@seams/wallet-server 0.5.0

package/dist/types/shared-ts/src/signing-lanes/rotation.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rotation.typecheck.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts

@@ -0,0 +1,32 @@
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import type { AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, EcdsaAdditiveLaneHolderRoundV1, EcdsaAdditiveLaneServerRoundV1, EcdsaAdditiveLaneTranscriptPreambleV1, EcdsaAdditiveLaneTranscriptV1, EcdsaServerRetirementReceiptV1, Ed25519ServerRetirementReceiptV1, Ed25519YaoLaneJobV1, LaneEnrollmentManifestV1, LaneProductEpochRecordV1, RevokeSigningLaneV1, SigningWorkerLaneMaterialIdentityV1 } from './rotation';
+export declare function encodeEd25519YaoLaneJobTranscriptV1(value: Ed25519YaoLaneJobV1): Uint8Array;
+export declare function computeEd25519YaoLaneJobTranscriptDigestV1(value: Ed25519YaoLaneJobV1): Promise<string>;
+export declare function computeEd25519YaoLaneSessionDigestV1(value: Ed25519YaoLaneJobV1): Promise<string>;
+export declare function encodeEcdsaAdditiveLaneTranscriptPreambleV1(value: EcdsaAdditiveLaneTranscriptPreambleV1): Uint8Array;
+export declare function encodeEcdsaAdditiveLaneHolderRoundV1(value: EcdsaAdditiveLaneHolderRoundV1): Uint8Array;
+export declare function encodeEcdsaAdditiveLaneServerRoundV1(value: EcdsaAdditiveLaneServerRoundV1): Uint8Array;
+export declare function encodeEcdsaAdditiveLaneTranscriptV1(value: EcdsaAdditiveLaneTranscriptV1): Uint8Array;
+export declare function computeEcdsaAdditiveLaneTranscriptPreambleDigestV1(value: EcdsaAdditiveLaneTranscriptPreambleV1): Promise<string>;
+export declare function computeEcdsaAdditiveLaneHolderRoundDigestV1(value: EcdsaAdditiveLaneHolderRoundV1): Promise<string>;
+export declare function computeEcdsaAdditiveLaneServerRoundDigestV1(value: EcdsaAdditiveLaneServerRoundV1): Promise<string>;
+export declare function computeEcdsaAdditiveLaneTranscriptDigestV1(value: EcdsaAdditiveLaneTranscriptV1): Promise<string>;
+export declare function encodeLaneEnrollmentManifestV1(value: LaneEnrollmentManifestV1): Uint8Array;
+export declare function computeLaneEnrollmentManifestDigestV1(value: LaneEnrollmentManifestV1): Promise<string>;
+export declare function encodeAggregateLaneActivationReceiptV1(value: AggregateLaneActivationReceiptV1): Uint8Array;
+export declare function computeAggregateLaneActivationReceiptDigestV1(value: AggregateLaneActivationReceiptV1): Promise<string>;
+export declare function encodeAggregateLaneRevocationReceiptV1(value: AggregateLaneRevocationReceiptV1): Uint8Array;
+export declare function computeAggregateLaneRevocationReceiptDigestV1(value: AggregateLaneRevocationReceiptV1): Promise<string>;
+export declare function encodeRevokeSigningLaneV1(value: RevokeSigningLaneV1): Uint8Array;
+export declare function computeRevokeSigningLaneDigestV1(value: RevokeSigningLaneV1): Promise<string>;
+export declare function encodeLaneProtocolCommitReceiptV1(value: import('./rotation').LaneProtocolCommitReceiptV1): Uint8Array;
+export declare function computeLaneProtocolCommitReceiptDigestV1(value: import('./rotation').LaneProtocolCommitReceiptV1): Promise<DigestB64u>;
+export declare function encodeLaneHolderDeliveryReceiptV1(value: import('./rotation').LaneHolderDeliveryReceiptV1): Uint8Array;
+export declare function encodeLaneServerActivationReceiptV1(value: import('./rotation').LaneServerActivationReceiptV1): Uint8Array;
+export declare function encodeEcdsaServerRetirementReceiptCanonicalPayloadV1(value: EcdsaServerRetirementReceiptV1): Uint8Array;
+export declare function computeEcdsaServerRetirementReceiptDigestV1(value: EcdsaServerRetirementReceiptV1): Promise<DigestB64u>;
+export declare function encodeSigningWorkerLaneMaterialIdentityV1(value: SigningWorkerLaneMaterialIdentityV1): Uint8Array;
+export declare function encodeEd25519ServerRetirementReceiptCanonicalPayloadV1(value: Ed25519ServerRetirementReceiptV1): Uint8Array;
