist/esm/shared-ts/src/near/nearClient.js +252 -0
  319. package/dist/esm/shared-ts/src/passkey-custody/credentialActivity.js +3 -1
  320. package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js +7 -5
  321. package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js +6 -4
  322. package/dist/esm/shared-ts/src/passkey-custody/primitives.js +9 -39
  323. package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js +1 -5
  324. package/dist/esm/shared-ts/src/signing-lanes/index.js +3 -3
  325. package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js +8 -19
  326. package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js +5 -14
  327. package/dist/esm/shared-ts/src/signing-lanes/participants.js +2 -5
  328. package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js +7 -5
  329. package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js +6 -45
  330. package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js +423 -1511
  331. package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js +323 -0
  332. package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js +59 -0
  333. package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentifier.js +12 -0
  334. package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js +2 -9
  335. package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js +2 -5
  336. package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js +1 -2
  337. package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js +49 -0
  338. package/dist/esm/shared-ts/src/utils/addAuthMethodRegistration.js +3 -4
  339. package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js +8 -1
  340. package/dist/esm/shared-ts/src/utils/digestEncoding.js +63 -0
  341. package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js +2 -4
  342. package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js +0 -1
  343. package/dist/esm/shared-ts/src/utils/emailOtpDomain.js +5 -3
  344. package/dist/esm/shared-ts/src/utils/exactKeys.js +17 -0
  345. package/dist/esm/shared-ts/src/utils/exactRecord.js +44 -0
  346. package/dist/esm/shared-ts/src/utils/failure.js +20 -0
  347. package/dist/esm/shared-ts/src/utils/registrationAuthMethodInput.js +127 -0
  348. package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js +2 -2
  349. package/dist/esm/shared-ts/src/utils/registrationIds.js +280 -0
  350. package/dist/esm/shared-ts/src/utils/registrationIntent.js +7 -1182
  351. package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js +426 -0
  352. package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js +11 -136
  353. package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js +3 -163
  354. package/dist/esm/shared-ts/src/utils/routerAbEd25519YaoDigests.js +160 -0
  355. package/dist/esm/shared-ts/src/utils/routerAbNormalSigningIdentity.js +1 -4
  356. package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js +7 -15
  357. package/dist/esm/shared-ts/src/utils/thresholdEcdsaChainTarget.js +9 -0
  358. package/dist/esm/shared-ts/src/utils/validation.js +37 -6
  359. package/dist/esm/shared-ts/src/utils/walletAuthMethodRecord.js +362 -0
  360. package/dist/esm/shared-ts/src/utils/wireSchema.js +77 -0
  361. package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js +1 -1
  362. package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeReservation.js +1 -1
  363. package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js +8 -15
  364. package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js +4 -8
  365. package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js +3 -1
  366. package/dist/esm/storage/d1Sql.js +10 -1
  367. package/dist/esm/storage/syncSqlite.js +79 -0
  368. package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js +11 -33
  369. package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js +1 -1
  370. package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js +3 -3
  371. package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js +3 -10
  372. package/dist/esm/threshold/session/signingSessionSeal/options.js +1 -1
  373. package/dist/esm/threshold/session/signingSessionSeal/service.js +8 -35
  374. package/dist/esm/threshold/session/signingSessionSeal/transport/express.js +18 -94
  375. package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js +6 -30
  376. package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js +23 -75
  377. package/dist/esm/threshold/statusCodes.js +1 -1
  378. package/dist/esm/wasm/evm_crypto/pkg/evm_crypto_bg.wasm +0 -0
  379. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.js +3 -3
  380. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker_bg.wasm +0 -0
  381. package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts +8 -26
  382. package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts +2 -9
  383. package/dist/types/shared-ts/src/authorization/operationFingerprint.d.ts +1 -3
  384. package/dist/types/shared-ts/src/authorization/walletAuthority.d.ts +25 -12
  385. package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts +8 -0
  386. package/dist/types/shared-ts/src/authorization/walletSignerActivationEquality.d.ts +4 -0
  387. package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts +3 -2
  388. package/dist/types/shared-ts/src/device-linking/authorityActivation.d.ts +5 -0
  389. package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts +4 -8
  390. package/dist/types/shared-ts/src/device-linking/contracts.d.ts +13 -74
  391. package/dist/types/shared-ts/src/device-linking/contracts.typecheck.d.ts +2 -1
  392. package/dist/types/shared-ts/src/device-linking/deviceManagement.d.ts +7 -0
  393. package/dist/types/shared-ts/src/device-linking/digests.d.ts +0 -5
  394. package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts +3 -2
  395. package/dist/types/shared-ts/src/device-linking/index.d.ts +2 -0
  396. package/dist/types/shared-ts/src/device-linking/parsers.d.ts +4 -41
  397. package/dist/types/shared-ts/src/device-linking/requestProof.d.ts +0 -1
  398. package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts +5 -2
  399. package/dist/types/shared-ts/src/device-linking/walletSessionCredentialDelivery.d.ts +2 -1
  400. package/dist/types/shared-ts/src/device-linking/wireFields.d.ts +26 -0
  401. package/dist/types/shared-ts/src/near/actions.d.ts +4 -4
  402. package/dist/types/shared-ts/src/near/delegate.d.ts +3 -2
  403. package/dist/types/shared-ts/src/near/nearClient.d.ts +145 -0
  404. package/dist/types/shared-ts/src/passkey-custody/ceremonyCommitPayload.d.ts +0 -22
  405. package/dist/types/shared-ts/src/passkey-custody/credentialActivity.d.ts +2 -4
  406. package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts +14 -30
  407. package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts +8 -24
  408. package/dist/types/shared-ts/src/passkey-custody/index.d.ts +0 -2
  409. package/dist/types/shared-ts/src/passkey-custody/primitives.d.ts +9 -14
  410. package/dist/types/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.d.ts +0 -15
  411. package/dist/types/shared-ts/src/signing-lanes/execution.d.ts +11 -50
  412. package/dist/types/shared-ts/src/signing-lanes/ids.d.ts +1 -10
  413. package/dist/types/shared-ts/src/signing-lanes/index.d.ts +1 -2
  414. package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts +1 -2
  415. package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts +5 -27
  416. package/dist/types/shared-ts/src/signing-lanes/participants.d.ts +0 -11
  417. package/dist/types/shared-ts/src/signing-lanes/recordParsers.d.ts +6 -53
  418. package/dist/types/shared-ts/src/signing-lanes/records.d.ts +1 -2
  419. package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts +18 -42
  420. package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts +1 -20
  421. package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts +4 -25
  422. package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts +1 -41
  423. package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts +6 -0
  424. package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts +20 -0
  425. package/dist/types/shared-ts/src/tenant-root/tenantRootIdentifier.d.ts +3 -0
  426. package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts +2 -1
