@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts

@@ -1,3 +1,15 @@
+import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
+import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
+import type { WebAuthnSyncChallengeStore } from '../../../../core/WebAuthnSyncChallengeStore';
+import type { PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
+import type { EmailOtpRateLimitCounter } from '../emailOtp/d1EmailOtpRateLimitStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from '../emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+import type { IdentityStore } from '../../../../core/IdentityStore';
+import type { WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
+import type { WalletRecoveryRoutingPublisher } from '../../../../authorization/recoveryRouting';
+import type { WalletSessionRoutingPublisher } from '../../../../authorization/sessionRouting';
+import type { WalletRegistrationSetupDispatcher } from '../../../framework/registrationSetupDispatch';
+import type { WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { LinkedDevicePasskeyTargetConfigurationFieldsV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { WalletEmailOtpChannel } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { EmailOtpChallengeAction, EmailOtpChallengeOperation } from '../../../../core/EmailOtpStores';
@@ -96,6 +108,18 @@ export type CloudflareD1GithubOAuthConfig = {
     readonly callbackUrl: string;
 };
 export interface CloudflareD1RouterApiAuthServiceOptions {
+    readonly identityStore?: IdentityStore;
+    readonly emailOtpRateLimitCounter?: EmailOtpRateLimitCounter;
+    readonly credentialClaims?: PasskeyCredentialClaims;
+    readonly linkedDeviceBootstrap?: LinkedDeviceBootstrapStore;
+    readonly linkedDeviceProofNonces?: LinkedDeviceRequestProofNonceStoreV1;
+    readonly syncChallenges?: WebAuthnSyncChallengeStore;
+    readonly googleRegistrationAttempts?: GoogleEmailOtpRegistrationAttemptStore;
+    readonly sessionRouting?: WalletSessionRoutingPublisher;
+    readonly lifecycleRouting?: WalletLifecycleRoutingPublisher;
+    readonly recoveryRouting?: WalletRecoveryRoutingPublisher;
+    readonly registrationSetupDispatcher?: WalletRegistrationSetupDispatcher;
+    readonly registrationAuthority?: WalletRegistrationReservationAuthority;
     readonly database: D1DatabaseLike;
     readonly namespace: string;
     readonly orgId: string;
@@ -110,7 +134,6 @@ export interface CloudflareD1RouterApiAuthServiceOptions {
     readonly implicitNearAccountTestFundingEnabled?: boolean | string;
     readonly googleOidcClientId?: string;
     readonly githubOAuth?: CloudflareD1GithubOAuthConfig;
-    readonly accountIdDerivationSecret?: string;
     readonly emailOtpServerSeal?: CloudflareD1EmailOtpServerSealConfig;
     readonly emailOtpDeliveryMode?: string;
     readonly emailOtpRuntimeProfile?: string;
@@ -171,7 +194,7 @@ export type EmailOtpServerSealRuntimeConfig = {
     readonly configured: false;
     readonly message: string;
 };
-export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'accountIdDerivationSecret' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
+export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD1RouterApiAuthServiceOptions, 'relayerAccount' | 'relayerPublicKey' | 'relayerPrivateKey' | 'nearRpcUrl' | 'accountInitialBalance' | 'implicitNearAccountTestFundingEnabled' | 'googleOidcClientId' | 'emailOtpServerSeal' | 'emailOtpDeliveryMode' | 'emailOtpRuntimeProfile' | 'emailOtpDemoAllowedOrigins' | 'emailOtpDeliveryProvider' | 'emailOtpDevOutboxEnabled' | 'emailOtpProduction' | 'emailOtpChallengeTtlMs' | 'emailOtpGrantTtlMs' | 'emailOtpMaxAttempts' | 'emailOtpLockoutTtlMs' | 'emailOtpCodeLength' | 'emailOtpMaxActiveChallengesPerContext' | 'emailOtpChallengeRateLimitMax' | 'emailOtpChallengeRateLimitWindowMs' | 'emailOtpVerifyRateLimitMax' | 'emailOtpVerifyRateLimitWindowMs' | 'emailOtpGrantRateLimitMax' | 'emailOtpGrantRateLimitWindowMs' | 'emailOtpGoogleRegistrationAttemptRateLimitMax' | 'emailOtpGoogleRegistrationAttemptRateLimitWindowMs' | 'routerAbEcdsaPresignRuntime'> & {
     readonly relayerAccount?: string;
     readonly relayerPublicKey?: string;
     readonly relayerPrivateKey?: string;
@@ -180,7 +203,6 @@ export type NormalizedCloudflareD1RouterApiAuthServiceOptions = Omit<CloudflareD
     readonly implicitNearAccountTestFundingEnabled: boolean;
     readonly googleOidcClientId?: string;
     readonly githubOAuth?: CloudflareD1GithubOAuthConfig;
-    readonly accountIdDerivationSecret?: string;
     readonly emailOtp: EmailOtpRuntimeConfig;
     readonly emailOtpServerSeal: EmailOtpServerSealRuntimeConfig;
     readonly routerAbEcdsaPresignRuntime?: RouterAbEcdsaPresignRuntime | null;