+export declare function computeEd25519ServerRetirementReceiptDigestV1(value: Ed25519ServerRetirementReceiptV1): Promise<DigestB64u>;
+export declare function encodeLaneProductEpochRecordV1(value: LaneProductEpochRecordV1): Uint8Array;
+//# sourceMappingURL=rotationDigests.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts

@@ -0,0 +1,99 @@
+import type { AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, LaneEnrollmentLifecycleV1, LaneProductEpochActiveV1, LaneProductEpochPendingVisibilityV1, LaneProductEpochRevocationPendingV1, LaneProductEpochRecordV1, LaneProductEpochRetiredV1, LaneProductEpochRevokedV1, LaneProtocolLifecycle } from './rotation';
+import type { LaneOperationId } from './ids';
+export type LaneProtocolLifecycleTransitionV1 = {
+    action: 'await_protocol_commitment';
+    atMs: number;
+} | {
+    action: 'record_commit';
+    committedAtMs: number;
+    transcriptHashB64u: string;
+    protocolCommitReceiptDigestB64u: string;
+} | {
+    action: 'record_holder_delivery';
+    holderReceiptAtMs: number;
+    holderDeliveryReceiptDigestB64u: string;
+} | {
+    action: 'record_server_activation';
+    serverActivatedAtMs: number;
+    serverActivationReceiptDigestB64u: string;
+} | {
+    action: 'activate';
+    activatedAtMs: number;
+    aggregateActivationReceiptDigestB64u: string;
+} | {
+    action: 'abort_precommit';
+    abortedAtMs: number;
+    abortReason: 'cancelled' | 'expired' | 'revoked_before_commit';
+} | {
+    action: 'require_completion';
+    recoveryReason: 'exact_redelivery_required' | 'recovery_required';
+} | {
+    action: 'resume_completion';
+    atMs: number;
+};
+export declare function transitionLaneProtocolLifecycleV1(current: LaneProtocolLifecycle, transition: LaneProtocolLifecycleTransitionV1): LaneProtocolLifecycle;
+export declare function beginLaneProtocolLifecycleV1(startedAtMs: number): Extract<LaneProtocolLifecycle, {
+    state: 'preparing';
+}>;
+export declare function markLaneProtocolCompletionRequiredV1(current: Extract<LaneProtocolLifecycle, {
+    state: 'committed_awaiting_holder_delivery';
+}>, recoveryReason: 'exact_redelivery_required' | 'recovery_required'): Extract<LaneProtocolLifecycle, {
+    state: 'committed_completion_required';
+}>;
+export declare function resumeLaneProtocolCompletionV1(current: Extract<LaneProtocolLifecycle, {
+    state: 'committed_completion_required';
+}>, atMs: number): Extract<LaneProtocolLifecycle, {
+    state: 'committed_awaiting_holder_delivery';
+}>;
+export type LaneEnrollmentLifecycleTransitionV1 = {
+    action: 'mark_committed_completion_required';
+    committedChildOperationIds: readonly [LaneOperationId, ...LaneOperationId[]];
+    markedAtMs: number;
+} | {
+    action: 'mark_ready_for_visibility';
+    aggregateReceiptDigestB64u: string;
+    readyAtMs: number;
+} | {
+    action: 'activate';
+    activatedAtMs: number;
+} | {
+    action: 'cancel_precommit';
+    cancelledAtMs: number;
+} | {
+    action: 'begin_revocation';
+    reason: 'cancelled_after_commit' | 'expired_after_commit' | 'revoked_during_activation';
+    markedAtMs: number;
+} | {
+    action: 'revoke';
+    aggregateRevocationReceiptDigestB64u: string;
+    revokedAtMs: number;
+};
+export declare function transitionLaneEnrollmentLifecycleV1(current: LaneEnrollmentLifecycleV1, transition: LaneEnrollmentLifecycleTransitionV1): LaneEnrollmentLifecycleV1;
+export declare function activateLaneProductEpochV1(current: LaneProductEpochPendingVisibilityV1, args: {
+    readonly aggregateActivationReceiptDigestB64u: string;
+    readonly activatedAtMs: number;
+}): LaneProductEpochActiveV1;
+export declare function retireFencedLaneProductEpochV1(current: LaneProductEpochRevocationPendingV1, args: {
+    readonly retirementReceiptDigestB64u: string;
+    readonly retiredAtMs: number;
+}): LaneProductEpochRetiredV1;
+export declare function beginLaneProductEpochRevocationV1(current: LaneProductEpochPendingVisibilityV1 | LaneProductEpochActiveV1, args: {
+    readonly revocationEpoch: number;