  427. package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts +8 -35
  428. package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts +8 -35
  429. package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts +25 -0
  430. package/dist/types/shared-ts/src/threshold/participants.d.ts +3 -9
  431. package/dist/types/shared-ts/src/threshold/secp256k1.d.ts +0 -37
  432. package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts +24 -0
  433. package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts +3 -5
  434. package/dist/types/shared-ts/src/utils/addAuthMethodRegistration.d.ts +3 -4
  435. package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts +7 -108
  436. package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts +16 -3
  437. package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts +2 -0
  438. package/dist/types/shared-ts/src/utils/digestEncoding.d.ts +9 -0
  439. package/dist/types/shared-ts/src/utils/domainIds.d.ts +1 -2
  440. package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts +3 -13
  441. package/dist/types/shared-ts/src/utils/eip1559TxWasmJson.d.ts +16 -0
  442. package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts +7 -5
  443. package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts +0 -2
  444. package/dist/types/shared-ts/src/utils/errors.d.ts +0 -7
  445. package/dist/types/shared-ts/src/utils/exactKeys.d.ts +11 -0
  446. package/dist/types/shared-ts/src/utils/exactRecord.d.ts +12 -0
  447. package/dist/types/shared-ts/src/utils/failure.d.ts +12 -0
  448. package/dist/types/shared-ts/src/utils/index.d.ts +5 -2
  449. package/dist/types/shared-ts/src/utils/jsonRpc.d.ts +6 -6
  450. package/dist/types/shared-ts/src/utils/near.d.ts +2 -1
  451. package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts +8 -7
  452. package/dist/types/shared-ts/src/utils/normalize.d.ts +0 -4
  453. package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts +179 -0
  454. package/dist/types/shared-ts/src/utils/registrationContracts.d.ts +76 -0
  455. package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts +1 -2
  456. package/dist/types/shared-ts/src/utils/registrationIds.d.ts +56 -0
  457. package/dist/types/shared-ts/src/utils/registrationIntent.d.ts +9 -514
  458. package/dist/types/shared-ts/src/utils/registrationSignerPlan.d.ts +130 -0
  459. package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts +24 -93
  460. package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts +15 -99
  461. package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts +38 -0
  462. package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts +30 -8
  463. package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts +10 -15
  464. package/dist/types/shared-ts/src/utils/routerAbTraceContext.d.ts +2 -1
  465. package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts +2 -0
  466. package/dist/types/shared-ts/src/utils/secureRandomId.d.ts +0 -2
  467. package/dist/types/shared-ts/src/utils/signerDomain.d.ts +3 -35
  468. package/dist/types/shared-ts/src/utils/signerSlot.d.ts +0 -4
  469. package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts +10 -17
  470. package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts +25 -0
  471. package/dist/types/shared-ts/src/utils/validation.d.ts +10 -10
  472. package/dist/types/shared-ts/src/utils/variant.d.ts +29 -0
  473. package/dist/types/shared-ts/src/utils/variant.typecheck.d.ts +22 -0
  474. package/dist/types/shared-ts/src/utils/walletAddSignerActivation.d.ts +2 -2
  475. package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts +1 -58
  476. package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts +101 -0
  477. package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts +3 -7
  478. package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts +5 -4
  479. package/dist/types/shared-ts/src/utils/wireSchema.d.ts +60 -0
  480. package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts +2 -1
  481. package/dist/types/shared-ts/src/wallet-recovery/index.d.ts +0 -1
  482. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeLocator.d.ts +0 -16
  483. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts +2 -11
  484. package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts +3 -16
  485. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.d.ts +6 -18
  486. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.d.ts +0 -2
  487. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.d.ts +1 -3
  488. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts +15 -0
  489. package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts +3 -4
  490. package/dist/types/wallet-server/src/authorization/capabilityPolicy.d.ts +0 -1
  491. package/dist/types/wallet-server/src/authorization/domain.d.ts +36 -5
  492. package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts +61 -0
  493. package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.typecheck.d.ts +2 -0
  494. package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts +6 -7
  495. package/dist/types/wallet-server/src/authorization/service.d.ts +71 -3
  496. package/dist/types/wallet-server/src/cloud-host.d.ts +6 -2
  497. package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts +10 -1
  498. package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts +16 -116
  499. package/dist/types/wallet-server/src/core/IdentityStore.d.ts +2 -7
  500. package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts +6 -16
  501. package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts +29 -90
  502. package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts +0 -12
  503. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts +10 -3
  504. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.d.ts +17 -48
  505. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/internalServiceHttp.d.ts +2 -1
  506. package/dist/types/wallet-server/src/core/ThresholdService/stores/CloudflareDurableObjectStore.d.ts +4 -71
  507. package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts +2 -1
  508. package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts +2 -6
  509. package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts +2 -1
  510. package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts +2 -4
  511. package/dist/types/wallet-server/src/core/ThresholdService/stores/exportReplayGuard.d.ts +3 -0
  512. package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts +11 -137
  513. package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts +2 -7
  514. package/dist/types/wallet-server/src/core/WalletStore.d.ts +3 -8
  515. package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts +15 -22
  516. package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts +14 -36
  517. package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts +9 -34
  518. package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts +9 -34
  519. package/dist/types/wallet-server/src/core/authService/AuthService.d.ts +0 -3
  520. package/dist/types/wallet-server/src/core/authService/bytes.d.ts +0 -1
  521. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts +6 -5
  522. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts +9 -17
  523. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts +3 -2
  524. package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts +8 -32
  525. package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts +3 -10
  526. package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts +4 -3
  527. package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts +4 -3
  528. package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts +3 -70
  529. package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts +2 -1
  530. package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts +6 -12
  531. package/dist/types/wallet-server/src/core/authService/googleEmailOtpRegistration.d.ts +5 -8
  532. package/dist/types/wallet-server/src/core/authService/nearPrivateKeySigning.d.ts +3 -2
  533. package/dist/types/wallet-server/src/core/authService/nearPublicKeyMetadata.d.ts +2 -1
  534. package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts +2 -1
