@seams/wallet-server 0.5.0

package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.d.ts

@@ -0,0 +1,62 @@
+import type { MpcMaterialActivationRef, MpcMaterialActivationId, WalletId } from '../utils/domainIds';
+import { type LaneEnrollmentId, type LaneOperationId, type LaneShareEpoch, type SigningLaneId, type WalletKeyId } from './ids';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import { type Secp256k1CompressedPublicKeyB64u } from '../passkey-custody/primitives';
+import { type LaneHolderParticipantId, type HpkePublicKeyB64u, type LaneParticipantBindingDigestB64u, type SigningWorkerParticipantId, type SigningWorkerRecipientKeyDigestB64u, type SigningWorkerRecipientKeyId } from './participants';
+import type { EcdsaTargetCapabilityBindingV1 } from './rotation';
+type LinkedEcdsaScopeOwnerFieldsForbiddenV1 = {
+    readonly signingRootId?: never;
+    readonly signingRootVersion?: never;
+    readonly context?: never;
+    readonly publicIdentity?: never;
+    readonly signingWorker?: never;
+    readonly activationEpoch?: never;
+    readonly keyHandle?: never;
+    readonly relayerKeyId?: never;
+    readonly participantIds?: never;
+    readonly runtimePolicyScope?: never;
+    readonly authorization?: never;
+};
+/**
+ * Trusted public identity for a linked ECDSA lane.
+ *
+ * The scope intentionally models the activated lane rather than the owner
+ * derivation root. Root metadata and owner public-identity bags are forbidden
+ * at the type level and rejected by the exact parser at runtime.
+ */
+export type LinkedDeviceEcdsaNormalSigningScopeV1 = LinkedEcdsaScopeOwnerFieldsForbiddenV1 & {
+    readonly kind: 'linked_device_ecdsa_normal_signing_scope_v1';
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly laneKind: 'linked_device';
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly enrollmentId: LaneEnrollmentId;
+    readonly operationId: LaneOperationId;
+    readonly laneId: SigningLaneId;
+    readonly laneShareEpoch: LaneShareEpoch;
+    readonly revocationEpoch: number;
+    readonly targetMaterialActivationId: MpcMaterialActivationId;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly targetCapability: EcdsaTargetCapabilityBindingV1;
+    readonly thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly evmAddress: string;
+    readonly publicIdentityDigestB64u: DigestB64u;
+    readonly targetHolderPublicCommitmentB64u: Secp256k1CompressedPublicKeyB64u;
+    readonly targetServerPublicCommitmentB64u: Secp256k1CompressedPublicKeyB64u;
+    readonly holderParticipantId: LaneHolderParticipantId;
+    readonly signingWorkerParticipantId: SigningWorkerParticipantId;
+    readonly holderParticipantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+    readonly signingWorkerParticipantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+    readonly holderRecipientKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
+    readonly serverRecipientKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
+    readonly signingWorkerRecipientKeyId: SigningWorkerRecipientKeyId;
+    readonly signingWorkerHpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly transcriptHashB64u: DigestB64u;
+    readonly protocolCommitReceiptDigestB64u: DigestB64u;
+};
+export type LinkedDeviceEcdsaNormalSigningScopeInputV1 = Omit<LinkedDeviceEcdsaNormalSigningScopeV1, 'kind' | 'keyFamily' | 'laneKind'>;
+export declare function buildLinkedDeviceEcdsaNormalSigningScopeV1(input: LinkedDeviceEcdsaNormalSigningScopeInputV1): LinkedDeviceEcdsaNormalSigningScopeV1;
+export declare function validateLinkedDeviceEcdsaNormalSigningScopeV1(scope: LinkedDeviceEcdsaNormalSigningScopeV1): void;
+export declare function parseLinkedDeviceEcdsaNormalSigningScopeV1(value: unknown, label?: string): LinkedDeviceEcdsaNormalSigningScopeV1;
+export {};
+//# sourceMappingURL=linkedEcdsaScope.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/linkedEcdsaScope.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=linkedEcdsaScope.typecheck.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts

@@ -0,0 +1,30 @@
+import type { MpcSigningWorkerRef } from '../utils/domainIds';
+import type { DigestB64u } from '../utils/canonicalPrimitives';
+import { type LaneParticipantBindingDigestB64u } from './participants';
+/** The durable signer identity used by canonical wallet-signer records. */
