@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts

@@ -1,6 +1,4 @@
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../shared-ts/src/utils/webauthnDeviceInfo';
-import type { StoreFactoryInput } from './storeBackends';
-import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 export type WebAuthnAuthenticatorRecord = {
     version: 'webauthn_authenticator_v1';
     credentialIdB64u: string;
@@ -26,22 +24,12 @@ export interface WebAuthnAuthenticatorStore {
      */
     list?(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
 }
-export interface D1WebAuthnAuthenticatorStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnAuthenticatorStoreOptions extends D1TenantStoreOptions {
-}
-export declare const WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_authenticators (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      credential_public_key_b64u TEXT NOT NULL,\n      counter INTEGER NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      device_info_json TEXT NOT NULL DEFAULT '{}',\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, credential_id_b64u),\n      CHECK (length(user_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(credential_public_key_b64u) > 0),\n      CHECK (counter >= 0),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_authenticators_user_idx\n      ON webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
-export declare function ensureWebAuthnAuthenticatorStoreD1Schema(options: D1WebAuthnAuthenticatorStoreSchemaOptions): Promise<void>;
-export declare function resolveWebAuthnAuthenticatorStoreNamespace(config: Record<string, unknown>): string;
-export declare class D1WebAuthnAuthenticatorStore implements WebAuthnAuthenticatorStore {
-    readonly adapterKind = "d1";
-    private readonly table;
-    private readonly prepare;
-    constructor(input: D1WebAuthnAuthenticatorStoreOptions);
-    get(userId: string, credentialIdB64u: string): Promise<WebAuthnAuthenticatorRecord | null>;
-    put(userId: string, record: WebAuthnAuthenticatorRecord): Promise<void>;
-    del(userId: string, credentialIdB64u: string): Promise<void>;
-    list(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
-}
-export declare function createWebAuthnAuthenticatorStore(input: StoreFactoryInput): WebAuthnAuthenticatorStore;
+export type D1WebAuthnAuthenticatorRow = {
+    readonly credential_id_b64u?: unknown;
+    readonly credential_public_key_b64u?: unknown;
+    readonly counter?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+    readonly device_info_json?: unknown;
+};
 //# sourceMappingURL=WebAuthnAuthenticatorStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts

@@ -1,6 +1,5 @@
 import type { ThresholdRuntimePolicyScope } from './types';
-import type { StoreFactoryInput } from './storeBackends';
-import { type D1SchemaOptions, type D1TenantScope, type D1TenantStoreOptions } from './d1TenantStore';
+import { type D1TenantScope } from './d1TenantStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 /**
  * The Ed25519 facts on a credential binding are denormalized from the wallet's
@@ -57,10 +56,6 @@ export interface WebAuthnCredentialBindingStore {
         rpId?: string;
     }): Promise<WebAuthnCredentialBindingRecord[]>;
 }
-export interface D1WebAuthnCredentialBindingStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnCredentialBindingStoreOptions extends D1TenantStoreOptions {
-}
 type D1WebAuthnCredentialBindingWrite = {
     readonly database: D1DatabaseLike;
     readonly scope: D1TenantScope;
@@ -69,26 +64,5 @@ type D1WebAuthnCredentialBindingWrite = {
 export declare function prepareD1WebAuthnCredentialBindingPutStatement(input: D1WebAuthnCredentialBindingWrite): D1PreparedStatementLike;
 /** Insert-only binding write for credential promotion. */
 export declare function prepareD1WebAuthnCredentialBindingInsertStatement(input: D1WebAuthnCredentialBindingWrite): D1PreparedStatementLike;
-export declare const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_credential_bindings (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      -- Nullable until the wallet's Ed25519 Yao ceremony settles.\n      signer_slot INTEGER,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u),\n      CHECK (length(rp_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (signer_slot IS NULL OR signer_slot >= 1),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_credential_bindings_user_idx\n      ON webauthn_credential_bindings (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        rp_id,\n        signer_slot\n      )\n  "];
-export declare function ensureWebAuthnCredentialBindingStoreD1Schema(options: D1WebAuthnCredentialBindingStoreSchemaOptions): Promise<void>;
-export declare function resolveWebAuthnCredentialBindingStoreNamespace(config: Record<string, unknown>): string;
-export declare class D1WebAuthnCredentialBindingStore implements WebAuthnCredentialBindingStore {
-    readonly adapterKind = "d1";
-    private readonly table;
-    private readonly prepare;
-    constructor(input: D1WebAuthnCredentialBindingStoreOptions);
-    get(rpId: string, credentialIdB64u: string): Promise<WebAuthnCredentialBindingRecord | null>;
-    put(record: WebAuthnCredentialBindingRecord): Promise<void>;
-    del(rpId: string, credentialIdB64u: string): Promise<void>;
-    getMaxSignerSlot(input: {
-        userId: string;
-        rpId?: string;
-    }): Promise<number | null>;
-    listByUserId(input: {
-        userId: string;
-        rpId?: string;
-    }): Promise<WebAuthnCredentialBindingRecord[]>;
-}
-export declare function createWebAuthnCredentialBindingStore(input: StoreFactoryInput): WebAuthnCredentialBindingStore;
 export {};
 //# sourceMappingURL=WebAuthnCredentialBindingStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts

