@seams/wallet-server 0.7.3 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (516) hide show
  1. package/THIRD_PARTY_NOTICES.md +1 -9
  2. package/artifact-manifest.json +78 -33
  3. package/cloudflare-router-ab/build/deriver-a/build-stamp.json +1 -1
  4. package/cloudflare-router-ab/build/deriver-a/index.js +2 -2
  5. package/cloudflare-router-ab/build/deriver-a/index_bg.wasm +0 -0
  6. package/cloudflare-router-ab/build/deriver-b/build-stamp.json +1 -1
  7. package/cloudflare-router-ab/build/deriver-b/index.js +2 -2
  8. package/cloudflare-router-ab/build/deriver-b/index_bg.wasm +0 -0
  9. package/cloudflare-router-ab/build/local-tools/darwin-arm64/router_ab_local_init +0 -0
  10. package/cloudflare-router-ab/build/local-tools/darwin-x64/router_ab_local_init +0 -0
  11. package/cloudflare-router-ab/build/local-tools/linux-x64/router_ab_local_init +0 -0
  12. package/cloudflare-router-ab/build/router/build-stamp.json +1 -1
  13. package/cloudflare-router-ab/build/router/index.js +2 -2
  14. package/cloudflare-router-ab/build/router/index_bg.wasm +0 -0
  15. package/cloudflare-router-ab/build/signing-worker/build-stamp.json +1 -1
  16. package/cloudflare-router-ab/build/signing-worker/index.js +2 -2
  17. package/cloudflare-router-ab/build/signing-worker/index_bg.wasm +0 -0
  18. package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json +1 -1
  19. package/cloudflare-router-ab/build/tenant-root-control-plane/index.js +2 -2
  20. package/cloudflare-router-ab/build/tenant-root-control-plane/index_bg.wasm +0 -0
  21. package/cloudflare-router-ab/scripts/prepare-local-runtime-config.mjs +0 -2
  22. package/cloudflare-router-ab/scripts/start-local-role-workers.mjs +77 -20
  23. package/dist/esm/authorization/lifecycleRouting.js +62 -0
  24. package/dist/esm/authorization/service.js +35 -12
  25. package/dist/esm/cloud-host.js +20 -22
  26. package/dist/esm/core/EmailOtpRecords.js +1 -217
  27. package/dist/esm/core/EmailOtpStores.js +0 -859
  28. package/dist/esm/core/IdentityStore.js +2 -339
  29. package/dist/esm/core/ThresholdService/config.js +1 -9
  30. package/dist/esm/core/ThresholdService/index.js +0 -4
  31. package/dist/esm/core/ThresholdService/kv.js +1 -66
  32. package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js +1 -13
  33. package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js +1 -11
  34. package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js +0 -541
  35. package/dist/esm/core/ThresholdService/validation.js +2 -346
  36. package/dist/esm/core/WalletAuthMethodStore.js +2 -123
  37. package/dist/esm/core/WalletStore.js +3 -209
  38. package/dist/esm/core/WebAuthnAuthenticatorStore.js +0 -202
  39. package/dist/esm/core/WebAuthnCredentialBindingStore.js +2 -182
  40. package/dist/esm/core/WebAuthnLoginChallengeStore.js +0 -52
  41. package/dist/esm/core/WebAuthnSyncChallengeStore.js +0 -54
  42. package/dist/esm/core/authService/emailOtpConfig.js +1 -195
  43. package/dist/esm/core/authService/emailOtpEnrollment.js +0 -110
  44. package/dist/esm/core/authService/emailOtpSeal.js +0 -63
  45. package/dist/esm/core/authService/nearTransactions.js +3 -98
  46. package/dist/esm/core/authService/rateLimits.js +0 -84
  47. package/dist/esm/core/authService/webauthn.js +2 -298
  48. package/dist/esm/core/authService/webauthnOidcHelpers.js +1 -24
  49. package/dist/esm/core/authService/webauthnWalletBinding.js +0 -37
  50. package/dist/esm/core/config.js +1 -95
  51. package/dist/esm/core/d1EcdsaSignerRead.js +1 -1
  52. package/dist/esm/core/d1IdentityStore.js +1 -2
  53. package/dist/esm/core/d1TenantStore.js +1 -24
  54. package/dist/esm/core/d1WalletAuthMethodStore.js +2 -5
  55. package/dist/esm/core/d1WalletStore.js +2 -2
  56. package/dist/esm/core/deviceLinking/linkedDeviceBootstrap.js +13 -0
  57. package/dist/esm/core/deviceLinking/linkedDeviceSession.js +20 -14
  58. package/dist/esm/core/deviceLinking/requestProof.js +9 -6
  59. package/dist/esm/core/emailOtpD1Statements.js +107 -94
  60. package/dist/esm/core/keyMaterialBrands.js +2 -12
  61. package/dist/esm/core/nearKeys.js +0 -1
  62. package/dist/esm/core/nearRelayerAccountProvisioning.js +6 -9
  63. package/dist/esm/core/passkeyCredentialClaims.js +8 -0
  64. package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js +2 -6
  65. package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js +2 -30
  66. package/dist/esm/core/thresholdEcdsaChainTarget.js +1 -4
  67. package/dist/esm/hosted-wallet-gateway.js +66 -43
  68. package/dist/esm/index.js +6 -19
  69. package/dist/esm/localHostedWalletGatewayHandler.js +12 -0
  70. package/dist/esm/localRegistrationSetupAuthority.js +89 -0
  71. package/dist/esm/router/auth/authRequestValidation.js +8 -16
  72. package/dist/esm/router/auth/webAuthnCredentialCodecs.js +0 -1
  73. package/dist/esm/router/cloudflare/d1/auth/d1AuthorizationAssembly.js +87 -0
  74. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthConfig.js +12 -2
  75. package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js +32 -281
  76. package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js +24 -22
  77. package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js +8 -6
  78. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js +12 -13
  79. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEd25519ExportRootStore.js +6 -1
  80. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js +12 -2
  81. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js +4 -4
  82. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceOwnerAuthorizationProvider.js +1 -1
  83. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.js +3 -9
  84. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.js +2 -1
  85. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js +89 -7
  86. package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js +23 -14
  87. package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js +9 -6
  88. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js +0 -1
  89. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js +0 -1
  90. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js +1 -1
  91. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js +0 -1
  92. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js +1 -1
  93. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js +1 -7
  94. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js +19 -13
  95. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js +0 -1
  96. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js +0 -1
  97. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js +2 -2
  98. package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js +0 -1
  99. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js +44 -12
  100. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js +1 -49
  101. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js +19 -31
  102. package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.js +85 -0
  103. package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js +0 -1
  104. package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js +0 -48
  105. package/dist/esm/router/cloudflare/d1/near/d1SponsoredNearAccount.js +242 -0
  106. package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js +0 -1
  107. package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js +2 -29
  108. package/dist/esm/router/cloudflare/d1/oidc/googleOidcToken.js +41 -0
  109. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.js +5 -0
  110. package/dist/esm/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.js +34 -0
  111. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js +9 -3
  112. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js +7 -13
  113. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js +25 -13
  114. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js +0 -1
  115. package/dist/esm/router/cloudflare/d1/registration/d1RegistrationSetupSupport.js +74 -0
  116. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js +7 -1
  117. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js +69 -238
  118. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js +12 -56
  119. package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.js +155 -0
  120. package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js +1 -3
  121. package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js +12 -6