+    readonly revocationReason: LaneProductEpochRevokedV1['revocationReason'];
+    readonly retirementEffectBindingDigestB64u: string;
+    readonly revocationRequestedAtMs: number;
+}): LaneProductEpochRevocationPendingV1;
+export declare function completeLaneProductEpochRevocationV1(current: LaneProductEpochRevocationPendingV1, args: {
+    readonly revocationReceiptDigestB64u: string;
+    readonly revokedAtMs: number;
+}): LaneProductEpochRevokedV1;
+export declare function assertForwardOnlyLaneProductEpochV1(value: LaneProductEpochRecordV1): void;
+export type LaneActivationReceiptInputV1 = {
+    readonly aggregateReceipt: AggregateLaneActivationReceiptV1;
+    readonly manifestDigestB64u: string;
+};
+export type LaneRevocationReceiptInputV1 = {
+    readonly aggregateReceipt: AggregateLaneRevocationReceiptV1;
+    readonly manifestDigestB64u: string;
+};
+//# sourceMappingURL=rotationLifecycle.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts

@@ -0,0 +1,67 @@
+import { type MpcMaterialActivationRef } from '../utils/domainIds';
+import { type SigningLaneId, type LaneShareEpoch } from './ids';
+import type { SigningLaneKind } from './records';
+import type { AggregateLaneActivationChildReceiptV1, AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, CommitLaneEnrollmentActivationV1, CommitLaneEnrollmentRevocationV1, CompleteSigningLaneRevocationV1, EcdsaAdditiveLaneHolderRoundV1, EcdsaAdditiveLaneServerRoundV1, EcdsaAdditiveLaneTranscriptPreambleV1, EcdsaAdditiveLaneTranscriptV1, EcdsaServerRetirementReceiptV1, Ed25519ServerRetirementReceiptV1, EcdsaTargetCapabilityBindingV1, LaneCreationTargetV1, LaneEnrollmentLifecycleV1, LaneEnrollmentPreparationResultV1, LaneEnrollmentManifestV1, LaneHolderDeliveryReceiptV1, LaneHolderPackageWireV1, LaneProductEpochActiveV1, LaneProductEpochPendingVisibilityV1, LaneProductEpochRevocationPendingV1, LaneProductEpochRecordV1, LaneProductEpochRetiredV1, LaneProductEpochRevokedV1, LaneProtocolCommitReceiptV1, LaneProtocolCasResultV1, LaneProtocolLifecycle, LaneProtocolRecordV1, LaneRefreshTargetV1, LaneRefreshPredecessorRetirementV1, LaneServerActivationReceiptV1, LaneServerRetirementReceiptV1, SigningWorkerLaneMaterialIdentityV1, RevokeLaneEnrollmentV1, RevokeSigningLaneV1, RotatableSigningLaneJobV1 } from './rotation';
+export declare function buildLaneCreationTargetV1(args: {
+    readonly laneId: SigningLaneId;
+    readonly laneShareEpoch: LaneShareEpoch;
+}): LaneCreationTargetV1;
+export declare function buildLaneRefreshTargetV1(args: {
+    readonly laneId: SigningLaneId;
+    readonly laneKind: Exclude<SigningLaneKind, 'delegated_execution'>;
+    readonly laneShareEpoch: LaneShareEpoch;
+    readonly priorMaterialActivation: MpcMaterialActivationRef;
+}): LaneRefreshTargetV1;
+export declare function parseEcdsaTargetCapabilityBindingV1(raw: unknown, label: string): EcdsaTargetCapabilityBindingV1;
+export declare function parseRotatableSigningLaneJobV1(raw: unknown, label?: string): RotatableSigningLaneJobV1;
+export declare function parseLaneHolderPackageWireV1(raw: unknown, label?: string): LaneHolderPackageWireV1;
+export declare const parseLaneProtocolJobV1: typeof parseRotatableSigningLaneJobV1;
+export declare function parseLaneProtocolCommitReceiptV1(raw: unknown, label?: string): LaneProtocolCommitReceiptV1;
+export declare function parseLaneHolderDeliveryReceiptV1(raw: unknown, label?: string): LaneHolderDeliveryReceiptV1;
+export declare function parseLaneServerActivationReceiptV1(raw: unknown, label?: string): LaneServerActivationReceiptV1;
+export declare function parseLaneEnrollmentManifestV1(raw: unknown, label?: string): LaneEnrollmentManifestV1;
+export declare function buildAggregateLaneActivationChildReceiptV1(input: AggregateLaneActivationChildReceiptV1): AggregateLaneActivationChildReceiptV1;
+export declare function parseAggregateLaneActivationReceiptV1(raw: unknown, label?: string): AggregateLaneActivationReceiptV1;
