@seams/wallet-server 0.7.3 → 0.8.0

package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts

@@ -1,6 +1,3 @@
-import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
-import type { StoreFactoryInput } from './storeBackends';
-import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnSyncChallengeRecord = {
     version: 'webauthn_sync_challenge_v1';
     challengeId: string;
@@ -10,16 +7,27 @@ export type WebAuthnSyncChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnSyncChallengeStore extends WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
-}
-export interface D1WebAuthnSyncChallengeStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnSyncChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
-}
-export declare const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare const ensureWebAuthnSyncChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
-export declare class D1WebAuthnSyncChallengeStore extends D1WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
-    constructor(input: D1WebAuthnSyncChallengeStoreOptions);
+export type SyncChallengeFailure = {
+    readonly ok: false;
+    readonly code: 'wallet_home_conflict' | 'wallet_home_unavailable';
+    readonly message: string;
+    readonly record?: never;
+};
+export interface WebAuthnSyncChallengeStore {
+    create(record: WebAuthnSyncChallengeRecord): Promise<{
+        readonly ok: true;
+        readonly code?: never;
+        readonly message?: never;
+        readonly record?: never;
+    } | SyncChallengeFailure>;
+    consume(input: {
+        readonly challengeId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly record: WebAuthnSyncChallengeRecord | null;
+        readonly code?: never;
+        readonly message?: never;
+    } | SyncChallengeFailure>;
 }
-export declare function createWebAuthnSyncChallengeStore(input: StoreFactoryInput): WebAuthnSyncChallengeStore;
 //# sourceMappingURL=WebAuthnSyncChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts

@@ -1,27 +1,3 @@
-import type { AuthServiceConfigSource } from './configValues';
-export type EmailOtpDeliveryMode = 'email_provider' | 'log' | 'memory';
 export declare const EMAIL_OTP_CODE_LENGTH: 6;
-export type EmailOtpConfig = {
-    deliveryMode: EmailOtpDeliveryMode;
-    challengeTtlMs: number;
-    grantTtlMs: number;
-    maxAttempts: number;
-    lockoutTtlMs: number;
-    codeLength: typeof EMAIL_OTP_CODE_LENGTH;
-    devOutboxEnabled: boolean;
-    maxActiveChallengesPerContext: number;
-};
-type AuthRateLimitPolicy = {
-    limit: number;
-    windowMs: number;
-};
 export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
-export type EmailOtpRateLimitPolicies = Record<EmailOtpRateLimitScope, AuthRateLimitPolicy>;
-type EmailOtpConfigInput = {
-    thresholdStore: AuthServiceConfigSource;
-    production: boolean;
-};
-export declare function resolveEmailOtpRateLimitPolicies(input: EmailOtpConfigInput): EmailOtpRateLimitPolicies;
-export declare function resolveEmailOtpConfig(input: EmailOtpConfigInput): EmailOtpConfig;
-export {};
 //# sourceMappingURL=emailOtpConfig.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpEnrollment.d.ts