  122. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.js +68 -0
  123. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js +7 -54
  124. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js +9 -8
  125. package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js +2 -142
  126. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js +25 -4
  127. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js +4 -70
  128. package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js +23 -7
  129. package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js +1 -0
  130. package/dist/esm/router/cloudflare/runtime/walletConsoleOps.js +1 -0
  131. package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js +5 -0
  132. package/dist/esm/router/cloudflare/runtime/walletGateway.js +1 -1
  133. package/dist/esm/router/cloudflare/runtime/walletRuntimeOps.js +16 -4
  134. package/dist/esm/router/cloudflare-adaptor.js +1 -2
  135. package/dist/esm/router/cloudflare.js +1342 -1733
  136. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js +11 -8
  137. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js +3 -2
  138. package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js +6 -6
  139. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js +6 -6
  140. package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js +3 -0
  141. package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js +8 -0
  142. package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js +0 -1
  143. package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js +2 -8
  144. package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js +2 -8
  145. package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js +5 -19
  146. package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js +2 -3
  147. package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js +70 -0
  148. package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js +10 -11
  149. package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js +2 -3
  150. package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js +14 -0
  151. package/dist/esm/router/express.js +574 -479
  152. package/dist/esm/router/framework/http.js +2 -0
  153. package/dist/esm/router/framework/registrationSetupDispatch.js +14 -0
  154. package/dist/esm/router/framework/ror/normalize.js +0 -1
  155. package/dist/esm/router/framework/ror/options.js +0 -1
  156. package/dist/esm/router/framework/ror/provider.js +0 -1
  157. package/dist/esm/router/framework/ror/staticProvider.js +0 -1
  158. package/dist/esm/router/framework/routeDefinitions.js +1 -2
  159. package/dist/esm/router/framework/routerApiWebhooks.js +0 -1
  160. package/dist/esm/router/ror.js +0 -1
  161. package/dist/esm/router/transport/fetch/createFetchRouter.js +0 -2
  162. package/dist/esm/router/transport/fetch/routes/auth.js +2 -0
  163. package/dist/esm/router/transport/fetch/routes/deviceLinking.js +36 -147
  164. package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js +3 -2
  165. package/dist/esm/router/transport/fetch/routes/deviceLinkingResponses.js +130 -0
  166. package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js +171 -0
  167. package/dist/esm/router/transport/fetch/routes/passkeyCustody.js +1 -0
  168. package/dist/esm/router/transport/fetch/routes/syncAccount.js +7 -2
  169. package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js +19 -115
  170. package/dist/esm/router/transport/fetch/routes/walletRegistration.js +3 -1
  171. package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js +0 -1
  172. package/dist/esm/shared-ts/src/device-linking/authorityActivation.js +0 -2
  173. package/dist/esm/shared-ts/src/device-linking/contracts.js +16 -1
  174. package/dist/esm/shared-ts/src/device-linking/digests.js +1 -8
  175. package/dist/esm/shared-ts/src/near/actions.js +0 -1
  176. package/dist/esm/shared-ts/src/near/nearClient.js +0 -2
  177. package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js +1 -1
  178. package/dist/esm/shared-ts/src/signing-lanes/index.js +1 -6
  179. package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js +1 -1
  180. package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js +2 -81
  181. package/dist/esm/shared-ts/src/signing-lanes/participants.js +1 -219
  182. package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js +0 -3
  183. package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js +1 -2
  184. package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js +0 -1
  185. package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js +1 -22
  186. package/dist/esm/shared-ts/src/threshold/participants.js +0 -1
  187. package/dist/esm/shared-ts/src/threshold/signingRootScope.js +0 -1
  188. package/dist/esm/shared-ts/src/utils/addWalletAuthMethod.js +4 -13
  189. package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js +1 -7
  190. package/dist/esm/shared-ts/src/utils/domainIds.js +1 -16
  191. package/dist/esm/shared-ts/src/utils/ecdsaCapabilityActivation.js +1 -11
  192. package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js +0 -1
  193. package/dist/esm/shared-ts/src/utils/errors.js +1 -19
  194. package/dist/esm/shared-ts/src/utils/near.js +1 -1
  195. package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js +1 -1
  196. package/dist/esm/shared-ts/src/utils/registrationIds.js +1 -5
  197. package/dist/esm/shared-ts/src/utils/registrationIntent.js +0 -1
  198. package/dist/esm/shared-ts/src/utils/registrationSetupOperation.js +8 -0
  199. package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js +1 -1
  200. package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js +0 -1
  201. package/dist/esm/shared-ts/src/utils/validation.js +1 -5
  202. package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js +0 -1
  203. package/dist/esm/shared-ts/src/utils/walletManagementProtocol.js +6 -0
  204. package/dist/esm/shared-ts/src/utils/wireSchema.js +2 -13
  205. package/dist/esm/shared-ts/src/wallet-recovery/backupAcknowledgement.js +6 -24
  206. package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js +0 -1
  207. package/dist/esm/shared-ts/src/wallet-recovery/recoveryKeyId.js +5 -6
  208. package/dist/esm/storage/d1Sql.js +1 -7
  209. package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js +0 -1
  210. package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js +1 -2
  211. package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js +0 -1
  212. package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js +0 -1
  213. package/dist/esm/threshold/session/signingSessionSeal/options.js +0 -1
  214. package/dist/esm/wasm/evm_crypto/pkg/evm_crypto_bg.wasm +0 -0
  215. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.js +0 -611
  216. package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker_bg.wasm +0 -0
  217. package/dist/esm/wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm +0 -0
  218. package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts +0 -4
  219. package/dist/types/shared-ts/src/device-linking/contracts.d.ts +1 -0
  220. package/dist/types/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.d.ts +0 -2
  221. package/dist/types/shared-ts/src/signing-lanes/execution.d.ts +0 -11
  222. package/dist/types/shared-ts/src/signing-lanes/ids.d.ts +2 -7
  223. package/dist/types/shared-ts/src/signing-lanes/index.d.ts +0 -4
  224. package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts +0 -1
  225. package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts +0 -18
  226. package/dist/types/shared-ts/src/signing-lanes/participants.d.ts +6 -35
  227. package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts +6 -843
  228. package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts +0 -10
  229. package/dist/types/shared-ts/src/threshold/participants.d.ts +1 -1
  230. package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts +1 -133
  231. package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts +4 -18
  232. package/dist/types/shared-ts/src/utils/domainIds.d.ts +0 -12
  233. package/dist/types/shared-ts/src/utils/errors.d.ts +0 -4
  234. package/dist/types/shared-ts/src/utils/near.d.ts +0 -20
  235. package/dist/types/shared-ts/src/utils/normalize.d.ts +0 -2
  236. package/dist/types/shared-ts/src/utils/registrationSetupOperation.d.ts +3 -0
  237. package/dist/types/shared-ts/src/utils/validation.d.ts +1 -3