+export type WalletSignerId = string & {
+    readonly __ownerLaneWalletSignerIdBrand: 'WalletSignerId';
+};
+/** Owner lanes bind to signer facts that predate independently provisioned R102 lanes. */
+export type OwnerLaneParticipantContinuityV1 = {
+    readonly kind: 'owner_lane_participant_continuity_v1';
+    readonly signerId: WalletSignerId;
+    readonly participantIds: readonly [number, number];
+    readonly signingWorkerId: MpcSigningWorkerRef;
+    readonly custodyKeyManifestDigestB64u: DigestB64u;
+    readonly sourceIdentityDigestB64u: DigestB64u;
+};
+export declare const OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/owner-lane-participant-continuity/v1";
+/** Parse the owner signer identity without widening it into a generic string. */
+export declare function parseWalletSignerId(raw: unknown, label?: string): WalletSignerId;
+export declare function buildOwnerLaneParticipantContinuityV1(args: {
+    readonly signerId: WalletSignerId;
+    readonly participantIds: readonly [number, number];
+    readonly signingWorkerId: MpcSigningWorkerRef;
+    readonly custodyKeyManifestDigestB64u: DigestB64u;
+    readonly sourceIdentityDigestB64u: DigestB64u;
+}): OwnerLaneParticipantContinuityV1;
+export declare function parseOwnerLaneParticipantContinuityV1(raw: unknown, label?: string): OwnerLaneParticipantContinuityV1;
+export declare function ownerLaneParticipantContinuityCanonicalBytesV1(input: OwnerLaneParticipantContinuityV1): Uint8Array;
+export declare function computeOwnerLaneParticipantBindingDigestV1(input: OwnerLaneParticipantContinuityV1): Promise<LaneParticipantBindingDigestB64u>;
+//# sourceMappingURL=ownerContinuity.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ownerContinuity.typecheck.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts

@@ -0,0 +1,48 @@
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import { type HpkePublicKeyB64u, type LaneHolderCustodyIdentityV1, type LaneHolderParticipantId, type LaneHolderParticipantRecordV1, type LaneParticipantBindingDigestB64u, type SigningWorkerParticipantId, type SigningWorkerParticipantRecordV1, type SigningWorkerRecipientIdentityV1, type SigningWorkerRecipientKeyDigestB64u } from './participants';
+/** Domain tags are part of the wire contract and must never be shortened. */
+export declare const LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/lane-holder-participant/v1";
+export declare const SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/signing-worker-participant/v1";
+/** The lane digest binds the fixed holder-then-SigningWorker participant set. */
+export declare const LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/lane-participant-set/v1";
+export type LaneHolderParticipantBindingInputV1 = {
+    readonly participantId: LaneHolderParticipantId;
+    readonly custody: LaneHolderCustodyIdentityV1;
+    readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly hpkePublicKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
+};
+export type SigningWorkerParticipantBindingInputV1 = {
+    readonly participantId: SigningWorkerParticipantId;
+    readonly recipient: SigningWorkerRecipientIdentityV1;
+};
+/** LP32(UTF8(value)) from the Refactor 102 canonical encoding. */
+export declare function encodeLaneCanonicalTextV1(value: string): Uint8Array;
+/** LP32(BASE64URL_DECODE_CANONICAL_32(value)) from the Refactor 102 encoding. */
+export declare function encodeLaneCanonicalDigestV1(value: DigestB64u): Uint8Array;
+/** U64(value), encoded as unsigned big-endian bytes. */
+export declare function encodeLaneCanonicalU64V1(value: number): Uint8Array;
+/** Nonempty array count encoding used by enrollment and receipt records. */
+export declare function encodeLaneCanonicalNonEmptyCountV1(count: number): Uint8Array;
+export declare function laneHolderParticipantCanonicalBytesV1(input: LaneHolderParticipantRecordV1): Uint8Array;
+export declare function signingWorkerParticipantCanonicalBytesV1(input: SigningWorkerParticipantRecordV1): Uint8Array;
+/**
+ * Canonical bytes for the lane's complete participant set. The order is part
+ * of the protocol: holder first, SigningWorker second. Individual participant
+ * binding digests are included after their canonical identity bytes so a
+ * verified record cannot be substituted while retaining the same identities.
