@seams/wallet-server 0.7.3 → 0.9.0

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.d.ts

@@ -6,6 +6,7 @@ export type RouterAbEcdsaDerivationPresignaturePoolFillAuth = {
 };
 export type RouterAbEcdsaPresignAuthorityV1 = {
     readonly kind: 'owner_wallet_session';
+    readonly ownership_generation: number;
     readonly wallet_scope: {
         readonly org_id: string;
         readonly project_id: string;
@@ -14,6 +15,7 @@ export type RouterAbEcdsaPresignAuthorityV1 = {
     };
 } | {
     readonly kind: 'operation_step_up';
+    readonly ownership_generation: number;
     readonly wallet_scope: {
         readonly org_id: string;
         readonly project_id: string;
@@ -91,6 +93,8 @@ export declare function stepRouterAbEcdsaPresignSession(input: {
  * uses a separate private-worker route from the owner pool-fill protocol.
  */
 export declare function startRouterAbLinkedDeviceEcdsaPresignSession(input: {
+    ownershipGeneration: number;
+    walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
     signingWorkerBaseUrl: string;
     request: Record<string, unknown>;
     materialSource: Record<string, unknown>;
@@ -100,6 +104,8 @@ export declare function startRouterAbLinkedDeviceEcdsaPresignSession(input: {
     fetchImpl: typeof fetch;
 }): Promise<RouterAbEcdsaPresignSessionHttpResult>;
 export declare function stepRouterAbLinkedDeviceEcdsaPresignSession(input: {
+    ownershipGeneration: number;
+    walletScope: RouterAbEcdsaPresignAuthorityV1['wallet_scope'];
     signingWorkerBaseUrl: string;
     request: Record<string, unknown>;
     materialSource: Record<string, unknown>;

package/dist/types/wallet-server/src/core/ThresholdService/routerAb/internalServiceHttp.d.ts

@@ -26,6 +26,7 @@ export declare function postRouterAbInternalServiceJson(input: {
     body: unknown;
     authSecret: string;
     fetchImpl: typeof fetch;
+    headers?: Readonly<Record<string, string>>;
     onServerTiming?: (header: string | null) => void;
 }): Promise<RouterAbInternalServiceJsonResult>;
 export {};

package/dist/types/wallet-server/src/core/ThresholdService/routerAbNormalSigningPolicy.d.ts

@@ -13,7 +13,6 @@ export type RouterAbNormalSigningServerPolicy = {
     mode: 'enabled';
     signingWorkerId: string;
 };
-export declare function parseRouterAbNormalSigningServerPolicy(config: Record<string, unknown>): RouterAbNormalSigningServerPolicy;
 export declare function validateRouterAbNormalSigningServerPolicy(args: {
     requested: RouterAbEd25519NormalSigningState | undefined;
     policy: RouterAbNormalSigningServerPolicy;

