@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts

@@ -1,50 +1,21 @@
 import { type WalletAuthAuthority } from '../../../../shared-ts/src/utils/walletAuthAuthority';
-import type { EcdsaDerivationClientBootstrapRequest, EcdsaDerivationPublicIdentity, ThresholdEd25519AuthorityScope } from '../types';
-import { type EcdsaKeyHandle } from '../keyMaterialBrands';
-export type ThresholdValidationOk = {
-    ok: true;
-};
-export type ThresholdValidationErr = {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type ThresholdValidationResult = ThresholdValidationOk | ThresholdValidationErr;
-export declare function isObject(v: unknown): v is Record<string, unknown>;
-export declare function isValidNumber(v: unknown): v is number;
-export type ParsedThresholdEcdsaSigningRootMetadata = {
-    signingRootId: string;
-    signingRootVersion?: string;
-    walletKeyVersion: string;
-    derivationVersion: number;
-};
+import type { EcdsaDerivationPublicIdentity, ThresholdEd25519AuthorityScope } from '../types';
+import type { ThresholdEcdsaMpcSessionRecord, ThresholdEd25519CoordinatorSigningSessionRecord, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord } from './stores/SessionStore';
+import type { EcdsaWalletSessionRecord, Ed25519WalletSessionRecord } from './stores/WalletSessionStore';
 export declare function toPrefixWithColon(prefix: unknown, defaultPrefix: string): string;
 export declare function toThresholdEd25519KeyPrefix(prefix: unknown): string;
 export declare function toThresholdEd25519SessionPrefix(prefix: unknown): string;
 export declare function toThresholdEd25519WalletSessionPrefix(prefix: unknown): string;
 export declare function toThresholdEd25519PrefixFromBase(basePrefix: unknown, kind: 'key' | 'sess' | 'wallet-session'): string;
 export declare function canonicalThresholdEd25519RelayerKeyId(relayerKeyId: unknown): string;
-export declare function toThresholdEcdsaKeyPrefix(prefix: unknown): string;
 export declare function toThresholdEcdsaSessionPrefix(prefix: unknown): string;
 export declare function toThresholdEcdsaWalletSessionPrefix(prefix: unknown): string;
-export declare function toThresholdEcdsaPresignPrefix(prefix: unknown): string;
 export declare function toThresholdEcdsaPrefixFromBase(basePrefix: unknown, kind: 'key' | 'sess' | 'wallet-session' | 'presign'): string;
-export type ParsedThresholdEd25519RouterMaterial = {
+type ParsedThresholdEd25519RouterMaterial = {
     signingShareB64u: string;
     verifyingShareB64u: string;
 };
-export type ParsedThresholdEd25519ProvisioningKeyRecord = {
-    kind: 'provisioning';
-    walletId: string;
-    nearAccountId: string;
-    nearEd25519SigningKeyId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    publicKey: string;
-    keyVersion: string;
-    routerMaterial?: never;
-    recoveryExportCapable?: never;
-};
-export type ParsedThresholdEd25519ReadyKeyRecord = {
+type ParsedThresholdEd25519ReadyKeyRecord = {
     kind: 'ready';
     walletId: string;
     nearAccountId: string;
@@ -55,113 +26,16 @@ export type ParsedThresholdEd25519ReadyKeyRecord = {
     keyVersion: string;
     recoveryExportCapable: true;
 };
-export type ParsedThresholdEd25519KeyRecord = ParsedThresholdEd25519ProvisioningKeyRecord | ParsedThresholdEd25519ReadyKeyRecord;
-export declare function parseThresholdEd25519ReadyKeyRecord(raw: unknown): ParsedThresholdEd25519ReadyKeyRecord | null;
 export declare function parseThresholdEd25519KeyRecord(raw: unknown): ParsedThresholdEd25519ReadyKeyRecord | null;
 export declare function parseEcdsaDerivationPublicIdentity(raw: unknown): EcdsaDerivationPublicIdentity | null;
-export declare function parseEcdsaDerivationClientBootstrapRequest(raw: unknown): EcdsaDerivationClientBootstrapRequest | null;
-export type ParsedThresholdEd25519Commitments = {
-    hiding: string;
-    binding: string;
-};
-export declare function parseThresholdEd25519Commitments(raw: unknown): ParsedThresholdEd25519Commitments | null;
-export type ParsedThresholdEd25519CommitmentsById = Record<string, ParsedThresholdEd25519Commitments>;
-export declare function parseThresholdEd25519CommitmentsById(raw: unknown): ParsedThresholdEd25519CommitmentsById | null;
 export declare function parseThresholdEd25519AuthorityScope(raw: unknown): ThresholdEd25519AuthorityScope | null;
 export declare function thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority: WalletAuthAuthority): ThresholdEd25519AuthorityScope;
 export declare function thresholdEd25519AuthorityScopesMatch(left: ThresholdEd25519AuthorityScope, right: ThresholdEd25519AuthorityScope): boolean;
-export type ParsedThresholdEd25519MpcSessionRecord = {
-    expiresAtMs: number;
