@seams/wallet-server 0.6.2 → 0.7.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/THIRD_PARTY_NOTICES.md +1 -105
- package/artifact-manifest.json +147 -32
- package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -0
- package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
- package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -0
- package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
- package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/local-tools/darwin-arm64/router_ab_local_init +0 -0
- package/cloudflare-router-ab/build/local-tools/darwin-x64/router_ab_local_init +0 -0
- package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
- package/cloudflare-router-ab/build/router/build-stamp.json +1 -0
- package/cloudflare-router-ab/build/router/index.js +2 -2
- package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -0
- package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
- package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
- package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -0
- package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
- package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
- package/cloudflare-router-ab/migrations/deriver-a/0012_tenant_root_creation_tombstones.sql +20 -0
- package/cloudflare-router-ab/migrations/deriver-a/0013_tenant_root_root_use_admissions.sql +32 -0
- package/cloudflare-router-ab/migrations/deriver-a/0014_tenant_root_refresh_supersessions.sql +24 -0
- package/cloudflare-router-ab/migrations/deriver-a/0015_tenant_root_root_use_attempts.sql +56 -0
- package/cloudflare-router-ab/migrations/deriver-a/0016_tenant_root_root_use_admission_settlement.sql +5 -0
- package/cloudflare-router-ab/migrations/deriver-a/0017_tenant_root_root_use_admission_claims.sql +64 -0
- package/cloudflare-router-ab/migrations/deriver-a/0018_tenant_root_recovery_retention_keys.sql +12 -0
- package/cloudflare-router-ab/migrations/deriver-b/0012_tenant_root_creation_tombstones.sql +20 -0
- package/cloudflare-router-ab/migrations/deriver-b/0013_tenant_root_root_use_admissions.sql +32 -0
- package/cloudflare-router-ab/migrations/deriver-b/0014_tenant_root_refresh_supersessions.sql +24 -0
- package/cloudflare-router-ab/migrations/deriver-b/0015_tenant_root_root_use_attempts.sql +56 -0
- package/cloudflare-router-ab/migrations/deriver-b/0016_tenant_root_root_use_admission_settlement.sql +5 -0
- package/cloudflare-router-ab/migrations/deriver-b/0017_tenant_root_root_use_admission_claims.sql +64 -0
- package/cloudflare-router-ab/migrations/deriver-b/0018_tenant_root_recovery_retention_keys.sql +12 -0
- package/cloudflare-router-ab/scripts/bootstrap-local-tenant-root.mjs +81 -16
- package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs +102 -9
- package/cloudflare-router-ab/scripts/start-local-role-workers.mjs +4 -1
- package/cloudflare-router-ab/wrangler.deriver-a.toml +24 -0
- package/cloudflare-router-ab/wrangler.router.toml +13 -0
- package/dist/esm/authorization/capabilityPolicy.js +1 -1
- package/dist/esm/authorization/domain.js +2 -2
- package/dist/esm/authorization/factorEvidence.js +6 -100
- package/dist/esm/authorization/service.js +42 -2
- package/dist/esm/authorization/vaultProxyUse.js +5 -10
- package/dist/esm/cloud-host.js +17 -12
- package/dist/esm/core/EmailOtpRecords.js +19 -1
- package/dist/esm/core/EmailOtpStores.js +323 -924
- package/dist/esm/core/IdentityStore.js +67 -345
- package/dist/esm/core/NearPublicKeyStore.js +21 -63
- package/dist/esm/core/RegistrationCeremonyStore.js +3 -1793
- package/dist/esm/core/SessionService.js +7 -30
- package/dist/esm/core/ThresholdService/config.js +1 -82
- package/dist/esm/core/ThresholdService/kv.js +3 -3
- package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js +37 -5
- package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.js +4 -74
- package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js +3 -10
- package/dist/esm/core/ThresholdService/stores/CloudflareDurableObjectStore.js +15 -51
- package/dist/esm/core/ThresholdService/stores/KeyStore.js +3 -3
- package/dist/esm/core/ThresholdService/stores/SessionStore.js +5 -81
- package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js +191 -372
- package/dist/esm/core/ThresholdService/stores/exportReplayGuard.js +7 -0
- package/dist/esm/core/ThresholdService/validation.js +18 -230
- package/dist/esm/core/WalletAuthMethodStore.js +22 -79
- package/dist/esm/core/WalletStore.js +62 -191
- package/dist/esm/core/WebAuthnAuthenticatorStore.js +57 -340
- package/dist/esm/core/WebAuthnCredentialBindingStore.js +90 -369
- package/dist/esm/core/WebAuthnLoginChallengeStore.js +17 -397
- package/dist/esm/core/WebAuthnSyncChallengeStore.js +17 -397
- package/dist/esm/core/authService/AuthService.js +2 -19
- package/dist/esm/core/authService/bytes.js +1 -4
- package/dist/esm/core/authService/emailOtpChallengeOperations.js +2 -5
- package/dist/esm/core/authService/emailOtpChallengeProof.js +10 -41
- package/dist/esm/core/authService/emailOtpChallengeVerification.js +19 -90
- package/dist/esm/core/authService/emailOtpChallenges.js +11 -46
- package/dist/esm/core/authService/emailOtpConfig.js +1 -32
- package/dist/esm/core/authService/emailOtpDelivery.js +10 -45
- package/dist/esm/core/authService/emailOtpEnrollment.js +9 -40
- package/dist/esm/core/authService/emailOtpGrant.js +9 -40
- package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js +15 -193
- package/dist/esm/core/authService/emailOtpSeal.js +5 -20
- package/dist/esm/core/authService/emailOtpUnlock.js +20 -110
- package/dist/esm/core/authService/googleEmailOtpRegistration.js +29 -116
- package/dist/esm/core/authService/identity.js +5 -20
- package/dist/esm/core/authService/nearPrivateKeySigning.js +7 -15
- package/dist/esm/core/authService/nearPublicKeyMetadata.js +6 -25
- package/dist/esm/core/authService/nearTransactions.js +2 -1
- package/dist/esm/core/authService/oidcVerification.js +25 -38
- package/dist/esm/core/authService/rateLimits.js +3 -36
- package/dist/esm/core/authService/registrationThresholdHelpers.js +2 -103
- package/dist/esm/core/authService/storeRegistry.js +2 -13
- package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js +6 -6
- package/dist/esm/core/authService/webauthn.js +52 -241
- package/dist/esm/core/authService/webauthnOidcHelpers.js +1 -6
- package/dist/esm/core/authService/webauthnVerificationOutcomes.js +41 -0
- package/dist/esm/core/authService/webauthnWalletBinding.js +2 -122
- package/dist/esm/core/d1EcdsaSignerRead.js +76 -0
- package/dist/esm/core/d1IdentityStore.js +46 -139
- package/dist/esm/core/d1TenantStore.js +82 -0
- package/dist/esm/core/d1WalletAuthMethodStore.js +92 -143
- package/dist/esm/core/d1WalletStore.js +28 -36
- package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js +10 -12
- package/dist/esm/core/deviceLinking/linkedDeviceManagement.js +25 -3
- package/dist/esm/core/deviceLinking/linkedDeviceSession.js +6 -895
- package/dist/esm/core/deviceLinking/linkedDeviceSessionApproval.js +100 -0
- package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js +662 -0
- package/dist/esm/core/deviceLinking/requestProof.js +13 -4
- package/dist/esm/core/ecdsaMaterialReadSnapshot.js +85 -0
- package/dist/esm/core/emailOtpD1Statements.js +383 -0
- package/dist/esm/core/hostedAccountIds.js +2 -2
- package/dist/esm/core/keyMaterialBrands.js +2 -48
- package/dist/esm/core/nearRelayerAccountProvisioning.js +27 -155
- package/dist/esm/core/nearSignerWasmRuntime.js +1 -4
- package/dist/esm/core/rpcClients/near/NearClient.js +15 -218
- package/dist/esm/core/signingLanes/LaneEnrollmentActivation.js +1 -1
- package/dist/esm/core/signingLanes/LaneLifecycleApplicationService.js +2 -4
- package/dist/esm/core/signingLanes/LaneLifecycleStore.js +0 -24
- package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js +8 -11
- package/dist/esm/core/signingLanes/ecdsaServerRetirement.js +3 -8
- package/dist/esm/core/signingLanes/ed25519ServerRetirement.js +1 -4
- package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js +2 -5
- package/dist/esm/core/storeBackends.js +208 -0
- package/dist/esm/core/thresholdEcdsaChainTarget.js +2 -10
- package/dist/esm/core/webAuthnD1Statements.js +92 -0
- package/dist/esm/core/webAuthnStoreBackends.js +198 -0
- package/dist/esm/hosted-wallet-gateway.js +34 -17
- package/dist/esm/index.js +2 -2
- package/dist/esm/local-hosted-wallet-gateway-worker.js +2 -23
- package/dist/esm/localHostedWalletGatewayHandler.js +312 -0
- package/dist/esm/localIntendedEcdsaFinalizeFault.js +85 -0
- package/dist/esm/localIntendedLinkExecuteFault.js +140 -0
- package/dist/esm/localIntendedMaterialAdmissionFault.js +176 -0
- package/dist/esm/localIntendedPresignCancellation.js +44 -0
- package/dist/esm/localIntendedRevokeFault.js +106 -0
- package/dist/esm/localIntendedSessionAdmissionFault.js +139 -0
- package/dist/esm/localIntendedYaoExportFault.js +117 -0
- package/dist/esm/localIntendedYaoFault.js +13 -16
- package/dist/esm/localIntendedYaoFinalizeFault.js +99 -0
- package/dist/esm/localIntendedYaoRecoveryFault.js +102 -0
- package/dist/esm/localIntendedYaoSigningFault.js +127 -0
- package/dist/esm/router/auth/authRequestValidation.js +1 -1
- package/dist/esm/router/auth/commonRouterUtils.js +34 -12
- package/dist/esm/router/auth/walletSessionFailure.js +3 -19
- package/dist/esm/router/auth/webAuthnCredentialCodecs.js +4 -15
- package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js +24 -0
- package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.js +2 -6
- package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +87 -89
- package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js +76 -0
- package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js +215 -0
- package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js +423 -308
- package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js +8 -12
- package/dist/esm/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.js +14 -0
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js +107 -66
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js +3 -6
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js +1 -19
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.js +4 -3
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +52 -9
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js +3 -6
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.js +100 -0
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.js +7 -10
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js +33 -124
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js +2 -2
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js +10 -18
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.js +6 -6
- package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js +3 -1
- package/dist/esm/router/cloudflare/d1/deviceLinking/index.js +4 -4
- package/dist/esm/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.js +69 -0
- package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js +39 -68
- package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js +69 -0
- package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.js +2 -2
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js +12 -55
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js +17 -80
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js +26 -71
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js +20 -3
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.js +6 -25
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js +7 -94
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js +5 -47
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js +38 -170
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +24 -87
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js +9 -32
- package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js +5 -20
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js +15 -134
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js +54 -260
- package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +24 -111
- package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js +1 -28
- package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js +9 -40
- package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js +5 -18