@@ -1,12 +1,4 @@
-import type { EmailOtpAuthStateRecord, EmailOtpAuthStateStore, EmailOtpWalletEnrollmentRecord, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
-export type EmailOtpEnrollmentReadResult = {
-    ok: true;
-    enrollment: EmailOtpWalletEnrollmentRecord;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
+import type { EmailOtpAuthStateRecord } from '../EmailOtpStores';
 export type EmailOtpAuthStateReadResult = {
     ok: true;
     state: EmailOtpAuthStateRecord | null;
@@ -15,65 +7,4 @@ export type EmailOtpAuthStateReadResult = {
     code: string;
     message: string;
 };
-export type EmailOtpAuthStatePatch = Partial<Pick<EmailOtpAuthStateRecord, 'otpFailureCount' | 'lastOtpFailureAtMs' | 'otpLockedUntilMs' | 'lastEmailOtpLoginAtMs' | 'lastStrongAuthAtMs'>>;
-export type EmailOtpStrongAuthRequiredResult = {
-    ok: true;
-    required: boolean;
-    walletId: string;
-    lastEmailOtpLoginAtMs?: number;
-    lastStrongAuthAtMs?: number;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type EmailOtpStrongAuthSatisfiedResult = {
-    ok: true;
-    walletId: string;
-    lastStrongAuthAtMs?: number;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export declare function readEmailOtpEnrollmentWithStore(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly request: {
-        walletId?: unknown;
-        orgId: unknown;
-    };
-}): Promise<EmailOtpEnrollmentReadResult>;
-export declare function readActiveEmailOtpEnrollmentWithStore(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly request: {
-        walletId?: unknown;
-        orgId: unknown;
-        providerUserId?: unknown;
-    };
-}): Promise<EmailOtpEnrollmentReadResult>;
-export declare function readEmailOtpAuthStateForEnrollmentWithStore(input: {
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly enrollment: EmailOtpWalletEnrollmentRecord;
-}): Promise<EmailOtpAuthStateReadResult>;
-export declare function putEmailOtpAuthStateForEnrollmentWithStore(input: {
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly enrollment: EmailOtpWalletEnrollmentRecord;
-    readonly patch: EmailOtpAuthStatePatch;
-    readonly nowMs: number;
-}): Promise<EmailOtpAuthStateRecord>;
-export declare function isEmailOtpStrongAuthRequiredWithStores(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly request: {
-        walletId?: unknown;
-    };
-}): Promise<EmailOtpStrongAuthRequiredResult>;
-export declare function markEmailOtpStrongAuthSatisfiedWithStores(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly request: {
-        walletId?: unknown;
-    };
-    readonly nowMs: number;
-}): Promise<EmailOtpStrongAuthSatisfiedResult>;
 //# sourceMappingURL=emailOtpEnrollment.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts

@@ -1,9 +1,4 @@
 import type { SigningSessionSealCipherAdapter } from '../../threshold/session/signingSessionSeal/signingSessionSeal.types';
-type EmailOtpShamirCipherConfig = {
-    readonly rootSecretB64u: string;
-    readonly currentKeyVersion: string;
-    readonly acceptedWarmKeyVersions: readonly string[];
-};
 export type EmailOtpShamirCipherResult = {
     readonly ok: true;
     readonly keyVersion: string;
@@ -13,7 +8,6 @@ export type EmailOtpShamirCipherResult = {
     readonly code: 'not_configured';
     readonly message: string;
 };
-export type EmailOtpServerSealOperation = 'apply-server-seal' | 'remove-server-seal';
 export type EmailOtpServerSealRequest = {
     readonly wrappedCiphertext?: unknown;
 };
@@ -26,11 +20,4 @@ export type EmailOtpServerSealResult = {
     code: string;
     message: string;
 };
-export declare function createEmailOtpShamirCipherFromConfig(input: EmailOtpShamirCipherConfig): EmailOtpShamirCipherResult;
-export declare function runEmailOtpServerSealOperation(input: {
-    readonly operation: EmailOtpServerSealOperation;
-    readonly request: EmailOtpServerSealRequest;
-    readonly shamir: EmailOtpShamirCipherResult;
-}): Promise<EmailOtpServerSealResult>;
-export {};
 //# sourceMappingURL=emailOtpSeal.d.ts.map

package/dist/types/wallet-server/src/core/authService/githubOAuth.d.ts

@@ -7,7 +7,7 @@ export type GithubOAuthPublicConfig = {
     clientId: string;
     callbackUrl: string;
 };
-export type GithubOAuthCodeFacadeResult = {
+type GithubOAuthCodeFacadeResult = {
     ok: true;
     verified: true;
     userId: string;
@@ -32,4 +32,5 @@ export declare function verifyGithubOAuthCodeWithIdentityStore(input: {
     identityStore: IdentityStore;
     fetchImpl?: typeof fetch;
 }): Promise<GithubOAuthCodeFacadeResult>;
+export {};
 //# sourceMappingURL=githubOAuth.d.ts.map

