@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/authorization/service.d.ts

@@ -1,6 +1,9 @@
+import type { D1EcdsaAdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { EcdsaMaterialRead } from '../core/d1EcdsaSignerRead';
+import type { D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
-import type { ActiveWalletSessionQuota, AuthorizedOperation, AuthorizedOperationInput, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, HostedWalletSeamsSessionExchangeCode, HostedWalletSeamsSessionExchangeDeliveryV2, HostedWalletSeamsSessionExchangeNonce, IssuedHostedWalletSeamsSessionExchangeV2, PersistedHostedWalletSeamsSessionExchangeV2Result, RedeemHostedWalletSeamsSessionExchangeV2Input, RedeemHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionStatusV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, SessionOrigin, VerifiedAuthorizationEvidenceSet, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, ExactWalletSessionQuotaProjectionV1, DirectV2CommitResult, DirectV2IssueResult, PersistedActiveWalletSessionAuthorizationV2, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, WalletSessionAuthorizationV2, VerifiedOwnerProof } from './domain';
+import type { ActiveWalletSessionQuota, AuthorizedOperation, AuthorizedOperationInput, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, HostedWalletSeamsSessionExchangeCode, HostedWalletSeamsSessionExchangeDeliveryV2, HostedWalletSeamsSessionExchangeNonce, IssuedHostedWalletSeamsSessionExchangeV2, PersistedHostedWalletSeamsSessionExchangeV2Result, RedeemHostedWalletSeamsSessionExchangeV2Input, RedeemHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, SessionOrigin, VerifiedAuthorizationEvidenceSet, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, ExactWalletSessionQuotaProjectionV1, DirectV2CommitResult, DirectV2IssueResult, PersistedActiveWalletSessionAuthorizationV2, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, WalletSessionAuthorizationV2, VerifiedOwnerProof } from './domain';
 import { type AuthorizedOperationId, type PrincipalId, type WalletSessionMintId, type TenantId, type WalletSessionAuthorizationId, type WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
 import { type VerifiedWalletOperationFactorEvidenceSetInput, type VerifiedOwnerProofInput } from './factorEvidence';
 import type { CapabilityPolicyPort, AuthorizationEvidenceRequirementEvaluation, ParseAuthorizationEvidenceRequirementResult } from './capabilityPolicy';
@@ -9,6 +12,11 @@ import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitive
 import type { RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { CapabilityOperationFingerprintDigest } from '../../../shared-ts/src/authorization/operationFingerprint';
+export type EcdsaWalletSessionAdmissionRead = {
+    readonly snapshot: WalletSessionAdmissionSnapshotV2;
+    readonly materialRead: EcdsaMaterialRead;
+    readonly policyRead: D1EcdsaAdmissionPolicyRead;
+};
 export interface AuthorizationSessionPort {
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
     redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
@@ -61,6 +69,17 @@ export interface AuthorizationGrantPort {
         readonly tokenHash: DigestB64u;
         readonly nowMs: number;
     }): Promise<IssuedWalletSessionAuthorizationV2 | null>;
+    readWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -71,6 +90,11 @@ export interface AuthorizationGrantPort {
         readonly tokenHash: DigestB64u;
         readonly nowMs: number;
     }): Promise<ExactWalletSessionStatusV2>;
+    readExactWalletSessionStatusSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<ExactWalletSessionStatusSnapshotV2>;
 }
 export interface AuthorizedOperationPort {
     readAuthorizedOperationById(input: {
@@ -85,6 +109,12 @@ export interface AuthorizedOperationPort {
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
+    /** The admission `admitAuthorizedOperation` would make, prepared, not applied. */
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<PreparedAuthorizedOperationAdmission>;
+    /** The rejection a prepared admission's failed batch stands for, if any. */
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): AuthorizedOperationAdmissionRejection | null;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: CompletedCapabilityOperationResult;
@@ -92,6 +122,9 @@ export interface AuthorizedOperationPort {
         readonly completedAtMs: number;
     }): Promise<AuthorizedOperation>;
 }
+export type AuthorizedOperationAdmissionRejection = {
+    readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
+};
 export type AuthorizedOperationAdmissionResult = {
     readonly kind: 'claimed';
     readonly operation: AuthorizedOperation;
@@ -101,9 +134,22 @@ export type AuthorizedOperationAdmissionResult = {
 } | {
     readonly kind: 'operation_in_progress';
     readonly operation: AuthorizedOperation;
+} | AuthorizedOperationAdmissionRejection;
+/**
+ * An admission prepared for a batch another store owns, after the reads
+ * `admitAuthorizedOperation` makes: an operation already admitted for the
+ * fingerprint answers as that call would, and nothing is written.