- package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js +18 -91
- package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js +6 -30
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.js +1 -1
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js +7 -18
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js +25 -80
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.js +24 -15
- package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.js +23 -253
- package/dist/esm/router/cloudflare/d1/registration/d1EvmFamilyEcdsaRegistrationBranch.js +5 -20
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +20 -39
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js +31 -73
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +4 -1
- package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js +10 -31
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +6 -30
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +286 -220
- package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js +5 -3
- package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js +2 -2
- package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js +4 -7
- package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js +139 -27
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js +0 -1
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js +1 -1
- package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js +2 -1
- package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js +2 -60
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +158 -19
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.js +19 -49
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js +100 -0
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +132 -33
- package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js +83 -4
- package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +45 -217
- package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js +10 -13
- package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js +22 -116
- package/dist/esm/router/cloudflare/durableObjects/thresholdStore.js +59 -66
- package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js +1 -2
- package/dist/esm/router/cloudflare/runtime/routerAbPrewarm.js +2 -2
- package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js +5 -20
- package/dist/esm/router/cloudflare/runtime/tenantRootCreationGrant.js +2 -9
- package/dist/esm/router/cloudflare/runtime/walletConsoleTenantRootLineage.js +11 -2
- package/dist/esm/router/cloudflare/runtime/walletControlOps.js +2 -1
- package/dist/esm/router/cloudflare/runtime/walletGateway.js +1 -1
- package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js +7 -7
- package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js +4 -3
- package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js +48 -21
- package/dist/esm/router/cloudflare.js +13343 -14372
- package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js +16 -5
- package/dist/esm/router/domains/ecdsa/thresholdEcdsaRequestValidation.js +2 -8
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js +33 -0
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +17 -9
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js +29 -431
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js +7 -2
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js +5 -8
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.js +2 -1
- package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js +70 -2
- package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js +134 -169
- package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js +77 -162
- package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js +205 -51
- package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js +29 -11
- package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js +3 -6
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js +182 -55
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js +2 -1
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.js +63 -247
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js +9 -27
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js +87 -132
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js +39 -55
- package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js +5 -4
- package/dist/esm/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js +45 -0
- package/dist/esm/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.js +1 -1
- package/dist/esm/router/domains/emailOtp/emailOtpExportPolicy.js +1 -42
- package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js +1 -6
- package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js +15 -62
- package/dist/esm/router/domains/emailOtp/emailOtpSessionRouteHelpers.js +1 -142
- package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js +1 -1
- package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js +2 -2
- package/dist/esm/router/domains/passkeyCustody/walletRecoveryFinalization.js +23 -45
- package/dist/esm/router/domains/passkeyCustody/walletRecoveryKeyManifest.js +5 -5
- package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js +1 -1
- package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js +836 -0
- package/dist/esm/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.js +698 -0
- package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js +210 -0
- package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js +16 -15
- package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js +314 -0
- package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js +62 -2159
- package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js +1 -4
- package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js +8 -14
- package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js +18 -22
- package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js +3 -4
- package/dist/esm/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.js +2 -2
- package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js +127 -339
- package/dist/esm/router/express.js +7172 -7997
- package/dist/esm/router/framework/http.js +5 -4
- package/dist/esm/router/framework/ror/normalize.js +1 -1
- package/dist/esm/router/framework/routerApiRouteSurface.js +1 -1
- package/dist/esm/router/framework/runtimeSnapshotConsumer.js +8 -35
- package/dist/esm/router/node/nodeHostedWalletGateway.js +64 -0
- package/dist/esm/router/node/nodeHostedWalletGatewayCheck.js +163 -0
- package/dist/esm/router/node/nodeHostedWalletGatewayMain.js +120 -0
- package/dist/esm/router/node/nodeHttp.js +79 -0
- package/dist/esm/router/node/nodeSqlite.js +43 -0
- package/dist/esm/router/node/signerSqlMigrations.js +48 -0
- package/dist/esm/router/transport/fetch/createFetchRouter.js +4 -7
- package/dist/esm/router/transport/fetch/routes/auth.js +9 -41
- package/dist/esm/router/transport/fetch/routes/deviceLinking.js +16 -18
- package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js +8 -27
- package/dist/esm/router/transport/fetch/routes/deviceManagement.js +15 -24
- package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js +4 -16
- package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js +3 -16
- package/dist/esm/router/transport/fetch/routes/passkeyCustody.js +144 -461
- package/dist/esm/router/transport/fetch/routes/sessions.js +5 -4
- package/dist/esm/router/transport/fetch/routes/syncAccount.js +12 -42
- package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js +2 -2
- package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js +96 -102
- package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js +52 -27
- package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js +4 -1
- package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js +4 -16
- package/dist/esm/shared-ts/src/authorization/capabilityKinds.js +1 -1
- package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js +1 -1
- package/dist/esm/shared-ts/src/authorization/operationFingerprint.js +1 -2
- package/dist/esm/shared-ts/src/authorization/walletAuthority.js +99 -227
- package/dist/esm/shared-ts/src/authorization/walletCustodyOperation.js +4 -6
- package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js +12 -0
- package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js +74 -0
- package/dist/esm/shared-ts/src/device-linking/authorityActivation.js +50 -0
- package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js +10 -14
- package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js +3 -5
- package/dist/esm/shared-ts/src/device-linking/deviceManagement.js +55 -0
- package/dist/esm/shared-ts/src/device-linking/digests.js +10 -65
- package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js +14 -16
- package/dist/esm/shared-ts/src/device-linking/index.js +4 -1
- package/dist/esm/shared-ts/src/device-linking/parsers.js +510 -1063
- package/dist/esm/shared-ts/src/device-linking/requestProof.js +5 -14
- package/dist/esm/shared-ts/src/device-linking/sourceContribution.js +10 -16
- package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js +9 -9
- package/dist/esm/shared-ts/src/device-linking/wireFields.js +59 -0
- package/dist/esm/shared-ts/src/near/nearClient.js +252 -0
- package/dist/esm/shared-ts/src/passkey-custody/credentialActivity.js +3 -1
- package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js +7 -5
- package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js +6 -4
- package/dist/esm/shared-ts/src/passkey-custody/primitives.js +9 -39
- package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js +1 -5
- package/dist/esm/shared-ts/src/signing-lanes/index.js +3 -3
- package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js +8 -19
- package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js +5 -14
- package/dist/esm/shared-ts/src/signing-lanes/participants.js +2 -5
- package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js +7 -5
- package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js +6 -45
- package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js +423 -1511
- package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js +323 -0
- package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js +59 -0
- package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentifier.js +12 -0
- package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js +2 -9
- package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js +2 -5
- package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js +1 -2
- package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js +49 -0
- package/dist/esm/shared-ts/src/utils/addAuthMethodRegistration.js +3 -4
- package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js +8 -1
- package/dist/esm/shared-ts/src/utils/digestEncoding.js +63 -0
- package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js +2 -4
- package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js +0 -1
- package/dist/esm/shared-ts/src/utils/emailOtpDomain.js +5 -3
- package/dist/esm/shared-ts/src/utils/exactKeys.js +17 -0
- package/dist/esm/shared-ts/src/utils/exactRecord.js +44 -0
- package/dist/esm/shared-ts/src/utils/failure.js +20 -0
- package/dist/esm/shared-ts/src/utils/registrationAuthMethodInput.js +127 -0
- package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js +2 -2
- package/dist/esm/shared-ts/src/utils/registrationIds.js +280 -0
- package/dist/esm/shared-ts/src/utils/registrationIntent.js +7 -1182
- package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js +426 -0
- package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js +11 -136
- package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js +3 -163
- package/dist/esm/shared-ts/src/utils/routerAbEd25519YaoDigests.js +160 -0
- package/dist/esm/shared-ts/src/utils/routerAbNormalSigningIdentity.js +1 -4
- package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js +7 -15
- package/dist/esm/shared-ts/src/utils/thresholdEcdsaChainTarget.js +9 -0
- package/dist/esm/shared-ts/src/utils/validation.js +37 -6
- package/dist/esm/shared-ts/src/utils/walletAuthMethodRecord.js +362 -0
- package/dist/esm/shared-ts/src/utils/wireSchema.js +77 -0
- package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js +1 -1