+export declare function parseCommitLaneEnrollmentActivationV1(raw: unknown, label?: string): CommitLaneEnrollmentActivationV1;
+export declare function parseLaneRefreshPredecessorRetirementV1(raw: unknown, label?: string): LaneRefreshPredecessorRetirementV1;
+export declare function parseAggregateLaneRevocationReceiptV1(raw: unknown, label?: string): AggregateLaneRevocationReceiptV1;
+export declare function parseRevokeLaneEnrollmentV1(raw: unknown, label?: string): RevokeLaneEnrollmentV1;
+export declare function parseRevokeSigningLaneV1(raw: unknown, label?: string): RevokeSigningLaneV1;
+export declare function parseCompleteSigningLaneRevocationV1(raw: unknown, label?: string): CompleteSigningLaneRevocationV1;
+export declare function parseCommitLaneEnrollmentRevocationV1(raw: unknown, label?: string): CommitLaneEnrollmentRevocationV1;
+export declare function parseLaneProductEpochRecordV1(raw: unknown, label?: string): LaneProductEpochRecordV1;
+export declare function parseLaneProtocolLifecycleV1(raw: unknown, label?: string): LaneProtocolLifecycle;
+export declare function parseLaneEnrollmentLifecycleV1(raw: unknown, label?: string): LaneEnrollmentLifecycleV1;
+export declare function buildLaneProtocolRecordV1(args: {
+    readonly job: RotatableSigningLaneJobV1;
+    readonly lifecycle: LaneProtocolLifecycle;
+}): LaneProtocolRecordV1;
+export declare function parseLaneProtocolRecordV1(raw: unknown, label?: string): LaneProtocolRecordV1;
+export declare function parseLaneProtocolCasResultV1(raw: unknown, label?: string): LaneProtocolCasResultV1;
+export declare function parseLaneEnrollmentPreparationResultV1(raw: unknown, label?: string): LaneEnrollmentPreparationResultV1;
+export declare function buildRotatableSigningLaneJobV1(raw: unknown, label?: string): RotatableSigningLaneJobV1;
+export declare function buildLaneProtocolCommitReceiptV1(args: Omit<LaneProtocolCommitReceiptV1, 'kind'>): LaneProtocolCommitReceiptV1;
+export declare function buildLaneHolderDeliveryReceiptV1(args: Omit<LaneHolderDeliveryReceiptV1, 'kind'>): LaneHolderDeliveryReceiptV1;
+export declare function buildLaneServerActivationReceiptV1(args: Omit<LaneServerActivationReceiptV1, 'kind'>): LaneServerActivationReceiptV1;
+export declare function buildLaneEnrollmentManifestV1(args: Omit<LaneEnrollmentManifestV1, 'kind'>): LaneEnrollmentManifestV1;
+export declare function buildAggregateLaneActivationReceiptV1(args: Omit<AggregateLaneActivationReceiptV1, 'kind'>): AggregateLaneActivationReceiptV1;
+export declare function buildCommitLaneEnrollmentActivationV1(args: Omit<CommitLaneEnrollmentActivationV1, 'kind'>): CommitLaneEnrollmentActivationV1;
+export declare function buildAggregateLaneRevocationReceiptV1(args: Omit<AggregateLaneRevocationReceiptV1, 'kind'>): AggregateLaneRevocationReceiptV1;
+export declare function buildRevokeLaneEnrollmentV1(args: Omit<RevokeLaneEnrollmentV1, 'kind'>): RevokeLaneEnrollmentV1;
+export declare function buildRevokeSigningLaneV1(args: Omit<RevokeSigningLaneV1, 'kind'>): RevokeSigningLaneV1;
+export declare function buildCompleteSigningLaneRevocationV1(args: Omit<CompleteSigningLaneRevocationV1, 'kind'>): CompleteSigningLaneRevocationV1;
+export declare function buildCommitLaneEnrollmentRevocationV1(args: Omit<CommitLaneEnrollmentRevocationV1, 'kind'>): CommitLaneEnrollmentRevocationV1;
+export declare function buildLaneProductEpochPendingVisibilityV1(args: Omit<LaneProductEpochPendingVisibilityV1, 'kind' | 'state'>): LaneProductEpochPendingVisibilityV1;
+export declare function buildLaneProductEpochActiveV1(args: Omit<LaneProductEpochActiveV1, 'kind' | 'state'>): LaneProductEpochActiveV1;
+export declare function buildLaneProductEpochRetiredV1(args: Omit<LaneProductEpochRetiredV1, 'kind' | 'state'>): LaneProductEpochRetiredV1;
+export declare function buildLaneProductEpochRevocationPendingV1(args: Omit<LaneProductEpochRevocationPendingV1, 'kind' | 'state'>): LaneProductEpochRevocationPendingV1;
+export declare function buildLaneProductEpochRevokedV1(args: Omit<LaneProductEpochRevokedV1, 'kind' | 'state'>): LaneProductEpochRevokedV1;
