@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/authorization/lifecycleRouting.d.ts

@@ -0,0 +1,32 @@
+import { type WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { RouterAbEd25519YaoRecoveryAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
+export declare class WalletLifecycleLocator {
+    #private;
+    readonly kind: 'yao_recovery' | 'yao_export' | 'passkey_challenge' | 'linked_device';
+    readonly value: string;
+    private constructor();
+    matches(other: WalletLifecycleLocator): boolean;
+    static parse(raw: unknown): WalletLifecycleLocator;
+}
+export interface WalletLifecycleRoutingPublisher {
+    publishLifecycle(input: {
+        readonly walletId: WalletId;
+        readonly locator: WalletLifecycleLocator;
+    }): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: 'locator_conflict';
+    }>;
+}
+type PublicationResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly status: 409 | 503;
+    readonly code: string;
+    readonly message: string;
+};
+export declare function publishWalletLifecycleHome(publisher: WalletLifecycleRoutingPublisher | null, kind: 'yao_recovery' | 'yao_export', admission: Pick<RouterAbEd25519YaoRecoveryAdmissionRequestV1, 'scope' | 'application_binding'>): Promise<PublicationResult>;
+export {};
+//# sourceMappingURL=lifecycleRouting.d.ts.map

package/dist/types/wallet-server/src/authorization/lifecycleRouting.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lifecycleRouting.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/recoveryRouting.d.ts

@@ -0,0 +1,22 @@
+import type { WalletId, WalletRecoveryOperationId } from '../../../shared-ts/src/utils/domainIds';
+import type { RecoveryCodeLocatorV1 } from '../../../shared-ts/src/wallet-recovery/recoveryCodeLocator';
+export type WalletRecoveryRoutingPublication = {
+    readonly kind: 'codes';
+    readonly walletId: WalletId;
+    readonly locators: readonly RecoveryCodeLocatorV1[];
+    readonly operationId?: never;
+} | {
+    readonly kind: 'operation';
+    readonly walletId: WalletId;
+    readonly operationId: WalletRecoveryOperationId;
+    readonly locators?: never;
+};
+export interface WalletRecoveryRoutingPublisher {
+    publishRecovery(input: WalletRecoveryRoutingPublication): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly code: 'locator_conflict';
+    }>;
+}
+//# sourceMappingURL=recoveryRouting.d.ts.map

package/dist/types/wallet-server/src/authorization/recoveryRouting.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=recoveryRouting.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/service.d.ts