package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts

@@ -1,31 +1,5 @@
-import type { AccessKeyList, FinalExecutionOutcome } from '@near-js/types';
 import type { NearTransactionActionArgsWasm } from '../../../../shared-ts/src/near/actions';
-import { MinimalNearClient, SignedTransaction } from '../rpcClients/near/NearClient';
-import type { NormalizedLogger } from '../logger';
-type NearTxContext = {
-    nextNonce: string;
-    blockHash: string;
-};
-export type AccountAccessKeyVisibilityOptions = {
-    attempts?: number;
-    delayMs?: number;
-    finality?: 'optimistic' | 'final';
-};
-export declare function viewAccessKeyListWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-}): Promise<AccessKeyList>;
-export declare function dispatchNearSignedTransactionBorshWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly signedTransactionBorshB64u: string;
-}): Promise<{
-    rpcResult: FinalExecutionOutcome;
-}>;
-export declare function fetchNearTxContextWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-    readonly publicKey: string;
-}): Promise<NearTxContext>;
+import { SignedTransaction } from '../rpcClients/near/NearClient';
 export declare function signGasRelayerNearTransactionWithDeps(input: {
     readonly ensureSignerWasm: () => Promise<void>;
     readonly relayerAccount: string;
@@ -35,16 +9,4 @@ export declare function signGasRelayerNearTransactionWithDeps(input: {
     readonly blockHash: string;
     readonly actions: readonly NearTransactionActionArgsWasm[];
 }): Promise<SignedTransaction>;
-export declare function checkNearAccountExistsWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly logger: NormalizedLogger;
-    readonly accountId: string;
-}): Promise<boolean>;
-export declare function verifyAccountAccessKeysPresentWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-    readonly expectedPublicKeys: readonly string[];
-    readonly options?: AccountAccessKeyVisibilityOptions;
-}): Promise<boolean>;
-export {};
 //# sourceMappingURL=nearTransactions.d.ts.map

package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts

@@ -1,6 +1,3 @@
-import { type SigningSessionSealRateLimiter } from '../../threshold/session/signingSessionSeal';
-import type { AuthServiceConfigSource } from './configValues';
-import type { EmailOtpRateLimitPolicies, EmailOtpRateLimitScope } from './emailOtpConfig';
 export type RateLimitResult = {
     ok: true;
 } | {
@@ -10,18 +7,4 @@ export type RateLimitResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export declare function createEmailOtpRateLimiter(input: {
-    thresholdStore: AuthServiceConfigSource;
-}): SigningSessionSealRateLimiter;
-export declare function consumeEmailOtpRateLimit(input: {
-    limiter: SigningSessionSealRateLimiter;
-    policies: EmailOtpRateLimitPolicies;
-    scope: EmailOtpRateLimitScope;
-    action?: string;
-    userId?: string;
-    walletId?: string;
-    providerSubject?: string;
-    orgId?: string;
-    clientIp?: string;
-}): Promise<RateLimitResult>;
 //# sourceMappingURL=rateLimits.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthn.d.ts