+ */
+export type PreparedAuthorizedOperationAdmission = {
+    readonly kind: 'prepared';
+    readonly statements: readonly D1PreparedStatementLike[];
 } | {
-    readonly kind: 'authorization_grant_rejected' | 'verified_step_up_rejected' | 'wallet_session_quota_exhausted' | 'material_mismatch';
-};
+    readonly kind: 'replayed';
+    readonly operation: AuthorizedOperation;
+} | {
+    readonly kind: 'operation_in_progress';
+    readonly operation: AuthorizedOperation;
+} | AuthorizedOperationAdmissionRejection;
 export type EcdsaMaterialActivationScope = Readonly<{
     readonly walletId: WalletId;
     readonly keyHandle: string;
@@ -174,6 +220,10 @@ export declare class AuthorizationService {
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
+    prepareAuthorizedOperationAdmission(input: {
+        readonly operation: AuthorizedOperationInput;
+    }): Promise<PreparedAuthorizedOperationAdmission>;
+    classifyAuthorizedOperationAdmissionFailure(error: unknown): AuthorizedOperationAdmissionRejection | null;
     completeAuthorizedOperation(input: {
         readonly operation: AuthorizedOperation;
         readonly result: CompletedCapabilityOperationResult;
@@ -217,6 +267,18 @@ export declare class AuthorizationService {
         readonly token: string;
         readonly nowMs: number;
     }): Promise<IssuedWalletSessionAuthorizationV2 | null>;
+    /** The session, its authority and its auth method from one read. */
+    readWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+    }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readLiveWalletSessionAuthorizationProjectionByCredential(input: {
         readonly tenantId: TenantId;
         readonly token: string;
@@ -237,6 +299,12 @@ export declare class AuthorizationService {
         readonly token: string;
         readonly nowMs: number;
     }): Promise<ExactWalletSessionStatusV2>;
+    /** The exact status with the authority and auth method it was judged against. */
+    readExactWalletSessionStatusSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+    }): Promise<ExactWalletSessionStatusSnapshotV2>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -63,7 +63,11 @@ export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRe
 export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization';
 export * from './router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare';
 export * from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export * from './router/domains/signingOperations/routerAbPrivateSigningWorker';
+export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAdmissionEvaluationInput, type RouterAbNormalSigningAdmissionFailure, type RouterAbNormalSigningAdmissionFailureCode, type RouterAbNormalSigningAdmissionInput, type RouterAbNormalSigningAdmissionResult, type RouterAbNormalSigningRouteAdmission, type RouterAbNormalSigningRouteRuntime, type RouterAbSigningWorkerJsonResult, } from './router/domains/signingOperations/routerAbNormalSigningAdmission';
+export { authenticateRouterAbWalletOperationStepUpIdentity } from './router/domains/signingOperations/routerAbOperationStepUp';
+export { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaDerivationPrivateSigningWorkerBody, type RouterAbEd25519NormalSigningScopeV2, type RouterAbEd25519PrivateSigningPath, type RouterAbEd25519PrivateSigningWorkerBody, routerAbNormalSigningMaterialSourceFromActiveLaneV1, type RouterAbNormalSigningMaterialSourceV1, } from './router/domains/signingOperations/routerAbPrivateSigningWorker';
+export * from './router/domains/signingOperations/routerAbEd25519NormalSigningRoute';
+export * from './router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute';
 export * from './router/framework/routerApi';
 export * from './router/auth/routerApiCredentialAuth';
 export * from './router/auth/routerApiKeyAuth';
@@ -84,7 +88,7 @@ export { keccak256Bytes } from '../../shared-ts/src/utils/keccak';
 export { normalizeBoundedPositiveInteger, normalizeLowercaseString, normalizeTrimmedString, } from '../../shared-ts/src/utils/normalize';
 export { ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, parseRouterAbPublicKeysetV2, type RouterAbPublicKeysetV2, } from '../../shared-ts/src/utils/routerAbPublicKeyset';
 export { secureRandomBase36, secureRandomBase64Url } from '../../shared-ts/src/utils/secureRandomId';
-export { ensureLeadingSlash, isPlainObject, toOptionalTrimmedString, } from '../../shared-ts/src/utils/validation';
+export { ensureLeadingSlash, isObject, isPlainObject, toOptionalTrimmedString, } from '../../shared-ts/src/utils/validation';
 export { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, } from '../../shared-ts/src/utils/routerAbEd25519Yao';