@@ -1,5 +1,7 @@
-import type { D1EcdsaAdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+import type { WalletSessionLocatorPublication, WalletSessionRoutingPublisher } from './sessionRouting';
+import type { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead } from '../router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
 import type { EcdsaMaterialRead } from '../core/d1EcdsaSignerRead';
+import type { Ed25519SignerRead } from '../core/d1Ed25519SignerRead';
 import type { D1PreparedStatementLike } from '../storage/tenantRoute';
 import type { WalletAuthMethodId, WalletId } from '../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1 } from '../../../shared-ts/src/authorization/walletAuthority';
@@ -17,9 +19,14 @@ export type EcdsaWalletSessionAdmissionRead = {
     readonly materialRead: EcdsaMaterialRead;
     readonly policyRead: D1EcdsaAdmissionPolicyRead;
 };
+export type Ed25519WalletSessionAdmissionRead = {
+    readonly snapshot: WalletSessionAdmissionSnapshotV2;
+    readonly signerRead: Ed25519SignerRead;
+    readonly policyRead: D1Ed25519AdmissionPolicyRead;
+};
 export interface AuthorizationSessionPort {
     putIssuedHostedWalletSeamsSessionExchange(exchange: IssuedHostedWalletSeamsSessionExchangeV2): Promise<void>;
-    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
+    redeemHostedWalletSeamsSessionExchange(input: RedeemHostedWalletSeamsSessionExchangeV2Input, publishCredentialLocator?: () => Promise<void>): Promise<PersistedHostedWalletSeamsSessionExchangeV2Result>;
     readHostedWalletSessionOperationCredentialV2(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -32,6 +39,7 @@ export interface AuthorizationEvidencePort {
     consumeVerifiedOwnerProof(proof: VerifiedOwnerProof, consumedAtMs: number, consumptionScopeId: string): Promise<boolean>;
 }
 export interface AuthorizationGrantPort {
+    readWalletSessionIssuanceGeneration(walletId: WalletId): Promise<number>;
     retireWalletSessionAuthorizationsForAuthMethod(input: {
         readonly tenantId: TenantId;
         readonly walletId: WalletId;
@@ -50,8 +58,10 @@ export interface AuthorizationGrantPort {
     commitDirectWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
     }): Promise<DirectV2CommitResult>;
+    /** Inserted confirms readback of the exact session identity and primary credential digest. */
     commitDirectReplayableWalletSessionAuthorizationV2(input: {
         readonly persisted: PersistedActiveWalletSessionAuthorizationV2;
+        readonly purpose: DirectWalletSessionCommitPurpose;
     }): Promise<DirectV2CommitResult>;
     readWalletSessionAuthorizationV2ByAuthorizationId(input: {
         readonly expected: WalletSessionAuthorizationV2;
@@ -80,6 +90,12 @@ export interface AuthorizationGrantPort {
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<EcdsaWalletSessionAdmissionRead | null>;
+    readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly tokenHash: DigestB64u;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<Ed25519WalletSessionAdmissionRead | null>;
     readWalletSessionExactOperationContextByCredential(input: {
         readonly tenantId: TenantId;
         readonly tokenHash: DigestB64u;
@@ -160,6 +176,7 @@ export type AuthorizedOperationMaterialScope = EcdsaMaterialActivationScope & {
     readonly kind?: 'ecdsa_material_activation';
 };
 export type AuthorizationServicePorts = {
+    readonly sessionRouting?: WalletSessionRoutingPublisher;
     readonly policy: CapabilityPolicyPort;
     readonly sessions: AuthorizationSessionPort;
     readonly evidence: AuthorizationEvidencePort;
@@ -179,6 +196,18 @@ type IssueWalletSessionAuthorizationV2InputBase = {
     readonly expiresAtMs: number;
 };
 export type IssueWalletSessionAuthorizationV2Input = IssueWalletSessionAuthorizationV2InputBase;
+export type DirectWalletSessionCommitPurpose = {
+    readonly kind: 'ordinary';
+    readonly ceremonyId?: never;
+} | {
+    readonly kind: 'registration';
+    readonly ceremonyId: string;
+};
+type DirectWalletSessionReplayMode = {
+    readonly kind: 'strict';
+} | {
+    readonly kind: 'validated_registration_authority_projection';
+};
 export type PreparedWalletSessionAuthorizationV2 = {
     readonly session: WalletSessionAuthorizationV2;
     readonly quota: ActiveWalletSessionQuota;
@@ -236,9 +265,19 @@ export declare class AuthorizationService {
      * committed digest cannot reproduce plaintext.
      */
     issueDirectWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input): Promise<DirectV2IssueResult>;
-    /** The Ed25519 registration caller validates current authority and owner proof first. */
-    issueDirectRegistrationPromotedWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input): Promise<DirectV2IssueResult>;
-    private issueDirectWalletSessionAuthorizationV2WithReplayMode;
+    /** Commits locally. Registration publishes the locator with home completion. */
+    commitDirectWalletSessionAuthorizationV2(input: IssueWalletSessionAuthorizationV2Input, replayMode: DirectWalletSessionReplayMode, purpose: DirectWalletSessionCommitPurpose, commitSession?: AuthorizationGrantPort['commitDirectReplayableWalletSessionAuthorizationV2']): Promise<{
+        readonly result: DirectV2IssueResult;
+        readonly publication: WalletSessionLocatorPublication & {
+            readonly kind: 'credential';
+        };
+        readonly registration: DirectV2CommitResult['registration'];
+    }>;
+    prepareDirectWalletSessionCredential(prepared: PreparedWalletSessionAuthorizationV2): Promise<{
+        persisted: PersistedActiveWalletSessionAuthorizationV2;
+        operationCredential: import("../../../shared-ts/src/device-linking").WalletSessionOperationCredentialV1;
+    }>;
+    private prepareDirectWalletSessionIssuance;
     refreshWalletSessionAuthorizationV2AuthorityProjection(input: {
         readonly existing: IssuedWalletSessionAuthorizationV2;
         readonly authority: ActiveWalletAuthorityV1;
@@ -279,6 +318,12 @@ export declare class AuthorizationService {
         readonly nowMs: number;
         readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
     }): Promise<EcdsaWalletSessionAdmissionRead | null>;
+    readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input: {
+        readonly tenantId: TenantId;
+        readonly token: string;
+        readonly nowMs: number;
+        readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<Ed25519WalletSessionAdmissionRead | null>;
     readLiveWalletSessionAuthorizationProjectionByCredential(input: {
         readonly tenantId: TenantId;
         readonly token: string;

package/dist/types/wallet-server/src/authorization/sessionRouting.d.ts

@@ -0,0 +1,22 @@
+import type { WalletSessionHome } from '../../../shared-ts/src/device-linking/contracts';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+export type WalletSessionLocatorPublication = {
+    readonly kind: 'credential' | 'exchange';
+    readonly digest: DigestB64u;
+    readonly walletId: WalletId;
+    readonly expiresAtMs: number;
+    readonly exchangeDigest?: never;
+} | {
+    readonly kind: 'exchanged_credential';
+    readonly digest: DigestB64u;
+    readonly exchangeDigest: DigestB64u;
+    readonly walletId?: never;
+    readonly expiresAtMs?: never;
+};
+/** Publishes digest-to-wallet metadata; home-local storage authorizes its use. */
+export interface WalletSessionRoutingPublisher {
+    home(): WalletSessionHome;
+    publish(input: WalletSessionLocatorPublication): Promise<void>;
+}
+//# sourceMappingURL=sessionRouting.d.ts.map

package/dist/types/wallet-server/src/authorization/sessionRouting.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sessionRouting.typecheck.d.ts.map