  535. package/dist/types/wallet-server/src/core/authService/oidcVerification.d.ts +4 -3
  536. package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts +0 -3
  537. package/dist/types/wallet-server/src/core/authService/registrationThresholdHelpers.d.ts +0 -26
  538. package/dist/types/wallet-server/src/core/authService/storeRegistry.d.ts +0 -5
  539. package/dist/types/wallet-server/src/core/authService/thresholdEcdsaKeyInventory.d.ts +0 -23
  540. package/dist/types/wallet-server/src/core/authService/webauthn.d.ts +8 -16
  541. package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts +7 -7
  542. package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts +43 -0
  543. package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts +1 -28
  544. package/dist/types/wallet-server/src/core/d1EcdsaSignerRead.d.ts +39 -0
  545. package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts +6 -16
  546. package/dist/types/wallet-server/src/core/d1TenantStore.d.ts +51 -0
  547. package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts +11 -29
  548. package/dist/types/wallet-server/src/core/d1WalletStore.d.ts +16 -1
  549. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEd25519ExportRoot.d.ts +2 -1
  550. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEmailOtpGrant.d.ts +2 -1
  551. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceManagement.d.ts +44 -26
  552. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts +19 -217
  553. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionApproval.d.ts +8 -0
  554. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts +258 -0
  555. package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts +2 -2
  556. package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts +19 -0
  557. package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts +54 -0
  558. package/dist/types/wallet-server/src/core/hostedAccountIds.d.ts +0 -15
  559. package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts +4 -24
  560. package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts +2 -3
  561. package/dist/types/wallet-server/src/core/nearSignerWasmRuntime.d.ts +0 -1
  562. package/dist/types/wallet-server/src/core/registrationContracts.d.ts +37 -108
  563. package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts +8 -9
  564. package/dist/types/wallet-server/src/core/rpcClients/near/NearClient.d.ts +10 -107
  565. package/dist/types/wallet-server/src/core/signingLanes/LaneAggregateRevocationApplicationService.d.ts +4 -3
  566. package/dist/types/wallet-server/src/core/signingLanes/LaneEffectJournalStore.d.ts +2 -3
  567. package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleStore.d.ts +2 -3
  568. package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts +5 -20
  569. package/dist/types/wallet-server/src/core/signingLanes/ecdsaServerRetirement.d.ts +4 -4
  570. package/dist/types/wallet-server/src/core/signingLanes/ed25519ServerRetirement.d.ts +3 -3
  571. package/dist/types/wallet-server/src/core/signingLanes/signingWorkerLaneMaterialIdentity.d.ts +2 -19
  572. package/dist/types/wallet-server/src/core/storeBackends.d.ts +83 -0
  573. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts +13 -59
  574. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts +51 -3
  575. package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts +3 -12
  576. package/dist/types/wallet-server/src/core/types.d.ts +5 -30
  577. package/dist/types/wallet-server/src/core/webAuthnD1Statements.d.ts +29 -0
  578. package/dist/types/wallet-server/src/core/webAuthnStoreBackends.d.ts +96 -0
  579. package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts +11 -7
  580. package/dist/types/wallet-server/src/index.d.ts +1 -1
  581. package/dist/types/wallet-server/src/local-hosted-wallet-gateway-worker.d.ts +1 -4
  582. package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts +12 -0
  583. package/dist/types/wallet-server/src/localIntendedEcdsaFinalizeFault.d.ts +33 -0
  584. package/dist/types/wallet-server/src/localIntendedLinkExecuteFault.d.ts +47 -0
  585. package/dist/types/wallet-server/src/localIntendedMaterialAdmissionFault.d.ts +38 -0
  586. package/dist/types/wallet-server/src/localIntendedPresignCancellation.d.ts +4 -0
  587. package/dist/types/wallet-server/src/localIntendedRevokeFault.d.ts +40 -0
  588. package/dist/types/wallet-server/src/localIntendedSessionAdmissionFault.d.ts +41 -0
  589. package/dist/types/wallet-server/src/localIntendedYaoExportFault.d.ts +41 -0
  590. package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts +7 -1
  591. package/dist/types/wallet-server/src/localIntendedYaoFinalizeFault.d.ts +37 -0
  592. package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts +45 -0
  593. package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts +51 -0
  594. package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts +13 -29
  595. package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts +20 -11
  596. package/dist/types/wallet-server/src/router/auth/walletSessionFailure.d.ts +1 -4
  597. package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts +3 -2
  598. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts +12 -0
  599. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts +3 -3
  600. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts +2 -2
  601. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts +1 -1
  602. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts +9 -0
  603. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts +34 -0
  604. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts +54 -21
  605. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.d.ts +3 -0
  606. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/walletSessionAuthorityProjection.d.ts +2 -1
  607. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts +74 -6
  608. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts +2 -3
  609. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.d.ts +8 -21
  610. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.d.ts +14 -1
  611. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.d.ts +49 -0
  612. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.d.ts +1 -1
  613. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts +6 -8
  614. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.d.ts +1 -1
  615. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts +7 -10
  616. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts +8 -4
  617. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.d.ts +3 -5
  618. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.d.ts +7 -0
  619. package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.d.ts +1 -2
  620. package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts +33 -0
  621. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts +1 -1
  622. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts +13 -3
  623. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts +24 -5
  624. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts +4 -11
  625. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts +1 -3
  626. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts +4 -12
  627. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts +13 -12
  628. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.d.ts +0 -2
  629. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.d.ts +5 -4
  630. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts +4 -14
  631. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts +1 -3
  632. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts +3 -21
  633. package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityRecords.d.ts +0 -23
  634. package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts +1 -2
  635. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.d.ts +11 -19
  636. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts +5 -54
  637. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts +7 -19
  638. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.d.ts +4 -3
  639. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.d.ts +8 -12
  640. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts +7 -14
  641. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts +10 -22