 export { ROUTER_AB_TRACE_ID_HEADER_V1 } from '../../shared-ts/src/utils/routerAbTraceContext';
 export type { RuntimePolicyScope } from '../../shared-ts/src/threshold/signingRootScope';

package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts

@@ -1,4 +1,7 @@
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord, GoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+import type { ThresholdRuntimePolicyScope } from './types';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput, PendingGoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+/** Parses JSON text; any other value, and text that is not JSON, comes back unchanged. */
+export declare function parseJsonRecord(raw: unknown): unknown;
 export declare function parseCurrentEmailOtpChallengeRecord(raw: unknown): EmailOtpChallengeRecord | null;
 export declare function parseCurrentEmailOtpChallengeRow(input: {
     recordJson: unknown;
@@ -20,6 +23,12 @@ export declare function parseCurrentGoogleEmailOtpRegistrationAttemptRow(input:
     expiresAtMs: unknown;
     updatedAtMs: unknown;
 }): GoogleEmailOtpRegistrationAttemptRecord | null;
+/** The scope as one comparable string, as D1 stores it in `runtime_policy_key`; empty when unset. */
+export declare function runtimePolicyScopeKey(scope: ThresholdRuntimePolicyScope | undefined): string;
+/** The pending attempt a registration with this owner binding resumes. */
+export declare function registrationAttemptMatchesStartedScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
+/** A pending attempt that a registration with a new owner binding replaces. */
+export declare function registrationAttemptMatchesReplacementScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
 export declare function parseCurrentEmailOtpWalletEnrollmentRecord(raw: unknown): EmailOtpWalletEnrollmentRecord | null;
 export declare function parseCurrentEmailOtpWalletEnrollmentRow(input: {
     recordJson: unknown;

package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts

@@ -1,6 +1,5 @@
 import type { NormalizedLogger } from './logger';
 import type { ThresholdRuntimePolicyScope, ThresholdStoreConfigInput } from './types';
-import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletEmailOtpChannel, WalletEmailOtpLoginOperation, WalletEmailOtpOperation } from '../../../shared-ts/src/utils/emailOtpDomain';
 import { WALLET_EMAIL_OTP_ACTIONS } from '../../../shared-ts/src/utils/emailOtpDomain';
 export type EmailOtpChannel = WalletEmailOtpChannel;
@@ -132,7 +131,6 @@ export interface EmailOtpUnlockChallengeStore {
     consume(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
     del(challengeId: string): Promise<void>;
 }
-export type GoogleEmailOtpRegistrationAttemptState = 'started' | 'key_finalized' | 'active' | 'abandoned' | 'failed' | 'expired';
 export type GoogleEmailOtpRegistrationOfferCandidateRecord = {
     candidateId: string;
     walletId: string;
@@ -163,50 +161,51 @@ type GoogleEmailOtpRegistrationAttemptBaseRecord = {
     expiresAtMs: number;
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
 };
-export type StartedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type StartedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'started';
     finalizedPublicKey?: never;
     failureCode?: never;
 };
-export type KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'key_finalized';
     finalizedPublicKey: string;
     failureCode?: never;
 };
-export type ActiveGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type ActiveGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'active';
     finalizedPublicKey?: string;
     failureCode?: never;
 };
-export type AbandonedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type AbandonedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'abandoned';
     finalizedPublicKey?: string;
     failureCode: string;
 };
-export type FailedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type FailedGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'failed';
     finalizedPublicKey?: string;
     failureCode: string;
 };
-export type ExpiredGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
+type ExpiredGoogleEmailOtpRegistrationAttemptRecord = GoogleEmailOtpRegistrationAttemptBaseRecord & GoogleEmailOtpRegistrationOfferBinding & {
     state: 'expired';
     finalizedPublicKey?: string;
     failureCode?: string;
 };
 export type GoogleEmailOtpRegistrationAttemptRecord = StartedGoogleEmailOtpRegistrationAttemptRecord | KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord | ActiveGoogleEmailOtpRegistrationAttemptRecord | AbandonedGoogleEmailOtpRegistrationAttemptRecord | FailedGoogleEmailOtpRegistrationAttemptRecord | ExpiredGoogleEmailOtpRegistrationAttemptRecord;