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthService.d.ts

@@ -8,6 +8,6 @@ export type CloudflareD1RouterApiAuthService = Omit<RouterApiServiceBag, 'thresh
     readonly executeSignedDelegate: (input: ExecuteSignedDelegateRequest) => Promise<ExecuteSignedDelegateResult>;
     readonly linkedDeviceEd25519AuthorityReader?: LinkedDeviceEd25519AuthorityReader;
 };
-type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityChainByMaterialActivationV1'>;
+type LinkedDeviceEd25519AuthorityReader = Pick<D1LinkedDeviceAuthorityInstallServiceV1, 'readInstalledEd25519AuthorityByIdentityV1' | 'readInstalledEd25519AuthorityByMaterialActivationV1' | 'readInstalledEcdsaAuthorityByMaterialActivationV1' | 'readInstalledEcdsaCustodySnapshotV1'>;
 export declare function createCloudflareD1RouterApiAuthService(input: CloudflareD1RouterApiAuthServiceOptions): CloudflareD1RouterApiAuthService;
 //# sourceMappingURL=d1RouterApiAuthService.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/walletSessionCredentialReaders.d.ts

@@ -0,0 +1,9 @@
+import type { AuthorizationService } from '../../../../authorization/service';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext, RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext, RouterApiWalletSessionSigningCandidate } from '../../../framework/authServicePort';
+type CredentialInput = Parameters<AuthorizationService['readWalletSessionAdmissionSnapshotByOperationCredential']>[0];
+type AdmissionSnapshotReader = Pick<AuthorizationService, 'readWalletSessionAdmissionSnapshotByOperationCredential'>;
+export declare function readActiveWalletSessionCredential(service: AdmissionSnapshotReader, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2AdmissionContext | null>;
+export declare function readWalletSessionSigningCandidate(service: Pick<AuthorizationService, 'readEcdsaWalletSessionAdmissionSnapshotByOperationCredential'>, input: Parameters<AuthorizationService['readEcdsaWalletSessionAdmissionSnapshotByOperationCredential']>[0]): Promise<RouterApiWalletSessionSigningCandidate | null>;
+export declare function readExhaustedWalletSessionCredential(service: Pick<AuthorizationService, 'readExactWalletSessionStatusSnapshotByOperationCredential'>, input: CredentialInput): Promise<RouterApiWalletSessionAuthorizationV2ExhaustedCandidateContext | null>;
+export {};
+//# sourceMappingURL=walletSessionCredentialReaders.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/authorizedOperationStatements.d.ts

@@ -1,3 +1,4 @@
+import type { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
 import type { AuthorizedOperation } from '../../../../authorization/domain';
 import type { AuthorizedOperationMaterialScope } from '../../../../authorization/service';
 import type { D1WalletStoreScope } from '../../../../core/d1WalletStore';
@@ -19,6 +20,7 @@ export declare function prepareAuthorizedOperationAdmissionRead(input: {
     readonly tenantId: TenantId;
     readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
     readonly nowMs: number;
+    readonly materialSnapshot: EcdsaMaterialReadSnapshot | null;
 }): D1PreparedStatementLike;
 export declare function prepareAuthorizedOperationInsert(input: {
     readonly database: D1DatabaseLike;
@@ -26,5 +28,7 @@ export declare function prepareAuthorizedOperationInsert(input: {
     readonly walletSignerScope: D1WalletStoreScope;
     readonly operation: AuthorizedOperation;
     readonly material: AuthorizedOperationMaterialScope | null;
+    readonly materialSnapshot: EcdsaMaterialReadSnapshot | null;
+    readonly existingOperation: 'reject' | 'preserve';
 }): D1PreparedStatementLike;
 //# sourceMappingURL=authorizedOperationStatements.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts

@@ -1,4 +1,6 @@
-import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
+import type { EcdsaWalletSessionAdmissionRead } from '../../../../authorization/service';
+import type { RouterAbMpcMaterialActivationRefWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { EcdsaWalletSessionAdmissionInput, EcdsaWalletSessionAdmissionResult, EcdsaWalletSessionResolutionResult, PinnedOwnerWalletScope } from '../../../../authorization/ecdsaWalletSessionAdmission';
 import { type MpcMaterialActivationRef, type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type AuthorizedOperationId, type TenantId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { AuthorizedOperation, AuthorizedOperationInput, IssuedWalletSessionAuthorizationV2, LiveWalletSessionAuthorizationProjectionV2, WalletSessionAuthorizationV2, ActiveWalletSessionQuota, PersistedActiveWalletSessionAuthorizationV2, DirectV2CommitResult, WalletSessionAuthorizationV2MintLookup, WalletSessionAuthorizationV2MintRead, AuthorizedOperationReplayResponse, CompletedCapabilityOperationResult, IssuedHostedWalletSeamsSessionExchangeV2, RedeemHostedWalletSeamsSessionExchangeV2Input, PersistedHostedWalletSeamsSessionExchangeV2Result, ExactWalletSessionQuotaProjectionV1, ExactWalletSessionStatusV2, ExactWalletSessionStatusSnapshotV2, WalletSessionAdmissionSnapshotV2, WalletSessionExactOperationContext, ResolvedHostedWalletSessionOperationCredentialV2, VerifiedAuthorizationEvidenceSet, VerifiedOwnerProof } from '../../../../authorization/domain';
@@ -58,7 +60,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
     }): readonly D1PreparedStatementLike[];
     private prepareRetireHostedChildrenForParentSelection;
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
-    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
+    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input, publishCredentialLocator?: () => Promise<void>): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -134,6 +136,12 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
         readonly nowMs: number;
     }): Promise<WalletSessionAdmissionSnapshotV2 | null>;
+    readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
+        readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<EcdsaWalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: WalletSessionAuthorizationV2['tenantId'];
         readonly tokenHash: import('../../../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
@@ -194,6 +202,7 @@ export declare class CloudflareD1AuthorizationStore implements AuthorizationSess
         readonly operation: AuthorizedOperationInput;
         readonly material?: AuthorizedOperationMaterialScope;
     }): Promise<AuthorizedOperationAdmissionResult>;
+    resolveEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionResolutionResult>;
     admitEcdsaWalletSessionOperation(input: EcdsaWalletSessionAdmissionInput): Promise<EcdsaWalletSessionAdmissionResult>;
     private admitAuthorizedOperationRecord;
     completeAuthorizedOperation(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts

@@ -1,3 +1,7 @@
+import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredentialClaims';
+import { EcdsaMaterialReadSnapshot } from '../../../../core/ecdsaMaterialReadSnapshot';
+import { type EcdsaMaterialReadSource } from '../../../../core/d1EcdsaSignerRead';
+import type { WalletEcdsaSignerRecord } from '../../../../core/WalletStore';
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type LinkDeviceSessionId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
@@ -20,6 +24,11 @@ import type { AuthorizationService } from '../../../../authorization/service';
 import { type PersistedActiveWalletSessionAuthorizationV2, type IssuedWalletSessionAuthorizationV2 } from '../../../../authorization/domain';
 import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+export type InstalledEcdsaCustodySnapshotV1 = {
+    readonly readSnapshot: EcdsaMaterialReadSnapshot;
+    readonly chain: readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[];
+    readonly signers: readonly WalletEcdsaSignerRecord[];
+};
 type ExactSigner = ExactAdministeredSignerV1;
 type ListWalletEd25519SignersV1 = (walletId: WalletId) => Promise<readonly WalletEd25519SignerRecord[]>;
 type WorkerOrdinarySignerMaterialReservationPreparationV1 = {
@@ -40,6 +49,7 @@ export type OrdinaryInactiveSignerMaterialActivationPortV1 = {
     }): Promise<void>;
 };
 export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
+    readonly credentialClaims?: PasskeyCredentialClaims;
     readonly database: D1DatabaseLike;
     readonly scope: D1WalletAuthorityStoreScope;
     readonly authorityStore: D1WalletAuthorityStore;
@@ -67,7 +77,7 @@ export type D1LinkedDeviceAuthorityInstallServiceOptionsV1 = {
     };
     readonly reservationService: OrdinaryInactiveSignerMaterialReservationServiceV1;
     readonly materialActivation: OrdinaryInactiveSignerMaterialActivationPortV1;
-    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint'>;
+    readonly authorizationService: Pick<AuthorizationService, 'prepareWalletSessionAuthorizationV2' | 'readWalletSessionAuthorizationV2ByMint' | 'prepareDirectWalletSessionCredential'>;
     readonly authorizationStore: {
         prepareDirectWalletSessionAuthorizationV2Statements(persisted: PersistedActiveWalletSessionAuthorizationV2): readonly [
             D1PreparedStatementLike,
@@ -226,10 +236,11 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
     }): Promise<InstalledLinkedDeviceEcdsaAuthorityProjectionV1 | null>;
-    readInstalledEcdsaAuthorityChainByMaterialActivationV1(input: {
+    readInstalledEcdsaCustodySnapshotV1(input: {
+        readonly source: EcdsaMaterialReadSource;
         readonly walletId: WalletId;
         readonly materialActivation: MpcMaterialActivationRef;
-    }): Promise<readonly InstalledLinkedDeviceEcdsaAuthorityProjectionV1[]>;
+    }): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
     private readVerifiedEcdsaInstallations;
     readActivationCleanupReceiptV1(input: {
         readonly linkSessionId: LinkDeviceSessionId;
@@ -264,7 +275,15 @@ export declare class D1LinkedDeviceAuthorityInstallServiceV1 {
     private readInstallation;
     private readInstallationByAuthority;
     private readInstallationsByWallet;
+    private prepareInstallationsByWalletRead;
 }
+export declare function parseInstalledEcdsaCustodySnapshotV1(input: {
+    readonly scope: D1LinkedDeviceAuthorityInstallServiceOptionsV1['scope'];
+    readonly walletId: WalletId;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly installations: unknown;
+    readonly signers: unknown;
+}): Promise<InstalledEcdsaCustodySnapshotV1 | null>;
 /**
  * The installed Ed25519 authority of a linked device, read from Gateway SQL
  * alone: a linked device approving another link names its own binding as the

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts

@@ -16,7 +16,13 @@ export declare class D1LinkedDeviceEmailOtpGrantStoreV1 {
         readonly database: D1DatabaseLike;
         readonly scope: D1LinkedDeviceSessionScopeV1;
     });
-    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<void>;
+    issueV1(record: LinkedDeviceEmailOtpGrantRecordV1): Promise<{
+        readonly kind: 'issued';
+    } | {
+        readonly kind: 'refused';
+        readonly code: 'link_session_inactive';
+        readonly message: string;
+    }>;
     readByIdV1(grantId: string): Promise<LinkedDeviceEmailOtpGrantRecordV1 | null>;
     /**
      * The consumption as statements: a CAS flip from `issued` to `consumed`

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.d.ts

@@ -1,5 +1,3 @@
-import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
-import { type DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
@@ -11,14 +9,7 @@ export declare class D1LinkedDeviceRequestProofNonceStoreV1 implements LinkedDev
     private readonly database;
     private readonly scope;
     constructor(options: D1LinkedDeviceRequestProofNonceStoreOptionsV1);
-    consumeRequestProofNonceV1(input: {
-        readonly linkSessionId: LinkDeviceSessionId;
-        readonly requestNonceB64u: string;
-        readonly proofDigestB64u: DigestB64u;
-        readonly issuedAtMs: number;
-        readonly expiresAtMs: number;
-        readonly consumedAtMs: number;
-    }): Promise<{
+    consumeRequestProofNonceV1(input: unknown): Promise<{
         readonly outcome: 'consumed';
     } | {
         readonly outcome: 'already_used';