- package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeReservation.js +1 -1
- package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js +8 -15
- package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js +4 -8
- package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js +3 -1
- package/dist/esm/storage/d1Sql.js +10 -1
- package/dist/esm/storage/syncSqlite.js +79 -0
- package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js +11 -33
- package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js +1 -1
- package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js +3 -3
- package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js +3 -10
- package/dist/esm/threshold/session/signingSessionSeal/options.js +1 -1
- package/dist/esm/threshold/session/signingSessionSeal/service.js +8 -35
- package/dist/esm/threshold/session/signingSessionSeal/transport/express.js +18 -94
- package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js +6 -30
- package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js +23 -75
- package/dist/esm/threshold/statusCodes.js +1 -1
- package/dist/esm/wasm/evm_crypto/pkg/evm_crypto_bg.wasm +0 -0
- package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.js +3 -3
- package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker_bg.wasm +0 -0
- package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts +8 -26
- package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts +2 -9
- package/dist/types/shared-ts/src/authorization/operationFingerprint.d.ts +1 -3
- package/dist/types/shared-ts/src/authorization/walletAuthority.d.ts +25 -12
- package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts +8 -0
- package/dist/types/shared-ts/src/authorization/walletSignerActivationEquality.d.ts +4 -0
- package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts +3 -2
- package/dist/types/shared-ts/src/device-linking/authorityActivation.d.ts +5 -0
- package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts +4 -8
- package/dist/types/shared-ts/src/device-linking/contracts.d.ts +13 -74
- package/dist/types/shared-ts/src/device-linking/contracts.typecheck.d.ts +2 -1
- package/dist/types/shared-ts/src/device-linking/deviceManagement.d.ts +7 -0
- package/dist/types/shared-ts/src/device-linking/digests.d.ts +0 -5
- package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts +3 -2
- package/dist/types/shared-ts/src/device-linking/index.d.ts +2 -0
- package/dist/types/shared-ts/src/device-linking/parsers.d.ts +4 -41
- package/dist/types/shared-ts/src/device-linking/requestProof.d.ts +0 -1
- package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts +5 -2
- package/dist/types/shared-ts/src/device-linking/walletSessionCredentialDelivery.d.ts +2 -1
- package/dist/types/shared-ts/src/device-linking/wireFields.d.ts +26 -0
- package/dist/types/shared-ts/src/near/actions.d.ts +4 -4
- package/dist/types/shared-ts/src/near/delegate.d.ts +3 -2
- package/dist/types/shared-ts/src/near/nearClient.d.ts +145 -0
- package/dist/types/shared-ts/src/passkey-custody/ceremonyCommitPayload.d.ts +0 -22
- package/dist/types/shared-ts/src/passkey-custody/credentialActivity.d.ts +2 -4
- package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts +14 -30
- package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts +8 -24
- package/dist/types/shared-ts/src/passkey-custody/index.d.ts +0 -2
- package/dist/types/shared-ts/src/passkey-custody/primitives.d.ts +9 -14
- package/dist/types/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.d.ts +0 -15
- package/dist/types/shared-ts/src/signing-lanes/execution.d.ts +11 -50
- package/dist/types/shared-ts/src/signing-lanes/ids.d.ts +1 -10
- package/dist/types/shared-ts/src/signing-lanes/index.d.ts +1 -2
- package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts +1 -2
- package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts +5 -27
- package/dist/types/shared-ts/src/signing-lanes/participants.d.ts +0 -11
- package/dist/types/shared-ts/src/signing-lanes/recordParsers.d.ts +6 -53
- package/dist/types/shared-ts/src/signing-lanes/records.d.ts +1 -2
- package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts +18 -42
- package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts +1 -20
- package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts +4 -25
- package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts +1 -41
- package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts +6 -0
- package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts +20 -0
- package/dist/types/shared-ts/src/tenant-root/tenantRootIdentifier.d.ts +3 -0
- package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts +2 -1
- package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts +8 -35
- package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts +8 -35
- package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts +25 -0
- package/dist/types/shared-ts/src/threshold/participants.d.ts +3 -9
- package/dist/types/shared-ts/src/threshold/secp256k1.d.ts +0 -37
- package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts +24 -0
- package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts +3 -5
- package/dist/types/shared-ts/src/utils/addAuthMethodRegistration.d.ts +3 -4
- package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts +7 -108
- package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts +16 -3
- package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts +2 -0
- package/dist/types/shared-ts/src/utils/digestEncoding.d.ts +9 -0
- package/dist/types/shared-ts/src/utils/domainIds.d.ts +1 -2
- package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts +3 -13
- package/dist/types/shared-ts/src/utils/eip1559TxWasmJson.d.ts +16 -0
- package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts +7 -5
- package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts +0 -2
- package/dist/types/shared-ts/src/utils/errors.d.ts +0 -7
- package/dist/types/shared-ts/src/utils/exactKeys.d.ts +11 -0
- package/dist/types/shared-ts/src/utils/exactRecord.d.ts +12 -0
- package/dist/types/shared-ts/src/utils/failure.d.ts +12 -0
- package/dist/types/shared-ts/src/utils/index.d.ts +5 -2
- package/dist/types/shared-ts/src/utils/jsonRpc.d.ts +6 -6
- package/dist/types/shared-ts/src/utils/near.d.ts +2 -1
- package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts +8 -7
- package/dist/types/shared-ts/src/utils/normalize.d.ts +0 -4
- package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts +179 -0
- package/dist/types/shared-ts/src/utils/registrationContracts.d.ts +76 -0
- package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts +1 -2
- package/dist/types/shared-ts/src/utils/registrationIds.d.ts +56 -0
- package/dist/types/shared-ts/src/utils/registrationIntent.d.ts +9 -514
- package/dist/types/shared-ts/src/utils/registrationSignerPlan.d.ts +130 -0
- package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts +24 -93
- package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts +15 -99
- package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts +38 -0
- package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts +30 -8
- package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts +10 -15
- package/dist/types/shared-ts/src/utils/routerAbTraceContext.d.ts +2 -1
- package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts +2 -0
- package/dist/types/shared-ts/src/utils/secureRandomId.d.ts +0 -2
- package/dist/types/shared-ts/src/utils/signerDomain.d.ts +3 -35
- package/dist/types/shared-ts/src/utils/signerSlot.d.ts +0 -4
- package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts +10 -17
- package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts +25 -0
- package/dist/types/shared-ts/src/utils/validation.d.ts +10 -10
- package/dist/types/shared-ts/src/utils/variant.d.ts +29 -0
- package/dist/types/shared-ts/src/utils/variant.typecheck.d.ts +22 -0
- package/dist/types/shared-ts/src/utils/walletAddSignerActivation.d.ts +2 -2
- package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts +1 -58
- package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts +101 -0
- package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts +3 -7
- package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts +5 -4
- package/dist/types/shared-ts/src/utils/wireSchema.d.ts +60 -0
- package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts +2 -1
- package/dist/types/shared-ts/src/wallet-recovery/index.d.ts +0 -1
- package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeLocator.d.ts +0 -16
- package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts +2 -11
- package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts +3 -16
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.d.ts +6 -18
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.d.ts +0 -2
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.d.ts +1 -3
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts +15 -0
- package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts +3 -4
- package/dist/types/wallet-server/src/authorization/capabilityPolicy.d.ts +0 -1
- package/dist/types/wallet-server/src/authorization/domain.d.ts +36 -5
- package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.d.ts +61 -0
- package/dist/types/wallet-server/src/authorization/ecdsaWalletSessionAdmission.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts +6 -7
- package/dist/types/wallet-server/src/authorization/service.d.ts +71 -3
- package/dist/types/wallet-server/src/cloud-host.d.ts +6 -2
- package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts +10 -1
- package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts +16 -116
- package/dist/types/wallet-server/src/core/IdentityStore.d.ts +2 -7
- package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts +6 -16
- package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts +29 -90
- package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts +0 -12
- package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts +10 -3
- package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.d.ts +17 -48
- package/dist/types/wallet-server/src/core/ThresholdService/routerAb/internalServiceHttp.d.ts +2 -1
- package/dist/types/wallet-server/src/core/ThresholdService/stores/CloudflareDurableObjectStore.d.ts +4 -71
- package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts +2 -1
- package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts +2 -6
- package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts +2 -1
- package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts +2 -4
- package/dist/types/wallet-server/src/core/ThresholdService/stores/exportReplayGuard.d.ts +3 -0
- package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts +11 -137
- package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts +2 -7
- package/dist/types/wallet-server/src/core/WalletStore.d.ts +3 -8
- package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts +15 -22
- package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts +14 -36
- package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts +9 -34
- package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts +9 -34
- package/dist/types/wallet-server/src/core/authService/AuthService.d.ts +0 -3
- package/dist/types/wallet-server/src/core/authService/bytes.d.ts +0 -1
- package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts +6 -5
- package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts +9 -17
- package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts +3 -2
- package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts +8 -32
- package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts +3 -10
- package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts +4 -3
- package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts +4 -3
- package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts +3 -70
- package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts +2 -1
- package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts +6 -12
- package/dist/types/wallet-server/src/core/authService/googleEmailOtpRegistration.d.ts +5 -8
- package/dist/types/wallet-server/src/core/authService/nearPrivateKeySigning.d.ts +3 -2
- package/dist/types/wallet-server/src/core/authService/nearPublicKeyMetadata.d.ts +2 -1