-    ecdsaThresholdKeyId?: string;
-    keyHandle?: string;
-    relayerKeyId: string;
-    purpose: string;
-    intentDigestB64u: string;
-    signingDigestB64u: string;
-    userId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    clientVerifyingShareB64u?: string;
-    participantIds: number[];
-} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
-export type ParsedThresholdEcdsaMpcSessionRecord = {
-    expiresAtMs: number;
-    ecdsaThresholdKeyId?: string;
-    keyHandle?: string;
-    relayerKeyId: string;
-    purpose: string;
-    intentDigestB64u: string;
-    signingDigestB64u: string;
-    walletId: string;
-    clientVerifyingShareB64u?: string;
-    participantIds: number[];
-} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
-export declare function parseThresholdEd25519MpcSessionRecord(raw: unknown): ParsedThresholdEd25519MpcSessionRecord | null;
-export declare function parseThresholdEcdsaMpcSessionRecord(raw: unknown): ParsedThresholdEcdsaMpcSessionRecord | null;
-export type ParsedThresholdEd25519SigningShareMaterial = {
-    kind: 'key_store';
-} | {
-    kind: 'embedded_cosigner_share';
-    relayerSigningShareB64u: string;
-};
-export type ParsedThresholdEd25519SigningSessionRecord = {
-    expiresAtMs: number;
-    mpcSessionId: string;
-    relayerKeyId: string;
-    signingDigestB64u: string;
-    userId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    commitmentsById: ParsedThresholdEd25519CommitmentsById;
-    signingShare: ParsedThresholdEd25519SigningShareMaterial;
-    relayerNoncesB64u: string;
-    participantIds: number[];
-};
-export declare function parseThresholdEd25519SigningSessionRecord(raw: unknown): ParsedThresholdEd25519SigningSessionRecord | null;
-export type ParsedThresholdEd25519StringById = Record<string, string>;
-export declare function parseThresholdEd25519StringById(raw: unknown): ParsedThresholdEd25519StringById | null;
-export type ParsedThresholdEd25519CoordinatorSigningSessionRecord = {
-    mode: 'cosigner';
-    expiresAtMs: number;
-    mpcSessionId: string;
-    relayerKeyId: string;
-    signingDigestB64u: string;
-    userId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    commitmentsById: ParsedThresholdEd25519CommitmentsById;
-    participantIds: number[];
-    groupPublicKey: string;
-    cosignerIds: number[];
-    cosignerRelayerUrlsById: ParsedThresholdEd25519StringById;
-    cosignerCoordinatorGrantsById: ParsedThresholdEd25519StringById;
-    relayerVerifyingSharesById: ParsedThresholdEd25519StringById;
-};
-export declare function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ParsedThresholdEd25519CoordinatorSigningSessionRecord | null;
-export type ParsedEd25519WalletSessionRecord = {
-    expiresAtMs: number;
-    relayerKeyId: string;
-    userId: string;
-    walletId: string;
-    nearAccountId: string;
-    nearEd25519SigningKeyId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    participantIds: number[];
-} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
-export declare function parseEd25519WalletSessionRecord(raw: unknown): ParsedEd25519WalletSessionRecord | null;
-type ParsedEcdsaWalletSessionRecordCore = {
-    expiresAtMs: number;
-    relayerKeyId: string;
-    walletId: string;
-    keyHandle: EcdsaKeyHandle;
-    participantIds: number[];
-};
-export type ParsedEcdsaWalletSessionRecord = ParsedEcdsaWalletSessionRecordCore & ({
-    signingRootId?: never;
-    signingRootVersion?: never;
-    walletKeyVersion?: never;
-    derivationVersion?: never;
-} | ParsedThresholdEcdsaSigningRootMetadata);
-export declare function parseEcdsaWalletSessionRecord(raw: unknown): ParsedEcdsaWalletSessionRecord | null;
-export declare function normalizeByteArray32(input: unknown): Uint8Array | null;
-export declare function toNearPublicKeyStr(v: unknown): string;
-export declare function extractAuthorizeSigningPublicKey(purpose: string, signingPayload: unknown): string;
+export declare function parseThresholdEd25519MpcSessionRecord(raw: unknown): ThresholdEd25519MpcSessionRecord | null;
+export declare function parseThresholdEcdsaMpcSessionRecord(raw: unknown): ThresholdEcdsaMpcSessionRecord | null;
+export declare function parseThresholdEd25519SigningSessionRecord(raw: unknown): ThresholdEd25519SigningSessionRecord | null;
+export declare function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ThresholdEd25519CoordinatorSigningSessionRecord | null;
+export declare function parseEd25519WalletSessionRecord(raw: unknown): Ed25519WalletSessionRecord | null;
+export declare function parseEcdsaWalletSessionRecord(raw: unknown): EcdsaWalletSessionRecord | null;
 export {};
 //# sourceMappingURL=validation.d.ts.map