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.d.ts

@@ -1,8 +1,12 @@
+import type { LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { DeviceLinkingAuthDeniedV1, DeviceLinkingAuthenticatedRequestV1, DeviceLinkingOwnerRequestInputV1, DeviceLinkingRouteServiceV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
+import { type LinkedDeviceRequestProofNonceStoreV1 } from '../../../../core/deviceLinking/requestProof';
 import type { LinkedDeviceOwnerAuthorizationPortV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
 import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 export type D1LinkedDeviceRouteServiceOptionsV1 = {
+    readonly bootstrap?: LinkedDeviceBootstrapStore;
+    readonly proofNonces?: LinkedDeviceRequestProofNonceStoreV1;
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationPortV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts

@@ -1,3 +1,4 @@
+import { type LinkedDeviceBootstrapStore } from '../../../../core/deviceLinking/linkedDeviceBootstrap';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
 import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { LinkedDeviceSessionListCursorV1, LinkedDeviceSessionListPageV1, LinkedDeviceSessionStoreV1 } from '../../../../core/deviceLinking/linkedDeviceSession';
@@ -5,13 +6,10 @@ import { type LinkedDeviceSessionMutationResultV1, type LinkedDeviceSessionRecor
 import { type LinkDeviceSessionId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { WalletAuthorityId, WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
-export type D1LinkedDeviceSessionScopeV1 = {
-    readonly namespace: string;
-    readonly orgId: string;
-    readonly projectId: string;
-    readonly envId: string;
-};
+import type { D1TenantScope } from '../../../../core/d1TenantStore';
+export type D1LinkedDeviceSessionScopeV1 = D1TenantScope;
 export type D1LinkedDeviceSessionStoreOptionsV1 = {
+    readonly bootstrap?: LinkedDeviceBootstrapStore;
     readonly database: D1DatabaseLike;
     readonly scope: D1LinkedDeviceSessionScopeV1;
     readonly now?: () => number;
@@ -19,11 +17,15 @@ export type D1LinkedDeviceSessionStoreOptionsV1 = {
 /** Aborts the batch it is in when the statement just before it changed no row. */
 export declare const SESSION_CAS_GUARD_SQL = "INSERT INTO linked_device_session_cas_guard (guard_id)\nSELECT 1\n WHERE changes() = 0";
 export declare class D1LinkedDeviceSessionStoreV1 implements LinkedDeviceSessionStoreV1 {
+    private readonly bootstrap;
     private readonly database;
     private readonly scope;
     constructor(options: D1LinkedDeviceSessionStoreOptionsV1);
     createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
     getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;
+    private sessionInsertStatement;
+    private importClaimedSession;
+    private readLocalSession;
     private deleteRetiredShapeSessionRowV1;
     listSessionsForWalletV1(input: {
         readonly walletId: WalletId;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.d.ts

@@ -6,6 +6,7 @@ import type { LinkedDeviceSessionRecordV1 } from '../../../../core/deviceLinking
 import type { DeviceLinkingTargetCredentialProviderV1, LinkedDeviceTargetPreparationResultV1 } from '../../../../router/transport/fetch/routes/deviceLinking';
 import { type D1LinkedDeviceSessionScopeV1 } from './d1LinkedDeviceSessionStore';
 import { type VerifiedLinkSourceReadV1, type VerifiedLinkSourceReaderV1 } from './d1LinkedDeviceVerifiedLinkBuilder';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type VerifiedLinkedDeviceWebAuthnCredentialV1 = {
     readonly credentialIdB64u: string;
     readonly credentialPublicKeyB64u: string;
@@ -36,15 +37,13 @@ export type VerifiedLinkedDeviceEmailOtpGrantV1 = (VerifiedLinkedDeviceEmailOtpG
  * per target factor. A Passkey commit cannot carry a grant and an Email OTP
  * commit cannot carry WebAuthn material.
  */
-export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = {
+export type VerifiedLinkedDeviceTargetFactorEvidenceV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey_prf';
     readonly credential: VerifiedLinkedDeviceWebAuthnCredentialV1;
-    readonly grant?: never;
 } | {
     readonly kind: 'email_otp';
     readonly grant: VerifiedLinkedDeviceEmailOtpGrantV1;
-    readonly credential?: never;
-};
+}>;
 /**
  * The complete registered-target replay record. It is kept as one payload so
  * a retry can finish the session CAS without rereading mutable source state.
@@ -171,15 +170,13 @@ export declare class D1LinkedDeviceTargetCredentialProviderV1 implements DeviceL
         readonly session: LinkedDeviceSessionRecordV1;
         readonly approval: LinkedDeviceApprovalV1;
         readonly requestedAtMs: number;
-    } & ({
+    } & ReadonlyExclusiveUnion<{
         readonly access: 'create_or_replay';
         readonly expectedOrigin: string;
         readonly deliveryRecipientPublicKey65B64u: string;
     } | {
         readonly access: 'replay_only';
-        readonly expectedOrigin?: never;
-        readonly deliveryRecipientPublicKey65B64u?: never;
-    })): Promise<LinkedDeviceTargetPreparationResultV1>;
+    }>): Promise<LinkedDeviceTargetPreparationResultV1>;
     registerTargetCredentialV1(input: {
         readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
         readonly preparation: LinkedDeviceTargetPreparationV1;