package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts

@@ -1,5 +1,4 @@
-import type { NormalizedLogger } from '../../logger';
-import type { ThresholdEd25519AuthorityScope, ThresholdEcdsaSigningRootMetadata, ThresholdStoreConfigInput } from '../../types';
+import type { ThresholdEd25519AuthorityScope, ThresholdEcdsaSigningRootMetadata } from '../../types';
 import { WALLET_SESSION_FAILURE_CODES, type WalletSessionFailureCode } from '../../../../../shared-ts/src/utils/walletSessionFailure';
 import type { EcdsaKeyHandle } from '../../keyMaterialBrands';
 export type Ed25519WalletSessionRecord = {
@@ -12,21 +11,21 @@ export type Ed25519WalletSessionRecord = {
     authorityScope: ThresholdEd25519AuthorityScope;
     participantIds: number[];
 } & Partial<ThresholdEcdsaSigningRootMetadata>;
-export type EcdsaWalletSessionRecordCore = {
+type EcdsaWalletSessionRecordCore = {
     expiresAtMs: number;
     relayerKeyId: string;
     walletId: string;
     keyHandle: EcdsaKeyHandle;
     participantIds: number[];
 };
-export type EcdsaWalletSessionRecord = EcdsaWalletSessionRecordCore & ({
+type EcdsaWalletSessionRecord = EcdsaWalletSessionRecordCore & ({
     signingRootId?: never;
     signingRootVersion?: never;
     walletKeyVersion?: never;
     derivationVersion?: never;
 } | ThresholdEcdsaSigningRootMetadata);
-export type WalletSessionRecord = Ed25519WalletSessionRecord | EcdsaWalletSessionRecord;
-export type WalletSessionConsumeUsesResult = {
+type WalletSessionRecord = Ed25519WalletSessionRecord | EcdsaWalletSessionRecord;
+type WalletSessionConsumeUsesResult = {
     ok: true;
     remainingUses: number;
 } | {
@@ -42,7 +41,7 @@ type WalletSessionConsumedUseResult = {
     code: string;
     message: string;
 };
-export type WalletSessionReplayGuardResult = {
+type WalletSessionReplayGuardResult = {
     ok: true;
 } | {
     ok: false;
@@ -54,7 +53,7 @@ export type WalletSessionStatus<TRecord extends WalletSessionRecord> = {
     expiresAtMs: number;
     remainingUses: number;
 };
-export type WalletSessionStatusLookupResult<TRecord extends WalletSessionRecord> = {
+type WalletSessionStatusLookupResult<TRecord extends WalletSessionRecord> = {
     ok: true;
     status: WalletSessionStatus<TRecord>;
 } | {
@@ -81,16 +80,5 @@ export interface WalletSessionStore<TRecord extends WalletSessionRecord> {
 }
 export type Ed25519WalletSessionStore = WalletSessionStore<Ed25519WalletSessionRecord>;
 export type EcdsaWalletSessionStore = WalletSessionStore<EcdsaWalletSessionRecord>;
-export type WalletSessionRecordParser<TRecord extends WalletSessionRecord> = (raw: unknown) => TRecord | null;
-export declare function createEd25519WalletSessionStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): Ed25519WalletSessionStore;
-export declare function createEcdsaWalletSessionStore(input: {
-    config?: ThresholdStoreConfigInput | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): EcdsaWalletSessionStore;
 export {};
 //# sourceMappingURL=WalletSessionStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts

@@ -1,41 +1,7 @@
 import { type WalletAuthAuthority } from '../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { EcdsaDerivationPublicIdentity, ThresholdEd25519AuthorityScope } from '../types';
-import type { ThresholdEcdsaMpcSessionRecord, ThresholdEd25519CoordinatorSigningSessionRecord, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord } from './stores/SessionStore';
-import type { EcdsaWalletSessionRecord, Ed25519WalletSessionRecord } from './stores/WalletSessionStore';
-export declare function toPrefixWithColon(prefix: unknown, defaultPrefix: string): string;
-export declare function toThresholdEd25519KeyPrefix(prefix: unknown): string;
-export declare function toThresholdEd25519SessionPrefix(prefix: unknown): string;
-export declare function toThresholdEd25519WalletSessionPrefix(prefix: unknown): string;
-export declare function toThresholdEd25519PrefixFromBase(basePrefix: unknown, kind: 'key' | 'sess' | 'wallet-session'): string;
-export declare function canonicalThresholdEd25519RelayerKeyId(relayerKeyId: unknown): string;
-export declare function toThresholdEcdsaSessionPrefix(prefix: unknown): string;
-export declare function toThresholdEcdsaWalletSessionPrefix(prefix: unknown): string;
-export declare function toThresholdEcdsaPrefixFromBase(basePrefix: unknown, kind: 'key' | 'sess' | 'wallet-session' | 'presign'): string;
-type ParsedThresholdEd25519RouterMaterial = {
-    signingShareB64u: string;
-    verifyingShareB64u: string;
-};
-type ParsedThresholdEd25519ReadyKeyRecord = {
-    kind: 'ready';
-    walletId: string;
-    nearAccountId: string;
-    nearEd25519SigningKeyId: string;
-    authorityScope: ThresholdEd25519AuthorityScope;
-    publicKey: string;
-    routerMaterial: ParsedThresholdEd25519RouterMaterial;
-    keyVersion: string;
-    recoveryExportCapable: true;
-};
-export declare function parseThresholdEd25519KeyRecord(raw: unknown): ParsedThresholdEd25519ReadyKeyRecord | null;
 export declare function parseEcdsaDerivationPublicIdentity(raw: unknown): EcdsaDerivationPublicIdentity | null;
 export declare function parseThresholdEd25519AuthorityScope(raw: unknown): ThresholdEd25519AuthorityScope | null;
 export declare function thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority: WalletAuthAuthority): ThresholdEd25519AuthorityScope;
 export declare function thresholdEd25519AuthorityScopesMatch(left: ThresholdEd25519AuthorityScope, right: ThresholdEd25519AuthorityScope): boolean;
-export declare function parseThresholdEd25519MpcSessionRecord(raw: unknown): ThresholdEd25519MpcSessionRecord | null;
-export declare function parseThresholdEcdsaMpcSessionRecord(raw: unknown): ThresholdEcdsaMpcSessionRecord | null;
-export declare function parseThresholdEd25519SigningSessionRecord(raw: unknown): ThresholdEd25519SigningSessionRecord | null;
-export declare function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ThresholdEd25519CoordinatorSigningSessionRecord | null;
-export declare function parseEd25519WalletSessionRecord(raw: unknown): Ed25519WalletSessionRecord | null;
-export declare function parseEcdsaWalletSessionRecord(raw: unknown): EcdsaWalletSessionRecord | null;
-export {};
 //# sourceMappingURL=validation.d.ts.map

package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts

@@ -1,7 +1,3 @@
-import type { WalletAuthMethodStore } from './d1WalletAuthMethodStore';
-import { type StoreFactoryInput } from './storeBackends';
-export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodV2Id, } from './d1WalletAuthMethodStore';
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodV2Id, } from './d1WalletAuthMethodStore';
 export type { D1WalletAuthMethodStoreOptions, D1WalletAuthMethodStoreSchemaOptions, WalletAuthMethodRecord, WalletAuthMethodRecordV2Owned, WalletAuthMethodStore, WalletAuthMethodV2Store, } from './d1WalletAuthMethodStore';
-export declare function resolveWalletAuthMethodStoreNamespace(config: Record<string, unknown>): string;
-export declare function createWalletAuthMethodStore(input: StoreFactoryInput): WalletAuthMethodStore;
 //# sourceMappingURL=WalletAuthMethodStore.d.ts.map

package/dist/types/wallet-server/src/core/WalletStore.d.ts

@@ -5,7 +5,6 @@ import { type RuntimePolicyScope } from '../../../shared-ts/src/threshold/signin
 import type { RouterAbEd25519YaoActivationResultV1, RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRecoveryAdmissionRequestV1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
 import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import { type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type StoreFactoryInput } from './storeBackends';
 export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, } from './d1WalletStore';
 export type { D1WalletStoreOptions, D1WalletStoreSchemaOptions } from './d1WalletStore';
 export type WalletRecord = {
@@ -128,11 +127,9 @@ export declare function ecdsaPostRegistrationRequestMatchesCapability(input: {
     request: WalletEcdsaPostRegistrationPublicRequest;
     capability: RouterAbEcdsaDerivationPublicCapabilityV1;
 }): boolean;
-export declare function resolveWalletStoreNamespace(config: Record<string, unknown>): string;
 export declare function parseWalletEcdsaSignerRecord(raw: unknown): WalletEcdsaSignerRecord | null;
 export declare function buildWalletEd25519SignerId(input: {
     nearAccountId: string;
     signerSlot: number;
 }): string;
-export declare function createWalletStore(input: StoreFactoryInput): WalletStore;
 //# sourceMappingURL=WalletStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts

@@ -1,6 +1,4 @@
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../shared-ts/src/utils/webauthnDeviceInfo';
-import type { StoreFactoryInput } from './storeBackends';
-import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
 export type WebAuthnAuthenticatorRecord = {
     version: 'webauthn_authenticator_v1';
     credentialIdB64u: string;
@@ -26,10 +24,6 @@ export interface WebAuthnAuthenticatorStore {
      */
     list?(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
 }
-export interface D1WebAuthnAuthenticatorStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnAuthenticatorStoreOptions extends D1TenantStoreOptions {
-}
 export type D1WebAuthnAuthenticatorRow = {
     readonly credential_id_b64u?: unknown;
     readonly credential_public_key_b64u?: unknown;
@@ -38,18 +32,4 @@ export type D1WebAuthnAuthenticatorRow = {
     readonly updated_at_ms?: unknown;
     readonly device_info_json?: unknown;
 };
-export declare const WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_authenticators (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      credential_public_key_b64u TEXT NOT NULL,\n      counter INTEGER NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      device_info_json TEXT NOT NULL DEFAULT '{}',\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, credential_id_b64u),\n      CHECK (length(user_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(credential_public_key_b64u) > 0),\n      CHECK (counter >= 0),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_authenticators_user_idx\n      ON webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
-export declare function ensureWebAuthnAuthenticatorStoreD1Schema(options: D1WebAuthnAuthenticatorStoreSchemaOptions): Promise<void>;
-export declare function resolveWebAuthnAuthenticatorStoreNamespace(config: Record<string, unknown>): string;
-export declare class D1WebAuthnAuthenticatorStore implements WebAuthnAuthenticatorStore {
-    readonly adapterKind = "d1";
-    private readonly table;
-    private readonly prepare;
-    constructor(input: D1WebAuthnAuthenticatorStoreOptions);
-    get(userId: string, credentialIdB64u: string): Promise<WebAuthnAuthenticatorRecord | null>;
-    put(userId: string, record: WebAuthnAuthenticatorRecord): Promise<void>;
-    del(userId: string, credentialIdB64u: string): Promise<void>;
-    list(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
-}
-export declare function createWebAuthnAuthenticatorStore(input: StoreFactoryInput): WebAuthnAuthenticatorStore;
 //# sourceMappingURL=WebAuthnAuthenticatorStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnCredentialBindingStore.d.ts