+ */
+export declare function laneParticipantSetCanonicalBytesV1(input: {
+    readonly holderParticipant: LaneHolderParticipantRecordV1;
+    readonly signingWorkerParticipant: SigningWorkerParticipantRecordV1;
+}): Uint8Array;
+export declare function computeLaneHolderParticipantBindingDigestV1(input: LaneHolderParticipantBindingInputV1): Promise<LaneParticipantBindingDigestB64u>;
+export declare function computeSigningWorkerParticipantBindingDigestV1(input: SigningWorkerParticipantBindingInputV1): Promise<LaneParticipantBindingDigestB64u>;
+export declare function computeLaneParticipantSetBindingDigestV1(input: {
+    readonly holderParticipant: LaneHolderParticipantRecordV1;
+    readonly signingWorkerParticipant: SigningWorkerParticipantRecordV1;
+}): Promise<LaneParticipantBindingDigestB64u>;
+export declare function buildLaneHolderParticipantRecordWithDigestV1(input: LaneHolderParticipantBindingInputV1): Promise<LaneHolderParticipantRecordV1>;
+export declare function buildSigningWorkerParticipantRecordWithDigestV1(input: SigningWorkerParticipantBindingInputV1): Promise<SigningWorkerParticipantRecordV1>;
+export declare function assertLaneHolderParticipantBindingDigestV1(record: LaneHolderParticipantRecordV1): Promise<LaneHolderParticipantRecordV1>;
+export declare function assertSigningWorkerParticipantBindingDigestV1(record: SigningWorkerParticipantRecordV1): Promise<SigningWorkerParticipantRecordV1>;
+//# sourceMappingURL=participantDigest.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/participantDigest.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=participantDigest.typecheck.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/participants.d.ts

@@ -0,0 +1,89 @@
+import type { DomainId, DomainIdParseResult } from '../utils/domainIds';
+import type { DigestB64u } from '../utils/canonicalPrimitives';
+/** The durable participant identity that owns a lane's holder share. */
+export type LaneHolderParticipantId = DomainId<'LaneHolderParticipantId'>;
+/** The durable SigningWorker participant that owns a lane's server share. */
+export type SigningWorkerParticipantId = DomainId<'SigningWorkerParticipantId'>;
+/** The recipient-key identity used to deliver material to one SigningWorker. */
+export type SigningWorkerRecipientKeyId = DomainId<'SigningWorkerRecipientKeyId'>;
+/** The custody identity to which a holder package is sealed. */
+export type LaneHolderCustodyBindingId = DomainId<'LaneHolderCustodyBindingId'>;
+/** HPKE public keys are opaque suite-specific bytes carried as canonical base64url. */
+export type HpkePublicKeyB64u = string & {
+    readonly __signingLaneHpkePublicKeyB64uBrand: 'SigningLaneHpkePublicKeyB64u';
+};
+export type LaneParticipantBindingDigestB64u = DigestB64u & {
+    readonly __laneParticipantBindingDigestB64uBrand: 'LaneParticipantBindingDigestB64u';
+};
+export type LaneCustodyBindingDigestB64u = DigestB64u & {
+    readonly __laneCustodyBindingDigestB64uBrand: 'LaneCustodyBindingDigestB64u';
+};
+export type HpkePublicKeyDigestB64u = DigestB64u & {
+    readonly __hpkePublicKeyDigestB64uBrand: 'HpkePublicKeyDigestB64u';
+};
+/** Alias retained for callers that need the worker-recipient-specific name. */
+export type SigningWorkerRecipientKeyDigestB64u = HpkePublicKeyDigestB64u;
+export type LaneHolderCustodyIdentityV1 = {
+    readonly kind: 'lane_holder_custody_identity_v1';
+    readonly custodyBindingId: LaneHolderCustodyBindingId;
+    readonly custodyBindingDigestB64u: LaneCustodyBindingDigestB64u;
+};
+export type SigningWorkerRecipientIdentityV1 = {
+    readonly kind: 'signing_worker_recipient_identity_v1';