package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts

@@ -1,12 +1,7 @@
-import type { ThresholdStoreConfigInput } from './types';
-import type { NormalizedLogger } from './logger';
 import type { WalletAuthMethodStore } from './d1WalletAuthMethodStore';
+import { type StoreFactoryInput } from './storeBackends';
 export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodV2Id, } from './d1WalletAuthMethodStore';
 export type { D1WalletAuthMethodStoreOptions, D1WalletAuthMethodStoreSchemaOptions, WalletAuthMethodRecord, WalletAuthMethodRecordV2Owned, WalletAuthMethodStore, WalletAuthMethodV2Store, } from './d1WalletAuthMethodStore';
 export declare function resolveWalletAuthMethodStoreNamespace(config: Record<string, unknown>): string;
-export declare function createWalletAuthMethodStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WalletAuthMethodStore;
+export declare function createWalletAuthMethodStore(input: StoreFactoryInput): WalletAuthMethodStore;
 //# sourceMappingURL=WalletAuthMethodStore.d.ts.map

package/dist/types/wallet-server/src/core/WalletStore.d.ts

@@ -1,11 +1,11 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdEcdsaChainTarget, ThresholdStoreConfigInput } from './types';
+import type { ThresholdEcdsaChainTarget } from './types';
 import type { WalletRegistrationEcdsaWalletKey, WalletId } from './registrationContracts';
 import { type EcdsaClientRootPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
 import { type RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
 import type { RouterAbEd25519YaoActivationResultV1, RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRecoveryAdmissionRequestV1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type StoreFactoryInput } from './storeBackends';
 export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, } from './d1WalletStore';
 export type { D1WalletStoreOptions, D1WalletStoreSchemaOptions } from './d1WalletStore';
 export type WalletRecord = {
@@ -51,7 +51,6 @@ export type WalletEd25519SignerRecord = {
     createdAtMs: number;
     updatedAtMs: number;
 };
-export declare function sameWalletEd25519SignerRecordV1(left: WalletEd25519SignerRecord, right: WalletEd25519SignerRecord): boolean;
 export type WalletEcdsaSignerKey = Omit<WalletRegistrationEcdsaWalletKey, 'evmFamilySigningKeySlotId'> & {
     evmFamilySigningKeySlotId?: never;
 };
@@ -135,9 +134,5 @@ export declare function buildWalletEd25519SignerId(input: {
     nearAccountId: string;
     signerSlot: number;
 }): string;
-export declare function createWalletStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WalletStore;
+export declare function createWalletStore(input: StoreFactoryInput): WalletStore;
 //# sourceMappingURL=WalletStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts

@@ -1,7 +1,6 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../shared-ts/src/utils/webauthnDeviceInfo';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import type { StoreFactoryInput } from './storeBackends';
+import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 export type WebAuthnAuthenticatorRecord = {
     version: 'webauthn_authenticator_v1';
     credentialIdB64u: string;
@@ -27,36 +26,30 @@ export interface WebAuthnAuthenticatorStore {
      */
     list?(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
 }
-export interface D1WebAuthnAuthenticatorStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WebAuthnAuthenticatorStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WebAuthnAuthenticatorStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1WebAuthnAuthenticatorStoreOptions extends D1TenantStoreOptions {
 }
+export type D1WebAuthnAuthenticatorRow = {
+    readonly credential_id_b64u?: unknown;
+    readonly credential_public_key_b64u?: unknown;
+    readonly counter?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+    readonly device_info_json?: unknown;
+};
 export declare const WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_authenticators (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      credential_public_key_b64u TEXT NOT NULL,\n      counter INTEGER NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      device_info_json TEXT NOT NULL DEFAULT '{}',\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, credential_id_b64u),\n      CHECK (length(user_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(credential_public_key_b64u) > 0),\n      CHECK (counter >= 0),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_authenticators_user_idx\n      ON webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureWebAuthnAuthenticatorStoreD1Schema(options: D1WebAuthnAuthenticatorStoreSchemaOptions): Promise<void>;
 export declare function resolveWebAuthnAuthenticatorStoreNamespace(config: Record<string, unknown>): string;
 export declare class D1WebAuthnAuthenticatorStore implements WebAuthnAuthenticatorStore {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
+    private readonly table;
+    private readonly prepare;
     constructor(input: D1WebAuthnAuthenticatorStoreOptions);
-    private ensureSchema;
     get(userId: string, credentialIdB64u: string): Promise<WebAuthnAuthenticatorRecord | null>;
     put(userId: string, record: WebAuthnAuthenticatorRecord): Promise<void>;
     del(userId: string, credentialIdB64u: string): Promise<void>;
     list(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
 }
-export declare function createWebAuthnAuthenticatorStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WebAuthnAuthenticatorStore;
+export declare function createWebAuthnAuthenticatorStore(input: StoreFactoryInput): WebAuthnAuthenticatorStore;
 //# sourceMappingURL=WebAuthnAuthenticatorStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts

@@ -1,5 +1,6 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput, ThresholdRuntimePolicyScope } from './types';
+import type { ThresholdRuntimePolicyScope } from './types';
+import type { StoreFactoryInput } from './storeBackends';
+import { type D1SchemaOptions, type D1TenantScope, type D1TenantStoreOptions } from './d1TenantStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 /**
  * The Ed25519 facts on a credential binding are denormalized from the wallet's
@@ -8,7 +9,7 @@ import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantR
  * that signer is committed. They are written together or not at all — a
  * binding never carries a partial Ed25519 identity.
  */
-export type WebAuthnCredentialBindingEd25519Facts = {
+type WebAuthnCredentialBindingEd25519Facts = {
     nearAccountId: string;
     nearEd25519SigningKeyId: string;
     signerSlot: number;
@@ -56,45 +57,26 @@ export interface WebAuthnCredentialBindingStore {
         rpId?: string;
     }): Promise<WebAuthnCredentialBindingRecord[]>;
 }
-export interface D1WebAuthnCredentialBindingStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WebAuthnCredentialBindingStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WebAuthnCredentialBindingStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
+export interface D1WebAuthnCredentialBindingStoreOptions extends D1TenantStoreOptions {
 }
-export type D1WebAuthnCredentialBindingScope = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
-export declare function prepareD1WebAuthnCredentialBindingPutStatement(input: {
+type D1WebAuthnCredentialBindingWrite = {
     readonly database: D1DatabaseLike;
-    readonly scope: D1WebAuthnCredentialBindingScope;
+    readonly scope: D1TenantScope;
     readonly record: WebAuthnCredentialBindingRecord;
-}): D1PreparedStatementLike;
+};
+export declare function prepareD1WebAuthnCredentialBindingPutStatement(input: D1WebAuthnCredentialBindingWrite): D1PreparedStatementLike;
 /** Insert-only binding write for credential promotion. */
-export declare function prepareD1WebAuthnCredentialBindingInsertStatement(input: {
-    readonly database: D1DatabaseLike;
-    readonly scope: D1WebAuthnCredentialBindingScope;
-    readonly record: WebAuthnCredentialBindingRecord;
-}): D1PreparedStatementLike;
+export declare function prepareD1WebAuthnCredentialBindingInsertStatement(input: D1WebAuthnCredentialBindingWrite): D1PreparedStatementLike;
 export declare const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_credential_bindings (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      -- Nullable until the wallet's Ed25519 Yao ceremony settles.\n      signer_slot INTEGER,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u),\n      CHECK (length(rp_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (signer_slot IS NULL OR signer_slot >= 1),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_credential_bindings_user_idx\n      ON webauthn_credential_bindings (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        rp_id,\n        signer_slot\n      )\n  "];
 export declare function ensureWebAuthnCredentialBindingStoreD1Schema(options: D1WebAuthnCredentialBindingStoreSchemaOptions): Promise<void>;
 export declare function resolveWebAuthnCredentialBindingStoreNamespace(config: Record<string, unknown>): string;
 export declare class D1WebAuthnCredentialBindingStore implements WebAuthnCredentialBindingStore {
     readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private schemaReady;
+    private readonly table;
+    private readonly prepare;
     constructor(input: D1WebAuthnCredentialBindingStoreOptions);
-    private ensureSchema;
     get(rpId: string, credentialIdB64u: string): Promise<WebAuthnCredentialBindingRecord | null>;
     put(record: WebAuthnCredentialBindingRecord): Promise<void>;
     del(rpId: string, credentialIdB64u: string): Promise<void>;
@@ -107,10 +89,6 @@ export declare class D1WebAuthnCredentialBindingStore implements WebAuthnCredent
         rpId?: string;
     }): Promise<WebAuthnCredentialBindingRecord[]>;
 }
-export declare function createWebAuthnCredentialBindingStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WebAuthnCredentialBindingStore;
+export declare function createWebAuthnCredentialBindingStore(input: StoreFactoryInput): WebAuthnCredentialBindingStore;
 export {};
 //# sourceMappingURL=WebAuthnCredentialBindingStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts

@@ -1,6 +1,6 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
+import type { StoreFactoryInput } from './storeBackends';
+import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnLoginChallengeRecord = {
     version: 'webauthn_login_challenge_v1';
     challengeId: string;
@@ -10,41 +10,16 @@ export type WebAuthnLoginChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnLoginChallengeStore {
-    put(record: WebAuthnLoginChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnLoginChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
+export interface WebAuthnLoginChallengeStore extends WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
 }
-export interface D1WebAuthnLoginChallengeStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WebAuthnLoginChallengeStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WebAuthnLoginChallengeStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
-    readonly now?: () => Date;
+export interface D1WebAuthnLoginChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
 }
 export declare const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare function ensureWebAuthnLoginChallengeStoreD1Schema(options: D1WebAuthnLoginChallengeStoreSchemaOptions): Promise<void>;
-export declare class D1WebAuthnLoginChallengeStore implements WebAuthnLoginChallengeStore {
-    readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private readonly now;
-    private schemaReady;
+export declare const ensureWebAuthnLoginChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
+export declare class D1WebAuthnLoginChallengeStore extends D1WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
     constructor(input: D1WebAuthnLoginChallengeStoreOptions);
-    private ensureSchema;
-    put(record: WebAuthnLoginChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnLoginChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
 }
-export declare function createWebAuthnLoginChallengeStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WebAuthnLoginChallengeStore;
+export declare function createWebAuthnLoginChallengeStore(input: StoreFactoryInput): WebAuthnLoginChallengeStore;
 //# sourceMappingURL=WebAuthnLoginChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts

@@ -1,6 +1,6 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdStoreConfigInput } from './types';
-import type { D1DatabaseLike } from '../storage/tenantRoute';
+import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
+import type { StoreFactoryInput } from './storeBackends';
+import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnSyncChallengeRecord = {
     version: 'webauthn_sync_challenge_v1';
     challengeId: string;
@@ -10,41 +10,16 @@ export type WebAuthnSyncChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnSyncChallengeStore {
-    put(record: WebAuthnSyncChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnSyncChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
+export interface WebAuthnSyncChallengeStore extends WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
 }
-export interface D1WebAuthnSyncChallengeStoreSchemaOptions {
-    readonly database: D1DatabaseLike;
+export interface D1WebAuthnSyncChallengeStoreSchemaOptions extends D1SchemaOptions {
 }
-export interface D1WebAuthnSyncChallengeStoreOptions {
-    readonly database: D1DatabaseLike;
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-    readonly ensureSchema?: boolean;
-    readonly now?: () => Date;
+export interface D1WebAuthnSyncChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
 }
 export declare const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare function ensureWebAuthnSyncChallengeStoreD1Schema(options: D1WebAuthnSyncChallengeStoreSchemaOptions): Promise<void>;
-export declare class D1WebAuthnSyncChallengeStore implements WebAuthnSyncChallengeStore {
-    readonly adapterKind = "d1";
-    private readonly database;
-    private readonly scope;
-    private readonly ensureSchemaOnUse;
-    private readonly now;
-    private schemaReady;
+export declare const ensureWebAuthnSyncChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
+export declare class D1WebAuthnSyncChallengeStore extends D1WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
     constructor(input: D1WebAuthnSyncChallengeStoreOptions);
-    private ensureSchema;
-    put(record: WebAuthnSyncChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<WebAuthnSyncChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
 }
-export declare function createWebAuthnSyncChallengeStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): WebAuthnSyncChallengeStore;
+export declare function createWebAuthnSyncChallengeStore(input: StoreFactoryInput): WebAuthnSyncChallengeStore;
 //# sourceMappingURL=WebAuthnSyncChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/authService/AuthService.d.ts