package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts

@@ -1,8 +1,7 @@
 import type { LinkedDeviceApprovalV1, LinkedDeviceTargetPreparationV1 } from '../../../../../../shared-ts/src/device-linking/contracts';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { MpcMaterialActivationRef, WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
-import type { ActiveLaneProtocolSourceV1, EcdsaTargetCapabilityBindingV1, LaneTargetSigningWorkerV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
-import type { LaneHolderParticipantId } from '../../../../../../shared-ts/src/signing-lanes/participants';
+import type { ActiveLaneProtocolSourceV1 } from '../../../../../../shared-ts/src/signing-lanes/rotation';
 import type { EvmFamilySigningKeySlotId } from '../../../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId';
 import type { KeyCreationSignerSlot } from '../../../../../../shared-ts/src/passkey-custody/primitives';
 import type { Ed25519PublicKeyB64u } from '../../../../../../shared-ts/src/passkey-custody/primitives';
@@ -44,17 +43,6 @@ type LinkedDeviceOwnerEcdsaSourceChildResolutionV1 = LinkedDeviceOwnerSourceChil
     readonly linkedSourceMaterialActivation?: MpcMaterialActivationRef;
 };
 export type LinkedDeviceOwnerSourceChildResolutionV1 = LinkedDeviceOwnerEd25519SourceChildResolutionV1 | LinkedDeviceOwnerEcdsaSourceChildResolutionV1;
-export type LinkedDeviceTargetEnrichedChildResolutionV1 = (LinkedDeviceOwnerEd25519SourceChildResolutionV1 & {
-    readonly targetHolderParticipantId: LaneHolderParticipantId;
-    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
-    readonly yaoSuiteId: import('../../../../../../shared-ts/src/signing-lanes/ids').Ed25519YaoSuiteId;
-    readonly circuitDigestB64u: string;
-}) | (LinkedDeviceOwnerEcdsaSourceChildResolutionV1 & {
-    readonly targetHolderParticipantId: LaneHolderParticipantId;
-    readonly targetSigningWorker: LaneTargetSigningWorkerV1;
-    readonly targetCapability: EcdsaTargetCapabilityBindingV1;
-    readonly reshareChannelBindingDigestB64u: string;
-});
 export type LinkedDeviceTargetPreparationResolutionV1 = LinkedDeviceOwnerSourceChildResolutionV1;
 export type LinkedDeviceOwnerSourceChildResolutionRequestV1 = {
     readonly kind: 'preparation';

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.d.ts

@@ -4,7 +4,7 @@ import type { CloudflareD1EmailOtpChallengeStore } from './d1EmailOtpChallengeSt
 import type { CloudflareD1EmailOtpChallengeVerifier } from './d1EmailOtpChallengeVerifier';
 import type { CloudflareD1EmailOtpGrantStore } from './d1EmailOtpGrantStore';
 import type { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from './d1EmailOtpRegistrationEnrollmentFinalizer';
-import type { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
+import type { GoogleEmailOtpRegistrationAttemptStore } from './d1GoogleEmailOtpRegistrationAttemptStore';
 type CreateEmailOtpChallengeInput = Parameters<RouterApiEmailOtpRouteService['createEmailOtpChallenge']>[0];
 type CreateEmailOtpChallengeResult = Awaited<ReturnType<RouterApiEmailOtpRouteService['createEmailOtpChallenge']>>;
 type CreateEmailOtpEnrollmentChallengeInput = Parameters<RouterApiEmailOtpRouteService['createEmailOtpEnrollmentChallenge']>[0];
@@ -33,7 +33,7 @@ export declare class CloudflareD1EmailOtpChallengeService {
         readonly grantTtlMs: number;
         readonly grants: CloudflareD1EmailOtpGrantStore;
         readonly issuer: CloudflareD1EmailOtpChallengeIssuer;
-        readonly registrationAttempts: CloudflareD1GoogleEmailOtpRegistrationAttemptStore;
+        readonly registrationAttempts: GoogleEmailOtpRegistrationAttemptStore;
         readonly verifier: CloudflareD1EmailOtpChallengeVerifier;
     });
     createEmailOtpChallenge(input: CreateEmailOtpChallengeInput): Promise<CreateEmailOtpChallengeResult>;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts

@@ -12,7 +12,7 @@ type EmailOtpRegistrationVerificationReceiptConsumeResult = {
 } | {
     readonly kind: 'challenge_missing';
 };
-export type EmailOtpChallengeContextInput = {
+type EmailOtpChallengeContextInput = {
     readonly challengeSubjectId: string;
     readonly walletId: string;
     readonly orgId: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.d.ts

@@ -1,15 +1,9 @@
 import type { EmailOtpAuthStateRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
 import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 import type { D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import type { EmailOtpAuthStateReadResult as CoreEmailOtpAuthStateReadResult } from '../../../../core/authService/emailOtpEnrollment';
 import { type EmailOtpAuthStatePatch } from './d1EmailOtpRecords';
-export type EmailOtpAuthStateReadResult = {
-    readonly ok: true;
-    readonly state: EmailOtpAuthStateRecord | null;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+export type EmailOtpAuthStateReadResult = Readonly<CoreEmailOtpAuthStateReadResult>;
 export declare class CloudflareD1EmailOtpEnrollmentStore {
     private readonly prepare;
     constructor(input: {

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts

@@ -7,7 +7,5 @@ export declare class CloudflareD1EmailOtpGrantStore {
     });
     put(record: EmailOtpGrantRecord): Promise<void>;
     consume(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    read(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    delete(grantToken: string): Promise<void>;
 }
 //# sourceMappingURL=d1EmailOtpGrantStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts

@@ -1,4 +1,5 @@
 import type { ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
+import type { RateLimitResult } from '../../../../core/authService/rateLimits';
 import type { EmailOtpRateLimitPolicy } from '../auth/d1RouterApiAuthConfig';
 import { type EmailOtpRateLimitScope } from './d1EmailOtpRecords';
 type EmailOtpRateLimitPolicies = {
@@ -13,24 +14,32 @@ type EmailOtpRateLimitConsumeInput = {
     readonly orgId?: string;
     readonly clientIp?: string;
 };
-type EmailOtpRateLimitConsumeResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly code: 'rate_limited';
-    readonly message: string;
-    readonly retryAfterMs?: number;
-    readonly resetAtMs?: number;
-};
+type EmailOtpRateLimitConsumeResult = Readonly<RateLimitResult>;
 export declare class CloudflareD1EmailOtpRateLimitStore {
-    private readonly prepare;
     private readonly rateLimits;
+    private readonly counter;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
         readonly rateLimits: EmailOtpRateLimitPolicies;
+        readonly counter?: EmailOtpRateLimitCounter;
     });
     consume(input: EmailOtpRateLimitConsumeInput): Promise<EmailOtpRateLimitConsumeResult>;
-    private consumeKey;
+}
+export interface EmailOtpRateLimitCounter {
+    consume(input: {
+        readonly key: string;
+        readonly limit: number;
+        readonly windowMs: number;
+    }): Promise<EmailOtpRateLimitConsumeResult>;
+}
+export declare class D1EmailOtpRateLimitCounter implements EmailOtpRateLimitCounter {
+    private readonly prepare;
+    constructor(prepare: ScopedD1Prepare);
+    consume(input: {
+        readonly key: string;
+        readonly limit: number;
+        readonly windowMs: number;
+    }): Promise<EmailOtpRateLimitConsumeResult>;
 }
 export {};
 //# sourceMappingURL=d1EmailOtpRateLimitStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.d.ts