+    readonly recipientKeyId: SigningWorkerRecipientKeyId;
+    readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly hpkePublicKeyDigestB64u: HpkePublicKeyDigestB64u;
+};
+/** Complete holder-side participant binding persisted beside a lane. */
+export type LaneHolderParticipantRecordV1 = {
+    readonly kind: 'lane_holder_participant_v1';
+    readonly participantId: LaneHolderParticipantId;
+    readonly custodyBindingId: LaneHolderCustodyBindingId;
+    readonly custodyBindingDigestB64u: LaneCustodyBindingDigestB64u;
+    readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly hpkePublicKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
+    readonly participantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+};
+/** Complete SigningWorker-side participant and recipient binding. */
+export type SigningWorkerParticipantRecordV1 = {
+    readonly kind: 'signing_worker_participant_v1';
+    readonly participantId: SigningWorkerParticipantId;
+    readonly recipientKeyId: SigningWorkerRecipientKeyId;
+    readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly hpkePublicKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
+    readonly participantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+};
+export declare function parseLaneHolderParticipantId(raw: unknown): DomainIdParseResult<LaneHolderParticipantId>;
+export declare function parseSigningWorkerParticipantId(raw: unknown): DomainIdParseResult<SigningWorkerParticipantId>;
+export declare function parseSigningWorkerRecipientKeyId(raw: unknown): DomainIdParseResult<SigningWorkerRecipientKeyId>;
+export declare function parseLaneHolderCustodyBindingId(raw: unknown): DomainIdParseResult<LaneHolderCustodyBindingId>;
+export declare function parseHpkePublicKeyB64u(raw: unknown): DomainIdParseResult<HpkePublicKeyB64u>;
+export declare function parseLaneParticipantBindingDigestB64u(raw: unknown): DomainIdParseResult<LaneParticipantBindingDigestB64u>;
+export declare function parseLaneCustodyBindingDigestB64u(raw: unknown): DomainIdParseResult<LaneCustodyBindingDigestB64u>;
+export declare function parseSigningWorkerRecipientKeyDigestB64u(raw: unknown): DomainIdParseResult<SigningWorkerRecipientKeyDigestB64u>;
+export declare function buildLaneHolderCustodyIdentityV1(args: {
+    readonly custodyBindingId: LaneHolderCustodyBindingId;
+    readonly custodyBindingDigestB64u: LaneCustodyBindingDigestB64u;
+}): LaneHolderCustodyIdentityV1;
+export declare function buildSigningWorkerRecipientIdentityV1(args: {
+    readonly recipientKeyId: SigningWorkerRecipientKeyId;
+    readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly hpkePublicKeyDigestB64u: HpkePublicKeyDigestB64u;
+}): SigningWorkerRecipientIdentityV1;
+export declare function parseLaneHolderCustodyIdentityV1(raw: unknown, label?: string): LaneHolderCustodyIdentityV1;
+export declare function parseSigningWorkerRecipientIdentityV1(raw: unknown, label?: string): SigningWorkerRecipientIdentityV1;
+export declare function buildLaneHolderParticipantRecordV1(args: {
+    readonly participantId: LaneHolderParticipantId;
+    readonly custody: LaneHolderCustodyIdentityV1;
+    readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
+    readonly hpkePublicKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
+    readonly participantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+}): LaneHolderParticipantRecordV1;
+export declare function buildSigningWorkerParticipantRecordV1(args: {
+    readonly participantId: SigningWorkerParticipantId;
+    readonly recipient: SigningWorkerRecipientIdentityV1;
+    readonly participantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+}): SigningWorkerParticipantRecordV1;