  642. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts +6 -2
  643. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts +10 -6
  644. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts +21 -26
  645. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts +5 -3
  646. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts +4 -3
  647. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts +5 -5
  648. package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts +17 -6
  649. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts +0 -1
  650. package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts +0 -16
  651. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts +29 -14
  652. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.d.ts +15 -12
  653. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.d.ts +71 -0
  654. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts +34 -24
  655. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts +44 -26
  656. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts +13 -46
  657. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts +8 -19
  658. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts +8 -34
  659. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleTenantRootLineage.d.ts +2 -1
  660. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts +1 -0
  661. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts +15 -2
  662. package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts +2 -2
  663. package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts +9 -7
  664. package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts +6 -18
  665. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.d.ts +46 -0
  666. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts +5 -3
  667. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts +20 -79
  668. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts +2 -0
  669. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.d.ts +1 -1
  670. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.d.ts +4 -3
  671. package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts +62 -42
  672. package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts +108 -32
  673. package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryActivation.typecheck.d.ts +5 -0
  674. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.d.ts +36 -5
  675. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.d.ts +5 -4
  676. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.d.ts +41 -50
  677. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.d.ts +2 -2
  678. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts +3 -3
  679. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.d.ts +6 -5
  680. package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.d.ts +14 -4
  681. package/dist/types/wallet-server/src/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.d.ts +12 -1
  682. package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts +11 -52
  683. package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.d.ts +3 -4
  684. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpExportPolicy.d.ts +2 -27
  685. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRequestValidation.d.ts +1 -2
  686. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRouteHandlers.d.ts +2 -1
  687. package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpSessionRouteHelpers.d.ts +2 -102
  688. package/dist/types/wallet-server/src/router/domains/passkeyCustody/envelopeRevocationAdmission.d.ts +2 -1
  689. package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts +3 -2
  690. package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.d.ts +1 -9
  691. package/dist/types/wallet-server/src/router/domains/passkeyCustody/registrationCustodyOutcome.d.ts +2 -1
  692. package/dist/types/wallet-server/src/router/domains/passkeyCustody/verifiedCustodyFactor.d.ts +2 -1
  693. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.d.ts +2 -1
  694. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts +2 -28
  695. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryFinalization.d.ts +43 -1
  696. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts +7 -19
  697. package/dist/types/wallet-server/src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.d.ts +0 -3
  698. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts +164 -0
  699. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.d.ts +110 -0
  700. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts +373 -0
  701. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.d.ts +11 -10
  702. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.typecheck.d.ts +2 -0
  703. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts +164 -0
  704. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts +22 -717
  705. package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts +5 -12
  706. package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts +6 -10
  707. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootCustodyLineage.d.ts +6 -1
  708. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootIdentityResolution.d.ts +4 -7
  709. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts +2 -1
  710. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts +8 -8
  711. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts +4 -4
  712. package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.d.ts +4 -4
  713. package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRouteHandlers.d.ts +4 -62
  714. package/dist/types/wallet-server/src/router/express-adaptor.d.ts +2 -2
  715. package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts +3 -1
  716. package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts +89 -65
  717. package/dist/types/wallet-server/src/router/framework/http.d.ts +1 -1
  718. package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts +1 -9
  719. package/dist/types/wallet-server/src/router/framework/routeMeteringPolicy.d.ts +3 -2
  720. package/dist/types/wallet-server/src/router/framework/routerApi.d.ts +1 -1
  721. package/dist/types/wallet-server/src/router/framework/routerApiRouteSurface.d.ts +3 -3
  722. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGateway.d.ts +34 -0
  723. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayCheck.d.ts +21 -0
  724. package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayMain.d.ts +2 -0
  725. package/dist/types/wallet-server/src/router/node/nodeHttp.d.ts +13 -0
  726. package/dist/types/wallet-server/src/router/node/nodeSqlite.d.ts +22 -0
  727. package/dist/types/wallet-server/src/router/node/signerSqlMigrations.d.ts +20 -0
  728. package/dist/types/wallet-server/src/router/transport/fetch/createFetchRouter.d.ts +1 -3
  729. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts +5 -6
  730. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts +5 -8
  731. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceManagement.d.ts +14 -16
  732. package/dist/types/wallet-server/src/router/transport/fetch/routes/normalSigningRouterProxy.d.ts +0 -12
  733. package/dist/types/wallet-server/src/router/transport/fetch/routes/passkeyCustody.d.ts +1 -1
  734. package/dist/types/wallet-server/src/router/transport/fetch/routes/sessions.d.ts +2 -1
  735. package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts +9 -17
  736. package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts +3 -58
  737. package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEd25519.d.ts +0 -44
  738. package/dist/types/wallet-server/src/storage/d1Sql.d.ts +7 -0
  739. package/dist/types/wallet-server/src/storage/syncSqlite.d.ts +28 -0
  740. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts +0 -1
  741. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts +5 -7
  742. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/signingSessionSeal.types.d.ts +6 -8
  743. package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/transport/shared.d.ts +1 -0
  744. package/dist/types/wallet-server/src/threshold/statusCodes.d.ts +4 -4
  745. package/migrations/d1-signer/0036_r150_yao_lifecycle_decisions.sql +22 -0
  746. package/migrations/d1-signer/0037_r150_wallet_auth_method_revocation_replays.sql +26 -0