@@ -1,25 +1,11 @@
-import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
-import type { StoreFactoryInput } from './storeBackends';
-import type { D1SchemaOptions } from './d1TenantStore';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
 export type WebAuthnLoginChallengeRecord = {
     version: 'webauthn_login_challenge_v1';
     challengeId: string;
-    userId: string;
+    userId: WalletId;
     rpId: string;
     challengeB64u: string;
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnLoginChallengeStore extends WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
-}
-export interface D1WebAuthnLoginChallengeStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnLoginChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
-}
-export declare const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare const ensureWebAuthnLoginChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
-export declare class D1WebAuthnLoginChallengeStore extends D1WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
-    constructor(input: D1WebAuthnLoginChallengeStoreOptions);
-}
-export declare function createWebAuthnLoginChallengeStore(input: StoreFactoryInput): WebAuthnLoginChallengeStore;
 //# sourceMappingURL=WebAuthnLoginChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts

@@ -1,6 +1,3 @@
-import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
-import type { StoreFactoryInput } from './storeBackends';
-import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnSyncChallengeRecord = {
     version: 'webauthn_sync_challenge_v1';
     challengeId: string;
@@ -10,16 +7,27 @@ export type WebAuthnSyncChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnSyncChallengeStore extends WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
-}
-export interface D1WebAuthnSyncChallengeStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnSyncChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
-}
-export declare const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare const ensureWebAuthnSyncChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
-export declare class D1WebAuthnSyncChallengeStore extends D1WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
-    constructor(input: D1WebAuthnSyncChallengeStoreOptions);
+export type SyncChallengeFailure = {
+    readonly ok: false;
+    readonly code: 'wallet_home_conflict' | 'wallet_home_unavailable';
+    readonly message: string;
+    readonly record?: never;
+};
+export interface WebAuthnSyncChallengeStore {
+    create(record: WebAuthnSyncChallengeRecord): Promise<{
+        readonly ok: true;
+        readonly code?: never;
+        readonly message?: never;
+        readonly record?: never;
+    } | SyncChallengeFailure>;
+    consume(input: {
+        readonly challengeId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly record: WebAuthnSyncChallengeRecord | null;
+        readonly code?: never;
+        readonly message?: never;
+    } | SyncChallengeFailure>;
 }
-export declare function createWebAuthnSyncChallengeStore(input: StoreFactoryInput): WebAuthnSyncChallengeStore;
 //# sourceMappingURL=WebAuthnSyncChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts

@@ -1,27 +1,3 @@
-import type { AuthServiceConfigSource } from './configValues';
-export type EmailOtpDeliveryMode = 'email_provider' | 'log' | 'memory';
 export declare const EMAIL_OTP_CODE_LENGTH: 6;
-export type EmailOtpConfig = {
-    deliveryMode: EmailOtpDeliveryMode;
-    challengeTtlMs: number;
-    grantTtlMs: number;
-    maxAttempts: number;
-    lockoutTtlMs: number;
-    codeLength: typeof EMAIL_OTP_CODE_LENGTH;
-    devOutboxEnabled: boolean;
-    maxActiveChallengesPerContext: number;
-};
-type AuthRateLimitPolicy = {
-    limit: number;
-    windowMs: number;
-};
 export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
-export type EmailOtpRateLimitPolicies = Record<EmailOtpRateLimitScope, AuthRateLimitPolicy>;
-type EmailOtpConfigInput = {
-    thresholdStore: AuthServiceConfigSource;
-    production: boolean;
-};
-export declare function resolveEmailOtpRateLimitPolicies(input: EmailOtpConfigInput): EmailOtpRateLimitPolicies;
-export declare function resolveEmailOtpConfig(input: EmailOtpConfigInput): EmailOtpConfig;
-export {};
 //# sourceMappingURL=emailOtpConfig.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpEnrollment.d.ts

@@ -1,12 +1,4 @@
-import type { EmailOtpAuthStateRecord, EmailOtpAuthStateStore, EmailOtpWalletEnrollmentRecord, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
-export type EmailOtpEnrollmentReadResult = {
-    ok: true;
-    enrollment: EmailOtpWalletEnrollmentRecord;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
+import type { EmailOtpAuthStateRecord } from '../EmailOtpStores';
 export type EmailOtpAuthStateReadResult = {
     ok: true;
     state: EmailOtpAuthStateRecord | null;
@@ -15,65 +7,4 @@ export type EmailOtpAuthStateReadResult = {
     code: string;
     message: string;
 };
-export type EmailOtpAuthStatePatch = Partial<Pick<EmailOtpAuthStateRecord, 'otpFailureCount' | 'lastOtpFailureAtMs' | 'otpLockedUntilMs' | 'lastEmailOtpLoginAtMs' | 'lastStrongAuthAtMs'>>;
-export type EmailOtpStrongAuthRequiredResult = {
-    ok: true;
-    required: boolean;
-    walletId: string;
-    lastEmailOtpLoginAtMs?: number;
-    lastStrongAuthAtMs?: number;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type EmailOtpStrongAuthSatisfiedResult = {
-    ok: true;
-    walletId: string;
-    lastStrongAuthAtMs?: number;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export declare function readEmailOtpEnrollmentWithStore(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly request: {
-        walletId?: unknown;
-        orgId: unknown;
-    };
-}): Promise<EmailOtpEnrollmentReadResult>;
-export declare function readActiveEmailOtpEnrollmentWithStore(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly request: {
-        walletId?: unknown;
-        orgId: unknown;
-        providerUserId?: unknown;
-    };
-}): Promise<EmailOtpEnrollmentReadResult>;
-export declare function readEmailOtpAuthStateForEnrollmentWithStore(input: {
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly enrollment: EmailOtpWalletEnrollmentRecord;
-}): Promise<EmailOtpAuthStateReadResult>;
-export declare function putEmailOtpAuthStateForEnrollmentWithStore(input: {
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly enrollment: EmailOtpWalletEnrollmentRecord;
-    readonly patch: EmailOtpAuthStatePatch;
-    readonly nowMs: number;
-}): Promise<EmailOtpAuthStateRecord>;
-export declare function isEmailOtpStrongAuthRequiredWithStores(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly request: {
-        walletId?: unknown;
-    };
-}): Promise<EmailOtpStrongAuthRequiredResult>;
-export declare function markEmailOtpStrongAuthSatisfiedWithStores(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly request: {
-        walletId?: unknown;
-    };
-    readonly nowMs: number;
-}): Promise<EmailOtpStrongAuthSatisfiedResult>;
 //# sourceMappingURL=emailOtpEnrollment.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts

@@ -1,10 +1,5 @@
 import type { SigningSessionSealCipherAdapter } from '../../threshold/session/signingSessionSeal/signingSessionSeal.types';
-type EmailOtpShamirCipherConfig = {
-    readonly rootSecretB64u: string;
-    readonly currentKeyVersion: string;
-    readonly acceptedWarmKeyVersions: readonly string[];
-};
-type EmailOtpShamirCipherResult = {
+export type EmailOtpShamirCipherResult = {
     readonly ok: true;
     readonly keyVersion: string;
     readonly cipher: SigningSessionSealCipherAdapter;
@@ -13,7 +8,6 @@ type EmailOtpShamirCipherResult = {
     readonly code: 'not_configured';
     readonly message: string;
 };
-export type EmailOtpServerSealOperation = 'apply-server-seal' | 'remove-server-seal';
 export type EmailOtpServerSealRequest = {
     readonly wrappedCiphertext?: unknown;
 };
@@ -26,11 +20,4 @@ export type EmailOtpServerSealResult = {
     code: string;
     message: string;
 };
-export declare function createEmailOtpShamirCipherFromConfig(input: EmailOtpShamirCipherConfig): EmailOtpShamirCipherResult;
-export declare function runEmailOtpServerSealOperation(input: {
-    readonly operation: EmailOtpServerSealOperation;
-    readonly request: EmailOtpServerSealRequest;
-    readonly shamir: EmailOtpShamirCipherResult;
-}): Promise<EmailOtpServerSealResult>;
-export {};
 //# sourceMappingURL=emailOtpSeal.d.ts.map

package/dist/types/wallet-server/src/core/authService/githubOAuth.d.ts

@@ -7,7 +7,7 @@ export type GithubOAuthPublicConfig = {
     clientId: string;
     callbackUrl: string;
 };
-export type GithubOAuthCodeFacadeResult = {
+type GithubOAuthCodeFacadeResult = {
     ok: true;
     verified: true;
     userId: string;
@@ -32,4 +32,5 @@ export declare function verifyGithubOAuthCodeWithIdentityStore(input: {
     identityStore: IdentityStore;
     fetchImpl?: typeof fetch;
 }): Promise<GithubOAuthCodeFacadeResult>;
+export {};
 //# sourceMappingURL=githubOAuth.d.ts.map

package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts

@@ -1,31 +1,5 @@
-import type { AccessKeyList, FinalExecutionOutcome } from '@near-js/types';
 import type { NearTransactionActionArgsWasm } from '../../../../shared-ts/src/near/actions';
-import { MinimalNearClient, SignedTransaction } from '../rpcClients/near/NearClient';
-import type { NormalizedLogger } from '../logger';
-type NearTxContext = {
-    nextNonce: string;
-    blockHash: string;
-};
-export type AccountAccessKeyVisibilityOptions = {
-    attempts?: number;
-    delayMs?: number;
-    finality?: 'optimistic' | 'final';
-};
-export declare function viewAccessKeyListWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-}): Promise<AccessKeyList>;
-export declare function dispatchNearSignedTransactionBorshWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly signedTransactionBorshB64u: string;
-}): Promise<{
-    rpcResult: FinalExecutionOutcome;
-}>;
-export declare function fetchNearTxContextWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-    readonly publicKey: string;
-}): Promise<NearTxContext>;
+import { SignedTransaction } from '../rpcClients/near/NearClient';
 export declare function signGasRelayerNearTransactionWithDeps(input: {
     readonly ensureSignerWasm: () => Promise<void>;
     readonly relayerAccount: string;
@@ -35,16 +9,4 @@ export declare function signGasRelayerNearTransactionWithDeps(input: {
     readonly blockHash: string;
     readonly actions: readonly NearTransactionActionArgsWasm[];
 }): Promise<SignedTransaction>;
-export declare function checkNearAccountExistsWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly logger: NormalizedLogger;
-    readonly accountId: string;
-}): Promise<boolean>;
-export declare function verifyAccountAccessKeysPresentWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-    readonly expectedPublicKeys: readonly string[];
-    readonly options?: AccountAccessKeyVisibilityOptions;
-}): Promise<boolean>;
-export {};
 //# sourceMappingURL=nearTransactions.d.ts.map