- package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts +2 -1
- package/dist/types/wallet-server/src/core/authService/oidcVerification.d.ts +4 -3
- package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts +0 -3
- package/dist/types/wallet-server/src/core/authService/registrationThresholdHelpers.d.ts +0 -26
- package/dist/types/wallet-server/src/core/authService/storeRegistry.d.ts +0 -5
- package/dist/types/wallet-server/src/core/authService/thresholdEcdsaKeyInventory.d.ts +0 -23
- package/dist/types/wallet-server/src/core/authService/webauthn.d.ts +8 -16
- package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts +7 -7
- package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts +43 -0
- package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts +1 -28
- package/dist/types/wallet-server/src/core/d1EcdsaSignerRead.d.ts +39 -0
- package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts +6 -16
- package/dist/types/wallet-server/src/core/d1TenantStore.d.ts +51 -0
- package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts +11 -29
- package/dist/types/wallet-server/src/core/d1WalletStore.d.ts +16 -1
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEd25519ExportRoot.d.ts +2 -1
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceEmailOtpGrant.d.ts +2 -1
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceManagement.d.ts +44 -26
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts +19 -217
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionApproval.d.ts +8 -0
- package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSessionRecord.d.ts +258 -0
- package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts +2 -2
- package/dist/types/wallet-server/src/core/ecdsaMaterialReadSnapshot.d.ts +19 -0
- package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts +54 -0
- package/dist/types/wallet-server/src/core/hostedAccountIds.d.ts +0 -15
- package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts +4 -24
- package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts +2 -3
- package/dist/types/wallet-server/src/core/nearSignerWasmRuntime.d.ts +0 -1
- package/dist/types/wallet-server/src/core/registrationContracts.d.ts +37 -108
- package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts +8 -9
- package/dist/types/wallet-server/src/core/rpcClients/near/NearClient.d.ts +10 -107
- package/dist/types/wallet-server/src/core/signingLanes/LaneAggregateRevocationApplicationService.d.ts +4 -3
- package/dist/types/wallet-server/src/core/signingLanes/LaneEffectJournalStore.d.ts +2 -3
- package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleStore.d.ts +2 -3
- package/dist/types/wallet-server/src/core/signingLanes/WalletExecutionLaneProjection.d.ts +5 -20
- package/dist/types/wallet-server/src/core/signingLanes/ecdsaServerRetirement.d.ts +4 -4
- package/dist/types/wallet-server/src/core/signingLanes/ed25519ServerRetirement.d.ts +3 -3
- package/dist/types/wallet-server/src/core/signingLanes/signingWorkerLaneMaterialIdentity.d.ts +2 -19
- package/dist/types/wallet-server/src/core/storeBackends.d.ts +83 -0
- package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts +13 -59
- package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts +51 -3
- package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts +3 -12
- package/dist/types/wallet-server/src/core/types.d.ts +5 -30
- package/dist/types/wallet-server/src/core/webAuthnD1Statements.d.ts +29 -0
- package/dist/types/wallet-server/src/core/webAuthnStoreBackends.d.ts +96 -0
- package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts +11 -7
- package/dist/types/wallet-server/src/index.d.ts +1 -1
- package/dist/types/wallet-server/src/local-hosted-wallet-gateway-worker.d.ts +1 -4
- package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts +12 -0
- package/dist/types/wallet-server/src/localIntendedEcdsaFinalizeFault.d.ts +33 -0
- package/dist/types/wallet-server/src/localIntendedLinkExecuteFault.d.ts +47 -0
- package/dist/types/wallet-server/src/localIntendedMaterialAdmissionFault.d.ts +38 -0
- package/dist/types/wallet-server/src/localIntendedPresignCancellation.d.ts +4 -0
- package/dist/types/wallet-server/src/localIntendedRevokeFault.d.ts +40 -0
- package/dist/types/wallet-server/src/localIntendedSessionAdmissionFault.d.ts +41 -0
- package/dist/types/wallet-server/src/localIntendedYaoExportFault.d.ts +41 -0
- package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts +7 -1
- package/dist/types/wallet-server/src/localIntendedYaoFinalizeFault.d.ts +37 -0
- package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts +45 -0
- package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts +51 -0
- package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts +13 -29
- package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts +20 -11
- package/dist/types/wallet-server/src/router/auth/walletSessionFailure.d.ts +1 -4
- package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts +3 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.d.ts +12 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts +3 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts +2 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts +9 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts +34 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts +54 -21
- package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/persistedWalletSessionAuthorization.d.ts +3 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/walletSessionAuthorityProjection.d.ts +2 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts +74 -6
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts +2 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.d.ts +8 -21
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.d.ts +14 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRevocation.d.ts +49 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionRecords.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts +6 -8
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts +7 -10
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts +8 -4
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceVerifiedLinkBuilder.d.ts +3 -5
- package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/installedEcdsaAuthority.d.ts +7 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.d.ts +1 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.d.ts +33 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.d.ts +1 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts +13 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.d.ts +24 -5
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts +4 -11
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts +1 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts +4 -12
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts +13 -12
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.d.ts +0 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.d.ts +5 -4
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts +4 -14
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts +1 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts +3 -21
- package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityRecords.d.ts +0 -23
- package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts +1 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore.d.ts +11 -19
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts +5 -54
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts +7 -19
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpRecords.d.ts +4 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletRecoveryGoogleEmailOtpService.d.ts +8 -12
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts +7 -14
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts +10 -22
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts +6 -2
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts +10 -6
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts +21 -26
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts +5 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts +4 -3
- package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.d.ts +5 -5
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.d.ts +17 -6
- package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts +0 -1
- package/dist/types/wallet-server/src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.d.ts +0 -16
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts +29 -14
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.d.ts +15 -12
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.d.ts +71 -0
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts +34 -24
- package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts +44 -26
- package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts +13 -46
- package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts +8 -19
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts +8 -34
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleTenantRootLineage.d.ts +2 -1
- package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts +1 -0
- package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.d.ts +15 -2
- package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts +2 -2
- package/dist/types/wallet-server/src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.d.ts +9 -7
- package/dist/types/wallet-server/src/router/domains/ecdsa/thresholdEcdsaRequestValidation.d.ts +6 -18
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.d.ts +46 -0
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts +5 -3
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts +20 -79
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts +2 -0
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRunner.d.ts +1 -1
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.d.ts +4 -3
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts +62 -42
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts +108 -32
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryActivation.typecheck.d.ts +5 -0
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.d.ts +36 -5
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.d.ts +5 -4
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.d.ts +41 -50
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.d.ts +2 -2
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts +3 -3
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.d.ts +6 -5
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.d.ts +14 -4
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.d.ts +12 -1
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/routerAbEd25519YaoWalletSession.d.ts +11 -52
- package/dist/types/wallet-server/src/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.d.ts +3 -4
- package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpExportPolicy.d.ts +2 -27
- package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRequestValidation.d.ts +1 -2
- package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpRouteHandlers.d.ts +2 -1
- package/dist/types/wallet-server/src/router/domains/emailOtp/emailOtpSessionRouteHelpers.d.ts +2 -102
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/envelopeRevocationAdmission.d.ts +2 -1
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts +3 -2
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.d.ts +1 -9
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/registrationCustodyOutcome.d.ts +2 -1
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/verifiedCustodyFactor.d.ts +2 -1
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.d.ts +2 -1
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts +2 -28
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryFinalization.d.ts +43 -1
- package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts +7 -19
- package/dist/types/wallet-server/src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.d.ts +0 -3
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.d.ts +164 -0
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbEd25519NormalSigningRoute.d.ts +110 -0
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmission.d.ts +373 -0
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.d.ts +11 -10