+export declare function parseLaneHolderParticipantRecordV1(raw: unknown, label?: string): LaneHolderParticipantRecordV1;
+export declare function parseSigningWorkerParticipantRecordV1(raw: unknown, label?: string): SigningWorkerParticipantRecordV1;
+//# sourceMappingURL=participants.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/recordParsers.d.ts

@@ -0,0 +1,128 @@
+import type { MpcMaterialActivationRef, WalletId } from '../utils/domainIds';
+import { type EvmFamilySigningKeySlotId } from './evmFamilySigningKeySlotId';
+import { type LaneHolderParticipantRecordV1, type LaneParticipantBindingDigestB64u, type SigningWorkerParticipantRecordV1 } from './participants';
+import { type LaneShareEpoch, type LinkedDeviceId, type SigningLaneId, type WalletKeyId } from './ids';
+import type { ActiveSigningLaneReference, AgentCustodyBindingId, AgentIdentityKeyId, BreakGlassSigningLaneRecord, DelegatedExecutionSigningLaneRecord, DelegatedSpendAuthorizationId, Ed25519WalletKeyRecord, EvmFamilyWalletKeyRecord, LinkedDeviceSigningLaneRecord, OwnerEmailOtpSigningLaneRecord, OwnerPasskeySigningLaneRecord, RecoverySigningLaneRecord, SigningLaneKind, SigningLaneLifecycle, SigningLaneRecord, SigningLaneReference, WalletKeyLifecycle, WalletKeyRecord, WalletKeyVersion } from './records';
+import { type OwnerLaneParticipantContinuityV1 } from './ownerContinuity';
+type ActiveSigningLaneLifecycle = Extract<SigningLaneLifecycle, {
+    readonly state: 'active';
+}>;
+export type WalletKeyReferenceBuilderArgs = {
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly walletKeyVersion: WalletKeyVersion;
+    readonly lifecycle: WalletKeyLifecycle;
+};
+export type SigningLaneReferenceBuilderArgs = {
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly laneId: SigningLaneId;
+    readonly laneShareEpoch: LaneShareEpoch;
+    readonly participantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+};
+type SigningLaneRecordBuilderCommonArgs = SigningLaneReferenceBuilderArgs & {
+    readonly lifecycle: SigningLaneLifecycle;
+};
+export type RotatableSigningLaneRecordBuilderArgs = SigningLaneRecordBuilderCommonArgs & {
+    readonly holderParticipant: LaneHolderParticipantRecordV1;
+    readonly serverParticipant: SigningWorkerParticipantRecordV1;
+};
+export type OwnerAuthSigningLaneRecordBuilderArgs = SigningLaneRecordBuilderCommonArgs & {
+    readonly walletAuthMethodId: NonNullable<OwnerPasskeySigningLaneRecord['walletAuthMethodId']>;
+    readonly ownerParticipantContinuity: OwnerLaneParticipantContinuityV1;
+};
+export type PrivilegedOwnerSigningLaneRecordBuilderArgs = SigningLaneRecordBuilderCommonArgs & {
+    readonly ownerParticipantContinuity: OwnerLaneParticipantContinuityV1;
+};
+export type ActiveSigningLaneReferenceBuilderArgs = SigningLaneReferenceBuilderArgs & {
+    readonly lifecycle: ActiveSigningLaneLifecycle;
+    readonly materialActivation: MpcMaterialActivationRef;
+};
+export declare function parseWalletKeyVersion(raw: unknown, label?: string): WalletKeyVersion;
+export declare function buildActiveWalletKeyLifecycle(args: {
+    readonly activatedAtMs: number;
+}): Extract<WalletKeyLifecycle, {
+    readonly state: 'active';
+}>;
+export declare function buildRetiredWalletKeyLifecycle(args: {
+    readonly retiredAtMs: number;
+}): Extract<WalletKeyLifecycle, {
+    readonly state: 'retired';
+}>;
+export declare function buildCompromisedWalletKeyLifecycle(args: {
+    readonly compromisedAtMs: number;
+}): Extract<WalletKeyLifecycle, {
+    readonly state: 'compromised';
+}>;
+export declare function buildEd25519WalletKeyRecord(args: {