@@ -1,6 +1,5 @@
 import type { ThresholdRuntimePolicyScope } from './types';
-import type { StoreFactoryInput } from './storeBackends';
-import { type D1SchemaOptions, type D1TenantScope, type D1TenantStoreOptions } from './d1TenantStore';
+import { type D1TenantScope } from './d1TenantStore';
 import type { D1DatabaseLike, D1PreparedStatementLike } from '../storage/tenantRoute';
 /**
  * The Ed25519 facts on a credential binding are denormalized from the wallet's
@@ -57,10 +56,6 @@ export interface WebAuthnCredentialBindingStore {
         rpId?: string;
     }): Promise<WebAuthnCredentialBindingRecord[]>;
 }
-export interface D1WebAuthnCredentialBindingStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnCredentialBindingStoreOptions extends D1TenantStoreOptions {
-}
 type D1WebAuthnCredentialBindingWrite = {
     readonly database: D1DatabaseLike;
     readonly scope: D1TenantScope;
@@ -69,26 +64,5 @@ type D1WebAuthnCredentialBindingWrite = {
 export declare function prepareD1WebAuthnCredentialBindingPutStatement(input: D1WebAuthnCredentialBindingWrite): D1PreparedStatementLike;
 /** Insert-only binding write for credential promotion. */
 export declare function prepareD1WebAuthnCredentialBindingInsertStatement(input: D1WebAuthnCredentialBindingWrite): D1PreparedStatementLike;
-export declare const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_credential_bindings (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      rp_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      -- Nullable until the wallet's Ed25519 Yao ceremony settles.\n      signer_slot INTEGER,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u),\n      CHECK (length(rp_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(user_id) > 0),\n      CHECK (signer_slot IS NULL OR signer_slot >= 1),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_credential_bindings_user_idx\n      ON webauthn_credential_bindings (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        rp_id,\n        signer_slot\n      )\n  "];
-export declare function ensureWebAuthnCredentialBindingStoreD1Schema(options: D1WebAuthnCredentialBindingStoreSchemaOptions): Promise<void>;
-export declare function resolveWebAuthnCredentialBindingStoreNamespace(config: Record<string, unknown>): string;
-export declare class D1WebAuthnCredentialBindingStore implements WebAuthnCredentialBindingStore {
-    readonly adapterKind = "d1";
-    private readonly table;
-    private readonly prepare;
-    constructor(input: D1WebAuthnCredentialBindingStoreOptions);
-    get(rpId: string, credentialIdB64u: string): Promise<WebAuthnCredentialBindingRecord | null>;
-    put(record: WebAuthnCredentialBindingRecord): Promise<void>;
-    del(rpId: string, credentialIdB64u: string): Promise<void>;
-    getMaxSignerSlot(input: {
-        userId: string;
-        rpId?: string;
-    }): Promise<number | null>;
-    listByUserId(input: {
-        userId: string;
-        rpId?: string;
-    }): Promise<WebAuthnCredentialBindingRecord[]>;
-}
-export declare function createWebAuthnCredentialBindingStore(input: StoreFactoryInput): WebAuthnCredentialBindingStore;
 export {};
 //# sourceMappingURL=WebAuthnCredentialBindingStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnLoginChallengeStore.d.ts

@@ -1,25 +1,11 @@
-import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
-import type { StoreFactoryInput } from './storeBackends';
-import type { D1SchemaOptions } from './d1TenantStore';
+import type { WalletId } from '../../../shared-ts/src/utils/domainIds';
 export type WebAuthnLoginChallengeRecord = {
     version: 'webauthn_login_challenge_v1';
     challengeId: string;
-    userId: string;
+    userId: WalletId;
     rpId: string;
     challengeB64u: string;
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnLoginChallengeStore extends WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
-}
-export interface D1WebAuthnLoginChallengeStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnLoginChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
-}
-export declare const WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare const ensureWebAuthnLoginChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
-export declare class D1WebAuthnLoginChallengeStore extends D1WebAuthnChallengeStore<WebAuthnLoginChallengeRecord> {
-    constructor(input: D1WebAuthnLoginChallengeStoreOptions);
-}
-export declare function createWebAuthnLoginChallengeStore(input: StoreFactoryInput): WebAuthnLoginChallengeStore;
 //# sourceMappingURL=WebAuthnLoginChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnSyncChallengeStore.d.ts