  747. package/migrations/d1-signer/0038_r150_registration_ceremony_cas_guard_seed.sql +8 -0
  748. package/migrations/d1-signer/0039_r150_revocation_replay_answer_kind.sql +9 -0
  749. package/package.json +1 -1
  750. package/dist/esm/core/ThresholdService/ecdsaClientRootProof.js +0 -27
  751. package/dist/esm/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.js +0 -115
  752. package/dist/esm/core/ThresholdService/secureRandomId.js +0 -9
  753. package/dist/esm/core/authService/record.js +0 -8
  754. package/dist/esm/core/authService/thresholdRuntimePolicy.js +0 -19
  755. package/dist/esm/core/authService/walletRegistrationPlanning.js +0 -49
  756. package/dist/esm/core/deviceLinking/index.js +0 -5
  757. package/dist/esm/core/errors.js +0 -54
  758. package/dist/esm/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.js +0 -39
  759. package/dist/esm/core/signingLanes/WalletKeyStore.js +0 -0
  760. package/dist/esm/core/signingLanes/index.js +0 -8
  761. package/dist/esm/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.js +0 -55
  762. package/dist/esm/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.js +0 -56
  763. package/dist/esm/shared-ts/src/signing-lanes/linkedEcdsaScope.js +0 -1
  764. package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker.js +0 -414
  765. package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm +0 -0
  766. package/dist/types/shared-ts/src/passkey-custody/credentialObservations.d.ts +0 -74
  767. package/dist/types/shared-ts/src/passkey-custody/kekContext.d.ts +0 -34
  768. package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.d.ts +0 -62
  769. package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.typecheck.d.ts +0 -2
  770. package/dist/types/shared-ts/src/signing-lanes/validation.d.ts +0 -11
  771. package/dist/types/shared-ts/src/utils/bigint.d.ts +0 -3
  772. package/dist/types/shared-ts/src/utils/paillier.d.ts +0 -37
  773. package/dist/types/shared-ts/src/utils/recoveryDomain.d.ts +0 -12
  774. package/dist/types/shared-ts/src/utils/signerDomain.typecheck.d.ts +0 -2
  775. package/dist/types/shared-ts/src/wallet-recovery/recoveryKekContext.d.ts +0 -37
  776. package/dist/types/wallet-server/src/core/ThresholdService/ecdsaClientRootProof.d.ts +0 -12
  777. package/dist/types/wallet-server/src/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.d.ts +0 -17
  778. package/dist/types/wallet-server/src/core/ThresholdService/secureRandomId.d.ts +0 -2
  779. package/dist/types/wallet-server/src/core/authService/record.d.ts +0 -2
  780. package/dist/types/wallet-server/src/core/authService/thresholdRuntimePolicy.d.ts +0 -4
  781. package/dist/types/wallet-server/src/core/authService/walletRegistrationPlanning.d.ts +0 -19
  782. package/dist/types/wallet-server/src/core/deviceLinking/index.d.ts +0 -5
  783. package/dist/types/wallet-server/src/core/errors.d.ts +0 -10
  784. package/dist/types/wallet-server/src/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.d.ts +0 -28
  785. package/dist/types/wallet-server/src/core/signingLanes/SigningLaneStore.d.ts +0 -15
  786. package/dist/types/wallet-server/src/core/signingLanes/WalletKeyStore.d.ts +0 -13
  787. package/dist/types/wallet-server/src/core/signingLanes/index.d.ts +0 -11
  788. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.d.ts +0 -35
  789. package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.d.ts +0 -35
  790. /package/dist/esm/{core/signingLanes/SigningLaneStore.js → authorization/ecdsaWalletSessionAdmission.js} +0 -0
@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId } from "../../shared-ts/src/utils/domainIds.js
2
2
  import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
3
3
  import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
4
4
  import { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 } from "../../shared-ts/src/device-linking/requestProof.js";
5
+ import { hasExactKeys } from "../../shared-ts/src/utils/exactKeys.js";
5
6
  //#region src/core/deviceLinking/requestProof.ts
6
7
  var LinkedDeviceRequestProofVerifierV1 = class {
7
8
  constructor(input) {
@@ -62,7 +63,18 @@ var LinkedDeviceRequestProofVerifierV1 = class {
62
63
  };
63
64
  function parseLinkedDeviceRequestProofV1(raw) {
64
65
  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
65
- if (!isLinkedDeviceRequestProofRecordV1(raw)) throw new Error("record contains invalid fields");
66
+ if (!hasExactKeys(raw, [
67
+ "kind",
68
+ "linkSessionId",
69
+ "devicePublicKeyDigestB64u",
70
+ "requestNonceB64u",
71
+ "method",
72
+ "canonicalPath",
73
+ "bodyDigestB64u",
74
+ "issuedAtMs",
75
+ "expiresAtMs",
76
+ "signatureB64u"
77
+ ])) throw new Error("record contains invalid fields");
66
78
  const record = raw;
67
79
  if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
68
80
  const linkSessionId = parseSessionId(record.linkSessionId);
@@ -152,9 +164,6 @@ function parseFixedB64u(raw, expectedBytes, field) {
152
164
  function toArrayBuffer(bytes) {
153
165
  return bytes.slice().buffer;
154
166
  }
155
- function isLinkedDeviceRequestProofRecordV1(value) {
156
- return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
157
- }
158
167
  function errorMessage(error) {
159
168
  return error instanceof Error ? error.message : String(error || "invalid device request proof");
160
169
  }
@@ -0,0 +1,85 @@
1
+ //#region src/core/ecdsaMaterialReadSnapshot.ts
2
+ const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS = [
3
+ "link_session_id",
4
+ "authority_id",
5
+ "wallet_id",
6
+ "auth_method_id",
7
+ "device_id",
8
+ "package_set_digest_b64u",
9
+ "target_factor_verification_digest_b64u",
10
+ "target_factor_verified_at_ms",
11
+ "source_manifest_digest_b64u",
12
+ "delivery_recipient_public_key_b64u",
13
+ "packages_json",
14
+ "server_reservation_ids_json",
15
+ "installed_record_set_digest_b64u",
16
+ "activated_at_ms"
17
+ ];
18
+ /** Request-local evidence of the exact records a material resolver examined. */
19
+ var EcdsaMaterialReadSnapshot = class EcdsaMaterialReadSnapshot {
20
+ #scope;
21
+ #conditions;
22
+ constructor(walletId, scope, conditions) {
23
+ this.walletId = walletId;
24
+ this.#scope = scope;
25
+ this.#conditions = conditions;
26
+ }
27
+ static canonical(scope, walletId, activationId, rows) {
28
+ return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("wallet_signers", scope, walletId, ["record_json"], rows, "signer_family = 'ecdsa' AND json_extract(record_json, '$.walletKey.publicCapability.material_activation.activation_id') = ?", [activationId])]);
29
+ }
30
+ static linked(scope, walletId, installations, signers) {
31
+ return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("linked_device_authority_installations", scope, walletId, ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, installations, "1", []), recordSetCondition("wallet_signers", scope, walletId, ["record_json"], signers, "signer_family = 'ecdsa'", [])]);
32
+ }
33
+ condition(scope) {
34
+ if (scope.namespace !== this.#scope.namespace || scope.orgId !== this.#scope.orgId || scope.projectId !== this.#scope.projectId || scope.envId !== this.#scope.envId) return {
35
+ sql: "0",
36
+ bindings: []
37
+ };
38
+ const clauses = [];
39
+ const bindings = [];
40
+ for (const condition of this.#conditions) {
41
+ clauses.push(`(${condition.sql})`);
42
+ bindings.push(...condition.bindings);
43
+ }
44
+ return {
45
+ sql: clauses.join(" AND "),
46
+ bindings
47
+ };
48
+ }
49
+ };
50
+ function recordSetCondition(table, scope, walletId, columns, rows, filter, filterBindings) {
51
+ const values = [];
52
+ for (const row of rows) {
53
+ const tuple = [];
54
+ for (const column of columns) {
55
+ const value = row[column];
56
+ if (value !== null && typeof value !== "string" && typeof value !== "number") throw new Error(`Invalid stored material column: ${column}`);
57
+ tuple.push(value);
58
+ }
59
+ values.push(tuple);
60
+ }
61
+ const predicate = `namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ? AND ${filter}`;
62
+ const identity = [
63
+ scope.namespace,
64
+ scope.orgId,
65
+ scope.projectId,
66
+ scope.envId,
67
+ walletId,
68
+ ...filterBindings
69
+ ];
70
+ return {
71
+ sql: `(SELECT COUNT(*) FROM ${table} WHERE ${predicate}) = ?