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -3,11 +3,12 @@ export * from './core/ThresholdService/evmCryptoWasm';
 export * from './core/d1WalletStore';
 export * from './core/d1WalletAuthMethodStore';
 export * from './core/logger';
-export * from './core/signingLanes/LaneLifecycleApplicationService';
 export * from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export * from './core/types';
 export * from './delegateAction';
 export * from './router/framework/apiCredentialPorts';
+export { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext, } from './router/auth/walletRegistrationContext';
+export { parseWalletRegistrationSetupRequest } from './router/domains/walletRegistration/walletRegistrationRoutes';
 export * from './router/framework/applyRouteMetering';
 export * from './router/cloudflare-adaptor';
 export type { CfEnv, CfExecutionContext, CfScheduledEvent, FetchHandler, RouterApiCloudflareSignerWorkerEnv, ScheduledHandler, SeamsD1SignerTenantStorageWorkerEnv, } from './router/cloudflare/runtime/cloudflare.types';
@@ -19,15 +20,10 @@ export * from './router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersisten
 export * from './router/cloudflare/d1/oidc/d1OidcBoundary';
 export * from './router/cloudflare/d1/auth/d1RouterApiAuthConfig';
 export * from './router/cloudflare/d1/auth/d1RouterApiAuthService';
-export * from './router/cloudflare/d1/signingLanes';
 export * from './router/cloudflare/d1/deviceLinking';
-export * from './router/cloudflare/signingLanes/cloudflareLaneCurveExecution';
-export * from './router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter';
-export * from './router/cloudflare/signingLanes/linkedDeviceEd25519CeremonyBinding';
 export * from './router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation';
 export * from './router/cloudflare/d1/webauthn/d1WebAuthnAuthService';
 export * from './router/cloudflare/d1/webauthn/d1WebAuthnStore';
-export * from './router/cloudflare/durableObjects/thresholdStore';
 export * from './router/cloudflare/runtime/cloudflareSignerWasm';
 export * from './router/cloudflare/runtime/ed25519SessionAdapter';
 export * from './router/cloudflare/runtime/routerAbServiceBindings';
@@ -35,6 +31,7 @@ export * from './router/cloudflare/runtime/sessionAdapterRuntime';
 export * from './router/cloudflare/runtime/walletConsoleOps';
 export * from './router/cloudflare/runtime/walletConsoleOpsClient';
 export * from './router/cloudflare/runtime/walletGateway';
+export { WalletPlacementRoutes } from './router/cloudflare/runtime/walletPlacementRoutes';
 export * from './router/cloudflare/runtime/walletRuntimeOps';
 export * from './router/cloudflare/runtime/walletRuntimeOpsHandler';
 export * from './router/cloudflare/runtime/walletControlOps';
@@ -63,9 +60,9 @@ export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRe
 export * from './router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization';
 export * from './router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare';
 export * from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
-export { buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEd25519AcceptedAuthorizedOperationV1, evaluateRouterAbNormalSigningAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAdmissionEvaluationInput, type RouterAbNormalSigningAdmissionFailure, type RouterAbNormalSigningAdmissionFailureCode, type RouterAbNormalSigningAdmissionInput, type RouterAbNormalSigningAdmissionResult, type RouterAbNormalSigningRouteAdmission, type RouterAbNormalSigningRouteRuntime, type RouterAbSigningWorkerJsonResult, } from './router/domains/signingOperations/routerAbNormalSigningAdmission';
+export { evaluateRouterAbNormalSigningAdmission, type RouterAbEcdsaOperationAdmission, type RouterAbEcdsaOperationAdmissionKind, type RouterAbJsonRouteResult, type RouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAdmissionEvaluationInput, type RouterAbNormalSigningAdmissionFailure, type RouterAbNormalSigningAdmissionFailureCode, type RouterAbNormalSigningAdmissionInput, type RouterAbNormalSigningAdmissionResult, type RouterAbNormalSigningRouteAdmission, type RouterAbNormalSigningRouteRuntime, type RouterAbSigningWorkerJsonResult, } from './router/domains/signingOperations/routerAbNormalSigningAdmission';
 export { authenticateRouterAbWalletOperationStepUpIdentity } from './router/domains/signingOperations/routerAbOperationStepUp';
-export { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaDerivationPrivateSigningWorkerBody, type RouterAbEd25519NormalSigningScopeV2, type RouterAbEd25519PrivateSigningPath, type RouterAbEd25519PrivateSigningWorkerBody, routerAbNormalSigningMaterialSourceFromActiveLaneV1, type RouterAbNormalSigningMaterialSourceV1, } from './router/domains/signingOperations/routerAbPrivateSigningWorker';
+export { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, type RouterAbEcdsaDerivationPrivateSigningPath, type RouterAbEcdsaDerivationPrivateSigningWorkerBody, type RouterAbEd25519NormalSigningScopeV2, type RouterAbEd25519PrivateSigningPath, type RouterAbEd25519PrivateSigningWorkerBody, type RouterAbNormalSigningMaterialSourceV1, } from './router/domains/signingOperations/routerAbPrivateSigningWorker';