@@ -1,17 +1,10 @@
-import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
 import type { ThresholdEd25519AuthorityScope } from '../types';
 import type { NormalizedLogger } from '../logger';
 import type { WebAuthnAuthenticatorStore } from '../WebAuthnAuthenticatorStore';
-import type { WebAuthnLoginChallengeStore } from '../WebAuthnLoginChallengeStore';
-import type { WebAuthnSyncChallengeStore } from '../WebAuthnSyncChallengeStore';
-import type { WebAuthnCredentialBindingStore } from '../WebAuthnCredentialBindingStore';
-import type { IdentityStore } from '../IdentityStore';
 import type { WebAuthnAuthenticationCredential } from '../types';
 import { type ResolvedEd25519WalletBinding } from './webauthnWalletBinding';
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
-import { type WebAuthnLoginEd25519 } from './webauthnVerificationOutcomes';
 type WebAuthnCredentialVerificationResult = {
     ok: true;
     credential: {
@@ -30,51 +23,6 @@ type WebAuthnAuthenticationLiteResult = {
     code?: string;
     message?: string;
 };
-/**
- * One listed authenticator. `device` is required: the published service
- * contract declares it, and a binding with no authenticator row still gets the
- * `Unknown device` fallback rather than an absent field.
- */
-type WebAuthnAuthenticatorListEntry = {
-    credentialIdB64u: string;
-    signerSlot?: number;
-    publicKey?: string;
-    createdAtMs?: number;
-    updatedAtMs?: number;
-    device: WebAuthnAuthenticatorDeviceInfo;
-};
-export type WebAuthnAuthenticatorListResult = {
-    ok: boolean;
-    code?: string;
-    message?: string;
-    authenticators?: WebAuthnAuthenticatorListEntry[];
-};
-type WebAuthnLoginOptionsResult = {
-    ok: boolean;
-    challengeId?: string;
-    challengeB64u?: string;
-    expiresAtMs?: number;
-    code?: string;
-    message?: string;
-};
-export type WebAuthnSyncAccountOptionsResult = {
-    ok: true;
-    challengeId: string;
-    challengeB64u: string;
-    expiresAtMs: number;
-    credentialIds?: string[];
-    walletBinding?: ResolvedEd25519WalletBinding;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type WebAuthnSyncAccountVerificationRequest = {
-    challengeId?: unknown;
-    challenge_id?: unknown;
-    webauthn_authentication: WebAuthnAuthenticationCredential;
-    expected_origin?: string;
-};
 export type WebAuthnSyncAccountVerificationResult = {
     ok: true;
     verified: true;
@@ -107,19 +55,6 @@ export type WebAuthnSyncAccountVerificationResult = {
     code: string;
     message: string;
 };
-export type WebAuthnLoginVerificationResult = {
-    ok: true;
-    verified: true;
-    userId: string;
-    rpId: string;
-    credentialIdB64u: string;
-    ed25519: WebAuthnLoginEd25519;
-} | {
-    ok: false;
-    verified?: false;
-    code: string;
-    message: string;
-};
 export declare function verifyWebAuthnRegistrationCredentialForIntent(input: {
     webauthnRegistration: unknown;
     expectedChallenge: string;
@@ -135,65 +70,5 @@ export declare function verifyWebAuthnAuthenticationLiteWithStore(input: {
     authenticatorStore: WebAuthnAuthenticatorStore;
     logger: NormalizedLogger;
 }): Promise<WebAuthnAuthenticationLiteResult>;
-export declare function listWebAuthnAuthenticatorsForUserWithStores(input: {
-    userId: string;
-    rpId: string;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-}): Promise<WebAuthnAuthenticatorListResult>;
-export declare function createWebAuthnLoginOptionsWithStore(input: {
-    request: {
-        userId?: unknown;
-        user_id?: unknown;
-        rpId?: unknown;
-        rp_id?: unknown;
-        ttlMs?: unknown;
-        ttl_ms?: unknown;
-    };
-    loginChallengeStore: WebAuthnLoginChallengeStore;
-}): Promise<WebAuthnLoginOptionsResult>;
-export declare function createWebAuthnSyncAccountOptionsWithStores(input: {
-    request: {
-        rp_id?: unknown;
-        account_id?: unknown;
-        ttl_ms?: unknown;
-        ttlMs?: unknown;
-    };
-    syncChallengeStore: WebAuthnSyncChallengeStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-}): Promise<WebAuthnSyncAccountOptionsResult>;
-/**
- * The one signer read sync needs. Shaped as the wallet store's own reader so
- * the existing store satisfies it structurally, with no adapter.
- */
-type SyncAccountEd25519SignerReader = {
-    getEd25519SignerBySlot(input: {
-        walletId: WalletId;
-        signerSlot: number;
-    }): Promise<{
-        readonly custodyKeyManifestDigestB64u: string;
-    } | null>;
-};
-export declare function verifyWebAuthnSyncAccountWithStores(input: {
-    request: WebAuthnSyncAccountVerificationRequest;
-    syncChallengeStore: WebAuthnSyncChallengeStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    walletStore: SyncAccountEd25519SignerReader;
-    logger: NormalizedLogger;
-}): Promise<WebAuthnSyncAccountVerificationResult>;
-export declare function verifyWebAuthnLoginWithStores(input: {
-    request: {
-        challengeId?: unknown;
-        challenge_id?: unknown;
-        webauthn_authentication?: unknown;
-        expected_origin?: string;
-    };
-    loginChallengeStore: WebAuthnLoginChallengeStore;
-    authenticatorStore: WebAuthnAuthenticatorStore;
-    credentialBindingStore: WebAuthnCredentialBindingStore;
-    identityStore: IdentityStore;
-    logger: NormalizedLogger;
-}): Promise<WebAuthnLoginVerificationResult>;
 export {};
 //# sourceMappingURL=webauthn.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts

@@ -45,8 +45,5 @@ export declare function parseClientDataJsonBase64url(clientDataJSONB64u: string)
 };
 export declare function originHostnameOrEmpty(origin: string): string;
 export declare function isHostWithinRpId(host: string, rpId: WebAuthnRpId): boolean;
-export declare function parseCacheControlMaxAgeSec(cacheControl: string | null): number | null;
-export declare function parseJwtSegmentJson(input: string): Record<string, unknown> | null;
-export declare function parseJwtAud(input: unknown): string[];
 export {};
 //# sourceMappingURL=webauthnOidcHelpers.d.ts.map

package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts

@@ -6,7 +6,7 @@ type WebAuthnVerificationFailure = {
     code: string;
     message: string;
 };
-export type WebAuthnLoginEd25519 = {
+type WebAuthnLoginEd25519 = {
     readonly kind: 'absent';
 } | {
     readonly kind: 'active';

package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts

@@ -1,5 +1,3 @@
-import type { WebAuthnCredentialBindingRecord } from '../WebAuthnCredentialBindingStore';
-export declare function parseBoundaryWalletId(raw: unknown): string | null;
 export type ResolvedEd25519WalletBinding = {
     walletId: string;
     nearAccountId: string;
@@ -8,14 +6,4 @@ export type ResolvedEd25519WalletBinding = {
     credentialIdB64u: string;
     signerSlot: number;
 };
-/**
- * Returns `null` when the binding carries no Ed25519 identity, which is the
- * valid state for a wallet whose Ed25519 Yao ceremony has not settled yet.
- * Callers must surface that as a typed "not provisioned" outcome rather than
- * treating it as a missing credential.
- */
-export declare function resolvedEd25519WalletBindingFromCredentialBinding(args: {
-    binding: WebAuthnCredentialBindingRecord;
-    signerSlot?: number;
-}): ResolvedEd25519WalletBinding | null;
 //# sourceMappingURL=webauthnWalletBinding.d.ts.map

package/dist/types/wallet-server/src/core/config.d.ts

@@ -1,13 +1,3 @@
-import type { AuthServiceConfig, AuthServiceConfigInput } from './types';
-export declare const AUTH_SERVICE_CONFIG_DEFAULTS: {
-    readonly nearRpcUrlTestnet: "https://rpc.testnet.fastnear.com";
-    readonly nearRpcUrlMainnet: "https://rpc.mainnet.near.org";
-    readonly networkId: "testnet";
-    readonly accountInitialBalance: "30000000000000000000000";
-    readonly createAccountAndRegisterGas: "85000000000000";
-};
-export declare function createAuthServiceConfig(input: AuthServiceConfigInput): AuthServiceConfig;
-export declare function validateConfigs(config: AuthServiceConfig): void;
 export declare function parseBool(v: unknown): boolean;
 export declare function requireEnvVar<T extends object, K extends keyof T & string>(env: T, name: K): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts

@@ -5,8 +5,6 @@ export interface D1IdentityStoreSchemaOptions extends D1SchemaOptions {
 export interface D1IdentityStoreOptions extends D1TenantStoreOptions {
     readonly now?: () => Date;
 }
-/** Names the identity store in D1 scope errors. */
-export declare const IDENTITY_D1_STORE = "identity store";
 export declare const IDENTITY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS identity_links (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      subject TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, subject),\n      CHECK (length(namespace) > 0),\n      CHECK (length(org_id) > 0),\n      CHECK (length(project_id) > 0),\n      CHECK (length(env_id) > 0),\n      CHECK (length(subject) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (COALESCE(json_extract(record_json, '$.version') = 'identity_subject_v1', 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.subject') = subject, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.userId') = user_id, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.createdAtMs') = created_at_ms, 0)),\n      CHECK (COALESCE(json_extract(record_json, '$.updatedAtMs') = updated_at_ms, 0))\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS identity_links_user_idx\n      ON identity_links (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
 export declare function ensureIdentityStoreD1Schema(options: D1IdentityStoreSchemaOptions): Promise<void>;
 export declare class D1IdentityStore implements IdentityStore {

package/dist/types/wallet-server/src/core/d1TenantStore.d.ts

@@ -1,9 +1,4 @@
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
-/**
- * A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
- * `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
- */
-export declare function resolveStorePrefix(config: Record<string, unknown>, explicitKeys: readonly string[], segment: string): string;
 /** The tenant scope that leads the key of every D1 table. */
 export type D1TenantScope = {
     readonly namespace: string;
@@ -22,8 +17,6 @@ export interface D1TenantStoreOptions {
     readonly envId: string;
     readonly ensureSchema?: boolean;
 }
-/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
-export declare function d1TenantScopeFromConfig(config: Record<string, unknown>, namespace: string, store: string): D1TenantScope;
 export declare function ensureD1Schema(database: D1DatabaseLike, statements: readonly string[]): Promise<void>;
 /** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
 export declare class D1Schema {