72
+ AND NOT EXISTS (SELECT 1 FROM ${table} WHERE ${predicate}
73
+ AND json_array(${columns.join(", ")}) NOT IN (SELECT value FROM json_each(?)))`,
74
+ bindings: [
75
+ ...identity,
76
+ rows.length,
77
+ ...identity,
78
+ JSON.stringify(values)
79
+ ]
80
+ };
81
+ }
82
+ //#endregion
83
+ export { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, EcdsaMaterialReadSnapshot };
84
+
85
+ //# sourceMappingURL=ecdsaMaterialReadSnapshot.js.map
@@ -0,0 +1,383 @@
1
+ import { EMAIL_OTP_CHANNEL } from "../shared-ts/src/utils/emailOtpDomain.js";
2
+ import { runtimePolicyScopeKey } from "./EmailOtpRecords.js";
3
+ //#region src/core/emailOtpD1Statements.ts
4
+ const INSERT_CHALLENGE_SQL = `INSERT INTO email_otp_challenges (
5
+ namespace,
6
+ org_id,
7
+ project_id,
8
+ env_id,
9
+ challenge_id,
10
+ challenge_subject_id,
11
+ wallet_id,
12
+ record_org_id,
13
+ otp_channel,
14
+ owner_proof_binding_digest,
15
+ action,
16
+ operation,
17
+ otp_code,
18
+ record_json,
19
+ created_at_ms,
20
+ expires_at_ms
21
+ )
22
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
23
+ function challengeValues(record) {
24
+ return [
25
+ record.challengeId,
26
+ record.challengeSubjectId,
27
+ record.walletId,
28
+ record.orgId || "",
29
+ EMAIL_OTP_CHANNEL,
30
+ record.ownerProofBindingDigest,
31
+ record.action,
32
+ record.operation,
33
+ record.otpCode,
34
+ JSON.stringify(record),
35
+ record.createdAtMs,
36
+ record.expiresAtMs
37
+ ];
38
+ }
39
+ /** Statements on `email_otp_challenges`. */
40
+ const emailOtpChallengeRows = {
41
+ insert: (prepare, record) => prepare(INSERT_CHALLENGE_SQL, challengeValues(record)),
42
+ upsert: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL}
43
+ ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
44
+ DO UPDATE SET
45
+ challenge_subject_id = EXCLUDED.challenge_subject_id,
46
+ wallet_id = EXCLUDED.wallet_id,
47
+ record_org_id = EXCLUDED.record_org_id,
48
+ otp_channel = EXCLUDED.otp_channel,
49
+ owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
50
+ action = EXCLUDED.action,
51
+ operation = EXCLUDED.operation,
52
+ otp_code = EXCLUDED.otp_code,
53
+ record_json = EXCLUDED.record_json,
54
+ created_at_ms = EXCLUDED.created_at_ms,
55
+ expires_at_ms = EXCLUDED.expires_at_ms`, challengeValues(record)),
56
+ delete: (prepare, challengeId) => prepare(`DELETE FROM email_otp_challenges
57
+ WHERE namespace = ?
58
+ AND org_id = ?
59
+ AND project_id = ?
60
+ AND env_id = ?
61
+ AND challenge_id = ?`, [challengeId])
62
+ };
63
+ const INSERT_GRANT_SQL = `INSERT INTO email_otp_grants (
64
+ namespace,
65
+ org_id,
66
+ project_id,
67
+ env_id,
68
+ grant_token,
69
+ user_id,
70
+ wallet_id,
71
+ record_org_id,
72
+ challenge_id,
73
+ action,
74
+ record_json,
75
+ issued_at_ms,
76
+ expires_at_ms
77
+ )
78
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
79
+ function grantValues(record) {
80
+ return [
81
+ record.grantToken,
82
+ record.userId,
83
+ record.walletId,
84
+ record.orgId || "",
85
+ record.challengeId,
86
+ record.action,
87
+ JSON.stringify(record),
88
+ record.issuedAtMs,
89
+ record.expiresAtMs
90
+ ];
91
+ }
92
+ /** Statements on `email_otp_grants`. */
93
+ const emailOtpGrantRows = {
94
+ insert: (prepare, record) => prepare(INSERT_GRANT_SQL, grantValues(record)),
95
+ upsert: (prepare, record) => prepare(`${INSERT_GRANT_SQL}
96
+ ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
97
+ DO UPDATE SET
98
+ user_id = EXCLUDED.user_id,
99
+ wallet_id = EXCLUDED.wallet_id,
100
+ record_org_id = EXCLUDED.record_org_id,
101
+ challenge_id = EXCLUDED.challenge_id,
102
+ action = EXCLUDED.action,
103
+ record_json = EXCLUDED.record_json,
104
+ issued_at_ms = EXCLUDED.issued_at_ms,
105
+ expires_at_ms = EXCLUDED.expires_at_ms`, grantValues(record)),
106
+ select: (prepare, grantToken) => prepare(`SELECT record_json, expires_at_ms
107
+ FROM email_otp_grants
108
+ WHERE namespace = ?
109
+ AND org_id = ?
110
+ AND project_id = ?
111
+ AND env_id = ?
112
+ AND grant_token = ?
113
+ LIMIT 1`, [grantToken]),
114
+ consume: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
115
+ WHERE namespace = ?
116
+ AND org_id = ?
117
+ AND project_id = ?
118
+ AND env_id = ?
119
+ AND grant_token = ?
120
+ RETURNING record_json, expires_at_ms`, [grantToken]),
121
+ delete: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
122
+ WHERE namespace = ?
123
+ AND org_id = ?
124
+ AND project_id = ?
125
+ AND env_id = ?