@@ -61,7 +61,6 @@ export declare class AuthService {
         runtimePolicyScope?: ThresholdRuntimePolicyScope;
         restartRegistrationOffer?: unknown;
     }): Promise<string>;
-    private cleanupGoogleEmailOtpRegistrationAttempts;
     consumeGoogleEmailOtpRegistrationAttemptRateLimit(input: {
         providerSubject?: unknown;
         email?: unknown;
@@ -198,7 +197,6 @@ export declare class AuthService {
      */
     createAccount(request: AccountCreationRequest): Promise<AccountCreationResult>;
     fundImplicitNearAccount(request: FundImplicitNearAccountRequest): Promise<FundImplicitNearAccountResult>;
-    private verifyRegistrationCredentialForIntent;
     /**
      * Standard WebAuthn assertion verification for lite flows.
      *
@@ -297,7 +295,6 @@ export declare class AuthService {
         code: string;
         message: string;
     }>;
-    private pruneExpiredEmailOtpChallenges;
     private readEmailOtpAuthStateForEnrollment;
     private putEmailOtpAuthStateForEnrollment;
     private createEmailOtpChallengeWithAction;

package/dist/types/wallet-server/src/core/authService/bytes.d.ts

@@ -1,4 +1,3 @@
 export declare function randomBase64Url(bytes: number): string;
-export declare function randomOpaqueId(byteLength?: number): string;
 export declare function randomNumericCode(length: number): string;
 //# sourceMappingURL=bytes.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts

@@ -10,7 +10,7 @@ export type EmailOtpChallengeOperationsInput = {
     readonly grantStore: EmailOtpGrantStore;
     readonly resolveConfig: () => EmailOtpConfig;
 };
-export type CreateEmailOtpLoginChallengeRequest = {
+type CreateEmailOtpLoginChallengeRequest = {
     userId?: unknown;
     walletId?: unknown;
     orgId?: unknown;
@@ -21,7 +21,7 @@ export type CreateEmailOtpLoginChallengeRequest = {
     operation?: unknown;
     reuseActiveChallenge?: unknown;
 };
-export type CreateEmailOtpLoginChallengeResult = {
+type CreateEmailOtpLoginChallengeResult = {
     ok: true;
     challenge: {
         challengeId: string;
@@ -45,7 +45,7 @@ export type CreateEmailOtpLoginChallengeResult = {
     code: string;
     message: string;
 };
-export type CreateEmailOtpEnrollmentChallengeRequest = {
+type CreateEmailOtpEnrollmentChallengeRequest = {
     userId?: unknown;
     walletId?: unknown;
     orgId?: unknown;
@@ -78,7 +78,7 @@ export type CreateEmailOtpEnrollmentChallengeResult = {
     code: string;
     message: string;
 };
-export type VerifyEmailOtpLoginChallengeRequest = {
+type VerifyEmailOtpLoginChallengeRequest = {
     userId?: unknown;
     walletId?: unknown;
     orgId?: unknown;
@@ -89,7 +89,7 @@ export type VerifyEmailOtpLoginChallengeRequest = {
     clientIp?: unknown;
     operation?: unknown;
 };
-export type VerifyEmailOtpLoginChallengeResult = {
+type VerifyEmailOtpLoginChallengeResult = {
     ok: true;
     challengeId: string;
     loginGrant: string;
@@ -105,4 +105,5 @@ export type VerifyEmailOtpLoginChallengeResult = {
 export declare function createEmailOtpChallenge(input: EmailOtpChallengeOperationsInput, request: CreateEmailOtpLoginChallengeRequest): Promise<CreateEmailOtpLoginChallengeResult>;
 export declare function createEmailOtpEnrollmentChallenge(input: EmailOtpChallengeOperationsInput, request: CreateEmailOtpEnrollmentChallengeRequest): Promise<CreateEmailOtpEnrollmentChallengeResult>;
 export declare function verifyEmailOtpChallenge(input: EmailOtpChallengeOperationsInput, request: VerifyEmailOtpLoginChallengeRequest): Promise<VerifyEmailOtpLoginChallengeResult>;
+export {};
 //# sourceMappingURL=emailOtpChallengeOperations.d.ts.map