  238. package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts +0 -1
  239. package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts +3 -0
  240. package/dist/types/shared-ts/src/utils/wireSchema.d.ts +0 -2
  241. package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts +0 -1
  242. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts +1 -10
  243. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodes.d.ts +1 -3
  244. package/dist/types/shared-ts/src/wallet-recovery/recoveryKeyId.d.ts +5 -21
  245. package/dist/types/wallet-server/src/authorization/lifecycleRouting.d.ts +32 -0
  246. package/dist/types/wallet-server/src/authorization/lifecycleRouting.typecheck.d.ts +2 -0
  247. package/dist/types/wallet-server/src/authorization/recoveryRouting.d.ts +22 -0
  248. package/dist/types/wallet-server/src/authorization/recoveryRouting.typecheck.d.ts +2 -0
  249. package/dist/types/wallet-server/src/authorization/service.d.ts +8 -1
  250. package/dist/types/wallet-server/src/authorization/sessionRouting.d.ts +20 -0
  251. package/dist/types/wallet-server/src/authorization/sessionRouting.typecheck.d.ts +2 -0
  252. package/dist/types/wallet-server/src/cloud-host.d.ts +31 -9
  253. package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts +1 -22
  254. package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts +1 -79
  255. package/dist/types/wallet-server/src/core/IdentityStore.d.ts +0 -10
  256. package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts +0 -1
  257. package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts +0 -2
  258. package/dist/types/wallet-server/src/core/ThresholdService/index.d.ts +1 -3
  259. package/dist/types/wallet-server/src/core/ThresholdService/kv.d.ts +0 -7
  260. package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts +0 -3
  261. package/dist/types/wallet-server/src/core/ThresholdService/routerAbNormalSigningPolicy.d.ts +0 -1
  262. package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts +7 -19
  263. package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts +0 -34
  264. package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts +1 -5
  265. package/dist/types/wallet-server/src/core/WalletStore.d.ts +0 -3
  266. package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts +0 -20
  267. package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts +1 -27
  268. package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts +2 -16
  269. package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts +22 -14
  270. package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts +0 -24
  271. package/dist/types/wallet-server/src/core/authService/emailOtpEnrollment.d.ts +1 -70
  272. package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts +0 -13
  273. package/dist/types/wallet-server/src/core/authService/githubOAuth.d.ts +2 -1
  274. package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts +1 -39
  275. package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts +0 -17
  276. package/dist/types/wallet-server/src/core/authService/webauthn.d.ts +0 -125
  277. package/dist/types/wallet-server/src/core/authService/webauthnOidcHelpers.d.ts +0 -3
  278. package/dist/types/wallet-server/src/core/authService/webauthnVerificationOutcomes.d.ts +1 -1
  279. package/dist/types/wallet-server/src/core/authService/webauthnWalletBinding.d.ts +0 -12
  280. package/dist/types/wallet-server/src/core/config.d.ts +0 -10
  281. package/dist/types/wallet-server/src/core/d1IdentityStore.d.ts +0 -2
  282. package/dist/types/wallet-server/src/core/d1TenantStore.d.ts +0 -7
  283. package/dist/types/wallet-server/src/core/d1WalletAuthMethodStore.d.ts +0 -1
  284. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceBootstrap.d.ts +19 -0
  285. package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts +8 -6
  286. package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts +2 -5
  287. package/dist/types/wallet-server/src/core/emailOtpD1Statements.d.ts +10 -7
  288. package/dist/types/wallet-server/src/core/keyMaterialBrands.d.ts +1 -5
  289. package/dist/types/wallet-server/src/core/nearRelayerAccountProvisioning.d.ts +0 -1
  290. package/dist/types/wallet-server/src/core/passkeyCredentialClaims.d.ts +9 -0
  291. package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.d.ts +0 -2
  292. package/dist/types/wallet-server/src/core/routerAbSigning/RouterAbNormalSigningRuntime.d.ts +0 -2
  293. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts +1 -92
  294. package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.typecheck.d.ts +4 -52
  295. package/dist/types/wallet-server/src/core/thresholdEcdsaChainTarget.d.ts +0 -1
  296. package/dist/types/wallet-server/src/core/types.d.ts +0 -299
  297. package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts +15 -3
  298. package/dist/types/wallet-server/src/index.d.ts +8 -13
  299. package/dist/types/wallet-server/src/localRegistrationSetupAuthority.d.ts +13 -0
  300. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1AuthorizationAssembly.d.ts +23 -0
  301. package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthConfig.d.ts +25 -3
  302. package/dist/types/wallet-server/src/router/cloudflare/d1/authorization/d1AuthorizationStore.d.ts +1 -1
  303. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.d.ts +3 -1
  304. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpGrantStore.d.ts +7 -1
  305. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore.d.ts +1 -10
  306. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceRouteService.d.ts +4 -0
  307. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.d.ts +6 -0
  308. package/dist/types/wallet-server/src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetPlanner.d.ts +1 -13
  309. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.d.ts +2 -2
  310. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.d.ts +1 -1
  311. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.d.ts +0 -2
  312. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.d.ts +18 -2
  313. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.d.ts +29 -1
  314. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.d.ts +3 -16
  315. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.d.ts +7 -2
  316. package/dist/types/wallet-server/src/router/cloudflare/d1/emailOtp/d1GoogleRegistrationCompletion.d.ts +23 -0
  317. package/dist/types/wallet-server/src/router/cloudflare/d1/identity/d1IdentityService.d.ts +0 -12
  318. package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.d.ts +24 -0
  319. package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1SponsoredNearAccount.typecheck.d.ts +2 -0
  320. package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/d1OidcVerificationService.d.ts +0 -1
  321. package/dist/types/wallet-server/src/router/cloudflare/d1/oidc/googleOidcToken.d.ts +4 -0
  322. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1PasskeyCustodyRouteService.d.ts +5 -0
  323. package/dist/types/wallet-server/src/router/cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore.d.ts +9 -0
  324. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts +1 -1
  325. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.d.ts +10 -11
  326. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts +3 -2
  327. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts +51 -0
  328. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts +3 -0
  329. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts +30 -47
  330. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.d.ts +3 -30
  331. package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationSetupExecution.d.ts +11 -0
  332. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerFinalizeRecord.d.ts +27 -0
  333. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAddSignerService.d.ts +1 -10
  334. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.d.ts +2 -2
  335. package/dist/types/wallet-server/src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.d.ts +0 -4
  336. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.d.ts +3 -0
  337. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts +0 -13
  338. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts +23 -10
  339. package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.typecheck.d.ts +2 -0
  340. package/dist/types/wallet-server/src/router/cloudflare/runtime/cloudflare.types.d.ts +0 -2