126
+ AND grant_token = ?`, [grantToken])
127
+ };
128
+ const INSERT_WALLET_ENROLLMENT_SQL = `INSERT INTO email_otp_wallet_enrollments (
129
+ namespace,
130
+ org_id,
131
+ project_id,
132
+ env_id,
133
+ wallet_id,
134
+ provider_user_id,
135
+ record_org_id,
136
+ verified_email,
137
+ record_json,
138
+ created_at_ms,
139
+ updated_at_ms
140
+ )
141
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
142
+ function walletEnrollmentValues(record) {
143
+ return [
144
+ record.walletId,
145
+ record.providerUserId,
146
+ record.orgId,
147
+ record.verifiedEmail,
148
+ JSON.stringify(record),
149
+ record.createdAtMs,
150
+ record.updatedAtMs
151
+ ];
152
+ }
153
+ /** Statements on `email_otp_wallet_enrollments`. */
154
+ const emailOtpWalletEnrollmentRows = {
155
+ insert: (prepare, record) => prepare(INSERT_WALLET_ENROLLMENT_SQL, walletEnrollmentValues(record)),
156
+ upsert: (prepare, record) => prepare(`${INSERT_WALLET_ENROLLMENT_SQL}
157
+ ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
158
+ DO UPDATE SET
159
+ provider_user_id = EXCLUDED.provider_user_id,
160
+ record_org_id = EXCLUDED.record_org_id,
161
+ verified_email = EXCLUDED.verified_email,
162
+ record_json = EXCLUDED.record_json,
163
+ created_at_ms = EXCLUDED.created_at_ms,
164
+ updated_at_ms = EXCLUDED.updated_at_ms`, walletEnrollmentValues(record)),
165
+ delete: (prepare, walletId) => prepare(`DELETE FROM email_otp_wallet_enrollments
166
+ WHERE namespace = ?
167
+ AND org_id = ?
168
+ AND project_id = ?
169
+ AND env_id = ?
170
+ AND wallet_id = ?`, [walletId])
171
+ };
172
+ /** Statements on `email_otp_auth_states`. */
173
+ const emailOtpAuthStateRows = {
174
+ select: (prepare, walletId) => prepare(`SELECT record_json, updated_at_ms
175
+ FROM email_otp_auth_states
176
+ WHERE namespace = ?
177
+ AND org_id = ?
178
+ AND project_id = ?
179
+ AND env_id = ?
180
+ AND wallet_id = ?
181
+ LIMIT 1`, [walletId]),
182
+ upsert: (prepare, record) => prepare(`INSERT INTO email_otp_auth_states (
183
+ namespace,
184
+ org_id,
185
+ project_id,
186
+ env_id,
187
+ wallet_id,
188
+ provider_user_id,
189
+ record_org_id,
190
+ record_json,
191
+ created_at_ms,
192
+ updated_at_ms
193
+ )
194
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
195
+ ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
196
+ DO UPDATE SET
197
+ provider_user_id = EXCLUDED.provider_user_id,
198
+ record_org_id = EXCLUDED.record_org_id,
199
+ record_json = EXCLUDED.record_json,
200
+ created_at_ms = EXCLUDED.created_at_ms,
201
+ updated_at_ms = EXCLUDED.updated_at_ms`, [
202
+ record.walletId,
203
+ record.providerUserId,
204
+ record.orgId,
205
+ JSON.stringify(record),
206
+ record.createdAtMs,
207
+ record.updatedAtMs
208
+ ])
209
+ };
210
+ const INSERT_UNLOCK_CHALLENGE_SQL = `INSERT INTO email_otp_unlock_challenges (
211
+ namespace,
212
+ org_id,
213
+ project_id,
214
+ env_id,
215
+ challenge_id,
216
+ wallet_id,
217
+ user_id,
218
+ record_org_id,
219
+ record_json,
220
+ created_at_ms,
221
+ expires_at_ms
222
+ )
223
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
224
+ function unlockChallengeValues(record) {
225
+ return [
226
+ record.challengeId,
227
+ record.walletId,
228
+ record.userId,
229
+ record.orgId || "",
230
+ JSON.stringify(record),
231
+ record.createdAtMs,
232
+ record.expiresAtMs
233
+ ];
234
+ }
235
+ /** Statements on `email_otp_unlock_challenges`. */
236
+ const emailOtpUnlockChallengeRows = {
237
+ insert: (prepare, record) => prepare(INSERT_UNLOCK_CHALLENGE_SQL, unlockChallengeValues(record)),
238
+ upsert: (prepare, record) => prepare(`${INSERT_UNLOCK_CHALLENGE_SQL}
239
+ ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
240
+ DO UPDATE SET
241
+ wallet_id = EXCLUDED.wallet_id,
242
+ user_id = EXCLUDED.user_id,
243
+ record_org_id = EXCLUDED.record_org_id,
244
+ record_json = EXCLUDED.record_json,
245
+ created_at_ms = EXCLUDED.created_at_ms,
246
+ expires_at_ms = EXCLUDED.expires_at_ms`, unlockChallengeValues(record)),
247
+ consume: (prepare, challengeId) => prepare(`DELETE FROM email_otp_unlock_challenges
248
+ WHERE namespace = ?
249
+ AND org_id = ?
250
+ AND project_id = ?
251
+ AND env_id = ?
252
+ AND challenge_id = ?
253
+ RETURNING record_json, expires_at_ms`, [challengeId])
254
+ };
255
+ function offerWalletIdsJson(candidates) {
256
+ const walletIds = [];
257
+ for (const candidate of candidates) walletIds.push(candidate.walletId);
258
+ return JSON.stringify(walletIds);
259
+ }
260
+ const PENDING_ATTEMPTS_SQL = `SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
261
+ FROM email_otp_registration_attempts
262
+ WHERE namespace = ?
263
+ AND org_id = ?
264
+ AND project_id = ?
265
+ AND env_id = ?
266
+ AND provider_subject = ?
267
+ AND email = ?
268
+ AND state IN ('started', 'key_finalized')
269
+ AND expires_at_ms > ?`;
270
+ /** Statements on `email_otp_registration_attempts`. */
271
+ const emailOtpRegistrationAttemptRows = {
272
+ upsert: (prepare, record) => prepare(`INSERT INTO email_otp_registration_attempts (
273
+ namespace,
274
+ org_id,
275
+ project_id,
276
+ env_id,
277
+ attempt_id,
278
+ provider_subject,
279
+ email,
280
+ wallet_id,
281
+ state,
282
+ owner_proof_binding_digest,
283
+ runtime_org_id,
284
+ runtime_policy_key,
285
+ offer_wallet_ids_json,
286
+ record_json,
287
+ created_at_ms,
288
+ updated_at_ms,
289
+ expires_at_ms
290
+ )
291
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
292
+ ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
293
+ DO UPDATE SET
294
+ provider_subject = EXCLUDED.provider_subject,
295
+ email = EXCLUDED.email,
296
+ wallet_id = EXCLUDED.wallet_id,
297
+ state = EXCLUDED.state,
298
+ owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
299
+ runtime_org_id = EXCLUDED.runtime_org_id,
300
+ runtime_policy_key = EXCLUDED.runtime_policy_key,
301
+ offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
302
+ record_json = EXCLUDED.record_json,
303
+ created_at_ms = EXCLUDED.created_at_ms,
304
+ updated_at_ms = EXCLUDED.updated_at_ms,
305
+ expires_at_ms = EXCLUDED.expires_at_ms`, [
306
+ record.attemptId,
307
+ record.providerSubject,
308
+ record.email,
309
+ record.walletId,
310
+ record.state,
311
+ record.ownerProofBindingDigest,
312
+ record.runtimePolicyScope?.orgId || "",
313
+ runtimePolicyScopeKey(record.runtimePolicyScope),
314
+ offerWalletIdsJson(record.offerCandidates),
315
+ JSON.stringify(record),
316
+ record.createdAtMs,
317
+ record.updatedAtMs,
318
+ record.expiresAtMs
319
+ ]),
320
+ select: (prepare, attemptId) => prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
321
+ FROM email_otp_registration_attempts
322
+ WHERE namespace = ?