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.typecheck.d.ts +2 -0
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbOperationStepUp.d.ts +164 -0
- package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts +22 -717
- package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts +5 -12
- package/dist/types/wallet-server/src/router/domains/syncAccount/syncAccountRequestValidation.d.ts +6 -10
- package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootCustodyLineage.d.ts +6 -1
- package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootIdentityResolution.d.ts +4 -7
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts +2 -1
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts +8 -8
- package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts +4 -4
- package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.d.ts +4 -4
- package/dist/types/wallet-server/src/router/domains/walletUnlock/walletUnlockRouteHandlers.d.ts +4 -62
- package/dist/types/wallet-server/src/router/express-adaptor.d.ts +2 -2
- package/dist/types/wallet-server/src/router/framework/apiCredentialPorts.d.ts +3 -1
- package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts +89 -65
- package/dist/types/wallet-server/src/router/framework/http.d.ts +1 -1
- package/dist/types/wallet-server/src/router/framework/ror/normalize.d.ts +1 -9
- package/dist/types/wallet-server/src/router/framework/routeMeteringPolicy.d.ts +3 -2
- package/dist/types/wallet-server/src/router/framework/routerApi.d.ts +1 -1
- package/dist/types/wallet-server/src/router/framework/routerApiRouteSurface.d.ts +3 -3
- package/dist/types/wallet-server/src/router/node/nodeHostedWalletGateway.d.ts +34 -0
- package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayCheck.d.ts +21 -0
- package/dist/types/wallet-server/src/router/node/nodeHostedWalletGatewayMain.d.ts +2 -0
- package/dist/types/wallet-server/src/router/node/nodeHttp.d.ts +13 -0
- package/dist/types/wallet-server/src/router/node/nodeSqlite.d.ts +22 -0
- package/dist/types/wallet-server/src/router/node/signerSqlMigrations.d.ts +20 -0
- package/dist/types/wallet-server/src/router/transport/fetch/createFetchRouter.d.ts +1 -3
- package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts +5 -6
- package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.d.ts +5 -8
- package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceManagement.d.ts +14 -16
- package/dist/types/wallet-server/src/router/transport/fetch/routes/normalSigningRouterProxy.d.ts +0 -12
- package/dist/types/wallet-server/src/router/transport/fetch/routes/passkeyCustody.d.ts +1 -1
- package/dist/types/wallet-server/src/router/transport/fetch/routes/sessions.d.ts +2 -1
- package/dist/types/wallet-server/src/router/transport/fetch/routes/syncAccountBootstrap.d.ts +9 -17
- package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEcdsa.d.ts +3 -58
- package/dist/types/wallet-server/src/router/transport/fetch/routes/thresholdEd25519.d.ts +0 -44
- package/dist/types/wallet-server/src/storage/d1Sql.d.ts +7 -0
- package/dist/types/wallet-server/src/storage/syncSqlite.d.ts +28 -0
- package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts +0 -1
- package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyRecords.d.ts +5 -7
- package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/signingSessionSeal.types.d.ts +6 -8
- package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/transport/shared.d.ts +1 -0
- package/dist/types/wallet-server/src/threshold/statusCodes.d.ts +4 -4
- package/migrations/d1-signer/0036_r150_yao_lifecycle_decisions.sql +22 -0
- package/migrations/d1-signer/0037_r150_wallet_auth_method_revocation_replays.sql +26 -0
- package/migrations/d1-signer/0038_r150_registration_ceremony_cas_guard_seed.sql +8 -0
- package/migrations/d1-signer/0039_r150_revocation_replay_answer_kind.sql +9 -0
- package/package.json +1 -1
- package/dist/esm/core/ThresholdService/ecdsaClientRootProof.js +0 -27
- package/dist/esm/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.js +0 -115
- package/dist/esm/core/ThresholdService/secureRandomId.js +0 -9
- package/dist/esm/core/authService/record.js +0 -8
- package/dist/esm/core/authService/thresholdRuntimePolicy.js +0 -19
- package/dist/esm/core/authService/walletRegistrationPlanning.js +0 -49
- package/dist/esm/core/deviceLinking/index.js +0 -5
- package/dist/esm/core/errors.js +0 -54
- package/dist/esm/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.js +0 -39
- package/dist/esm/core/signingLanes/WalletKeyStore.js +0 -0
- package/dist/esm/core/signingLanes/index.js +0 -8
- package/dist/esm/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.js +0 -55
- package/dist/esm/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.js +0 -56
- package/dist/esm/shared-ts/src/signing-lanes/linkedEcdsaScope.js +0 -1
- package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker.js +0 -414
- package/dist/esm/wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker_bg.wasm +0 -0
- package/dist/types/shared-ts/src/passkey-custody/credentialObservations.d.ts +0 -74
- package/dist/types/shared-ts/src/passkey-custody/kekContext.d.ts +0 -34
- package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.d.ts +0 -62
- package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.typecheck.d.ts +0 -2
- package/dist/types/shared-ts/src/signing-lanes/validation.d.ts +0 -11
- package/dist/types/shared-ts/src/utils/bigint.d.ts +0 -3
- package/dist/types/shared-ts/src/utils/paillier.d.ts +0 -37
- package/dist/types/shared-ts/src/utils/recoveryDomain.d.ts +0 -12
- package/dist/types/shared-ts/src/utils/signerDomain.typecheck.d.ts +0 -2
- package/dist/types/shared-ts/src/wallet-recovery/recoveryKekContext.d.ts +0 -37
- package/dist/types/wallet-server/src/core/ThresholdService/ecdsaClientRootProof.d.ts +0 -12
- package/dist/types/wallet-server/src/core/ThresholdService/routerAbEcdsaSigningWorkerWasm.d.ts +0 -17
- package/dist/types/wallet-server/src/core/ThresholdService/secureRandomId.d.ts +0 -2
- package/dist/types/wallet-server/src/core/authService/record.d.ts +0 -2
- package/dist/types/wallet-server/src/core/authService/thresholdRuntimePolicy.d.ts +0 -4
- package/dist/types/wallet-server/src/core/authService/walletRegistrationPlanning.d.ts +0 -19
- package/dist/types/wallet-server/src/core/deviceLinking/index.d.ts +0 -5
- package/dist/types/wallet-server/src/core/errors.d.ts +0 -10
- package/dist/types/wallet-server/src/core/routerAbSigning/createCloudflareDurableObjectRouterAbSigningRuntimes.d.ts +0 -28
- package/dist/types/wallet-server/src/core/signingLanes/SigningLaneStore.d.ts +0 -15
- package/dist/types/wallet-server/src/core/signingLanes/WalletKeyStore.d.ts +0 -13
- package/dist/types/wallet-server/src/core/signingLanes/index.d.ts +0 -11
- package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.d.ts +0 -35
- package/dist/types/wallet-server/src/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.d.ts +0 -35
- /package/dist/esm/{core/signingLanes/SigningLaneStore.js → authorization/ecdsaWalletSessionAdmission.js} +0 -0
|
@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId } from "../../shared-ts/src/utils/domainIds.js
|
|
|
2
2
|
import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
|
|
3
3
|
import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
|
|
4
4
|
import { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 } from "../../shared-ts/src/device-linking/requestProof.js";
|
|
5
|
+
import { hasExactKeys } from "../../shared-ts/src/utils/exactKeys.js";
|
|
5
6
|
//#region src/core/deviceLinking/requestProof.ts
|
|
6
7
|
var LinkedDeviceRequestProofVerifierV1 = class {
|
|
7
8
|
constructor(input) {
|
|
@@ -62,7 +63,18 @@ var LinkedDeviceRequestProofVerifierV1 = class {
|
|
|
62
63
|
};
|
|
63
64
|
function parseLinkedDeviceRequestProofV1(raw) {
|
|
64
65
|
if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
|
|
65
|
-
if (!
|
|
66
|
+
if (!hasExactKeys(raw, [
|
|
67
|
+
"kind",
|
|
68
|
+
"linkSessionId",
|
|
69
|
+
"devicePublicKeyDigestB64u",
|
|
70
|
+
"requestNonceB64u",
|
|
71
|
+
"method",
|
|
72
|
+
"canonicalPath",
|
|
73
|
+
"bodyDigestB64u",
|
|
74
|
+
"issuedAtMs",
|
|
75
|
+
"expiresAtMs",
|
|
76
|
+
"signatureB64u"
|
|
77
|
+
])) throw new Error("record contains invalid fields");
|
|
66
78
|
const record = raw;
|
|
67
79
|
if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
|
|
68
80
|
const linkSessionId = parseSessionId(record.linkSessionId);
|
|
@@ -152,9 +164,6 @@ function parseFixedB64u(raw, expectedBytes, field) {
|
|
|
152
164
|
function toArrayBuffer(bytes) {
|
|
153
165
|
return bytes.slice().buffer;
|
|
154
166
|
}
|
|
155
|
-
function isLinkedDeviceRequestProofRecordV1(value) {
|
|
156
|
-
return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
|
|
157
|
-
}
|
|
158
167
|
function errorMessage(error) {
|
|
159
168
|
return error instanceof Error ? error.message : String(error || "invalid device request proof");
|
|
160
169
|
}
|
|
@@ -0,0 +1,85 @@
|
|
|
1
|
+
//#region src/core/ecdsaMaterialReadSnapshot.ts
|
|
2
|
+
const ECDSA_INSTALLATION_SNAPSHOT_COLUMNS = [
|
|
3
|
+
"link_session_id",
|
|
4
|
+
"authority_id",
|
|
5
|
+
"wallet_id",
|
|
6
|
+
"auth_method_id",
|
|
7
|
+
"device_id",
|
|
8
|
+
"package_set_digest_b64u",
|
|
9
|
+
"target_factor_verification_digest_b64u",
|
|
10
|
+
"target_factor_verified_at_ms",
|
|
11
|
+
"source_manifest_digest_b64u",
|
|
12
|
+
"delivery_recipient_public_key_b64u",
|
|
13
|
+
"packages_json",
|
|
14
|
+
"server_reservation_ids_json",
|
|
15
|
+
"installed_record_set_digest_b64u",
|
|
16
|
+
"activated_at_ms"
|
|
17
|
+
];
|
|
18
|
+
/** Request-local evidence of the exact records a material resolver examined. */
|
|
19
|
+
var EcdsaMaterialReadSnapshot = class EcdsaMaterialReadSnapshot {
|
|
20
|
+
#scope;
|
|
21
|
+
#conditions;
|
|
22
|
+
constructor(walletId, scope, conditions) {
|
|
23
|
+
this.walletId = walletId;
|
|
24
|
+
this.#scope = scope;
|
|
25
|
+
this.#conditions = conditions;
|
|
26
|
+
}
|
|
27
|
+
static canonical(scope, walletId, activationId, rows) {
|
|
28
|
+
return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("wallet_signers", scope, walletId, ["record_json"], rows, "signer_family = 'ecdsa' AND json_extract(record_json, '$.walletKey.publicCapability.material_activation.activation_id') = ?", [activationId])]);
|
|
29
|
+
}
|
|
30
|
+
static linked(scope, walletId, installations, signers) {
|
|
31
|
+
return new EcdsaMaterialReadSnapshot(walletId, scope, [recordSetCondition("linked_device_authority_installations", scope, walletId, ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, installations, "1", []), recordSetCondition("wallet_signers", scope, walletId, ["record_json"], signers, "signer_family = 'ecdsa'", [])]);
|
|
32
|
+
}
|
|
33
|
+
condition(scope) {
|
|
34
|
+
if (scope.namespace !== this.#scope.namespace || scope.orgId !== this.#scope.orgId || scope.projectId !== this.#scope.projectId || scope.envId !== this.#scope.envId) return {
|
|
35
|
+
sql: "0",
|
|
36
|
+
bindings: []
|
|
37
|
+
};
|
|
38
|
+
const clauses = [];
|
|
39
|
+
const bindings = [];
|
|
40
|
+
for (const condition of this.#conditions) {
|
|
41
|
+
clauses.push(`(${condition.sql})`);
|
|
42
|
+
bindings.push(...condition.bindings);
|
|
43
|
+
}
|
|
44
|
+
return {
|
|
45
|
+
sql: clauses.join(" AND "),
|
|
46
|
+
bindings
|
|
47
|
+
};
|
|
48
|
+
}
|
|
49
|
+
};
|
|
50
|
+
function recordSetCondition(table, scope, walletId, columns, rows, filter, filterBindings) {
|
|
51
|
+
const values = [];
|
|
52
|
+
for (const row of rows) {
|
|
53
|
+
const tuple = [];
|
|
54
|
+
for (const column of columns) {
|
|
55
|
+
const value = row[column];
|
|
56
|
+
if (value !== null && typeof value !== "string" && typeof value !== "number") throw new Error(`Invalid stored material column: ${column}`);
|
|
57
|
+
tuple.push(value);
|
|
58
|
+
}
|
|
59
|
+
values.push(tuple);
|
|
60
|
+
}
|
|
61
|
+
const predicate = `namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ? AND ${filter}`;
|
|
62
|
+
const identity = [
|
|
63
|
+
scope.namespace,
|
|
64
|
+
scope.orgId,
|
|
65
|
+
scope.projectId,
|
|
66
|
+
scope.envId,
|
|
67
|
+
walletId,
|
|
68
|
+
...filterBindings
|
|
69
|
+
];
|
|
70
|
+
return {
|
|
71
|
+
sql: `(SELECT COUNT(*) FROM ${table} WHERE ${predicate}) = ?