package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts

@@ -72,7 +72,6 @@ export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL: readonly ["\n    CR
  */
 export declare const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS wallet_auth_methods (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      wallet_id TEXT NOT NULL,\n      wallet_authority_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL DEFAULT '',\n      kind TEXT NOT NULL,\n      status TEXT NOT NULL,\n      wallet_auth_method_id TEXT NOT NULL,\n      auth_identifier_key TEXT NOT NULL,\n      credential_id_b64u TEXT,\n      credential_public_key_b64u TEXT,\n      email_hash_hex TEXT,\n      registration_authority_id TEXT,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      activated_at_ms INTEGER,\n      revoked_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_auth_method_id),\n      FOREIGN KEY (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_authority_id\n      ) REFERENCES wallet_authorities(\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        authority_id\n      ),\n      CHECK (length(wallet_id) > 0),\n      CHECK (length(wallet_authority_id) > 0),\n      CHECK (kind IN ('passkey', 'email_otp')),\n      CHECK (status IN ('pending_local_install', 'active', 'revoked')),\n      CHECK (length(wallet_auth_method_id) > 0),\n      CHECK (length(auth_identifier_key) > 0),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms >= 0),\n      CHECK (updated_at_ms >= created_at_ms),\n      CHECK (\n        (status = 'pending_local_install' AND activated_at_ms IS NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'active' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NULL)\n        OR\n        (status = 'revoked' AND activated_at_ms IS NOT NULL AND revoked_at_ms IS NOT NULL)\n      ),\n      CHECK (\n        (kind = 'passkey'\n          AND length(rp_id) > 0\n          AND credential_id_b64u IS NOT NULL\n          AND length(credential_id_b64u) > 0\n          AND credential_public_key_b64u IS NOT NULL\n          AND length(credential_public_key_b64u) > 0\n          AND email_hash_hex IS NULL\n          AND registration_authority_id IS NULL\n          AND auth_identifier_key = credential_id_b64u)\n        OR\n        (kind = 'email_otp'\n          AND rp_id = ''\n          AND credential_id_b64u IS NULL\n          AND credential_public_key_b64u IS NULL\n          AND email_hash_hex IS NOT NULL\n          AND length(email_hash_hex) > 0\n          AND registration_authority_id IS NOT NULL\n          AND length(registration_authority_id) > 0\n          AND auth_identifier_key = email_hash_hex)\n      ),\n      CHECK (json_extract(record_json, '$.version') = 'wallet_auth_method_v2'),\n      CHECK (json_extract(record_json, '$.walletAuthMethodId') = wallet_auth_method_id),\n      CHECK (json_extract(record_json, '$.walletId') = wallet_id),\n      CHECK (json_extract(record_json, '$.walletAuthorityId') = wallet_authority_id),\n      CHECK (json_extract(record_json, '$.kind') = kind),\n      CHECK (json_extract(record_json, '$.status') = status),\n      CHECK (json_extract(record_json, '$.createdAtMs') = created_at_ms),\n      CHECK (json_extract(record_json, '$.updatedAtMs') = updated_at_ms),\n      CHECK (\n        (kind = 'passkey'\n          AND json_extract(record_json, '$.rpId') = rp_id\n          AND json_extract(record_json, '$.credentialIdB64u') = credential_id_b64u\n          AND json_extract(record_json, '$.credentialPublicKeyB64u') = credential_public_key_b64u\n          AND json_extract(record_json, '$.counter') >= 0)\n        OR\n        (kind = 'email_otp'\n          AND json_extract(record_json, '$.emailHashHex') = email_hash_hex\n          AND json_extract(record_json, '$.registrationAuthorityId') = registration_authority_id)\n      )\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS wallet_auth_methods_wallet_authority_status_idx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        wallet_id,\n        wallet_authority_id,\n        status\n      )\n  ", "\n    CREATE UNIQUE INDEX IF NOT EXISTS wallet_auth_methods_v2_passkey_uidx\n      ON wallet_auth_methods (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        rp_id,\n        credential_id_b64u\n      )\n      WHERE kind = 'passkey' AND credential_id_b64u IS NOT NULL\n  "];
 export declare function ensureWalletAuthMethodStoreD1Schema(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
-export declare function ensureWalletAuthMethodStoreD1SchemaV2(options: D1WalletAuthMethodStoreSchemaOptions): Promise<void>;
 export declare function walletAuthMethodId(record: WalletAuthMethodRecord): WalletAuthMethodId;
 export declare function normalizeWalletAuthMethod(raw: unknown): WalletAuthMethodRecord | null;
 export declare function normalizeWalletAuthMethodV2(raw: unknown): WalletAuthMethodRecordV2 | null;

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceBootstrap.d.ts

@@ -0,0 +1,19 @@
+import type { LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+import type { LinkedDeviceSessionRecordV1 } from './linkedDeviceSessionRecord';
+export type LinkedDeviceBootstrapResult = {
+    readonly ok: true;
+    readonly record: LinkedDeviceSessionRecordV1 | null;
+} | {
+    readonly ok: false;
+    readonly code: 'home_conflict' | 'home_unavailable';
+    readonly record?: never;
+};
+export interface LinkedDeviceBootstrapStore {
+    read(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceBootstrapResult>;
+    create(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+    claim(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+    finish(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceBootstrapResult>;
+}
+export declare function requireLinkedDeviceBootstrapRecord(result: LinkedDeviceBootstrapResult): LinkedDeviceSessionRecordV1 | null;
+export declare function linkedDeviceBootstrapFailure(error: unknown): 'home_conflict' | 'home_unavailable' | null;
+//# sourceMappingURL=linkedDeviceBootstrap.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts

@@ -144,18 +144,20 @@ export type LinkedDeviceSessionStoreV1 = {
         readonly nowMs: number;
     }): Promise<LinkedDeviceSessionMutationResultV1>;
 };
-export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | {
-    readonly outcome: 'invalid_input';
+type LinkedDeviceSessionFailureV1 = {
+    readonly outcome: 'home_conflict' | 'home_unavailable';
     readonly message: string;
+    readonly record?: never;
 } | {
-    readonly outcome: 'unauthorized';
-    readonly code: string;
+    readonly outcome: 'invalid_input';
     readonly message: string;
 };
-type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | {
-    readonly outcome: 'invalid_input';
+export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | LinkedDeviceSessionFailureV1 | {
+    readonly outcome: 'unauthorized';
+    readonly code: string;
     readonly message: string;
 };
+type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | LinkedDeviceSessionFailureV1;
 type LinkedDeviceSessionCreateInputV1 = {
     readonly payload: QrLinkedDeviceSessionPayloadV5;
     readonly nowMs: number;

package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts

@@ -21,17 +21,14 @@ export type LinkedDeviceRequestProofNonceStoreV1 = {
         readonly expiresAtMs: number;
         readonly consumedAtMs: number;
     }): Promise<{
-        readonly outcome: 'consumed';
-    } | {
-        readonly outcome: 'already_used';
+        readonly outcome: 'consumed' | 'already_used' | 'unavailable';
     }>;
 };
 type LinkedDeviceRequestProofVerificationResultV1 = {
     readonly kind: 'authorized';
-    readonly proofDigestB64u: DigestB64u;
 } | {
     readonly kind: 'denied';
-    readonly code: 'invalid' | 'expired' | 'replayed';
+    readonly code: 'invalid' | 'expired' | 'replayed' | 'unavailable';
     readonly message: string;
 };
 export declare class LinkedDeviceRequestProofVerifierV1 {

package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts

@@ -5,16 +5,12 @@ export type ScopedD1Prepare = (sql: string, values: readonly unknown[]) => D1Pre
 /** Statements on `email_otp_challenges`. */
 export declare const emailOtpChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpChallengeRecord) => D1PreparedStatementLike;
     delete: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_grants`. */
 export declare const emailOtpGrantRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpGrantRecord) => D1PreparedStatementLike;
-    select: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
     consume: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
-    delete: (prepare: ScopedD1Prepare, grantToken: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_wallet_enrollments`. */
 export declare const emailOtpWalletEnrollmentRows: {
@@ -30,12 +26,19 @@ export declare const emailOtpAuthStateRows: {
 /** Statements on `email_otp_unlock_challenges`. */
 export declare const emailOtpUnlockChallengeRows: {
     insert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
-    upsert: (prepare: ScopedD1Prepare, record: EmailOtpUnlockChallengeRecord) => D1PreparedStatementLike;
     consume: (prepare: ScopedD1Prepare, challengeId: string) => D1PreparedStatementLike;
 };
 /** Statements on `email_otp_registration_attempts`. */
 export declare const emailOtpRegistrationAttemptRows: {
-    upsert: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    insertPendingIfAbsent: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
+    claimCandidate: (prepare: ScopedD1Prepare, input: {
+        readonly attemptId: string;
+        readonly candidateId: string;
+        readonly walletId: string;
+        readonly intentDigest: string;
+        readonly nowMs: number;
+    }) => D1PreparedStatementLike;
+    updatePending: (prepare: ScopedD1Prepare, record: GoogleEmailOtpRegistrationAttemptRecord) => D1PreparedStatementLike;
     select: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
     /** The latest live attempt for the subject, email, owner binding and runtime scope. */
     selectStarted: (prepare: ScopedD1Prepare, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>) => D1PreparedStatementLike;
@@ -49,6 +52,6 @@ export declare const emailOtpRegistrationAttemptRows: {
     deleteExpired: (prepare: ScopedD1Prepare, nowMs: number) => D1PreparedStatementLike;
     /** Finds a live attempt that selected or offered the wallet. */
     selectLiveForWallet: (prepare: ScopedD1Prepare, walletId: string, nowMs: number) => D1PreparedStatementLike;
-    delete: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
+    deleteUnclaimed: (prepare: ScopedD1Prepare, attemptId: string) => D1PreparedStatementLike;
 };
 //# sourceMappingURL=emailOtpD1Statements.d.ts.map