 export type PendingGoogleEmailOtpRegistrationAttemptRecord = StartedGoogleEmailOtpRegistrationAttemptRecord | KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord;
-export type GoogleEmailOtpRegistrationAttemptWithFinalizedPublicKey = KeyFinalizedGoogleEmailOtpRegistrationAttemptRecord | ActiveGoogleEmailOtpRegistrationAttemptRecord | AbandonedGoogleEmailOtpRegistrationAttemptRecord | FailedGoogleEmailOtpRegistrationAttemptRecord | ExpiredGoogleEmailOtpRegistrationAttemptRecord;
+/** A registration's subject, email, owner binding and runtime scope, as of `nowMs`. */
+export type GoogleEmailOtpRegistrationAttemptScopeInput = {
+    providerSubject: string;
+    email: string;
+    orgId: string;
+    ownerProofBindingDigest: string;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    nowMs: number;
+};
 export interface EmailOtpRegistrationAttemptStore {
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
     get(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
-    findStartedBySubjectEmail(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-    }): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
+    findStartedBySubjectEmail(input: GoogleEmailOtpRegistrationAttemptScopeInput): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
     abandonStartedBySubjectEmailExceptBinding(input: {
         providerSubject: string;
         email: string;
@@ -227,105 +226,6 @@ type EmailOtpStoreFactoryInput = {
     logger?: NormalizedLogger;
     isNode?: boolean;
 };
-export interface D1EmailOtpStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
-}
-export interface D1EmailOtpStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
-}
-type D1EmailOtpScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
-export declare const EMAIL_OTP_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS email_otp_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_subject_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      otp_channel TEXT NOT NULL,\n      owner_proof_binding_digest TEXT NOT NULL,\n      action TEXT NOT NULL,\n      operation TEXT NOT NULL,\n      otp_code TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (length(challenge_subject_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (otp_channel = 'email_otp'),\n      CHECK (length(owner_proof_binding_digest) > 0),\n      CHECK (length(action) > 0),\n      CHECK (length(operation) > 0),\n      CHECK (length(otp_code) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_challenges_context_idx\n      ON email_otp_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_subject_id,\n        wallet_id,\n        record_org_id,\n        otp_channel,\n        owner_proof_binding_digest,\n        action,\n        operation,\n        expires_at_ms\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_challenges_expires_idx\n      ON email_otp_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        expires_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_grants (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      grant_token TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      action TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      issued_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, grant_token),\n      CHECK (length(grant_token) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(challenge_id) > 0),\n      CHECK (length(action) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (issued_at_ms > 0),\n      CHECK (expires_at_ms > issued_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_grants_expires_idx\n      ON email_otp_grants (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        expires_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_wallet_enrollments (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      provider_user_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      verified_email TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(provider_user_id) > 0),\n      CHECK (length(record_org_id) > 0),\n      CHECK (length(verified_email) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_wallet_enrollments_provider_idx\n      ON email_otp_wallet_enrollments (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        record_org_id,\n        provider_user_id,\n        updated_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_auth_states (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      provider_user_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(provider_user_id) > 0),\n      CHECK (length(record_org_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_unlock_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_org_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_unlock_challenges_expires_idx\n      ON email_otp_unlock_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        expires_at_ms\n      )\n  ", "\n    CREATE TABLE IF NOT EXISTS email_otp_registration_attempts (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      attempt_id TEXT NOT NULL,\n      provider_subject TEXT NOT NULL,\n      email TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      state TEXT NOT NULL,\n      owner_proof_binding_digest TEXT NOT NULL,\n      runtime_org_id TEXT NOT NULL,\n      runtime_policy_key TEXT NOT NULL,\n      offer_wallet_ids_json TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),\n      CHECK (length(attempt_id) > 0),\n      CHECK (length(provider_subject) > 0),\n      CHECK (length(email) > 0),\n      CHECK (length(wallet_id) > 0),\n      CHECK (state IN ('started', 'key_finalized', 'active', 'abandoned', 'failed', 'expired')),\n      CHECK (length(owner_proof_binding_digest) > 0),\n      CHECK (json_valid(offer_wallet_ids_json)),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0),\n      CHECK (expires_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_subject_idx\n      ON email_otp_registration_attempts (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        provider_subject,\n        email,\n        state,\n        expires_at_ms,\n        owner_proof_binding_digest,\n        runtime_org_id,\n        runtime_policy_key,\n        updated_at_ms\n      )\n  ", "\n    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_wallet_idx\n      ON email_otp_registration_attempts (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        state,\n        expires_at_ms\n      )\n  "];
-export declare function ensureEmailOtpStoreD1Schema(options: D1EmailOtpStoreSchemaOptions): Promise<void>;
-export declare function resolveEmailOtpStoreNamespace(config: Record<string, unknown>): string;
-declare abstract class D1EmailOtpStoreBase {
-    protected readonly database: D1DatabaseLike;
-    protected readonly scope: D1EmailOtpScope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
-    constructor(input: D1EmailOtpStoreOptions);
-    protected ensureSchema(): Promise<void>;
-    protected bindScope(statement: string, values?: readonly unknown[]): D1PreparedStatementLike;
-}
-export declare class D1EmailOtpChallengeStore extends D1EmailOtpStoreBase implements EmailOtpChallengeStore {
-    readonly adapterKind = "d1";
-    put(record: EmailOtpChallengeRecord): Promise<void>;
-    get(challengeId: string): Promise<EmailOtpChallengeRecord | null>;
-    deleteExpired(nowMs: number): Promise<EmailOtpChallengeRecord[]>;
-    countActiveByContext(input: EmailOtpChallengeContextInput): Promise<number>;
-    findLatestActiveByContext(input: EmailOtpChallengeContextInput): Promise<EmailOtpChallengeRecord | null>;
-    deleteOldestActiveByContext(input: EmailOtpChallengeContextInput): Promise<EmailOtpChallengeRecord | null>;
-    findActiveByContext(input: EmailOtpChallengeContextInput & {
-        otpCode: string;
-    }): Promise<EmailOtpChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
-}
-export declare class D1EmailOtpGrantStore extends D1EmailOtpStoreBase implements EmailOtpGrantStore {
-    readonly adapterKind = "d1";
-    put(record: EmailOtpGrantRecord): Promise<void>;
-    get(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    consume(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    del(grantToken: string): Promise<void>;
-}
-export declare class D1EmailOtpWalletEnrollmentStore extends D1EmailOtpStoreBase implements EmailOtpWalletEnrollmentStore {
-    readonly adapterKind = "d1";
-    get(walletId: string): Promise<EmailOtpWalletEnrollmentRecord | null>;
-    getByProviderUserId(input: {
-        providerUserId: string;
-        orgId: string;
-    }): Promise<EmailOtpWalletEnrollmentRecord | null>;
-    put(record: EmailOtpWalletEnrollmentRecord): Promise<void>;
-    del(walletId: string): Promise<void>;
-}
-export declare class D1EmailOtpAuthStateStore extends D1EmailOtpStoreBase implements EmailOtpAuthStateStore {
-    readonly adapterKind = "d1";
-    get(walletId: string): Promise<EmailOtpAuthStateRecord | null>;
-    put(record: EmailOtpAuthStateRecord): Promise<void>;
-    del(walletId: string): Promise<void>;
-}
-export declare class D1EmailOtpUnlockChallengeStore extends D1EmailOtpStoreBase implements EmailOtpUnlockChallengeStore {
-    readonly adapterKind = "d1";
-    put(record: EmailOtpUnlockChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
-}