package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts

@@ -1,6 +1,3 @@
-import { type SigningSessionSealRateLimiter } from '../../threshold/session/signingSessionSeal';
-import type { AuthServiceConfigSource } from './configValues';
-import type { EmailOtpRateLimitPolicies, EmailOtpRateLimitScope } from './emailOtpConfig';
 export type RateLimitResult = {
     ok: true;
 } | {
@@ -10,18 +7,4 @@ export type RateLimitResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export declare function createEmailOtpRateLimiter(input: {
-    thresholdStore: AuthServiceConfigSource;
-}): SigningSessionSealRateLimiter;
-export declare function consumeEmailOtpRateLimit(input: {
-    limiter: SigningSessionSealRateLimiter;
-    policies: EmailOtpRateLimitPolicies;
-    scope: EmailOtpRateLimitScope;
-    action?: string;
-    userId?: string;
-    walletId?: string;
-    providerSubject?: string;
-    orgId?: string;
-    clientIp?: string;
-}): Promise<RateLimitResult>;
 //# sourceMappingURL=rateLimits.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthn.d.ts

@@ -1,17 +1,10 @@
-import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
 import type { ThresholdEd25519AuthorityScope } from '../types';
 import type { NormalizedLogger } from '../logger';
 import type { WebAuthnAuthenticatorStore } from '../WebAuthnAuthenticatorStore';
-import type { WebAuthnLoginChallengeStore } from '../WebAuthnLoginChallengeStore';
-import type { WebAuthnSyncChallengeStore } from '../WebAuthnSyncChallengeStore';
-import type { WebAuthnCredentialBindingStore } from '../WebAuthnCredentialBindingStore';
-import type { IdentityStore } from '../IdentityStore';
 import type { WebAuthnAuthenticationCredential } from '../types';
 import { type ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
-import { type WebAuthnLoginEd25519 } from './webauthnVerificationOutcomes';
 type WebAuthnCredentialVerificationResult = {
     ok: true;
     credential: {
@@ -30,51 +23,6 @@ type WebAuthnAuthenticationLiteResult = {
     code?: string;
     message?: string;
 };
-/**
- * One listed authenticator. `device` is required: the published service
- * contract declares it, and a binding with no authenticator row still gets the
- * `Unknown device` fallback rather than an absent field.
- */
-type WebAuthnAuthenticatorListEntry = {
-    credentialIdB64u: string;
-    signerSlot?: number;
-    publicKey?: string;
-    createdAtMs?: number;
-    updatedAtMs?: number;
-    device: WebAuthnAuthenticatorDeviceInfo;
-};
-export type WebAuthnAuthenticatorListResult = {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    authenticators?: WebAuthnAuthenticatorListEntry[];
-};
-type WebAuthnLoginOptionsResult = {
-    ok: boolean;
-    challengeId?: string;
-    challengeB64u?: string;
-    expiresAtMs?: number;
-    code?: string;
-    message?: string;
-};
-export type WebAuthnSyncAccountOptionsResult = {
-    ok: true;
-    challengeId: string;
-    challengeB64u: string;
-    expiresAtMs: number;
-    credentialIds?: string[];
-    walletBinding?: ResolvedEd25519WalletBinding;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type WebAuthnSyncAccountVerificationRequest = {
-    challengeId?: unknown;
-    challenge_id?: unknown;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin?: string;
-};
 export type WebAuthnSyncAccountVerificationResult = {
     ok: true;
     verified: true;
@@ -107,19 +55,6 @@ export type WebAuthnSyncAccountVerificationResult = {
     code: string;