@@ -1,6 +1,3 @@
-import { D1WebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema, type D1WebAuthnChallengeStoreOptions, type WebAuthnChallengeStore } from './webAuthnStoreBackends';
-import type { StoreFactoryInput } from './storeBackends';
-import type { D1SchemaOptions } from './d1TenantStore';
 export type WebAuthnSyncChallengeRecord = {
     version: 'webauthn_sync_challenge_v1';
     challengeId: string;
@@ -10,16 +7,27 @@ export type WebAuthnSyncChallengeRecord = {
     createdAtMs: number;
     expiresAtMs: number;
 };
-export interface WebAuthnSyncChallengeStore extends WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
-}
-export interface D1WebAuthnSyncChallengeStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1WebAuthnSyncChallengeStoreOptions extends D1WebAuthnChallengeStoreOptions {
-}
-export declare const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_challenges (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      challenge_id TEXT NOT NULL,\n      challenge_kind TEXT NOT NULL,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      expires_at_ms INTEGER NOT NULL,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),\n      CHECK (length(challenge_id) > 0),\n      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (expires_at_ms > created_at_ms)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx\n      ON webauthn_challenges (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        challenge_kind,\n        expires_at_ms\n      )\n  "];
-export declare const ensureWebAuthnSyncChallengeStoreD1Schema: typeof ensureWebAuthnChallengeStoreD1Schema;
-export declare class D1WebAuthnSyncChallengeStore extends D1WebAuthnChallengeStore<WebAuthnSyncChallengeRecord> {
-    constructor(input: D1WebAuthnSyncChallengeStoreOptions);
+export type SyncChallengeFailure = {
+    readonly ok: false;
+    readonly code: 'wallet_home_conflict' | 'wallet_home_unavailable';
+    readonly message: string;
+    readonly record?: never;
+};
+export interface WebAuthnSyncChallengeStore {
+    create(record: WebAuthnSyncChallengeRecord): Promise<{
+        readonly ok: true;
+        readonly code?: never;
+        readonly message?: never;
+        readonly record?: never;
+    } | SyncChallengeFailure>;
+    consume(input: {
+        readonly challengeId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<{
+        readonly ok: true;
+        readonly record: WebAuthnSyncChallengeRecord | null;
+        readonly code?: never;
+        readonly message?: never;
+    } | SyncChallengeFailure>;
 }
-export declare function createWebAuthnSyncChallengeStore(input: StoreFactoryInput): WebAuthnSyncChallengeStore;
 //# sourceMappingURL=WebAuthnSyncChallengeStore.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpConfig.d.ts

@@ -1,27 +1,3 @@
-import type { AuthServiceConfigSource } from './configValues';
-export type EmailOtpDeliveryMode = 'email_provider' | 'log' | 'memory';
 export declare const EMAIL_OTP_CODE_LENGTH: 6;
-export type EmailOtpConfig = {
-    deliveryMode: EmailOtpDeliveryMode;
-    challengeTtlMs: number;
-    grantTtlMs: number;
-    maxAttempts: number;
-    lockoutTtlMs: number;
-    codeLength: typeof EMAIL_OTP_CODE_LENGTH;
-    devOutboxEnabled: boolean;
-    maxActiveChallengesPerContext: number;
-};
-type AuthRateLimitPolicy = {
-    limit: number;
-    windowMs: number;
-};
 export type EmailOtpRateLimitScope = 'challenge' | 'verify' | 'grant' | 'googleRegistrationAttempt';
-export type EmailOtpRateLimitPolicies = Record<EmailOtpRateLimitScope, AuthRateLimitPolicy>;
-type EmailOtpConfigInput = {
-    thresholdStore: AuthServiceConfigSource;
-    production: boolean;
-};
-export declare function resolveEmailOtpRateLimitPolicies(input: EmailOtpConfigInput): EmailOtpRateLimitPolicies;
-export declare function resolveEmailOtpConfig(input: EmailOtpConfigInput): EmailOtpConfig;
-export {};
 //# sourceMappingURL=emailOtpConfig.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpEnrollment.d.ts