323
+ AND org_id = ?
324
+ AND project_id = ?
325
+ AND env_id = ?
326
+ AND attempt_id = ?
327
+ LIMIT 1`, [attemptId]),
328
+ selectStarted: (prepare, input) => prepare(`${PENDING_ATTEMPTS_SQL}
329
+ AND owner_proof_binding_digest = ?
330
+ AND runtime_org_id = ?
331
+ AND runtime_policy_key = ?
332
+ ORDER BY updated_at_ms DESC
333
+ LIMIT 1`, [
334
+ input.providerSubject,
335
+ input.email,
336
+ input.nowMs,
337
+ input.ownerProofBindingDigest,
338
+ input.orgId,
339
+ runtimePolicyScopeKey(input.runtimePolicyScope)
340
+ ]),
341
+ selectPending: (prepare, input) => prepare(PENDING_ATTEMPTS_SQL, [
342
+ input.providerSubject,
343
+ input.email,
344
+ input.nowMs
345
+ ]),
346
+ deleteExpired: (prepare, nowMs) => prepare(`DELETE FROM email_otp_registration_attempts
347
+ WHERE namespace = ?
348
+ AND org_id = ?
349
+ AND project_id = ?
350
+ AND env_id = ?
351
+ AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]),
352
+ selectLiveForWallet: (prepare, walletId, nowMs) => prepare(`SELECT 1 AS found
353
+ FROM email_otp_registration_attempts
354
+ WHERE namespace = ?
355
+ AND org_id = ?
356
+ AND project_id = ?
357
+ AND env_id = ?
358
+ AND state IN ('started', 'key_finalized')
359
+ AND expires_at_ms > ?
360
+ AND (
361
+ wallet_id = ?
362
+ OR EXISTS (
363
+ SELECT 1
364
+ FROM json_each(offer_wallet_ids_json)
365
+ WHERE value = ?
366
+ )
367
+ )
368
+ LIMIT 1`, [
369
+ nowMs,
370
+ walletId,
371
+ walletId
372
+ ]),
373
+ delete: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
374
+ WHERE namespace = ?
375
+ AND org_id = ?
376
+ AND project_id = ?
377
+ AND env_id = ?
378
+ AND attempt_id = ?`, [attemptId])
379
+ };
380
+ //#endregion
381
+ export { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows };
382
+
383
+ //# sourceMappingURL=emailOtpD1Statements.js.map
@@ -1,6 +1,6 @@
1
1
  import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
2
- import { isValidAccountId } from "../shared-ts/src/utils/near.js";
3
2
  import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
3
+ import { isValidAccountId } from "../shared-ts/src/utils/near.js";
4
4
  import "../shared-ts/src/utils/validation.js";
5
5
  //#region src/core/hostedAccountIds.ts
6
6
  const DOMAIN = "near_account_slug_v1";
@@ -220,6 +220,6 @@ async function deriveHostedNearAccountId(input) {
220
220
  return walletId;
221
221
  }
222
222
  //#endregion
223
- export { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId, parseHostedHmacReadableRelayerWalletId };
223
+ export { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId };
224
224
 
225
225
  //# sourceMappingURL=hostedAccountIds.js.map
@@ -1,58 +1,12 @@
1
+ import { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
1
2
  //#region src/core/keyMaterialBrands.ts
2
- function parseNonEmptyBrand(value, label) {
3
- const normalized = String(value ?? "").trim();
4
- if (!normalized) throw new Error(`${label} must be a non-empty string`);
5
- return normalized;
6
- }
7
- function parseEcdsaDerivationKeyVersion(value) {
8
- return parseNonEmptyBrand(value, "ECDSA DERIVATION key version");
9
- }
10
- function parseSigningSessionSealKeyVersion(value) {
11
- return parseNonEmptyBrand(value, "signing-session seal key version");
12
- }
13
- function parseEd25519ClientVerifyingShareB64u(value) {
14
- return parseNonEmptyBrand(value, "Ed25519 client verifying share");
15
- }
16
- function parseEcdsaClientVerifyingShareB64u(value) {
17
- return parseNonEmptyBrand(value, "ECDSA client verifying share");
18
- }
19
- function parseEd25519RelayerKeyId(value) {
20
- return parseNonEmptyBrand(value, "Ed25519 relayer key id");
21
- }
22
- function parseEcdsaRelayerKeyId(value) {
23
- return parseNonEmptyBrand(value, "ECDSA relayer key id");
24
- }
25
3
  function parseEcdsaThresholdKeyId(value) {
26
4
  return parseNonEmptyBrand(value, "ECDSA threshold key id");
27
5
  }
28
- function parseEcdsaKeyHandle(value) {
29
- return parseNonEmptyBrand(value, "ECDSA key handle");
30
- }
31
- function formatEcdsaDerivationKeyVersionForWire(value) {
32
- return value;
33
- }
34
- function formatSigningSessionSealKeyVersionForWire(value) {
35
- return value;
36
- }
37
6
  function formatEd25519ClientVerifyingShareB64uForWire(value) {
38
7
  return value;
39
8
  }
40
- function formatEcdsaClientVerifyingShareB64uForWire(value) {
41
- return value;
42
- }
43
- function formatEd25519RelayerKeyIdForWire(value) {
44
- return value;
45
- }
46
- function formatEcdsaRelayerKeyIdForWire(value) {
47
- return value;
48
- }
49
- function formatEcdsaThresholdKeyIdForWire(value) {
50
- return value;
51
- }
52
- function formatEcdsaKeyHandleForWire(value) {
53
- return value;
54
- }
55
9
  //#endregion
56
- export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519ClientVerifyingShareB64u, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
10
+ export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
57
11
 
58
12
  //# sourceMappingURL=keyMaterialBrands.js.map