 export * from './router/domains/signingOperations/routerAbEd25519NormalSigningRoute';
 export * from './router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute';
 export * from './router/framework/routerApi';
@@ -82,8 +79,6 @@ export { parseOrgId, parseWalletId, parseWebAuthnRpId, type OrgId, type WebAuthn
 export { base64UrlDecode, base64UrlEncode } from '../../shared-ts/src/utils/encoders';
 export { sha256Bytes } from '../../shared-ts/src/utils/digests';
 export { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1, type TenantRootIdentityV1, } from '../../shared-ts/src/tenant-root/tenantRootIdentity';
-export { buildSigningWorkerParticipantRecordWithDigestV1 } from '../../shared-ts/src/signing-lanes/participantDigest';
-export { parseHpkePublicKeyB64u, parseSigningWorkerParticipantId, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId, } from '../../shared-ts/src/signing-lanes/participants';
 export { keccak256Bytes } from '../../shared-ts/src/utils/keccak';
 export { normalizeBoundedPositiveInteger, normalizeLowercaseString, normalizeTrimmedString, } from '../../shared-ts/src/utils/normalize';
 export { ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, parseRouterAbPublicKeysetV2, type RouterAbPublicKeysetV2, } from '../../shared-ts/src/utils/routerAbPublicKeyset';
@@ -95,4 +90,35 @@ export type { RuntimePolicyScope } from '../../shared-ts/src/threshold/signingRo
 export type { WalletEmailOtpOperation } from '../../shared-ts/src/utils/emailOtpDomain';
 export { decodeJsonRpcEnvelope } from '../../shared-ts/src/utils/jsonRpc';
 export * from '../../shared-ts/src/utils/evmRpcResults';
+export { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest, type WalletRegistrationSetupReservation, type WalletRegistrationReservationAuthority, } from './router/domains/walletRegistration/walletRegistrationReservation';
+export type { WalletRegistrationSetupDispatcher } from './router/framework/registrationSetupDispatch';
+export type { WalletSessionLocatorPublication, WalletSessionRoutingPublisher, } from './authorization/sessionRouting';
+export { digestOpaqueValue } from './authorization/service';
+export type { WalletRecoveryRoutingPublication, WalletRecoveryRoutingPublisher, } from './authorization/recoveryRouting';
+export { parseRecoveryCodeLocatorV1, deriveRecoveryCodeLocatorV1FromBytes, } from '../../shared-ts/src/wallet-recovery/recoveryCodeLocator';
+export { parseWalletRecoveryOperationId } from '../../shared-ts/src/utils/domainIds';
+export { WalletLifecycleLocator } from './authorization/lifecycleRouting';
+export type { WalletLifecycleRoutingPublisher } from './authorization/lifecycleRouting';
+export { D1IdentityStore } from './core/d1IdentityStore';
+export type { IdentityStore } from './core/IdentityStore';
+export { verifyGoogleOidcToken } from './router/cloudflare/d1/oidc/googleOidcToken';
+export { parseGoogleLoginVerifyRequest } from './router/auth/authRequestValidation';
+export { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from './router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+export type { GoogleEmailOtpRegistrationAttemptStore } from './router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore';
+export { parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope, } from './router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords';
+export { prepareD1TenantStatement } from './core/d1TenantStore';
+export type { PasskeyCredentialClaims } from './core/passkeyCredentialClaims';
+export type { WebAuthnSyncChallengeStore, WebAuthnSyncChallengeRecord, } from './core/WebAuthnSyncChallengeStore';
+export { parseWebAuthnSyncChallengeRecord } from './router/cloudflare/d1/webauthn/d1WebAuthnRecords';
+export { webAuthnCredentialIdB64uFromCredential } from './router/auth/webAuthnCredentialCodecs';
+export type { SyncChallengeFailure } from './core/WebAuthnSyncChallengeStore';
+export type { LinkedDeviceRequestProofNonceStoreV1 } from './core/deviceLinking/requestProof';
+export { D1LinkedDeviceRequestProofNonceStoreV1 } from './router/cloudflare/d1/deviceLinking/d1LinkedDeviceRequestProofNonceStore';
+export type { LinkedDeviceBootstrapStore, LinkedDeviceBootstrapResult, } from './core/deviceLinking/linkedDeviceBootstrap';
+export { parseLinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
+export type { LinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
+export { computeLinkedDeviceSessionClaimDigestV1 } from '../../shared-ts/src/device-linking/digests';
+export { admitD1EstablishedWalletHome } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
+export { D1WalletObjectAddresses } from './router/cloudflare/d1/walletObjectAddresses';
+export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity } from './router/cloudflare/runtime/walletObjectAddresses';
 //# sourceMappingURL=cloud-host.d.ts.map