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly walletKeyVersion: WalletKeyVersion;
+    readonly nearEd25519SigningKeyId: Ed25519WalletKeyRecord['nearEd25519SigningKeyId'];
+    readonly keyCreationSignerSlot: Ed25519WalletKeyRecord['keyCreationSignerSlot'];
+    readonly registeredPublicKeyB64u: Ed25519WalletKeyRecord['registeredPublicKeyB64u'];
+    readonly lifecycle: WalletKeyLifecycle;
+}): Ed25519WalletKeyRecord;
+export declare function buildEvmFamilyWalletKeyRecord(args: {
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly walletKeyVersion: WalletKeyVersion;
+    readonly evmFamilySigningKeySlotId: EvmFamilySigningKeySlotId;
+    readonly thresholdPublicKey33B64u: EvmFamilyWalletKeyRecord['thresholdPublicKey33B64u'];
+    readonly evmAddress: string;
+    readonly lifecycle: WalletKeyLifecycle;
+}): EvmFamilyWalletKeyRecord;
+export declare function buildSigningLaneReference(args: SigningLaneReferenceBuilderArgs & {
+    readonly laneKind: SigningLaneKind;
+}): SigningLaneReference;
+export declare function buildProvisioningSigningLaneLifecycle(args: {
+    readonly revocationEpoch: number;
+    readonly startedAtMs: number;
+}): Extract<SigningLaneLifecycle, {
+    readonly state: 'provisioning';
+}>;
+export declare function buildPendingReceiptSigningLaneLifecycle(args: {
+    readonly revocationEpoch: number;
+    readonly startedAtMs: number;
+    readonly deliveryDigestB64u: string;
+}): Extract<SigningLaneLifecycle, {
+    readonly state: 'pending_receipt';
+}>;
+export declare function buildActiveSigningLaneLifecycle(args: {
+    readonly revocationEpoch: number;
+    readonly activatedAtMs: number;
+    readonly activationReceiptDigestB64u: string;
+}): ActiveSigningLaneLifecycle;
+export declare function buildRevokedSigningLaneLifecycle(args: {
+    readonly revocationEpoch: number;
+    readonly revokedAtMs: number;
+    readonly revokeReason: Extract<SigningLaneLifecycle, {
+        readonly state: 'revoked';
+    }>['revokeReason'];
+}): Extract<SigningLaneLifecycle, {
+    readonly state: 'revoked';
+}>;
+export declare function buildOwnerPasskeySigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerPasskeySigningLaneRecord;
+export declare function buildOwnerEmailOtpSigningLaneRecord(args: OwnerAuthSigningLaneRecordBuilderArgs): OwnerEmailOtpSigningLaneRecord;
+export declare function buildLinkedDeviceSigningLaneRecord(args: RotatableSigningLaneRecordBuilderArgs & {
+    readonly linkedDeviceId: LinkedDeviceId;
+}): LinkedDeviceSigningLaneRecord;
+export declare function buildDelegatedExecutionSigningLaneRecord(args: RotatableSigningLaneRecordBuilderArgs & {
+    readonly authorizationId: DelegatedSpendAuthorizationId;
+    readonly agentIdentityKeyId: AgentIdentityKeyId;
+    readonly custodyBindingId: AgentCustodyBindingId;
+    readonly authorizationBindingDigestB64u: string;
+}): DelegatedExecutionSigningLaneRecord;
+export declare function buildRecoverySigningLaneRecord(args: PrivilegedOwnerSigningLaneRecordBuilderArgs): RecoverySigningLaneRecord;
+export declare function buildBreakGlassSigningLaneRecord(args: PrivilegedOwnerSigningLaneRecordBuilderArgs): BreakGlassSigningLaneRecord;
+export declare function buildActiveSigningLaneReference(args: ActiveSigningLaneReferenceBuilderArgs & {
+    readonly laneKind: SigningLaneKind;
+}): ActiveSigningLaneReference;
+export declare function parseWalletKeyLifecycle(raw: unknown, label?: string): WalletKeyLifecycle;
+export declare function parseSigningLaneLifecycle(raw: unknown, label?: string): SigningLaneLifecycle;
+export declare function parseWalletKeyRecord(raw: unknown, label?: string): WalletKeyRecord;