+export declare function parseEcdsaAdditiveLaneTranscriptPreambleV1(raw: unknown, label?: string): EcdsaAdditiveLaneTranscriptPreambleV1;
+export declare function parseEcdsaAdditiveLaneHolderRoundV1(raw: unknown, label?: string): EcdsaAdditiveLaneHolderRoundV1;
+export declare function parseEcdsaAdditiveLaneServerRoundV1(raw: unknown, label?: string): EcdsaAdditiveLaneServerRoundV1;
+export declare function parseEcdsaAdditiveLaneTranscriptV1(raw: unknown, label?: string): EcdsaAdditiveLaneTranscriptV1;
+export declare function parseEcdsaServerRetirementReceiptV1(raw: unknown, label?: string): EcdsaServerRetirementReceiptV1;
+export declare function parseSigningWorkerLaneMaterialIdentityV1<TKeyFamily extends 'ed25519' | 'ecdsa_secp256k1'>(raw: unknown, expectedKeyFamily: TKeyFamily, label?: string): SigningWorkerLaneMaterialIdentityV1<TKeyFamily>;
+export declare function parseEd25519ServerRetirementReceiptV1(raw: unknown, label?: string): Ed25519ServerRetirementReceiptV1;
+export declare function parseLaneServerRetirementReceiptV1(raw: unknown, label?: string): LaneServerRetirementReceiptV1;
+//# sourceMappingURL=rotationParsers.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/validation.d.ts

@@ -0,0 +1,11 @@
+import { type WalletKeyId } from './ids';
+export declare function parseWalletKeyIdOrNull(value: unknown): WalletKeyId | null;
+export declare function requireWalletKeyId(value: unknown, label?: string): WalletKeyId;
+export declare function assertMatchingWalletKeyId(args: {
+    expected: unknown;
+    actual: unknown;
+    expectedLabel?: string;
+    actualLabel?: string;
+    message?: string;
+}): WalletKeyId;
+//# sourceMappingURL=validation.d.ts.map

package/dist/types/shared-ts/src/tenant-root/index.d.ts

@@ -0,0 +1,3 @@
+export * from './tenantRootIdentity';
+export * from './tenantRootOperationRecord';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootIdentity.d.ts

@@ -0,0 +1,72 @@
+import type { DomainId, OrgId } from '../utils/domainIds';
+import type { SigningRootId, SigningRootVersion } from '../threshold/ecdsaDerivationRoleLocalBootstrap';
+export type TenantRootIdentityFieldV1 = 'orgId' | 'projectId' | 'envId' | 'signingRootId' | 'signingRootVersion';
+export type TenantRootOrganizationIdV1 = OrgId;
+export type TenantRootProjectIdV1 = DomainId<'TenantRootProjectIdV1'>;
+export type TenantRootEnvironmentIdV1 = DomainId<'TenantRootEnvironmentIdV1'>;
+export type TenantRootSigningRootIdV1 = SigningRootId;
+export type TenantRootSigningRootVersionV1 = SigningRootVersion;
+export type TenantRootIdentityFieldValueV1<F extends TenantRootIdentityFieldV1> = F extends 'orgId' ? TenantRootOrganizationIdV1 : F extends 'projectId' ? TenantRootProjectIdV1 : F extends 'envId' ? TenantRootEnvironmentIdV1 : F extends 'signingRootId' ? TenantRootSigningRootIdV1 : TenantRootSigningRootVersionV1;
+export type TenantRootIdentityWireV1 = {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+};
+export type TenantRootIdentityDecodeErrorV1 = {
+    readonly kind: 'invalid_object';
+} | {
+    readonly kind: 'missing_field';
+    readonly field: TenantRootIdentityFieldV1;
+} | {
+    readonly kind: 'unexpected_field';
+    readonly field: string;
+} | {
+    readonly kind: 'invalid_field';
+    readonly field: TenantRootIdentityFieldV1;
+};
+export type TenantRootIdentityDecodeResultV1<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: TenantRootIdentityDecodeErrorV1;
+};
+type TenantRootIdentityFieldsV1 = {
+    readonly orgId: TenantRootOrganizationIdV1;
+    readonly projectId: TenantRootProjectIdV1;
+    readonly envId: TenantRootEnvironmentIdV1;
+    readonly signingRootId: TenantRootSigningRootIdV1;
+    readonly signingRootVersion: TenantRootSigningRootVersionV1;
+};
+/**
+ * The identity proof is only emitted by the authenticated builder or exact
+ * wire decoder. Its private method makes raw object literals structurally
+ * incompatible with the trusted identity.