@@ -1,12 +1,4 @@
-import type { EmailOtpAuthStateRecord, EmailOtpAuthStateStore, EmailOtpWalletEnrollmentRecord, EmailOtpWalletEnrollmentStore } from '../EmailOtpStores';
-export type EmailOtpEnrollmentReadResult = {
-    ok: true;
-    enrollment: EmailOtpWalletEnrollmentRecord;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
+import type { EmailOtpAuthStateRecord } from '../EmailOtpStores';
 export type EmailOtpAuthStateReadResult = {
     ok: true;
     state: EmailOtpAuthStateRecord | null;
@@ -15,65 +7,4 @@ export type EmailOtpAuthStateReadResult = {
     code: string;
     message: string;
 };
-export type EmailOtpAuthStatePatch = Partial<Pick<EmailOtpAuthStateRecord, 'otpFailureCount' | 'lastOtpFailureAtMs' | 'otpLockedUntilMs' | 'lastEmailOtpLoginAtMs' | 'lastStrongAuthAtMs'>>;
-export type EmailOtpStrongAuthRequiredResult = {
-    ok: true;
-    required: boolean;
-    walletId: string;
-    lastEmailOtpLoginAtMs?: number;
-    lastStrongAuthAtMs?: number;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export type EmailOtpStrongAuthSatisfiedResult = {
-    ok: true;
-    walletId: string;
-    lastStrongAuthAtMs?: number;
-} | {
-    ok: false;
-    code: string;
-    message: string;
-};
-export declare function readEmailOtpEnrollmentWithStore(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly request: {
-        walletId?: unknown;
-        orgId: unknown;
-    };
-}): Promise<EmailOtpEnrollmentReadResult>;
-export declare function readActiveEmailOtpEnrollmentWithStore(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly request: {
-        walletId?: unknown;
-        orgId: unknown;
-        providerUserId?: unknown;
-    };
-}): Promise<EmailOtpEnrollmentReadResult>;
-export declare function readEmailOtpAuthStateForEnrollmentWithStore(input: {
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly enrollment: EmailOtpWalletEnrollmentRecord;
-}): Promise<EmailOtpAuthStateReadResult>;
-export declare function putEmailOtpAuthStateForEnrollmentWithStore(input: {
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly enrollment: EmailOtpWalletEnrollmentRecord;
-    readonly patch: EmailOtpAuthStatePatch;
-    readonly nowMs: number;
-}): Promise<EmailOtpAuthStateRecord>;
-export declare function isEmailOtpStrongAuthRequiredWithStores(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly request: {
-        walletId?: unknown;
-    };
-}): Promise<EmailOtpStrongAuthRequiredResult>;
-export declare function markEmailOtpStrongAuthSatisfiedWithStores(input: {
-    readonly walletEnrollmentStore: EmailOtpWalletEnrollmentStore;
-    readonly authStateStore: EmailOtpAuthStateStore;
-    readonly request: {
-        walletId?: unknown;
-    };
-    readonly nowMs: number;
-}): Promise<EmailOtpStrongAuthSatisfiedResult>;
 //# sourceMappingURL=emailOtpEnrollment.d.ts.map

package/dist/types/wallet-server/src/core/authService/emailOtpSeal.d.ts

@@ -1,9 +1,4 @@
 import type { SigningSessionSealCipherAdapter } from '../../threshold/session/signingSessionSeal/signingSessionSeal.types';
-type EmailOtpShamirCipherConfig = {
-    readonly rootSecretB64u: string;
-    readonly currentKeyVersion: string;
-    readonly acceptedWarmKeyVersions: readonly string[];
-};
 export type EmailOtpShamirCipherResult = {
     readonly ok: true;
     readonly keyVersion: string;
@@ -13,7 +8,6 @@ export type EmailOtpShamirCipherResult = {
     readonly code: 'not_configured';
     readonly message: string;
 };
-export type EmailOtpServerSealOperation = 'apply-server-seal' | 'remove-server-seal';
 export type EmailOtpServerSealRequest = {
     readonly wrappedCiphertext?: unknown;
 };
@@ -26,11 +20,4 @@ export type EmailOtpServerSealResult = {
     code: string;
     message: string;
 };
-export declare function createEmailOtpShamirCipherFromConfig(input: EmailOtpShamirCipherConfig): EmailOtpShamirCipherResult;
-export declare function runEmailOtpServerSealOperation(input: {
-    readonly operation: EmailOtpServerSealOperation;
-    readonly request: EmailOtpServerSealRequest;
-    readonly shamir: EmailOtpShamirCipherResult;
-}): Promise<EmailOtpServerSealResult>;
-export {};
 //# sourceMappingURL=emailOtpSeal.d.ts.map