  341. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts +1 -0
  342. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOpsClient.d.ts +2 -0
  343. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletGateway.d.ts +1 -1
  344. package/dist/types/wallet-server/src/router/cloudflare/runtime/walletRuntimeOps.d.ts +3 -0
  345. package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts +0 -1
  346. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts +1 -1
  347. package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.d.ts +2 -2
  348. package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.d.ts +2 -2
  349. package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.typecheck.d.ts +2 -0
  350. package/dist/types/wallet-server/src/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.d.ts +2 -0
  351. package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts +2 -0
  352. package/dist/types/wallet-server/src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.d.ts +0 -2
  353. package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts +0 -3
  354. package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbPrivateSigningWorker.d.ts +0 -17
  355. package/dist/types/wallet-server/src/router/domains/signingOperations/walletExecutionAdmission.d.ts +1 -2
  356. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts +1 -0
  357. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts +51 -0
  358. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts +2 -10
  359. package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationSetupPayload.d.ts +2 -2
  360. package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts +14 -34
  361. package/dist/types/wallet-server/src/router/framework/googleLoginResolution.typecheck.d.ts +2 -0
  362. package/dist/types/wallet-server/src/router/framework/registrationSetupDispatch.d.ts +13 -0
  363. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinking.d.ts +1 -1
  364. package/dist/types/wallet-server/src/router/transport/fetch/routes/deviceLinkingResponses.d.ts +17 -0
  365. package/dist/types/wallet-server/src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.d.ts +37 -0
  366. package/dist/types/wallet-server/src/storage/d1Sql.d.ts +0 -1
  367. package/migrations/d1-signer/0040_namespace_home_challenges.sql +16 -0
  368. package/migrations/d1-signer/0041_step_up_admission_expiry.sql +28 -0
  369. package/migrations/d1-signer/0042_deployment_resource_challenges.sql +4 -0
  370. package/migrations/d1-signer/0043_google_registration_candidate_claim.sql +2 -0
  371. package/migrations/d1-signer/0044_linked_device_bootstrap_imports.sql +6 -0
  372. package/migrations/d1-signer/0045_wallet_owned_capability_receipts.sql +29 -0
  373. package/migrations/d1-signer/0046_wallet_owned_signing_abuse.sql +41 -0
  374. package/migrations/d1-signer/0047_remove_unused_near_public_keys.sql +2 -0
  375. package/migrations/d1-signer/0048_operation_owner_scope.sql +45 -0
  376. package/package.json +2 -3
  377. package/src/README.md +11 -3
  378. package/dist/esm/core/AuthService.js +0 -2
  379. package/dist/esm/core/NearPublicKeyStore.js +0 -200
  380. package/dist/esm/core/ThresholdService/stores/CloudflareDurableObjectStore.js +0 -397
  381. package/dist/esm/core/ThresholdService/stores/KeyStore.js +0 -140
  382. package/dist/esm/core/ThresholdService/stores/SessionStore.js +0 -361
  383. package/dist/esm/core/ThresholdService/stores/StoreConfig.js +0 -13
  384. package/dist/esm/core/ThresholdService/stores/exportReplayGuard.js +0 -7
  385. package/dist/esm/core/authService/AuthService.js +0 -594
  386. package/dist/esm/core/authService/bytes.js +0 -19
  387. package/dist/esm/core/authService/configValues.js +0 -15
  388. package/dist/esm/core/authService/emailOtpChallengeOperations.js +0 -123
  389. package/dist/esm/core/authService/emailOtpChallengeProof.js +0 -183
  390. package/dist/esm/core/authService/emailOtpChallengeVerification.js +0 -264
  391. package/dist/esm/core/authService/emailOtpChallenges.js +0 -225
  392. package/dist/esm/core/authService/emailOtpDelivery.js +0 -134
  393. package/dist/esm/core/authService/emailOtpGrant.js +0 -43
  394. package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js +0 -144
  395. package/dist/esm/core/authService/emailOtpUnlock.js +0 -174
  396. package/dist/esm/core/authService/googleEmailOtpOperations.js +0 -141
  397. package/dist/esm/core/authService/googleEmailOtpRegistration.js +0 -587
  398. package/dist/esm/core/authService/identity.js +0 -42
  399. package/dist/esm/core/authService/identityOperations.js +0 -32
  400. package/dist/esm/core/authService/nearAccountOperations.js +0 -229
  401. package/dist/esm/core/authService/nearPublicKeyMetadata.js +0 -108
  402. package/dist/esm/core/authService/oidcVerification.js +0 -249
  403. package/dist/esm/core/authService/registrationThresholdHelpers.js +0 -30
  404. package/dist/esm/core/authService/runtime.js +0 -45
  405. package/dist/esm/core/authService/storeRegistry.js +0 -102
  406. package/dist/esm/core/authService/thresholdStoreSummary.js +0 -32
  407. package/dist/esm/core/authService/webauthnAuthority.js +0 -17
  408. package/dist/esm/core/defaultConfigsServer.js +0 -9
  409. package/dist/esm/core/hostedAccountIds.js +0 -225
  410. package/dist/esm/core/routerAbSigning/createRouterAbSigningRuntimes.js +0 -84
  411. package/dist/esm/core/signingLanes/LaneAggregateRevocationApplicationService.js +0 -86
  412. package/dist/esm/core/signingLanes/LaneEnrollmentActivation.js +0 -324
  413. package/dist/esm/core/signingLanes/LaneEnrollmentRevocation.js +0 -173
  414. package/dist/esm/core/signingLanes/LaneLifecycleApplicationService.js +0 -198
  415. package/dist/esm/core/signingLanes/ecdsaServerRetirement.js +0 -73
  416. package/dist/esm/core/signingLanes/ed25519ServerRetirement.js +0 -68
  417. package/dist/esm/core/signingLanes/signingWorkerLaneMaterialIdentity.js +0 -0
  418. package/dist/esm/core/storeBackends.js +0 -208
  419. package/dist/esm/core/utils.js +0 -14
  420. package/dist/esm/core/webAuthnStoreBackends.js +0 -198
  421. package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js +0 -49
  422. package/dist/esm/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.js +0 -10
  423. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.js +0 -22
  424. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js +0 -166
  425. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEnrollmentGateway.js +0 -38
  426. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleApplicationService.js +0 -20
  427. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js +0 -1459
  428. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLockStore.js +0 -114
  429. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.js +0 -16
  430. package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js +0 -171
  431. package/dist/esm/router/cloudflare/d1/signingLanes/index.js +0 -10
  432. package/dist/esm/router/cloudflare/durableObjects/thresholdStore.js +0 -397
  433. package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js +0 -597
  434. package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js +0 -273
  435. package/dist/esm/router/cloudflare/signingLanes/index.js +0 -4
  436. package/dist/esm/router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding.js +0 -32
  437. package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js +0 -27
  438. package/dist/esm/shared-ts/src/signing-lanes/rotation.js +0 -8
  439. package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js +0 -358
  440. package/dist/esm/shared-ts/src/signing-lanes/rotationLifecycle.js +0 -313
  441. package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js +0 -532
  442. package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js +0 -323
  443. package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js +0 -59
  444. package/dist/types/shared-ts/src/signing-lanes/participantDigest.typecheck.d.ts +0 -2
  445. package/dist/types/shared-ts/src/signing-lanes/rotation.typecheck.d.ts +0 -2
  446. package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts +0 -13
  447. package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts +0 -78
  448. package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts +0 -27
  449. package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts +0 -6
  450. package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts +0 -20