package/dist/types/wallet-server/src/core/EmailOtpRecords.d.ts

@@ -1,42 +1,22 @@
 import type { ThresholdRuntimePolicyScope } from './types';
-import type { EmailOtpAuthStateRecord, EmailOtpChallengeRecord, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, EmailOtpWalletEnrollmentRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput, PendingGoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
-/** Parses JSON text; any other value, and text that is not JSON, comes back unchanged. */
-export declare function parseJsonRecord(raw: unknown): unknown;
-export declare function parseCurrentEmailOtpChallengeRecord(raw: unknown): EmailOtpChallengeRecord | null;
+import type { EmailOtpChallengeRecord, EmailOtpChallengePurpose, EmailOtpGrantRecord, EmailOtpUnlockChallengeRecord, GoogleEmailOtpRegistrationAttemptRecord, GoogleEmailOtpRegistrationAttemptScopeInput, PendingGoogleEmailOtpRegistrationAttemptRecord } from './EmailOtpStores';
+export declare function parseEmailOtpChallengePurpose(action: unknown, operation: unknown): EmailOtpChallengePurpose | null;
 export declare function parseCurrentEmailOtpChallengeRow(input: {
     recordJson: unknown;
     expiresAtMs: unknown;
 }): EmailOtpChallengeRecord | null;
-export declare function parseCurrentEmailOtpGrantRecord(raw: unknown): EmailOtpGrantRecord | null;
 export declare function parseCurrentEmailOtpGrantRow(input: {
     recordJson: unknown;
     expiresAtMs: unknown;
 }): EmailOtpGrantRecord | null;
-export declare function parseCurrentEmailOtpUnlockChallengeRecord(raw: unknown): EmailOtpUnlockChallengeRecord | null;
 export declare function parseCurrentEmailOtpUnlockChallengeRow(input: {
     recordJson: unknown;
     expiresAtMs: unknown;
 }): EmailOtpUnlockChallengeRecord | null;
-export declare function parseCurrentGoogleEmailOtpRegistrationAttemptRecord(raw: unknown): GoogleEmailOtpRegistrationAttemptRecord | null;
-export declare function parseCurrentGoogleEmailOtpRegistrationAttemptRow(input: {
-    recordJson: unknown;
-    expiresAtMs: unknown;
-    updatedAtMs: unknown;
-}): GoogleEmailOtpRegistrationAttemptRecord | null;
 /** The scope as one comparable string, as D1 stores it in `runtime_policy_key`; empty when unset. */
 export declare function runtimePolicyScopeKey(scope: ThresholdRuntimePolicyScope | undefined): string;
 /** The pending attempt a registration with this owner binding resumes. */
 export declare function registrationAttemptMatchesStartedScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
 /** A pending attempt that a registration with a new owner binding replaces. */
 export declare function registrationAttemptMatchesReplacementScope(record: GoogleEmailOtpRegistrationAttemptRecord, input: Readonly<GoogleEmailOtpRegistrationAttemptScopeInput>): record is PendingGoogleEmailOtpRegistrationAttemptRecord;
-export declare function parseCurrentEmailOtpWalletEnrollmentRecord(raw: unknown): EmailOtpWalletEnrollmentRecord | null;
-export declare function parseCurrentEmailOtpWalletEnrollmentRow(input: {
-    recordJson: unknown;
-    updatedAtMs: unknown;
-}): EmailOtpWalletEnrollmentRecord | null;
-export declare function parseCurrentEmailOtpAuthStateRecord(raw: unknown): EmailOtpAuthStateRecord | null;
-export declare function parseCurrentEmailOtpAuthStateRow(input: {
-    recordJson: unknown;
-    updatedAtMs: unknown;
-}): EmailOtpAuthStateRecord | null;
 //# sourceMappingURL=EmailOtpRecords.d.ts.map