+export declare function parseSigningLaneReference(raw: unknown, label?: string): SigningLaneReference;
+export declare function parseSigningLaneRecord(raw: unknown, label?: string): SigningLaneRecord;
+export declare function parseActiveSigningLaneReference(raw: unknown, label?: string): ActiveSigningLaneReference;
+export {};
+//# sourceMappingURL=recordParsers.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/records.d.ts

@@ -0,0 +1,160 @@
+import type { DomainId, MpcMaterialActivationRef, WalletAuthMethodId, WalletId } from '../utils/domainIds';
+import type { KeyCreationSignerSlot } from '../passkey-custody/primitives';
+import type { Ed25519PublicKeyB64u, Secp256k1CompressedPublicKeyB64u } from '../passkey-custody/primitives';
+import type { NearEd25519SigningKeyId } from '../utils/registrationIntent';
+import type { LaneHolderParticipantRecordV1, LaneParticipantBindingDigestB64u, SigningWorkerParticipantRecordV1 } from './participants';
+import type { LaneShareEpoch, LinkedDeviceId, SigningLaneId, WalletKeyId } from './ids';
+import type { EvmFamilySigningKeySlotId } from './evmFamilySigningKeySlotId';
+import type { OwnerLaneParticipantContinuityV1 } from './ownerContinuity';
+export type WalletKeyVersion = DomainId<'WalletKeyVersion'>;
+export type WalletKeyLifecycle = {
+    readonly state: 'active';
+    readonly activatedAtMs: number;
+} | {
+    readonly state: 'retired';
+    readonly retiredAtMs: number;
+} | {
+    readonly state: 'compromised';
+    readonly compromisedAtMs: number;
+};
+export type Ed25519WalletKeyRecord = {
+    readonly kind: 'wallet_key_record_v1';
+    readonly keyFamily: 'ed25519';
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly walletKeyVersion: WalletKeyVersion;
+    readonly nearEd25519SigningKeyId: NearEd25519SigningKeyId;
+    readonly keyCreationSignerSlot: KeyCreationSignerSlot;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly lifecycle: WalletKeyLifecycle;
+    readonly evmFamilySigningKeySlotId?: never;
+    readonly thresholdPublicKey33B64u?: never;
+    readonly evmAddress?: never;
+};
+export type EvmFamilyWalletKeyRecord = {
+    readonly kind: 'wallet_key_record_v1';
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly walletKeyVersion: WalletKeyVersion;
+    readonly evmFamilySigningKeySlotId: EvmFamilySigningKeySlotId;
+    readonly thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly evmAddress: string;
+    readonly lifecycle: WalletKeyLifecycle;
+    readonly nearEd25519SigningKeyId?: never;
+    readonly keyCreationSignerSlot?: never;
+    readonly registeredPublicKeyB64u?: never;
+};
+export type WalletKeyRecord = Ed25519WalletKeyRecord | EvmFamilyWalletKeyRecord;
+export type SigningLaneKind = 'owner_passkey' | 'owner_email_otp' | 'linked_device' | 'delegated_execution' | 'recovery' | 'break_glass';
+export type SigningLaneReference = {
+    readonly kind: 'signing_lane_reference_v1';
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly laneId: SigningLaneId;
+    readonly laneKind: SigningLaneKind;
+    readonly laneShareEpoch: LaneShareEpoch;
+    readonly participantBindingDigestB64u: LaneParticipantBindingDigestB64u;
+};
+export type SigningLaneLifecycle = {
+    readonly state: 'provisioning';
+    readonly revocationEpoch: number;
+    readonly startedAtMs: number;
+} | {
+    readonly state: 'pending_receipt';
+    readonly revocationEpoch: number;
+    readonly startedAtMs: number;
+    readonly deliveryDigestB64u: string;
+} | {
+    readonly state: 'active';
+    readonly revocationEpoch: number;
+    readonly activatedAtMs: number;
+    readonly activationReceiptDigestB64u: string;
+} | {
+    readonly state: 'revoked';