  451. package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeAttempt.d.ts +0 -59
  452. package/dist/types/wallet-server/src/core/AuthService.d.ts +0 -3
  453. package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts +0 -48
  454. package/dist/types/wallet-server/src/core/ThresholdService/stores/CloudflareDurableObjectStore.d.ts +0 -21
  455. package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts +0 -40
  456. package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts +0 -98
  457. package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts +0 -4
  458. package/dist/types/wallet-server/src/core/ThresholdService/stores/ThresholdStoreConfig.typecheck.d.ts +0 -2
  459. package/dist/types/wallet-server/src/core/ThresholdService/stores/exportReplayGuard.d.ts +0 -3
  460. package/dist/types/wallet-server/src/core/authService/AuthService.d.ts +0 -490
  461. package/dist/types/wallet-server/src/core/authService/bytes.d.ts +0 -3
  462. package/dist/types/wallet-server/src/core/authService/configValues.d.ts +0 -7
  463. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeOperations.d.ts +0 -109
  464. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeProof.d.ts +0 -169
  465. package/dist/types/wallet-server/src/core/authService/emailOtpChallengeVerification.d.ts +0 -47
  466. package/dist/types/wallet-server/src/core/authService/emailOtpChallenges.d.ts +0 -86
  467. package/dist/types/wallet-server/src/core/authService/emailOtpDelivery.d.ts +0 -66
  468. package/dist/types/wallet-server/src/core/authService/emailOtpGrant.d.ts +0 -43
  469. package/dist/types/wallet-server/src/core/authService/emailOtpRegistrationEnrollment.d.ts +0 -49
  470. package/dist/types/wallet-server/src/core/authService/emailOtpUnlock.d.ts +0 -64
  471. package/dist/types/wallet-server/src/core/authService/googleEmailOtpOperations.d.ts +0 -126
  472. package/dist/types/wallet-server/src/core/authService/googleEmailOtpRegistration.d.ts +0 -169
  473. package/dist/types/wallet-server/src/core/authService/identity.d.ts +0 -25
  474. package/dist/types/wallet-server/src/core/authService/identityOperations.d.ts +0 -19
  475. package/dist/types/wallet-server/src/core/authService/nearAccountOperations.d.ts +0 -55
  476. package/dist/types/wallet-server/src/core/authService/nearPublicKeyMetadata.d.ts +0 -44
  477. package/dist/types/wallet-server/src/core/authService/oidcVerification.d.ts +0 -66
  478. package/dist/types/wallet-server/src/core/authService/registrationThresholdHelpers.d.ts +0 -11
  479. package/dist/types/wallet-server/src/core/authService/runtime.d.ts +0 -20
  480. package/dist/types/wallet-server/src/core/authService/storeRegistry.d.ts +0 -53
  481. package/dist/types/wallet-server/src/core/authService/thresholdStoreSummary.d.ts +0 -3
  482. package/dist/types/wallet-server/src/core/authService/webauthnAuthority.d.ts +0 -5
  483. package/dist/types/wallet-server/src/core/defaultConfigsServer.d.ts +0 -5
  484. package/dist/types/wallet-server/src/core/hostedAccountIds.d.ts +0 -16
  485. package/dist/types/wallet-server/src/core/routerAbSigning/createRouterAbSigningRuntimes.d.ts +0 -16
  486. package/dist/types/wallet-server/src/core/signingLanes/LaneAggregateRevocationApplicationService.d.ts +0 -36
  487. package/dist/types/wallet-server/src/core/signingLanes/LaneEffectJournalStore.d.ts +0 -62
  488. package/dist/types/wallet-server/src/core/signingLanes/LaneEnrollmentActivation.d.ts +0 -13
  489. package/dist/types/wallet-server/src/core/signingLanes/LaneEnrollmentRevocation.d.ts +0 -24
  490. package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleApplicationService.d.ts +0 -141
  491. package/dist/types/wallet-server/src/core/signingLanes/LaneLifecycleStore.d.ts +0 -228
  492. package/dist/types/wallet-server/src/core/signingLanes/ecdsaServerRetirement.d.ts +0 -58
  493. package/dist/types/wallet-server/src/core/signingLanes/ed25519ServerRetirement.d.ts +0 -30
  494. package/dist/types/wallet-server/src/core/signingLanes/signingWorkerLaneMaterialIdentity.d.ts +0 -4
  495. package/dist/types/wallet-server/src/core/storeBackends.d.ts +0 -83
  496. package/dist/types/wallet-server/src/core/utils.d.ts +0 -3
  497. package/dist/types/wallet-server/src/core/webAuthnStoreBackends.d.ts +0 -96
  498. package/dist/types/wallet-server/src/router/cloudflare/d1/near/d1NearPublicKeyStore.d.ts +0 -29
  499. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.d.ts +0 -4
  500. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.d.ts +0 -4
  501. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.d.ts +0 -24
  502. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneEnrollmentGateway.d.ts +0 -20
  503. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLifecycleApplicationService.d.ts +0 -13
  504. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.d.ts +0 -51
  505. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneLockStore.d.ts +0 -28
  506. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.d.ts +0 -5
  507. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/d1LaneRecords.d.ts +0 -107
  508. package/dist/types/wallet-server/src/router/cloudflare/d1/signingLanes/index.d.ts +0 -10
  509. package/dist/types/wallet-server/src/router/cloudflare/durableObjects/thresholdStore.d.ts +0 -18
  510. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.d.ts +0 -217
  511. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.d.ts +0 -73
  512. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/index.d.ts +0 -4
  513. package/dist/types/wallet-server/src/router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding.d.ts +0 -6
  514. package/dist/types/wallet-server/src/router/transport/fetch/routes/nearPublicKeys.d.ts +0 -3
  515. /package/dist/esm/{core/signingLanes/LaneEffectJournalStore.js → authorization/recoveryRouting.js} +0 -0
  516. /package/dist/esm/{core/signingLanes/LaneLifecycleStore.js → authorization/sessionRouting.js} +0 -0
@@ -1,198 +0,0 @@
1
- import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
2
- import "../shared-ts/src/utils/validation.js";
3
- import { parseD1JsonColumn } from "../storage/d1Sql.js";
4
- import { D1TenantTable, ensureD1Schema, resolveStorePrefix } from "./d1TenantStore.js";
5
- import { createKeyValueStore } from "./storeBackends.js";
6
- import { webAuthnChallengeRows } from "./webAuthnD1Statements.js";
7
- //#region src/core/webAuthnStoreBackends.ts
8
- /**
9
- * A store's key prefix, which is also its D1 namespace: `config[spec.prefixConfigKey]` when set,
10
- * else `<THRESHOLD_PREFIX>:webauthn:<spec.prefixName>:`. It always ends with a colon.
11
- */
12
- function resolveWebAuthnStorePrefix(config, spec) {
13
- return resolveStorePrefix(config, [spec.prefixConfigKey], `webauthn:${spec.prefixName}:`);
14
- }
15
- /**
16
- * Selects a WebAuthn store's backend: the config's explicit `kind`, else Upstash or Redis from
17
- * env-shaped config, else in memory. The store type `S` comes from the caller's return type.
18
- */
19
- function createWebAuthnStore(input, spec, build) {
20
- return createKeyValueStore(input, {
21
- tag: "webauthn",
22
- label: spec.label,
23
- connectionErrorSubject: spec.connectionErrorSubject,
24
- durableObjectLog: `store for ${spec.durableObjectLogSubject}`,
25
- durableObjectErrorName: "WebAuthn",
26
- unconfiguredNote: spec.unconfiguredNote,
27
- d1StoreName: webAuthnD1Store(spec.d1ScopeLabel),
28
- resolvePrefix: (config) => resolveWebAuthnStorePrefix(config, spec),
29
- parse: spec.parse
30
- }, {
31
- d1: build.d1,
32
- keyValue: build.keyValue,
33
- inMemory: (prefix) => build.inMemory(new InMemoryWebAuthnRecords(), prefix)
34
- });
35
- }
36
- /** Keeps each record as it was put, without expiry; reads return the stored object. */
37
- var InMemoryWebAuthnRecords = class {
38
- constructor() {
39
- this.map = /* @__PURE__ */ new Map();
40
- }
41
- async get(key) {
42
- return this.map.get(key) ?? null;
43
- }
44
- async take(key) {
45
- const record = this.map.get(key) ?? null;
46
- this.map.delete(key);
47
- return record;
48
- }
49
- async set(key, record) {
50
- this.map.set(key, record);
51
- }
52
- async del(key) {
53
- this.map.delete(key);
54
- }
55
- };
56
- /**
57
- * Per-credential records under `${prefix}${ownerId}:${credentialIdB64u}`, where the owner is the
58
- * user for authenticators and the RP ID for credential bindings. A blank id reads as missing.