+ */
+declare class TenantRootIdentityProof {
+    readonly orgId: TenantRootOrganizationIdV1;
+    readonly projectId: TenantRootProjectIdV1;
+    readonly envId: TenantRootEnvironmentIdV1;
+    readonly signingRootId: TenantRootSigningRootIdV1;
+    readonly signingRootVersion: TenantRootSigningRootVersionV1;
+    private retainProof;
+    private constructor();
+    static create(fields: TenantRootIdentityFieldsV1): TenantRootIdentityProof;
+}
+/** Canonical server-resolved identity for one logical tenant derivation root. */
+export type TenantRootIdentityV1 = TenantRootIdentityProof;
+/** Checks one already-resolved field without normalizing it. */
+export declare function isTenantRootIdentityFieldCanonicalV1(field: TenantRootIdentityFieldV1, value: unknown): value is string;
+/**
+ * Builds the nominal identity after an authenticated deployment resolver has
+ * supplied the complete, already-selected five-field scope.
+ */
+export declare function buildTenantRootIdentityFromAuthenticatedDeploymentV1(input: TenantRootIdentityWireV1): TenantRootIdentityDecodeResultV1<TenantRootIdentityV1>;
+/** Decodes the exact private wire/persistence representation of the identity. */
+export declare function decodeTenantRootIdentityWireV1(value: unknown): TenantRootIdentityDecodeResultV1<TenantRootIdentityV1>;
+/** Encodes the exact Rust-compatible canonical identity bytes. */
+export declare function encodeTenantRootIdentityV1(identity: TenantRootIdentityV1): Uint8Array;
+export {};
+//# sourceMappingURL=tenantRootIdentity.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts

@@ -0,0 +1,192 @@
+import { type TenantRootIdentityV1 } from './tenantRootIdentity';
+declare const TENANT_ROOT_OPERATION_RECORD_FORMAT_V1 = "tenant_root_operation_record_v1";
+/** Maximum authorization lifetime for most operations. */
+export declare const TENANT_ROOT_OPERATION_MAX_LIFETIME_MS_V1 = 600000;
+/** Maximum authorization lifetime for a ciphertext download. */
+export declare const TENANT_ROOT_DOWNLOAD_MAX_LIFETIME_MS_V1 = 300000;
+/** One console operation on a tenant derivation root. */
+export type TenantRootOperationKindV1 = 'tenant_root_operational_share_rotation_v1' | 'tenant_root_recovery_governance_change_v1' | 'tenant_root_recovery_recipient_pair_enroll_v1' | 'tenant_root_recovery_recipient_pair_replace_v1' | 'tenant_root_recovery_backup_create_v1' | 'tenant_root_recovery_backup_replace_v1' | 'tenant_root_recovery_role_package_download_v1' | 'tenant_root_recovery_manifest_download_v1' | 'tenant_root_restore_session_start_v1' | 'tenant_root_restore_manifest_register_v1' | 'tenant_root_restore_role_import_key_issue_v1' | 'tenant_root_restore_role_import_v1' | 'tenant_root_restore_activate_v1' | 'tenant_root_source_lineage_retire_v1';
+/** What one operation acts on. */
+export type TenantRootOperationSubjectV1 = {
+    readonly kind: 'tenant_root';
+} | {
+    readonly kind: 'recovery_set';
+    readonly recoverySetId: string;
+} | {
+    readonly kind: 'recipient_pair';
+    readonly recipientPairDigest: string;
+};
+/** The single Deriver role a role-local operation acts on. */
+export type TenantRootDeriverRoleV1 = 'deriver_a' | 'deriver_b';
+export declare const TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1: "tenant_root_restore_role_import_key_issue_v1";
+type TenantRootOperationRecordWithActiveRootV1 = {
+    readonly formatVersion: typeof TENANT_ROOT_OPERATION_RECORD_FORMAT_V1;
+    readonly operationKind: Exclude<TenantRootOperationKindV1, typeof TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1>;
+    readonly tenantRootIdentityDigest: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly custodyLineageId: string;
+    readonly expectedLifecycleRevision: number;
+    readonly recoveryGovernanceDigest: string;
+    readonly subject: TenantRootOperationSubjectV1;