-export declare class D1EmailOtpRegistrationAttemptStore extends D1EmailOtpStoreBase implements EmailOtpRegistrationAttemptStore {
-    readonly adapterKind = "d1";
-    put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
-    get(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
-    findStartedBySubjectEmail(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-    }): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
-    abandonStartedBySubjectEmailExceptBinding(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-        failureCode: 'owner_proof_binding_replaced';
-    }): Promise<number>;
-    hasLiveStartedWalletAttempt(input: {
-        walletId: string;
-        nowMs: number;
-    }): Promise<boolean>;
-    deleteExpired(nowMs: number): Promise<number>;
-    private deleteAttempt;
-}
 export declare function createEmailOtpChallengeStore(input?: EmailOtpStoreFactoryInput): EmailOtpChallengeStore;
 export declare function createEmailOtpGrantStore(input?: EmailOtpStoreFactoryInput): EmailOtpGrantStore;
 export declare function createEmailOtpWalletEnrollmentStore(input?: EmailOtpStoreFactoryInput): EmailOtpWalletEnrollmentStore;

package/dist/types/wallet-server/src/core/IdentityStore.d.ts

@@ -1,5 +1,4 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
+import { type StoreFactoryInput } from './storeBackends';
 export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema, } from './d1IdentityStore';
 export type { D1IdentityStoreOptions, D1IdentityStoreSchemaOptions } from './d1IdentityStore';
 export type IdentitySubjectRecord = {
@@ -49,9 +48,5 @@ export interface IdentityStore {
     }): Promise<UnlinkIdentityResult>;
 }
 export declare function resolveIdentityStoreNamespace(config: Record<string, unknown>): string;
-export declare function createIdentityStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): IdentityStore;
+export declare function createIdentityStore(input: StoreFactoryInput): IdentityStore;
 //# sourceMappingURL=IdentityStore.d.ts.map

package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts

@@ -1,6 +1,6 @@
 import type { NormalizedLogger } from './logger';
 import { type WebAuthnRpId } from '../../../shared-ts/src/utils/domainIds';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 export type NearPublicKeyKind = 'threshold' | 'local' | 'backup' | 'ephemeral';
 export type NearPublicKeyAuthBinding = {
     readonly kind: 'passkey';
@@ -25,28 +25,18 @@ export interface NearPublicKeyStore {
     put(record: NearPublicKeyRecord): Promise<void>;
     listByUserId(userId: string): Promise<NearPublicKeyRecord[]>;
 }
-export interface D1NearPublicKeyStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1NearPublicKeyStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1NearPublicKeyStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1NearPublicKeyStoreOptions extends D1TenantStoreOptions {
 }
 export declare const NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS near_public_keys (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      public_key TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      signer_slot INTEGER,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      removed_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, public_key),\n      CHECK (length(user_id) > 0),\n      CHECK (length(public_key) > 0),\n      CHECK (kind IN ('threshold', 'local', 'backup', 'ephemeral')),\n      CHECK (signer_slot IS NULL OR signer_slot >= 1),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0),\n      CHECK (removed_at_ms IS NULL OR removed_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS near_public_keys_user_idx\n      ON near_public_keys (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        signer_slot,\n        created_at_ms\n      )\n  "];
 export declare function ensureNearPublicKeyStoreD1Schema(options: D1NearPublicKeyStoreSchemaOptions): Promise<void>;
+/** A user's NEAR public keys, in signer-slot order; binds the scope, then the user. */
+export declare const NEAR_PUBLIC_KEYS_BY_USER_SQL = "SELECT record_json\n         FROM near_public_keys\n        WHERE namespace = ?\n          AND org_id = ?\n          AND project_id = ?\n          AND env_id = ?\n          AND user_id = ?\n        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC";
 export declare class D1NearPublicKeyStore implements NearPublicKeyStore {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
+    private readonly table;
     constructor(input: D1NearPublicKeyStoreOptions);
-    private ensureSchema;
-    private bindScope;
     put(record: NearPublicKeyRecord): Promise<void>;
     listByUserId(userId: string): Promise<NearPublicKeyRecord[]>;
 }