59
- */
60
- var WebAuthnCredentialRecords = class {
61
- constructor(records, prefix) {
62
- this.records = records;
63
- this.prefix = prefix;
64
- }
65
- async get(ownerId, credentialIdB64u) {
66
- const key = this.trimmedKey(ownerId, credentialIdB64u);
67
- return key ? this.records.get(key) : null;
68
- }
69
- async set(ownerId, credentialIdB64u, record) {
70
- await this.records.set(this.key(ownerId, credentialIdB64u), record);
71
- }
72
- async del(ownerId, credentialIdB64u) {
73
- const key = this.trimmedKey(ownerId, credentialIdB64u);
74
- if (key) await this.records.del(key);
75
- }
76
- key(ownerId, credentialIdB64u) {
77
- return `${this.prefix}${ownerId}:${credentialIdB64u}`;
78
- }
79
- trimmedKey(ownerId, credentialIdB64u) {
80
- const owner = normalizeOptionalTrimmedString(ownerId);
81
- const credential = normalizeOptionalTrimmedString(credentialIdB64u);
82
- return owner && credential ? this.key(owner, credential) : null;
83
- }
84
- };
85
- /** Names a WebAuthn store in D1 scope errors, e.g. `WebAuthn credential store`. */
86
- function webAuthnD1Store(d1ScopeLabel) {
87
- return `WebAuthn ${d1ScopeLabel} store`;
88
- }
89
- const WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL = Object.freeze([`
90
- CREATE TABLE IF NOT EXISTS webauthn_challenges (
91
- namespace TEXT NOT NULL,
92
- org_id TEXT NOT NULL,
93
- project_id TEXT NOT NULL,
94
- env_id TEXT NOT NULL,
95
- challenge_id TEXT NOT NULL,
96
- challenge_kind TEXT NOT NULL,
97
- record_json TEXT NOT NULL,
98
- created_at_ms INTEGER NOT NULL,
99
- expires_at_ms INTEGER NOT NULL,
100
- PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
101
- CHECK (length(challenge_id) > 0),
102
- CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),
103
- CHECK (json_valid(record_json)),
104
- CHECK (created_at_ms > 0),
105
- CHECK (expires_at_ms > created_at_ms)
106
- )
107
- `, `
108
- CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx
109
- ON webauthn_challenges (
110
- namespace,
111
- org_id,
112
- project_id,
113
- env_id,
114
- challenge_kind,
115
- expires_at_ms
116
- )
117
- `]);
118
- async function ensureWebAuthnChallengeStoreD1Schema(options) {
119
- await ensureD1Schema(options.database, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL);
120
- }
121
- function createWebAuthnChallengeStore(input, spec, d1) {
122
- const keyValue = (records, prefix) => new KeyValueWebAuthnChallengeStore(records, prefix, spec);
123
- return createWebAuthnStore(input, spec, {
124
- d1,
125
- keyValue,
126
- inMemory: keyValue
127
- });
128
- }
129
- var KeyValueWebAuthnChallengeStore = class {
130
- constructor(records, prefix, spec) {
131
- this.records = records;
132
- this.prefix = prefix;
133
- this.spec = spec;
134
- }
135
- async put(record) {
136
- const parsed = this.spec.parse(record);
137
- if (!parsed) throw new Error(`Invalid ${this.spec.label} record`);
138
- const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
139
- await this.records.set(`${this.prefix}${parsed.challengeId}`, parsed, ttlMs);
140
- }
141
- async consume(challengeId) {
142
- const id = normalizeOptionalTrimmedString(challengeId);
143
- if (!id) return null;
144
- const record = await this.records.take(`${this.prefix}${id}`);
145
- if (!record) return null;
146
- if (Date.now() > record.expiresAtMs) return null;
147
- return record;
148
- }
149
- async del(challengeId) {
150
- const id = normalizeOptionalTrimmedString(challengeId);
151
- if (!id) return;
152
- await this.records.del(`${this.prefix}${id}`);
153
- }
154
- };
155
- var D1WebAuthnChallengeStore = class {
156
- constructor(input, spec) {
157
- this.spec = spec;
158
- this.adapterKind = "d1";
159
- this.prepare = (sql, values) => this.table.prepare(sql, values);
160
- this.table = new D1TenantTable(input, webAuthnD1Store(spec.d1ScopeLabel), WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL);
161
- this.now = input.now || (() => /* @__PURE__ */ new Date());
162
- }
163
- async put(record) {
164
- await this.table.ensureSchema();
165
- const parsed = this.spec.parse(record);
166
- if (!parsed) throw new Error(`Invalid ${this.spec.label} record`);
167
- await webAuthnChallengeRows.upsert(this.prepare, {
168
- challengeId: parsed.challengeId,
169
- challengeKind: this.spec.challengeKind,
170
- record: parsed,
171
- createdAtMs: parsed.createdAtMs,
172
- expiresAtMs: parsed.expiresAtMs
173
- }).run();
174
- }
175
- async consume(challengeId) {
176
- await this.table.ensureSchema();
177
- const id = normalizeOptionalTrimmedString(challengeId);
178
- if (!id) return null;
179
- const row = await webAuthnChallengeRows.consume(this.prepare, id, this.spec.challengeKind, this.now().getTime()).first();
180
- return this.spec.parse(parseD1JsonColumn(row?.record_json));
181
- }
182
- async del(challengeId) {
183
- await this.table.ensureSchema();
184
- const id = normalizeOptionalTrimmedString(challengeId);
185
- if (!id) return;
186
- await this.table.prepare(`DELETE FROM webauthn_challenges
187
- WHERE namespace = ?
188
- AND org_id = ?
189
- AND project_id = ?
190
- AND env_id = ?
191
- AND challenge_id = ?
192
- AND challenge_kind = ?`, [id, this.spec.challengeKind]).run();
193
- }
194
- };
195
- //#endregion
196
- export { D1WebAuthnChallengeStore, InMemoryWebAuthnRecords, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, WebAuthnCredentialRecords, createWebAuthnChallengeStore, createWebAuthnStore, ensureWebAuthnChallengeStoreD1Schema, resolveWebAuthnStorePrefix, webAuthnD1Store };
197
-
198
- //# sourceMappingURL=webAuthnStoreBackends.js.map
@@ -1,49 +0,0 @@
1
- import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
2
- import "../../../../shared-ts/src/utils/validation.js";
3
- import { failure } from "../../../../shared-ts/src/utils/failure.js";
4
- import { parseNearPublicKey } from "../webauthn/d1WebAuthnRecords.js";
5
- import { NEAR_PUBLIC_KEYS_BY_USER_SQL } from "../../../../core/NearPublicKeyStore.js";
6
- //#region src/router/cloudflare/d1/near/d1NearPublicKeyStore.ts
7
- var CloudflareD1NearPublicKeyStore = class {
8
- constructor(input) {
9
- this.prepare = input.prepare;
10
- }
11
- async listForRelayUser(input) {
12
- try {
13
- const userId = normalizeOptionalTrimmedString(input.userId);
14
- if (!userId) return failure("invalid_args", "Missing userId");
15
- return {
16
- ok: true,
17
- keys: (await this.listForUser(userId)).map(nearPublicKeyForRelayResponse)
18
- };
19
- } catch (error) {
20
- return failure("internal", nearPublicKeyErrorMessage(error) || "Failed to list keys");
21
- }
22
- }
23
- async listForUser(userId) {
24
- const result = await this.prepare(NEAR_PUBLIC_KEYS_BY_USER_SQL, [userId]).all();
25
- const records = [];
26
- for (const row of result.results || []) {
27
- const record = parseNearPublicKey(row);
28
- if (record) records.push(record);
29
- }
30
- return records;
31
- }
32
- };
33
- function nearPublicKeyForRelayResponse(record) {
34
- return {
35
- publicKey: record.publicKey,
36
- kind: record.kind,
37
- signerSlot: record.signerSlot,
38
- createdAtMs: record.createdAtMs,
39
- updatedAtMs: record.updatedAtMs,
40
- ...record.authBinding ? { authBinding: record.authBinding } : {}
41
- };
42
- }
43
- function nearPublicKeyErrorMessage(error) {
44
- return error instanceof Error ? error.message : String(error || "");
45
- }