|
|
72
|
+
AND NOT EXISTS (SELECT 1 FROM ${table} WHERE ${predicate}
|
|
73
|
+
AND json_array(${columns.join(", ")}) NOT IN (SELECT value FROM json_each(?)))`,
|
|
74
|
+
bindings: [
|
|
75
|
+
...identity,
|
|
76
|
+
rows.length,
|
|
77
|
+
...identity,
|
|
78
|
+
JSON.stringify(values)
|
|
79
|
+
]
|
|
80
|
+
};
|
|
81
|
+
}
|
|
82
|
+
//#endregion
|
|
83
|
+
export { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS, EcdsaMaterialReadSnapshot };
|
|
84
|
+
|
|
85
|
+
//# sourceMappingURL=ecdsaMaterialReadSnapshot.js.map
|
|
@@ -0,0 +1,383 @@
|
|
|
1
|
+
import { EMAIL_OTP_CHANNEL } from "../shared-ts/src/utils/emailOtpDomain.js";
|
|
2
|
+
import { runtimePolicyScopeKey } from "./EmailOtpRecords.js";
|
|
3
|
+
//#region src/core/emailOtpD1Statements.ts
|
|
4
|
+
const INSERT_CHALLENGE_SQL = `INSERT INTO email_otp_challenges (
|
|
5
|
+
namespace,
|
|
6
|
+
org_id,
|
|
7
|
+
project_id,
|
|
8
|
+
env_id,
|
|
9
|
+
challenge_id,
|
|
10
|
+
challenge_subject_id,
|
|
11
|
+
wallet_id,
|
|
12
|
+
record_org_id,
|
|
13
|
+
otp_channel,
|
|
14
|
+
owner_proof_binding_digest,
|
|
15
|
+
action,
|
|
16
|
+
operation,
|
|
17
|
+
otp_code,
|
|
18
|
+
record_json,
|
|
19
|
+
created_at_ms,
|
|
20
|
+
expires_at_ms
|
|
21
|
+
)
|
|
22
|
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
|
|
23
|
+
function challengeValues(record) {
|
|
24
|
+
return [
|
|
25
|
+
record.challengeId,
|
|
26
|
+
record.challengeSubjectId,
|
|
27
|
+
record.walletId,
|
|
28
|
+
record.orgId || "",
|
|
29
|
+
EMAIL_OTP_CHANNEL,
|
|
30
|
+
record.ownerProofBindingDigest,
|
|
31
|
+
record.action,
|
|
32
|
+
record.operation,
|
|
33
|
+
record.otpCode,
|
|
34
|
+
JSON.stringify(record),
|
|
35
|
+
record.createdAtMs,
|
|
36
|
+
record.expiresAtMs
|
|
37
|
+
];
|
|
38
|
+
}
|
|
39
|
+
/** Statements on `email_otp_challenges`. */
|
|
40
|
+
const emailOtpChallengeRows = {
|
|
41
|
+
insert: (prepare, record) => prepare(INSERT_CHALLENGE_SQL, challengeValues(record)),
|
|
42
|
+
upsert: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL}
|
|
43
|
+
ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
|
|
44
|
+
DO UPDATE SET
|
|
45
|
+
challenge_subject_id = EXCLUDED.challenge_subject_id,
|
|
46
|
+
wallet_id = EXCLUDED.wallet_id,
|
|
47
|
+
record_org_id = EXCLUDED.record_org_id,
|
|
48
|
+
otp_channel = EXCLUDED.otp_channel,
|
|
49
|
+
owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
|
|
50
|
+
action = EXCLUDED.action,
|
|
51
|
+
operation = EXCLUDED.operation,
|
|
52
|
+
otp_code = EXCLUDED.otp_code,
|
|
53
|
+
record_json = EXCLUDED.record_json,
|
|
54
|
+
created_at_ms = EXCLUDED.created_at_ms,
|
|
55
|
+
expires_at_ms = EXCLUDED.expires_at_ms`, challengeValues(record)),
|
|
56
|
+
delete: (prepare, challengeId) => prepare(`DELETE FROM email_otp_challenges
|
|
57
|
+
WHERE namespace = ?
|
|
58
|
+
AND org_id = ?
|
|
59
|
+
AND project_id = ?
|
|
60
|
+
AND env_id = ?
|
|
61
|
+
AND challenge_id = ?`, [challengeId])
|
|
62
|
+
};
|
|
63
|
+
const INSERT_GRANT_SQL = `INSERT INTO email_otp_grants (
|
|
64
|
+
namespace,
|
|
65
|
+
org_id,
|
|
66
|
+
project_id,
|
|
67
|
+
env_id,
|
|
68
|
+
grant_token,
|
|
69
|
+
user_id,
|
|
70
|
+
wallet_id,
|
|
71
|
+
record_org_id,
|
|
72
|
+
challenge_id,
|
|
73
|
+
action,
|
|
74
|
+
record_json,
|
|
75
|
+
issued_at_ms,
|
|
76
|
+
expires_at_ms
|
|
77
|
+
)
|
|
78
|
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
|
|
79
|
+
function grantValues(record) {
|
|
80
|
+
return [
|
|
81
|
+
record.grantToken,
|
|
82
|
+
record.userId,
|
|
83
|
+
record.walletId,
|
|
84
|
+
record.orgId || "",
|
|
85
|
+
record.challengeId,
|
|
86
|
+
record.action,
|
|
87
|
+
JSON.stringify(record),
|
|
88
|
+
record.issuedAtMs,
|
|
89
|
+
record.expiresAtMs
|
|
90
|
+
];
|
|
91
|
+
}
|
|
92
|
+
/** Statements on `email_otp_grants`. */
|
|
93
|
+
const emailOtpGrantRows = {
|
|
94
|
+
insert: (prepare, record) => prepare(INSERT_GRANT_SQL, grantValues(record)),
|
|
95
|
+
upsert: (prepare, record) => prepare(`${INSERT_GRANT_SQL}
|
|
96
|
+
ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
|
|
97
|
+
DO UPDATE SET
|
|
98
|
+
user_id = EXCLUDED.user_id,
|
|
99
|
+
wallet_id = EXCLUDED.wallet_id,
|
|
100
|
+
record_org_id = EXCLUDED.record_org_id,
|
|
101
|
+
challenge_id = EXCLUDED.challenge_id,
|
|
102
|
+
action = EXCLUDED.action,
|
|
103
|
+
record_json = EXCLUDED.record_json,
|
|
104
|
+
issued_at_ms = EXCLUDED.issued_at_ms,
|
|
105
|
+
expires_at_ms = EXCLUDED.expires_at_ms`, grantValues(record)),
|
|
106
|
+
select: (prepare, grantToken) => prepare(`SELECT record_json, expires_at_ms
|
|
107
|
+
FROM email_otp_grants
|
|
108
|
+
WHERE namespace = ?
|
|
109
|
+
AND org_id = ?
|
|
110
|
+
AND project_id = ?
|
|
111
|
+
AND env_id = ?
|
|
112
|
+
AND grant_token = ?
|
|
113
|
+
LIMIT 1`, [grantToken]),
|
|
114
|
+
consume: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
|
|
115
|
+
WHERE namespace = ?