package/dist/types/wallet-server/src/core/EmailOtpStores.d.ts

@@ -1,12 +1,27 @@
-import type { NormalizedLogger } from './logger';
-import type { ThresholdRuntimePolicyScope, ThresholdStoreConfigInput } from './types';
+import type { ThresholdRuntimePolicyScope } from './types';
 import type { WalletEmailOtpChannel, WalletEmailOtpLoginOperation, WalletEmailOtpOperation } from '../../../shared-ts/src/utils/emailOtpDomain';
-import { WALLET_EMAIL_OTP_ACTIONS } from '../../../shared-ts/src/utils/emailOtpDomain';
+import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION } from '../../../shared-ts/src/utils/emailOtpDomain';
 export type EmailOtpChannel = WalletEmailOtpChannel;
 export type EmailOtpGrantAction = typeof WALLET_EMAIL_OTP_ACTIONS.unseal | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap;
-export type EmailOtpChallengeAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
+export type EmailOtpChallengeAction = typeof WALLET_EMAIL_OTP_ACTIONS.login | typeof WALLET_EMAIL_OTP_ACTIONS.registration | typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap | typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink | typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
 export type EmailOtpChallengeOperation = WalletEmailOtpOperation;
 export type EmailOtpLoginChallengeOperation = WalletEmailOtpLoginOperation;
+export type EmailOtpChallengePurpose = {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.login;
+    readonly operation: WalletEmailOtpLoginOperation;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.registration;
+    readonly operation: typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap;
+    readonly operation: typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.deviceLink;
+    readonly operation: typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
+} | {
+    readonly action: typeof WALLET_EMAIL_OTP_ACTIONS.relocation;
+    readonly operation: typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
+};
 export type EmailOtpChallengeRecord = {
     version: 'email_otp_challenge_v1';
     challengeId: string;
@@ -26,35 +41,11 @@ export type EmailOtpChallengeRecord = {
     otpCode: string;
     /** Exact wallet, owner, operation, origin, and audience binding digest. */
     ownerProofBindingDigest: string;
-    action: EmailOtpChallengeAction;
-    operation: EmailOtpChallengeOperation;
     createdAtMs: number;
     expiresAtMs: number;
     attemptCount: number;
     maxAttempts: number;
-};
-export type EmailOtpChallengeContextInput = {
-    challengeSubjectId: string;
-    walletId: string;
-    orgId?: string;
-    otpChannel: EmailOtpChannel;
-    ownerProofBindingDigest: string;
-    action: EmailOtpChallengeAction;
-    operation: EmailOtpChallengeOperation;
-    nowMs: number;
-};
-export interface EmailOtpChallengeStore {
-    put(record: EmailOtpChallengeRecord): Promise<void>;
-    get(challengeId: string): Promise<EmailOtpChallengeRecord | null>;
-    deleteExpired(nowMs: number): Promise<EmailOtpChallengeRecord[]>;
-    countActiveByContext(input: EmailOtpChallengeContextInput): Promise<number>;
-    findLatestActiveByContext(input: EmailOtpChallengeContextInput): Promise<EmailOtpChallengeRecord | null>;
-    deleteOldestActiveByContext(input: EmailOtpChallengeContextInput): Promise<EmailOtpChallengeRecord | null>;
-    findActiveByContext(input: EmailOtpChallengeContextInput & {
-        otpCode: string;
-    }): Promise<EmailOtpChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
-}
+} & EmailOtpChallengePurpose;
 export type EmailOtpGrantRecord = {
     version: 'email_otp_grant_v1';
     grantToken: string;
@@ -68,12 +59,6 @@ export type EmailOtpGrantRecord = {
     issuedAtMs: number;
     expiresAtMs: number;
 };
-export interface EmailOtpGrantStore {