46
- //#endregion
47
- export { CloudflareD1NearPublicKeyStore };
48
-
49
- //# sourceMappingURL=d1NearPublicKeyStore.js.map
@@ -1,10 +0,0 @@
1
- import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
2
- import { LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1 } from "../../signingLanes/cloudflareLaneCurveExecution.js";
3
- //#region src/router/cloudflare/d1/signingLanes/d1EcdsaLanePrivateBindingResolver.ts
4
- function createCloudflareD1EcdsaLanePrivateBindingResolverV1(options) {
5
- return new LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1(new CloudflareD1LaneLifecycleStore(options), options);
6
- }
7
- //#endregion
8
- export { createCloudflareD1EcdsaLanePrivateBindingResolverV1 };
9
-
10
- //# sourceMappingURL=d1EcdsaLanePrivateBindingResolver.js.map
@@ -1,22 +0,0 @@
1
- import { LaneLifecycleApplicationService } from "../../../../core/signingLanes/LaneLifecycleApplicationService.js";
2
- import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
3
- import { LaneEnrollmentRevocation } from "../../../../core/signingLanes/LaneEnrollmentRevocation.js";
4
- import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
5
- import { LaneAggregateRevocationApplicationService } from "../../../../core/signingLanes/LaneAggregateRevocationApplicationService.js";
6
- //#region src/router/cloudflare/d1/signingLanes/d1LaneAggregateRevocationApplicationService.ts
7
- function createCloudflareD1LaneAggregateRevocationApplicationService(options) {
8
- const lifecycleStore = new CloudflareD1LaneLifecycleStore(options);
9
- return new LaneAggregateRevocationApplicationService({
10
- lifecycleStore,
11
- laneLifecycle: new LaneLifecycleApplicationService({
12
- gateway: new CloudflareD1LaneEnrollmentGateway({ lifecycleStore }),
13
- authorization: options.authorization,
14
- execution: options.execution
15
- }),
16
- enrollmentRevocation: new LaneEnrollmentRevocation(lifecycleStore)
17
- });
18
- }
19
- //#endregion
20
- export { createCloudflareD1LaneAggregateRevocationApplicationService };
21
-
22
- //# sourceMappingURL=d1LaneAggregateRevocationApplicationService.js.map
@@ -1,166 +0,0 @@
1
- import { parseLaneEnrollmentId, parseLaneOperationId, parseLaneShareEpoch, parseSigningLaneId, parseWalletId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
2
- import { LANE_CAS_GUARD_SQL, assertD1Success, firstBatchResult, requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";
3
- //#region src/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.ts
4
- const EFFECT_TABLE = "lane_effect_journal";
5
- var CloudflareD1LaneEffectJournalStore = class {
6
- constructor(options) {
7
- const normalized = requireD1LaneStoreOptions(options);
8
- this.database = normalized.database;
9
- this.scope = normalized.scope;
10
- }
11
- async getEffect(input) {
12
- const row = await this.database.prepare(`SELECT effect_id, enrollment_id, operation_id, wallet_id, wallet_key_id, lane_id, lane_share_epoch, effect_kind, request_digest_b64u, status, response_digest_b64u, recorded_at_ms, confirmed_at_ms, version, command_digest_b64u FROM ${EFFECT_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND effect_id = ?5`).bind(...scopeValues(this.scope), input.effectId).first();
13
- return row ? parseEffectRow(row) : null;
14
- }
15
- async recordEffect(input) {
16
- const record = input.record;
17
- if (record.status !== "recorded") throw new Error("lane effect admission requires a recorded effect");
18
- const existing = await this.getEffect({ effectId: record.effectId });
19
- if (existing) {
20
- if (sameEffect(existing.record, record) && existing.commandDigestB64u === input.commandDigestB64u) return {
21
- outcome: "replayed",
22
- version: existing.version,
23
- commandDigestB64u: existing.commandDigestB64u,
24
- record: existing.record
25
- };
26
- return {
27
- outcome: "conflict",
28
- expectedVersion: null,
29
- actualVersion: existing.version,
30
- requestedCommandDigestB64u: input.commandDigestB64u,
31
- storedCommandDigestB64u: existing.commandDigestB64u
32
- };
33
- }
34
- const statements = [this.database.prepare(`INSERT INTO ${EFFECT_TABLE} (namespace, org_id, project_id, env_id, effect_id, enrollment_id, operation_id, wallet_id, wallet_key_id, lane_id, lane_share_epoch, effect_kind, request_digest_b64u, status, response_digest_b64u, recorded_at_ms, confirmed_at_ms, version, command_digest_b64u) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, 'recorded', NULL, ?14, NULL, 1, ?15)`).bind(...scopeValues(this.scope), record.effectId, String(record.enrollmentId), String(record.operationId), String(record.walletId), String(record.walletKeyId), String(record.laneId), String(record.laneShareEpoch), record.effectKind, record.requestDigestB64u, record.recordedAtMs, input.commandDigestB64u), this.database.prepare(LANE_CAS_GUARD_SQL)];
35
- try {
36
- assertD1Success(firstBatchResult(await this.database.batch(statements), 0), "lane effect admission");
37
- return {
38
- outcome: "applied",
39
- version: 1,
40
- commandDigestB64u: input.commandDigestB64u,
41
- record
42
- };
43
- } catch (error) {
44
- const raced = await this.getEffect({ effectId: record.effectId });
45
- if (raced && sameEffect(raced.record, record) && raced.commandDigestB64u === input.commandDigestB64u) return {
46
- outcome: "replayed",
47
- version: raced.version,
48
- commandDigestB64u: raced.commandDigestB64u,
49
- record: raced.record
50
- };
51
- if (raced) return {
52
- outcome: "conflict",
53
- expectedVersion: null,
54
- actualVersion: raced.version,
55
- requestedCommandDigestB64u: input.commandDigestB64u,
56
- storedCommandDigestB64u: raced.commandDigestB64u
57
- };
58
- throw error;
59
- }
60
- }
61
- async confirmEffect(input) {
62
- const existing = await this.getEffect({ effectId: input.effectId });
63
- if (!existing) return {
64
- outcome: "conflict",
65
- expectedVersion: input.expectedVersion,
66
- actualVersion: 0,
67
- requestedCommandDigestB64u: input.commandDigestB64u,
68
- storedCommandDigestB64u: ""
69
- };
70
- if (existing.record.status === "confirmed" && existing.record.responseDigestB64u === input.responseDigestB64u && existing.commandDigestB64u === input.commandDigestB64u) return {
71
- outcome: "replayed",
72
- version: existing.version,
73
- commandDigestB64u: existing.commandDigestB64u,
74
- record: existing.record
75
- };
76
- const values = scopeValues(this.scope);
77
- const statements = [this.database.prepare(`UPDATE ${EFFECT_TABLE} SET status = 'confirmed', response_digest_b64u = ?5, confirmed_at_ms = ?6, version = version + 1, command_digest_b64u = ?7 WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND effect_id = ?8 AND version = ?9 AND status = 'recorded'`).bind(...values, input.responseDigestB64u, input.confirmedAtMs, input.commandDigestB64u, input.effectId, input.expectedVersion), this.database.prepare(LANE_CAS_GUARD_SQL)];
78
- try {
79
- assertD1Success(firstBatchResult(await this.database.batch(statements), 0), "lane effect confirmation");
80
- } catch {
81
- const raced = await this.getEffect({ effectId: input.effectId });
82
- if (raced && raced.record.status === "confirmed" && raced.record.responseDigestB64u === input.responseDigestB64u && raced.commandDigestB64u === input.commandDigestB64u) return {
83
- outcome: "replayed",
84
- version: raced.version,
85