|
|
116
|
+
AND org_id = ?
|
|
117
|
+
AND project_id = ?
|
|
118
|
+
AND env_id = ?
|
|
119
|
+
AND grant_token = ?
|
|
120
|
+
RETURNING record_json, expires_at_ms`, [grantToken]),
|
|
121
|
+
delete: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
|
|
122
|
+
WHERE namespace = ?
|
|
123
|
+
AND org_id = ?
|
|
124
|
+
AND project_id = ?
|
|
125
|
+
AND env_id = ?
|
|
126
|
+
AND grant_token = ?`, [grantToken])
|
|
127
|
+
};
|
|
128
|
+
const INSERT_WALLET_ENROLLMENT_SQL = `INSERT INTO email_otp_wallet_enrollments (
|
|
129
|
+
namespace,
|
|
130
|
+
org_id,
|
|
131
|
+
project_id,
|
|
132
|
+
env_id,
|
|
133
|
+
wallet_id,
|
|
134
|
+
provider_user_id,
|
|
135
|
+
record_org_id,
|
|
136
|
+
verified_email,
|
|
137
|
+
record_json,
|
|
138
|
+
created_at_ms,
|
|
139
|
+
updated_at_ms
|
|
140
|
+
)
|
|
141
|
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
|
|
142
|
+
function walletEnrollmentValues(record) {
|
|
143
|
+
return [
|
|
144
|
+
record.walletId,
|
|
145
|
+
record.providerUserId,
|
|
146
|
+
record.orgId,
|
|
147
|
+
record.verifiedEmail,
|
|
148
|
+
JSON.stringify(record),
|
|
149
|
+
record.createdAtMs,
|
|
150
|
+
record.updatedAtMs
|
|
151
|
+
];
|
|
152
|
+
}
|
|
153
|
+
/** Statements on `email_otp_wallet_enrollments`. */
|
|
154
|
+
const emailOtpWalletEnrollmentRows = {
|
|
155
|
+
insert: (prepare, record) => prepare(INSERT_WALLET_ENROLLMENT_SQL, walletEnrollmentValues(record)),
|
|
156
|
+
upsert: (prepare, record) => prepare(`${INSERT_WALLET_ENROLLMENT_SQL}
|
|
157
|
+
ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
|
|
158
|
+
DO UPDATE SET
|
|
159
|
+
provider_user_id = EXCLUDED.provider_user_id,
|
|
160
|
+
record_org_id = EXCLUDED.record_org_id,
|
|
161
|
+
verified_email = EXCLUDED.verified_email,
|
|
162
|
+
record_json = EXCLUDED.record_json,
|
|
163
|
+
created_at_ms = EXCLUDED.created_at_ms,
|
|
164
|
+
updated_at_ms = EXCLUDED.updated_at_ms`, walletEnrollmentValues(record)),
|
|
165
|
+
delete: (prepare, walletId) => prepare(`DELETE FROM email_otp_wallet_enrollments
|
|
166
|
+
WHERE namespace = ?
|
|
167
|
+
AND org_id = ?
|
|
168
|
+
AND project_id = ?
|
|
169
|
+
AND env_id = ?
|
|
170
|
+
AND wallet_id = ?`, [walletId])
|
|
171
|
+
};
|
|
172
|
+
/** Statements on `email_otp_auth_states`. */
|
|
173
|
+
const emailOtpAuthStateRows = {
|
|
174
|
+
select: (prepare, walletId) => prepare(`SELECT record_json, updated_at_ms
|
|
175
|
+
FROM email_otp_auth_states
|
|
176
|
+
WHERE namespace = ?
|
|
177
|
+
AND org_id = ?
|
|
178
|
+
AND project_id = ?
|
|
179
|
+
AND env_id = ?
|
|
180
|
+
AND wallet_id = ?
|
|
181
|
+
LIMIT 1`, [walletId]),
|
|
182
|
+
upsert: (prepare, record) => prepare(`INSERT INTO email_otp_auth_states (
|
|
183
|
+
namespace,
|
|
184
|
+
org_id,
|
|
185
|
+
project_id,
|
|
186
|
+
env_id,
|
|
187
|
+
wallet_id,
|
|
188
|
+
provider_user_id,
|
|
189
|
+
record_org_id,
|
|
190
|
+
record_json,
|
|
191
|
+
created_at_ms,
|
|
192
|
+
updated_at_ms
|
|
193
|
+
)
|
|
194
|
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
|
|
195
|
+
ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
|
|
196
|
+
DO UPDATE SET
|
|
197
|
+
provider_user_id = EXCLUDED.provider_user_id,
|
|
198
|
+
record_org_id = EXCLUDED.record_org_id,
|
|
199
|
+
record_json = EXCLUDED.record_json,
|
|
200
|
+
created_at_ms = EXCLUDED.created_at_ms,
|
|
201
|
+
updated_at_ms = EXCLUDED.updated_at_ms`, [
|
|
202
|
+
record.walletId,
|
|
203
|
+
record.providerUserId,
|
|
204
|
+
record.orgId,
|
|
205
|
+
JSON.stringify(record),
|
|
206
|
+
record.createdAtMs,
|
|
207
|
+
record.updatedAtMs
|
|
208
|
+
])
|
|
209
|
+
};
|
|
210
|
+
const INSERT_UNLOCK_CHALLENGE_SQL = `INSERT INTO email_otp_unlock_challenges (
|
|
211
|
+
namespace,
|
|
212
|
+
org_id,
|
|
213
|
+
project_id,
|
|
214
|
+
env_id,
|
|
215
|
+
challenge_id,
|
|
216
|
+
wallet_id,
|
|
217
|
+
user_id,
|
|
218
|
+
record_org_id,
|
|
219
|
+
record_json,
|
|
220
|
+
created_at_ms,
|
|
221
|
+
expires_at_ms
|
|
222
|
+
)
|
|
223
|
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
|
|
224
|
+
function unlockChallengeValues(record) {
|
|
225
|
+
return [
|
|
226
|
+
record.challengeId,
|
|
227
|
+
record.walletId,
|
|
228
|
+
record.userId,
|
|
229
|
+
record.orgId || "",
|
|
230
|
+
JSON.stringify(record),
|
|
231
|
+
record.createdAtMs,
|
|
232
|
+
record.expiresAtMs
|
|
233
|
+
];
|
|
234
|
+
}
|
|
235
|
+
/** Statements on `email_otp_unlock_challenges`. */
|
|
236
|
+
const emailOtpUnlockChallengeRows = {
|
|
237
|
+
insert: (prepare, record) => prepare(INSERT_UNLOCK_CHALLENGE_SQL, unlockChallengeValues(record)),
|
|
238
|
+
upsert: (prepare, record) => prepare(`${INSERT_UNLOCK_CHALLENGE_SQL}
|
|
239
|
+
ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
|
|
240
|
+
DO UPDATE SET
|
|
241
|
+
wallet_id = EXCLUDED.wallet_id,
|
|
242
|
+
user_id = EXCLUDED.user_id,
|
|
243
|
+
record_org_id = EXCLUDED.record_org_id,
|
|
244
|
+
record_json = EXCLUDED.record_json,
|
|
245
|
+
created_at_ms = EXCLUDED.created_at_ms,
|
|
246
|
+
expires_at_ms = EXCLUDED.expires_at_ms`, unlockChallengeValues(record)),
|
|
247
|
+
consume: (prepare, challengeId) => prepare(`DELETE FROM email_otp_unlock_challenges
|
|
248
|
+
WHERE namespace = ?
|
|
249
|
+
AND org_id = ?
|
|
250
|
+
AND project_id = ?
|
|
251
|
+
AND env_id = ?
|
|
252
|
+
AND challenge_id = ?
|
|
253
|
+
RETURNING record_json, expires_at_ms`, [challengeId])
|
|
254
|
+
};
|
|
255
|
+
function offerWalletIdsJson(candidates) {
|
|
256
|
+
const walletIds = [];
|
|
257
|
+
for (const candidate of candidates) walletIds.push(candidate.walletId);
|
|
258
|
+
return JSON.stringify(walletIds);
|
|
259
|
+
}
|
|
260
|
+
const PENDING_ATTEMPTS_SQL = `SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
|
|
261
|
+
FROM email_otp_registration_attempts
|
|
262
|
+
WHERE namespace = ?
|
|
263
|
+
AND org_id = ?
|
|
264
|
+
AND project_id = ?
|
|
265
|
+
AND env_id = ?
|
|
266
|
+
AND provider_subject = ?
|
|
267
|
+
AND email = ?