package/dist/types/wallet-server/src/core/authService/githubOAuth.d.ts

@@ -7,7 +7,7 @@ export type GithubOAuthPublicConfig = {
     clientId: string;
     callbackUrl: string;
 };
-export type GithubOAuthCodeFacadeResult = {
+type GithubOAuthCodeFacadeResult = {
     ok: true;
     verified: true;
     userId: string;
@@ -32,4 +32,5 @@ export declare function verifyGithubOAuthCodeWithIdentityStore(input: {
     identityStore: IdentityStore;
     fetchImpl?: typeof fetch;
 }): Promise<GithubOAuthCodeFacadeResult>;
+export {};
 //# sourceMappingURL=githubOAuth.d.ts.map

package/dist/types/wallet-server/src/core/authService/nearTransactions.d.ts

@@ -1,31 +1,5 @@
-import type { AccessKeyList, FinalExecutionOutcome } from '@near-js/types';
 import type { NearTransactionActionArgsWasm } from '../../../../shared-ts/src/near/actions';
-import { MinimalNearClient, SignedTransaction } from '../rpcClients/near/NearClient';
-import type { NormalizedLogger } from '../logger';
-type NearTxContext = {
-    nextNonce: string;
-    blockHash: string;
-};
-export type AccountAccessKeyVisibilityOptions = {
-    attempts?: number;
-    delayMs?: number;
-    finality?: 'optimistic' | 'final';
-};
-export declare function viewAccessKeyListWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-}): Promise<AccessKeyList>;
-export declare function dispatchNearSignedTransactionBorshWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly signedTransactionBorshB64u: string;
-}): Promise<{
-    rpcResult: FinalExecutionOutcome;
-}>;
-export declare function fetchNearTxContextWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-    readonly publicKey: string;
-}): Promise<NearTxContext>;
+import { SignedTransaction } from '../rpcClients/near/NearClient';
 export declare function signGasRelayerNearTransactionWithDeps(input: {
     readonly ensureSignerWasm: () => Promise<void>;
     readonly relayerAccount: string;
@@ -35,16 +9,4 @@ export declare function signGasRelayerNearTransactionWithDeps(input: {
     readonly blockHash: string;
     readonly actions: readonly NearTransactionActionArgsWasm[];
 }): Promise<SignedTransaction>;
-export declare function checkNearAccountExistsWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly logger: NormalizedLogger;
-    readonly accountId: string;
-}): Promise<boolean>;
-export declare function verifyAccountAccessKeysPresentWithClient(input: {
-    readonly nearClient: MinimalNearClient;
-    readonly accountId: string;
-    readonly expectedPublicKeys: readonly string[];
-    readonly options?: AccountAccessKeyVisibilityOptions;
-}): Promise<boolean>;
-export {};
 //# sourceMappingURL=nearTransactions.d.ts.map

package/dist/types/wallet-server/src/core/authService/rateLimits.d.ts

@@ -1,6 +1,3 @@
-import { type SigningSessionSealRateLimiter } from '../../threshold/session/signingSessionSeal';
-import type { AuthServiceConfigSource } from './configValues';
-import type { EmailOtpRateLimitPolicies, EmailOtpRateLimitScope } from './emailOtpConfig';
 export type RateLimitResult = {
     ok: true;
 } | {
@@ -10,18 +7,4 @@ export type RateLimitResult = {
     retryAfterMs?: number;
     resetAtMs?: number;
 };
-export declare function createEmailOtpRateLimiter(input: {
-    thresholdStore: AuthServiceConfigSource;
-}): SigningSessionSealRateLimiter;
-export declare function consumeEmailOtpRateLimit(input: {
-    limiter: SigningSessionSealRateLimiter;
-    policies: EmailOtpRateLimitPolicies;
-    scope: EmailOtpRateLimitScope;
-    action?: string;
-    userId?: string;
-    walletId?: string;
-    providerSubject?: string;
-    orgId?: string;
-    clientIp?: string;
-}): Promise<RateLimitResult>;
 //# sourceMappingURL=rateLimits.d.ts.map