- commandDigestB64u: raced.commandDigestB64u,
86
- record: raced.record
87
- };
88
- return {
89
- outcome: "conflict",
90
- expectedVersion: input.expectedVersion,
91
- actualVersion: raced?.version ?? 0,
92
- requestedCommandDigestB64u: input.commandDigestB64u,
93
- storedCommandDigestB64u: raced?.commandDigestB64u ?? ""
94
- };
95
- }
96
- const updated = await this.getEffect({ effectId: input.effectId });
97
- if (!updated) throw new Error("lane effect disappeared after confirmation");
98
- return {
99
- outcome: "applied",
100
- version: updated.version,
101
- commandDigestB64u: updated.commandDigestB64u,
102
- record: updated.record
103
- };
104
- }
105
- };
106
- function parseEffectRow(row) {
107
- const required = (value, label) => {
108
- if (typeof value !== "string" || !value) throw new Error(`${label} is invalid`);
109
- return value;
110
- };
111
- const status = required(row.status, "effect status");
112
- if (status !== "recorded" && status !== "confirmed") throw new Error("effect status is invalid");
113
- const effectKindValue = required(row.effect_kind, "effect kind");
114
- if (effectKindValue !== "activate_server_material" && effectKindValue !== "retire_server_material" && effectKindValue !== "invalidate_holder_material") throw new Error("effect kind is invalid");
115
- const effectKind = effectKindValue;
116
- const version = Number(row.version);
117
- if (!Number.isSafeInteger(version) || version < 1) throw new Error("effect version is invalid");
118
- const recordedAtMs = Number(row.recorded_at_ms);
119
- if (!Number.isSafeInteger(recordedAtMs) || recordedAtMs < 0) throw new Error("effect recorded time is invalid");
120
- const responseDigest = row.response_digest_b64u === null || row.response_digest_b64u === void 0 ? void 0 : required(row.response_digest_b64u, "effect response digest");
121
- const confirmedAt = row.confirmed_at_ms === null || row.confirmed_at_ms === void 0 ? void 0 : Number(row.confirmed_at_ms);
122
- const base = {
123
- kind: "lane_effect_record_v1",
124
- effectId: required(row.effect_id, "effect id"),
125
- enrollmentId: parsedId(parseLaneEnrollmentId, row.enrollment_id, "enrollment id"),
126
- operationId: parsedId(parseLaneOperationId, row.operation_id, "operation id"),
127
- walletId: parsedId(parseWalletId, row.wallet_id, "wallet id"),
128
- walletKeyId: parsedId(parseWalletKeyId, row.wallet_key_id, "wallet key id"),
129
- laneId: parsedId(parseSigningLaneId, row.lane_id, "lane id"),
130
- laneShareEpoch: parsedId(parseLaneShareEpoch, row.lane_share_epoch, "lane share epoch"),
131
- effectKind,
132
- requestDigestB64u: required(row.request_digest_b64u, "effect request digest"),
133
- recordedAtMs
134
- };
135
- const record = status === "recorded" ? {
136
- ...base,
137
- status: "recorded"
138
- } : responseDigest !== void 0 && confirmedAt !== void 0 && Number.isSafeInteger(confirmedAt) && confirmedAt >= recordedAtMs ? {
139
- ...base,
140
- status: "confirmed",
141
- responseDigestB64u: responseDigest,
142
- confirmedAtMs: confirmedAt
143
- } : (() => {
144
- throw new Error("confirmed lane effect is missing response or confirmation time");
145
- })();
146
- return {
147
- version,
148
- commandDigestB64u: required(row.command_digest_b64u, "effect command digest"),
149
- record
150
- };
151
- }
152
- function parsedId(parser, raw, label) {
153
- const result = parser(raw);
154
- if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
155
- return result.value;
156
- }
157
- function sameEffect(left, right) {
158
- if (left.kind !== right.kind || left.effectId !== right.effectId || left.enrollmentId !== right.enrollmentId || left.operationId !== right.operationId || left.walletId !== right.walletId || left.walletKeyId !== right.walletKeyId || left.laneId !== right.laneId || left.laneShareEpoch !== right.laneShareEpoch || left.effectKind !== right.effectKind || left.requestDigestB64u !== right.requestDigestB64u || left.recordedAtMs !== right.recordedAtMs || left.status !== right.status) return false;
159
- if (left.status === "recorded" && right.status === "recorded") return true;
160
- if (left.status !== "confirmed" || right.status !== "confirmed") return false;
161
- return left.responseDigestB64u === right.responseDigestB64u && left.confirmedAtMs === right.confirmedAtMs;
162
- }
163
- //#endregion
164
- export { CloudflareD1LaneEffectJournalStore };
165
-
166
- //# sourceMappingURL=d1LaneEffectJournalStore.js.map
@@ -1,38 +0,0 @@
1
- import { LaneEnrollmentActivation } from "../../../../core/signingLanes/LaneEnrollmentActivation.js";
2
- import { LaneEnrollmentRevocation } from "../../../../core/signingLanes/LaneEnrollmentRevocation.js";
3
- //#region src/router/cloudflare/d1/signingLanes/d1LaneEnrollmentGateway.ts
4
- /** D1 gateway composition. Participant network calls are injected by callers. */
5
- var CloudflareD1LaneEnrollmentGateway = class {
6
- constructor(options) {
7
- this.activation = new LaneEnrollmentActivation(options.lifecycleStore);
8
- this.revocation = new LaneEnrollmentRevocation(options.lifecycleStore);
9
- }
10
- async prepareLaneEnrollmentV1(...args) {
11
- return await this.activation.prepareLaneEnrollmentV1(...args);
12
- }
13
- async resumeLaneProtocolOperationV1(...args) {
14
- return await this.activation.resumeLaneProtocolOperationV1(...args);
15
- }
16
- async recordLaneProtocolCommitV1(...args) {
17
- return await this.activation.recordLaneProtocolCommitV1(...args);
18
- }
19
- async recordLaneHolderDeliveryV1(...args) {
20
- return await this.activation.recordLaneHolderDeliveryV1(...args);
21
- }
22
- async activateLaneServerMaterialV1(...args) {
23
- return await this.activation.activateLaneServerMaterialV1(...args);
24
- }
25
- async commitLaneEnrollmentActivationV1(...args) {
26
- return await this.activation.commitLaneEnrollmentActivationV1(...args);
27
- }
28
- async fenceSigningLaneRevocationV1(...args) {
29
- return await this.revocation.fenceSigningLaneRevocationV1(...args);
30
- }
31
- async completeSigningLaneRevocationV1(...args) {
32
- return await this.revocation.completeSigningLaneRevocationV1(...args);
33
- }
34
- };
35
- //#endregion
36
- export { CloudflareD1LaneEnrollmentGateway };
37
-
38
- //# sourceMappingURL=d1LaneEnrollmentGateway.js.map
@@ -1,20 +0,0 @@
1
- import { LaneLifecycleApplicationService } from "../../../../core/signingLanes/LaneLifecycleApplicationService.js";
2
- import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
3
- import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
4
- //#region src/router/cloudflare/d1/signingLanes/d1LaneLifecycleApplicationService.ts
5
- /**
6
- * Builds the authenticated server-internal lane lifecycle boundary. Routes
7
- * should receive this service from their private composition and never expose
8
- * the receipt methods as a public raw-receipt endpoint.
9
- */
10
- function createCloudflareD1LaneLifecycleApplicationService(options) {
11
- return new LaneLifecycleApplicationService({
12
- gateway: new CloudflareD1LaneEnrollmentGateway({ lifecycleStore: new CloudflareD1LaneLifecycleStore(options) }),
13
- authorization: options.authorization,
14
- execution: options.execution
15
- });
16
- }
17
- //#endregion
18
- export { createCloudflareD1LaneLifecycleApplicationService };
19
-
20
- //# sourceMappingURL=d1LaneLifecycleApplicationService.js.map