-    put(record: EmailOtpGrantRecord): Promise<void>;
-    get(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    consume(grantToken: string): Promise<EmailOtpGrantRecord | null>;
-    del(grantToken: string): Promise<void>;
-}
 export type EmailOtpWalletEnrollmentRecord = {
     version: 'email_otp_wallet_enrollment_v1';
     walletId: string;
@@ -89,15 +74,6 @@ export type EmailOtpWalletEnrollmentRecord = {
     createdAtMs: number;
     updatedAtMs: number;
 };
-export interface EmailOtpWalletEnrollmentStore {
-    get(walletId: string): Promise<EmailOtpWalletEnrollmentRecord | null>;
-    getByProviderUserId(input: {
-        providerUserId: string;
-        orgId: string;
-    }): Promise<EmailOtpWalletEnrollmentRecord | null>;
-    put(record: EmailOtpWalletEnrollmentRecord): Promise<void>;
-    del(walletId: string): Promise<void>;
-}
 export type EmailOtpAuthStateRecord = {
     version: 'email_otp_auth_state_v1';
     walletId: string;
@@ -111,11 +87,6 @@ export type EmailOtpAuthStateRecord = {
     lastEmailOtpLoginAtMs?: number;
     lastStrongAuthAtMs?: number;
 };
-export interface EmailOtpAuthStateStore {
-    get(walletId: string): Promise<EmailOtpAuthStateRecord | null>;
-    put(record: EmailOtpAuthStateRecord): Promise<void>;
-    del(walletId: string): Promise<void>;
-}
 export type EmailOtpUnlockChallengeRecord = {
     version: 'email_otp_unlock_challenge_v1';
     challengeId: string;
@@ -126,11 +97,6 @@ export type EmailOtpUnlockChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface EmailOtpUnlockChallengeStore {
-    put(record: EmailOtpUnlockChallengeRecord): Promise<void>;
-    consume(challengeId: string): Promise<EmailOtpUnlockChallengeRecord | null>;
-    del(challengeId: string): Promise<void>;
-}
 export type GoogleEmailOtpRegistrationOfferCandidateRecord = {
     candidateId: string;
     walletId: string;
@@ -202,35 +168,5 @@ export type GoogleEmailOtpRegistrationAttemptScopeInput = {
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
     nowMs: number;
 };
-export interface EmailOtpRegistrationAttemptStore {
-    put(record: GoogleEmailOtpRegistrationAttemptRecord): Promise<void>;
-    get(attemptId: string): Promise<GoogleEmailOtpRegistrationAttemptRecord | null>;
-    findStartedBySubjectEmail(input: GoogleEmailOtpRegistrationAttemptScopeInput): Promise<PendingGoogleEmailOtpRegistrationAttemptRecord | null>;
-    abandonStartedBySubjectEmailExceptBinding(input: {
-        providerSubject: string;
-        email: string;
-        orgId: string;
-        ownerProofBindingDigest: string;
-        runtimePolicyScope?: ThresholdRuntimePolicyScope;
-        nowMs: number;
-        failureCode: 'owner_proof_binding_replaced';
-    }): Promise<number>;
-    hasLiveStartedWalletAttempt(input: {
-        walletId: string;
-        nowMs: number;
-    }): Promise<boolean>;
-    deleteExpired(nowMs: number): Promise<number>;
-}
-type EmailOtpStoreFactoryInput = {
-    config?: ThresholdStoreConfigInput | null;
-    logger?: NormalizedLogger;
-    isNode?: boolean;
-};
-export declare function createEmailOtpChallengeStore(input?: EmailOtpStoreFactoryInput): EmailOtpChallengeStore;
-export declare function createEmailOtpGrantStore(input?: EmailOtpStoreFactoryInput): EmailOtpGrantStore;
-export declare function createEmailOtpWalletEnrollmentStore(input?: EmailOtpStoreFactoryInput): EmailOtpWalletEnrollmentStore;
-export declare function createEmailOtpAuthStateStore(input?: EmailOtpStoreFactoryInput): EmailOtpAuthStateStore;
-export declare function createEmailOtpUnlockChallengeStore(input?: EmailOtpStoreFactoryInput): EmailOtpUnlockChallengeStore;
-export declare function createEmailOtpRegistrationAttemptStore(input?: EmailOtpStoreFactoryInput): EmailOtpRegistrationAttemptStore;
 export {};
 //# sourceMappingURL=EmailOtpStores.d.ts.map