+    readonly role?: TenantRootDeriverRoleV1;
+    readonly requesterActorId: string;
+    readonly idempotencyKey: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly expectedRootCommitment: string;
+    readonly manifestDigestB64u?: never;
+    readonly destinationFingerprintB64u?: never;
+    readonly restoreSessionIdB64u?: never;
+    readonly importKeyId?: never;
+    readonly generation?: never;
+    readonly nonceB64u?: never;
+};
+/**
+ * The restore import-key issue branch is scoped to an empty destination. It
+ * carries the destination identity and restore binding, so active-root
+ * lifecycle and governance state do not belong in this record.
+ */
+export type TenantRootRestoreRoleImportKeyIssueOperationRecordV1 = {
+    readonly formatVersion: typeof TENANT_ROOT_OPERATION_RECORD_FORMAT_V1;
+    readonly operationKind: typeof TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1;
+    readonly tenantRootIdentityDigest: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly custodyLineageId: string;
+    readonly expectedLifecycleRevision?: never;
+    readonly recoveryGovernanceDigest?: never;
+    readonly subject: Extract<TenantRootOperationSubjectV1, {
+        readonly kind: 'recovery_set';
+    }>;
+    readonly role: TenantRootDeriverRoleV1;
+    readonly requesterActorId: string;
+    readonly idempotencyKey: string;
+    readonly nonceB64u: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly expectedRootCommitment?: never;
+    readonly manifestDigestB64u: string;
+    readonly destinationFingerprintB64u: string;
+    readonly restoreSessionIdB64u: string;
+    readonly importKeyId: string;
+    readonly generation: number;
+};
+/** One exact server-generated operation record. */
+export type TenantRootOperationRecordV1 = TenantRootOperationRecordWithActiveRootV1 | TenantRootRestoreRoleImportKeyIssueOperationRecordV1;
+/** Why one record could not be built. */
+export type TenantRootOperationRecordErrorV1 = {
+    readonly kind: 'subject_does_not_match_operation';
+} | {
+    readonly kind: 'role_does_not_match_operation';
+} | {
+    readonly kind: 'lifecycle_revision_not_positive';
+} | {
+    readonly kind: 'restore_binding_invalid';
+    readonly field: 'tenantRootIdentityDigest' | 'recoverySetId' | 'manifestDigestB64u' | 'custodyLineageId' | 'destinationFingerprintB64u' | 'nonceB64u';
+} | {
+    readonly kind: 'restore_session_id_invalid';
+} | {
+    readonly kind: 'restore_import_key_id_invalid';
+} | {
+    readonly kind: 'restore_generation_not_positive';
+} | {
+    readonly kind: 'timestamp_not_canonical';
+    readonly field: 'issuedAt' | 'expiresAt';
+} | {
+    readonly kind: 'expiry_not_after_issue';
+} | {
+    readonly kind: 'lifetime_exceeds_maximum';
+    readonly maximumMs: number;
+};
+/** Result of building one record. */
+export type TenantRootOperationRecordResultV1 = {
+    readonly ok: true;
+    readonly record: TenantRootOperationRecordV1;
+} | {
+    readonly ok: false;
+    readonly error: TenantRootOperationRecordErrorV1;
+};
+/** Inputs the console resolves before building a record. */
+type TenantRootOperationRecordInputWithActiveRootV1 = {
+    readonly operationKind: Exclude<TenantRootOperationKindV1, typeof TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1>;
+    readonly identity: TenantRootIdentityV1;
+    readonly tenantRootIdentityDigest: string;
+    readonly custodyLineageId: string;
+    readonly expectedLifecycleRevision: number;
+    readonly recoveryGovernanceDigest: string;
+    readonly subject: TenantRootOperationSubjectV1;
+    readonly role?: TenantRootDeriverRoleV1;
+    readonly requesterActorId: string;
+    readonly idempotencyKey: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly expectedRootCommitment: string;
+    readonly manifestDigestB64u?: never;
+    readonly destinationFingerprintB64u?: never;