     message: string;
 };
-export type WebAuthnLoginVerificationResult = {
-    ok: true;
-    verified: true;
-    userId: string;
-    rpId: string;
-    credentialIdB64u: string;
-    ed25519: WebAuthnLoginEd25519;
-} | {
-    ok: false;
-    verified?: false;
-    code: string;
-    message: string;
-};
 export declare function verifyWebAuthnRegistrationCredentialForIntent(input: {
     webauthnRegistration: unknown;
     expectedChallenge: string;
@@ -135,65 +70,5 @@ export declare function verifyWebAuthnAuthenticationLiteWithStore(input: {
     authenticatorStore: WebAuthnAuthenticatorStore;
     logger: NormalizedLogger;
 }): Promise<WebAuthnAuthenticationLiteResult>;
-export declare function listWebAuthnAuthenticatorsForUserWithStores(input: {
-    userId: string;
-    rpId: string;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-}): Promise<WebAuthnAuthenticatorListResult>;
-export declare function createWebAuthnLoginOptionsWithStore(input: {
-    request: {
-        userId?: unknown;
-        user_id?: unknown;
-        rpId?: unknown;
-        rp_id?: unknown;
-        ttlMs?: unknown;
-        ttl_ms?: unknown;
-    };
-    loginChallengeStore: WebAuthnLoginChallengeStore;
-}): Promise<WebAuthnLoginOptionsResult>;
-export declare function createWebAuthnSyncAccountOptionsWithStores(input: {
-    request: {
-        rp_id?: unknown;
-        account_id?: unknown;
-        ttl_ms?: unknown;
-        ttlMs?: unknown;
-    };
-    syncChallengeStore: WebAuthnSyncChallengeStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-}): Promise<WebAuthnSyncAccountOptionsResult>;
-/**
- * The one signer read sync needs. Shaped as the wallet store's own reader so
- * the existing store satisfies it structurally, with no adapter.
- */
-type SyncAccountEd25519SignerReader = {
-    getEd25519SignerBySlot(input: {
-        walletId: WalletId;
-        signerSlot: number;
-    }): Promise<{
-        readonly custodyKeyManifestDigestB64u: string;
-    } | null>;
-};
-export declare function verifyWebAuthnSyncAccountWithStores(input: {
-    request: WebAuthnSyncAccountVerificationRequest;
-    syncChallengeStore: WebAuthnSyncChallengeStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    walletStore: SyncAccountEd25519SignerReader;
-    logger: NormalizedLogger;
-}): Promise<WebAuthnSyncAccountVerificationResult>;
-export declare function verifyWebAuthnLoginWithStores(input: {
-    request: {
-        challengeId?: unknown;
-        challenge_id?: unknown;
-        webauthn_authentication?: unknown;
-        expected_origin?: string;
-    };
-    loginChallengeStore: WebAuthnLoginChallengeStore;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-    identityStore: IdentityStore;
-    logger: NormalizedLogger;
-}): Promise<WebAuthnLoginVerificationResult>;
 export {};
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts

@@ -45,8 +45,5 @@ export declare function parseClientDataJsonBase64url(clientDataJSONB64u: string)
 };
 export declare function originHostnameOrEmpty(origin: string): string;
 export declare function isHostWithinRpId(host: string, rpId: WebAuthnRpId): boolean;
-export declare function parseCacheControlMaxAgeSec(cacheControl: string | null): number | null;
-export declare function parseJwtSegmentJson(input: string): Record<string, unknown> | null;
-export declare function parseJwtAud(input: unknown): string[];
 export {};
 //# sourceMappingURL=webauthnOidcHelpers.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts

@@ -6,7 +6,7 @@ type WebAuthnVerificationFailure = {
     code: string;
     message: string;
 };
-export type WebAuthnLoginEd25519 = {
+type WebAuthnLoginEd25519 = {
     readonly kind: 'absent';
 } | {
     readonly kind: 'active';

package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts

@@ -1,5 +1,3 @@
-import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
-export declare function parseBoundaryWalletId(raw: unknown): string | null;
 export type ResolvedEd25519WalletBinding = {
     walletId: string;
     nearAccountId: string;
@@ -8,14 +6,4 @@ export type ResolvedEd25519WalletBinding = {
     credentialIdB64u: string;
     signerSlot: number;
 };
-/**
- * Returns `null` when the binding carries no Ed25519 identity, which is the
- * valid state for a wallet whose Ed25519 Yao ceremony has not settled yet.
- * Callers must surface that as a typed "not provisioned" outcome rather than
- * treating it as a missing credential.
- */
-export declare function resolvedEd25519WalletBindingFromCredentialBinding(args: {
-    binding: WebAuthnCredentialBindingRecord;
-    signerSlot?: number;
-}): ResolvedEd25519WalletBinding | null;
 //# sourceMappingURL=webauthnWalletBinding.d.ts.map

package/dist/types/wallet-server/src/core/config.d.ts

@@ -1,13 +1,3 @@
-import type { AuthServiceConfig, AuthServiceConfigInput } from './types';
-export declare const AUTH_SERVICE_CONFIG_DEFAULTS: {
-    readonly nearRpcUrlTestnet: "https://rpc.testnet.fastnear.com";
-    readonly nearRpcUrlMainnet: "https://rpc.mainnet.near.org";
-    readonly networkId: "testnet";
-    readonly accountInitialBalance: "30000000000000000000000";
-    readonly createAccountAndRegisterGas: "85000000000000";
-};
-export declare function createAuthServiceConfig(input: AuthServiceConfigInput): AuthServiceConfig;
-export declare function validateConfigs(config: AuthServiceConfig): void;
 export declare function parseBool(v: unknown): boolean;
 export declare function requireEnvVar<T extends object, K extends keyof T & string>(env: T, name: K): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/types/wallet-server/src/core/d1EcdsaSignerRead.d.ts

@@ -0,0 +1,39 @@
+import type { InstalledEcdsaCustodySnapshotV1 } from '../router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { EcdsaMaterialReadSnapshot } from './ecdsaMaterialReadSnapshot';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { D1WalletStoreScope } from './d1WalletStore';
+import { type WalletEcdsaSignerRecord } from './WalletStore';
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
+export declare function prepareWalletEcdsaSignersRead(database: D1DatabaseLike, scope: D1WalletStoreScope, walletId: WalletId): D1PreparedStatementLike;
+export declare function parseWalletEcdsaSignerRows(rows: readonly Readonly<Record<string, unknown>>[], walletId: WalletId): readonly WalletEcdsaSignerRecord[];
+/** Parsed persistence evidence; material failures are surfaced after session validation. */
+export declare class EcdsaMaterialRead {
+    #private;
+    readonly walletId: WalletId;
+    private readonly scope;
+    private readonly activation;
+    private readonly linkedSnapshot;
+    private constructor();
+    static fromRows(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire, rows: unknown, linkedSnapshot: InstalledEcdsaCustodySnapshotV1 | null): EcdsaMaterialRead;
+    resolveLinked(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): InstalledEcdsaCustodySnapshotV1 | null;
+    resolve(scope: D1WalletStoreScope, walletId: WalletId, activation: RouterAbMpcMaterialActivationRefWire): CanonicalMaterialSnapshot | null;
+}
+type CanonicalMaterialSnapshot = {
+    readonly signer: WalletEcdsaSignerRecord;
+    readonly readSnapshot: EcdsaMaterialReadSnapshot;
+};
+export type EcdsaMaterialReadSource = {
+    readonly kind: 'database';
+    readonly materialRead?: never;
+} | {
+    readonly kind: 'credential_snapshot';
+    readonly materialRead: EcdsaMaterialRead;
+};
+export type EcdsaMaterialActivationReadInput = {
+    readonly walletId: string;
+    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    readonly source: EcdsaMaterialReadSource;
+};
+export {};
+//# sourceMappingURL=d1EcdsaSignerRead.d.ts.map