|
|
268
|
+
AND state IN ('started', 'key_finalized')
|
|
269
|
+
AND expires_at_ms > ?`;
|
|
270
|
+
/** Statements on `email_otp_registration_attempts`. */
|
|
271
|
+
const emailOtpRegistrationAttemptRows = {
|
|
272
|
+
upsert: (prepare, record) => prepare(`INSERT INTO email_otp_registration_attempts (
|
|
273
|
+
namespace,
|
|
274
|
+
org_id,
|
|
275
|
+
project_id,
|
|
276
|
+
env_id,
|
|
277
|
+
attempt_id,
|
|
278
|
+
provider_subject,
|
|
279
|
+
email,
|
|
280
|
+
wallet_id,
|
|
281
|
+
state,
|
|
282
|
+
owner_proof_binding_digest,
|
|
283
|
+
runtime_org_id,
|
|
284
|
+
runtime_policy_key,
|
|
285
|
+
offer_wallet_ids_json,
|
|
286
|
+
record_json,
|
|
287
|
+
created_at_ms,
|
|
288
|
+
updated_at_ms,
|
|
289
|
+
expires_at_ms
|
|
290
|
+
)
|
|
291
|
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
|
|
292
|
+
ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
|
|
293
|
+
DO UPDATE SET
|
|
294
|
+
provider_subject = EXCLUDED.provider_subject,
|
|
295
|
+
email = EXCLUDED.email,
|
|
296
|
+
wallet_id = EXCLUDED.wallet_id,
|
|
297
|
+
state = EXCLUDED.state,
|
|
298
|
+
owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
|
|
299
|
+
runtime_org_id = EXCLUDED.runtime_org_id,
|
|
300
|
+
runtime_policy_key = EXCLUDED.runtime_policy_key,
|
|
301
|
+
offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
|
|
302
|
+
record_json = EXCLUDED.record_json,
|
|
303
|
+
created_at_ms = EXCLUDED.created_at_ms,
|
|
304
|
+
updated_at_ms = EXCLUDED.updated_at_ms,
|
|
305
|
+
expires_at_ms = EXCLUDED.expires_at_ms`, [
|
|
306
|
+
record.attemptId,
|
|
307
|
+
record.providerSubject,
|
|
308
|
+
record.email,
|
|
309
|
+
record.walletId,
|
|
310
|
+
record.state,
|
|
311
|
+
record.ownerProofBindingDigest,
|
|
312
|
+
record.runtimePolicyScope?.orgId || "",
|
|
313
|
+
runtimePolicyScopeKey(record.runtimePolicyScope),
|
|
314
|
+
offerWalletIdsJson(record.offerCandidates),
|
|
315
|
+
JSON.stringify(record),
|
|
316
|
+
record.createdAtMs,
|
|
317
|
+
record.updatedAtMs,
|
|
318
|
+
record.expiresAtMs
|
|
319
|
+
]),
|
|
320
|
+
select: (prepare, attemptId) => prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
|
|
321
|
+
FROM email_otp_registration_attempts
|
|
322
|
+
WHERE namespace = ?
|
|
323
|
+
AND org_id = ?
|
|
324
|
+
AND project_id = ?
|
|
325
|
+
AND env_id = ?
|
|
326
|
+
AND attempt_id = ?
|
|
327
|
+
LIMIT 1`, [attemptId]),
|
|
328
|
+
selectStarted: (prepare, input) => prepare(`${PENDING_ATTEMPTS_SQL}
|
|
329
|
+
AND owner_proof_binding_digest = ?
|
|
330
|
+
AND runtime_org_id = ?
|
|
331
|
+
AND runtime_policy_key = ?
|
|
332
|
+
ORDER BY updated_at_ms DESC
|
|
333
|
+
LIMIT 1`, [
|
|
334
|
+
input.providerSubject,
|
|
335
|
+
input.email,
|
|
336
|
+
input.nowMs,
|
|
337
|
+
input.ownerProofBindingDigest,
|
|
338
|
+
input.orgId,
|
|
339
|
+
runtimePolicyScopeKey(input.runtimePolicyScope)
|
|
340
|
+
]),
|
|
341
|
+
selectPending: (prepare, input) => prepare(PENDING_ATTEMPTS_SQL, [
|
|
342
|
+
input.providerSubject,
|
|
343
|
+
input.email,
|
|
344
|
+
input.nowMs
|
|
345
|
+
]),
|
|
346
|
+
deleteExpired: (prepare, nowMs) => prepare(`DELETE FROM email_otp_registration_attempts
|
|
347
|
+
WHERE namespace = ?
|
|
348
|
+
AND org_id = ?
|
|
349
|
+
AND project_id = ?
|
|
350
|
+
AND env_id = ?
|
|
351
|
+
AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]),
|
|
352
|
+
selectLiveForWallet: (prepare, walletId, nowMs) => prepare(`SELECT 1 AS found
|
|
353
|
+
FROM email_otp_registration_attempts
|
|
354
|
+
WHERE namespace = ?
|
|
355
|
+
AND org_id = ?
|
|
356
|
+
AND project_id = ?
|
|
357
|
+
AND env_id = ?
|
|
358
|
+
AND state IN ('started', 'key_finalized')
|
|
359
|
+
AND expires_at_ms > ?
|
|
360
|
+
AND (
|
|
361
|
+
wallet_id = ?
|
|
362
|
+
OR EXISTS (
|
|
363
|
+
SELECT 1
|
|
364
|
+
FROM json_each(offer_wallet_ids_json)
|
|
365
|
+
WHERE value = ?
|
|
366
|
+
)
|
|
367
|
+
)
|
|
368
|
+
LIMIT 1`, [
|
|
369
|
+
nowMs,
|
|
370
|
+
walletId,
|
|
371
|
+
walletId
|
|
372
|
+
]),
|
|
373
|
+
delete: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
|
|
374
|
+
WHERE namespace = ?
|
|
375
|
+
AND org_id = ?
|
|
376
|
+
AND project_id = ?
|
|
377
|
+
AND env_id = ?
|
|
378
|
+
AND attempt_id = ?`, [attemptId])
|
|
379
|
+
};
|
|
380
|
+
//#endregion
|
|
381
|
+
export { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows };
|
|
382
|
+
|
|
383
|
+
//# sourceMappingURL=emailOtpD1Statements.js.map
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
|
|
2
|
-
import { isValidAccountId } from "../shared-ts/src/utils/near.js";
|
|
3
2
|
import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
|
|
3
|
+
import { isValidAccountId } from "../shared-ts/src/utils/near.js";
|
|
4
4
|
import "../shared-ts/src/utils/validation.js";
|
|
5
5
|
//#region src/core/hostedAccountIds.ts
|
|
6
6
|
const DOMAIN = "near_account_slug_v1";
|
|
@@ -220,6 +220,6 @@ async function deriveHostedNearAccountId(input) {
|
|
|
220
220
|
return walletId;
|
|
221
221
|
}
|
|
222
222
|
//#endregion
|
|
223
|
-
export { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId
|
|
223
|
+
export { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId };
|
|
224
224
|
|
|
225
225
|
//# sourceMappingURL=hostedAccountIds.js.map
|
|
@@ -1,58 +1,12 @@
|
|
|
1
|
+
import { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
|
|
1
2
|
//#region src/core/keyMaterialBrands.ts
|
|
2
|
-
function parseNonEmptyBrand(value, label) {
|
|
3
|
-
const normalized = String(value ?? "").trim();
|
|
4
|
-
if (!normalized) throw new Error(`${label} must be a non-empty string`);
|
|
5
|
-
return normalized;
|
|
6
|
-
}
|
|
7
|
-
function parseEcdsaDerivationKeyVersion(value) {
|
|
8
|
-
return parseNonEmptyBrand(value, "ECDSA DERIVATION key version");
|
|
9
|
-
}
|
|
10
|
-
function parseSigningSessionSealKeyVersion(value) {
|
|
11
|
-
return parseNonEmptyBrand(value, "signing-session seal key version");
|
|
12
|
-
}
|
|
13
|
-
function parseEd25519ClientVerifyingShareB64u(value) {
|
|
14
|
-
return parseNonEmptyBrand(value, "Ed25519 client verifying share");
|
|
15
|
-
}
|
|
16
|
-
function parseEcdsaClientVerifyingShareB64u(value) {
|
|
17
|
-
return parseNonEmptyBrand(value, "ECDSA client verifying share");
|
|
18
|
-
}
|
|
19
|
-
function parseEd25519RelayerKeyId(value) {
|
|
20
|
-
return parseNonEmptyBrand(value, "Ed25519 relayer key id");
|
|
21
|
-
}
|
|
22
|
-
function parseEcdsaRelayerKeyId(value) {
|
|
23
|
-
return parseNonEmptyBrand(value, "ECDSA relayer key id");
|
|
24
|
-
}
|
|
25
3
|
function parseEcdsaThresholdKeyId(value) {
|
|
26
4
|
return parseNonEmptyBrand(value, "ECDSA threshold key id");
|
|
27
5
|
}
|
|
28
|
-
function parseEcdsaKeyHandle(value) {
|
|
29
|
-
return parseNonEmptyBrand(value, "ECDSA key handle");
|
|
30
|
-
}
|
|
31
|
-
function formatEcdsaDerivationKeyVersionForWire(value) {
|
|
32
|
-
return value;
|
|
33
|
-
}
|
|
34
|
-
function formatSigningSessionSealKeyVersionForWire(value) {
|
|
35
|
-
return value;
|
|
36
|
-
}
|
|
37
6
|
function formatEd25519ClientVerifyingShareB64uForWire(value) {
|
|
38
7
|
return value;
|
|
39
8
|
}
|
|
40
|
-
function formatEcdsaClientVerifyingShareB64uForWire(value) {
|
|
41
|
-
return value;
|
|
42
|
-
}
|
|
43
|
-
function formatEd25519RelayerKeyIdForWire(value) {
|
|
44
|
-
return value;
|
|
45
|
-
}
|
|
46
|
-
function formatEcdsaRelayerKeyIdForWire(value) {
|
|
47
|
-
return value;
|
|
48
|
-
}
|
|
49
|
-
function formatEcdsaThresholdKeyIdForWire(value) {
|
|
50
|
-
return value;
|
|
51
|
-
}
|
|
52
|
-
function formatEcdsaKeyHandleForWire(value) {
|
|
53
|
-
return value;
|
|
54
|
-
}
|
|
55
9
|
//#endregion
|
|
56
|
-
export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId,
|
|
10
|
+
export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
|
|
57
11
|
|
|
58
12
|
//# sourceMappingURL=keyMaterialBrands.js.map
|