@@ -1,7 +1,8 @@
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
-export type EmailOtpChallengeIssueAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
-export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
+import { EMAIL_OTP_CHANNEL } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
+import type { EmailOtpAuthStateRecord, EmailOtpChallengeAction, EmailOtpChallengeOperation, EmailOtpChallengeRecord, EmailOtpGrantAction, EmailOtpGrantRecord, EmailOtpLoginChallengeOperation, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord } from '../../../../core/EmailOtpStores';
+import type { EmailOtpRateLimitScope } from '../../../../core/authService/emailOtpConfig';
+export type EmailOtpChallengeIssueAction = EmailOtpChallengeAction;
+export type { EmailOtpRateLimitScope };
 export type EmailOtpAuthStatePatch = {
     readonly otpFailureCount?: number | null;
     readonly lastOtpFailureAtMs?: number | null;
@@ -183,5 +184,4 @@ export declare function emailOtpChallengePurposeIsValid(input: {
     readonly action: EmailOtpChallengeIssueAction;
     readonly operation: EmailOtpChallengeOperation;
 }): boolean;
-export {};
 //# sourceMappingURL=d1EmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.d.ts

@@ -1,22 +1,12 @@
 import type { EmailOtpServerSealRuntimeConfig } from '../auth/d1RouterApiAuthConfig';
-type EmailOtpServerSealInput = {
-    readonly wrappedCiphertext?: unknown;
-};
-type EmailOtpServerSealResult = {
-    readonly ok: true;
-    readonly ciphertext: string;
-    readonly enrollmentSealKeyVersion: string;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-};
+import type { EmailOtpServerSealRequest, EmailOtpServerSealResult as CoreEmailOtpServerSealResult } from '../../../../core/authService/emailOtpSeal';
+type EmailOtpServerSealResult = Readonly<CoreEmailOtpServerSealResult>;
 export declare class CloudflareD1EmailOtpServerSealRuntime {
     private readonly config;
     private readonly cipherResult;
     constructor(config: EmailOtpServerSealRuntimeConfig);
-    removeEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
-    applyEmailOtpServerSeal(input: EmailOtpServerSealInput): Promise<EmailOtpServerSealResult>;
+    removeEmailOtpServerSeal(input: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
+    applyEmailOtpServerSeal(input: EmailOtpServerSealRequest): Promise<EmailOtpServerSealResult>;
     private runServerSealOperation;
     private createCipher;
 }

package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts

@@ -1,13 +1,25 @@
+import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { RuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import type { GoogleEmailOtpRegistrationAttemptRecord, NonEmptyGoogleEmailOtpRegistrationOfferCandidates, PendingGoogleEmailOtpRegistrationAttemptRecord } from '../../../../core/EmailOtpStores';
 import { type ScopedD1Prepare } from '../../../../core/emailOtpD1Statements';
 export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
     private readonly prepare;
     private readonly orgId;
+    private readonly batch;
     constructor(input: {
         readonly prepare: ScopedD1Prepare;
         readonly orgId: string;
+        readonly batch: D1DatabaseLike['batch'];
     });
+    complete(input: {
+        readonly attemptId: string;
+        readonly walletId: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
+    completeCommitted(input: {
+        readonly attemptId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<import("./d1GoogleRegistrationCompletion").GoogleRegistrationCompletionResult>;
     cleanupExpired(nowMs: number): Promise<number>;
     create(input: {
         readonly providerSubject: string;
@@ -42,8 +54,24 @@ export declare class CloudflareD1GoogleEmailOtpRegistrationAttemptStore {
         readonly walletId: string;
         readonly nowMs: number;
     }): Promise<boolean>;
+    claimCandidate(input: {
+        readonly attemptId: string;
+        readonly candidateId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+    }): Promise<RegistrationCandidateClaimResult>;
     read(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
     put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
-    delete(attemptId: string): Promise<void>;
+    private deleteMalformedUnclaimed;
 }
+export type GoogleEmailOtpRegistrationAttemptStore = Pick<CloudflareD1GoogleEmailOtpRegistrationAttemptStore, keyof CloudflareD1GoogleEmailOtpRegistrationAttemptStore>;
+export type RegistrationCandidateClaimResult = {
+    readonly ok: true;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'registration_candidate_unavailable';
+    readonly message: string;
+};
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationAttemptStore.d.ts.map