package/dist/types/wallet-server/src/core/IdentityStore.d.ts

@@ -1,4 +1,3 @@
-import { type StoreFactoryInput } from './storeBackends';
 export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema, } from './d1IdentityStore';
 export type { D1IdentityStoreOptions, D1IdentityStoreSchemaOptions } from './d1IdentityStore';
 export type IdentitySubjectRecord = {
@@ -8,13 +7,6 @@ export type IdentitySubjectRecord = {
     createdAtMs: number;
     updatedAtMs: number;
 };
-export type IdentityUserRecord = {
-    version: 'identity_user_v1';
-    userId: string;
-    subjects: string[];
-    createdAtMs: number;
-    updatedAtMs: number;
-};
 export type LinkIdentityResult = {
     ok: true;
     movedFromUserId?: string;
@@ -47,6 +39,4 @@ export interface IdentityStore {
         subject: string;
     }): Promise<UnlinkIdentityResult>;
 }
-export declare function resolveIdentityStoreNamespace(config: Record<string, unknown>): string;
-export declare function createIdentityStore(input: StoreFactoryInput): IdentityStore;
 //# sourceMappingURL=IdentityStore.d.ts.map

package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts

@@ -458,7 +458,6 @@ export interface RegistrationCeremonyStore {
     putAddSignerIntent(intent: StoredAddSignerIntent): Promise<void>;
     getAddSignerIntent(grant: AddSignerIntentGrant): Promise<StoredAddSignerIntent | null>;
     takeAddSignerIntent(grant: AddSignerIntentGrant): Promise<ConsumedAddSignerIntent | null>;
-    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     updateCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
     takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;

package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts

@@ -1,5 +1,3 @@
-export type ThresholdNodeRole = 'cosigner' | 'coordinator';
-export declare function coerceThresholdNodeRole(input: unknown): ThresholdNodeRole;
 export declare function parseThresholdEd25519ParticipantIds2p(input: {
     THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: unknown;
     THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: unknown;

package/dist/types/wallet-server/src/core/ThresholdService/index.d.ts

@@ -1,4 +1,2 @@
-export { createThresholdEd25519KeyStore, type ThresholdEd25519KeyStore, type ThresholdEd25519KeyRecord, } from './stores/KeyStore';
-export { createThresholdEd25519SessionStore, type ThresholdEd25519SessionStore, type ThresholdEd25519MpcSessionRecord, type ThresholdEd25519SigningSessionRecord, type ThresholdEd25519Commitments, } from './stores/SessionStore';
-export { createEd25519WalletSessionStore, createEcdsaWalletSessionStore, type Ed25519WalletSessionStore, type Ed25519WalletSessionRecord, } from './stores/WalletSessionStore';
+export { type Ed25519WalletSessionStore, type Ed25519WalletSessionRecord, } from './stores/WalletSessionStore';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/kv.d.ts

@@ -11,10 +11,6 @@ export declare class UpstashRedisRestClient {
     setRaw(key: string, value: string, ttlMs?: number): Promise<void>;
     getJson(key: string): Promise<unknown | null>;
     setJson(key: string, value: unknown, ttlMs?: number): Promise<void>;
-    getdelJson(key: string): Promise<unknown | null>;
-    incrby(key: string, delta: number): Promise<number>;
-    rpush(key: string, value: string): Promise<number>;
-    lpop(key: string): Promise<string | null>;
     eval(script: string, keys: string[], args: string[]): Promise<unknown | null>;
 }
 export type RedisResp = {
@@ -44,9 +40,6 @@ export declare class RedisTcpClient {
     send(args: string[]): Promise<RedisResp>;
 }
 export declare function redisGetJson(client: RedisTcpClient, key: string): Promise<unknown | null>;
-export declare function redisGetRaw(client: RedisTcpClient, key: string): Promise<string | null>;
 export declare function redisDel(client: RedisTcpClient, key: string): Promise<void>;
 export declare function redisSetJson(client: RedisTcpClient, key: string, value: unknown, ttlMs?: number): Promise<void>;
-export declare function redisGetdelJson(client: RedisTcpClient, key: string): Promise<unknown | null>;
-export declare function redisEval(client: RedisTcpClient, script: string, keys: string[], args: string[]): Promise<RedisResp>;
 //# sourceMappingURL=kv.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.d.ts

@@ -1,7 +1,6 @@
 import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RouterAbEcdsaDerivationPoolFillInitRequest, RouterAbEcdsaDerivationPoolFillInitResponse, RouterAbEcdsaDerivationPoolFillStepRequest, RouterAbEcdsaDerivationPoolFillStepResponse } from '../../types';
 import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
-import type { ThresholdNodeRole } from '../config';
 import { type RouterAbEcdsaDerivationPresignaturePoolFillAuth } from './ecdsaDerivationPresignBridge';
 export type RouterAbEcdsaOwnerWalletScope = {
     readonly orgId: string;
@@ -10,6 +9,7 @@ export type RouterAbEcdsaOwnerWalletScope = {
     readonly walletId: string;
 };
 export type RouterAbEcdsaDerivationPoolFillBinding = {
+    readonly ownershipGeneration: number;
     readonly walletId: string;
     readonly relayerKeyId: string;
     readonly keyHandle: string;
@@ -42,12 +42,10 @@ export type RouterAbEcdsaPresignSigningWorkerTransport = {
     readonly fetchImpl: typeof fetch;
 };
 export declare class RouterAbEcdsaDerivationPoolFillHandlers {
-    private readonly nodeRole;
     private readonly participantIds2p;
     private readonly ensureReady;
     private readonly signingWorkerTransport;
     constructor(input: {
-        readonly nodeRole: ThresholdNodeRole;
         readonly participantIds2p: number[];
         readonly ensureReady: () => Promise<void>;
         readonly signingWorkerTransport: RouterAbEcdsaPresignSigningWorkerTransport;