+    readonly revocationEpoch: number;
+    readonly revokedAtMs: number;
+    readonly revokeReason: 'user_revoked' | 'device_compromise' | 'agent_compromise' | 'rotation';
+};
+export type ActiveSigningLaneReference = SigningLaneReference & {
+    readonly lifecycle: Extract<SigningLaneLifecycle, {
+        readonly state: 'active';
+    }>;
+    readonly materialActivation: MpcMaterialActivationRef;
+};
+type SigningLaneRecordBase = SigningLaneReference & {
+    readonly lifecycle: SigningLaneLifecycle;
+};
+type OwnerAuthSigningLaneRecordBase = SigningLaneRecordBase & {
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly ownerParticipantContinuity: OwnerLaneParticipantContinuityV1;
+    readonly holderParticipant?: never;
+    readonly serverParticipant?: never;
+};
+type PrivilegedOwnerSigningLaneRecordBase = SigningLaneRecordBase & {
+    readonly ownerParticipantContinuity: OwnerLaneParticipantContinuityV1;
+    readonly walletAuthMethodId?: never;
+    readonly holderParticipant?: never;
+    readonly serverParticipant?: never;
+};
+type RotatableSigningLaneRecordBase = SigningLaneRecordBase & {
+    readonly holderParticipant: LaneHolderParticipantRecordV1;
+    readonly serverParticipant: SigningWorkerParticipantRecordV1;
+    readonly ownerParticipantContinuity?: never;
+    readonly walletAuthMethodId?: never;
+};
+export type OwnerPasskeySigningLaneRecord = OwnerAuthSigningLaneRecordBase & {
+    readonly laneKind: 'owner_passkey';
+    readonly linkedDeviceId?: never;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
+export type OwnerEmailOtpSigningLaneRecord = OwnerAuthSigningLaneRecordBase & {
+    readonly laneKind: 'owner_email_otp';
+    readonly linkedDeviceId?: never;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
+export type LinkedDeviceSigningLaneRecord = RotatableSigningLaneRecordBase & {
+    readonly laneKind: 'linked_device';
+    readonly linkedDeviceId: LinkedDeviceId;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
+export type DelegatedSpendAuthorizationId = DomainId<'DelegatedSpendAuthorizationId'>;
+export type AgentIdentityKeyId = DomainId<'AgentIdentityKeyId'>;
+export type AgentCustodyBindingId = DomainId<'AgentCustodyBindingId'>;
+export type DelegatedExecutionSigningLaneRecord = RotatableSigningLaneRecordBase & {
+    readonly laneKind: 'delegated_execution';
+    readonly authorizationId: DelegatedSpendAuthorizationId;
+    readonly agentIdentityKeyId: AgentIdentityKeyId;
+    readonly custodyBindingId: AgentCustodyBindingId;
+    readonly authorizationBindingDigestB64u: string;
+    readonly linkedDeviceId?: never;
+};
+export type RecoverySigningLaneRecord = PrivilegedOwnerSigningLaneRecordBase & {
+    readonly laneKind: 'recovery';
+    readonly linkedDeviceId?: never;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
+export type BreakGlassSigningLaneRecord = PrivilegedOwnerSigningLaneRecordBase & {
+    readonly laneKind: 'break_glass';
+    readonly linkedDeviceId?: never;
+    readonly authorizationId?: never;
+    readonly agentIdentityKeyId?: never;
+    readonly custodyBindingId?: never;
+    readonly authorizationBindingDigestB64u?: never;
+};
+export type SigningLaneRecord = OwnerPasskeySigningLaneRecord | OwnerEmailOtpSigningLaneRecord | LinkedDeviceSigningLaneRecord | DelegatedExecutionSigningLaneRecord | RecoverySigningLaneRecord | BreakGlassSigningLaneRecord;
+export declare function assertNeverSigningLane(value: never): never;
+export {};
+//# sourceMappingURL=records.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/records.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=records.typecheck.d.ts.map