+    readonly restoreSessionIdB64u?: never;
+    readonly importKeyId?: never;
+    readonly generation?: never;
+    readonly nonceB64u?: never;
+};
+/** Input for the destination-scoped restore import-key issue branch. */
+export type TenantRootRestoreRoleImportKeyIssueOperationInputV1 = {
+    readonly operationKind: typeof TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1;
+    readonly identity: TenantRootIdentityV1;
+    readonly tenantRootIdentityDigest: string;
+    readonly custodyLineageId: string;
+    readonly subject: Extract<TenantRootOperationSubjectV1, {
+        readonly kind: 'recovery_set';
+    }>;
+    readonly role: TenantRootDeriverRoleV1;
+    readonly requesterActorId: string;
+    readonly idempotencyKey: string;
+    readonly nonceB64u: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly manifestDigestB64u: string;
+    readonly destinationFingerprintB64u: string;
+    readonly restoreSessionIdB64u: string;
+    readonly importKeyId: string;
+    readonly generation: number;
+    readonly expectedLifecycleRevision?: never;
+    readonly recoveryGovernanceDigest?: never;
+    readonly expectedRootCommitment?: never;
+};
+/** Inputs the console resolves before building a record. */
+export type TenantRootOperationRecordInputV1 = TenantRootOperationRecordInputWithActiveRootV1 | TenantRootRestoreRoleImportKeyIssueOperationInputV1;
+/** Returns the four operations that follow the tenant's recovery governance. */
+export declare function tenantRootOperationFollowsGovernanceV1(kind: TenantRootOperationKindV1): boolean;
+/** Returns the maximum authorization lifetime for one operation. */
+export declare function tenantRootOperationMaxLifetimeMsV1(kind: TenantRootOperationKindV1): number;
+/** Returns true when a string names a known operation kind. */
+export declare function isTenantRootOperationKindV1(value: unknown): value is TenantRootOperationKindV1;
+/**
+ * Parses one stored canonical record back into the exact object it encodes.
+ *
+ * A stored record is reused for a retry so the digest a second owner approved,
+ * or the control plane already consumed, is the digest the retry presents.
+ * Anything that does not re-encode to exactly the stored bytes is refused.
+ */
+export declare function parseTenantRootOperationRecordV1(canonicalJson: string): TenantRootOperationRecordV1 | null;
+/**
+ * Builds one operation record from resolved server state.
+ *
+ * The organization, project, and environment ids come from the trusted
+ * identity rather than from a caller, so the record's ids and its identity
+ * digest cannot disagree.
+ */
+export declare function buildTenantRootOperationRecordV1(input: TenantRootOperationRecordInputV1): TenantRootOperationRecordResultV1;
+/**
+ * Returns the exact canonical bytes the digest covers.
+ *
+ * Object keys are sorted by UTF-16 code unit, matching the Rust encoder. An
+ * absent role is absent from the object rather than present as null.
+ */
+export declare function canonicalTenantRootOperationRecordJsonV1(record: TenantRootOperationRecordV1): string;
+/** Returns SHA-256 over the operation domain and the canonical record bytes. */
+export declare function tenantRootOperationDigestB64uV1(record: TenantRootOperationRecordV1): Promise<string>;
+export {};
+//# sourceMappingURL=tenantRootOperationRecord.d.ts.map

package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts

@@ -0,0 +1,77 @@
+import type { WalletId } from '../utils/domainIds';
+export declare const ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION: "ecdsa-derivation:role-local:first-bootstrap-root-proof:v2";
+export declare const ECDSA_DERIVATION_ROLE_LOCAL_PASSKEY_BOOTSTRAP_AUTH_VERSION: "ecdsa-derivation:role-local:passkey-bootstrap-auth:v2";
+export type EcdsaClientRootPublicKey33B64u = string & {
+    readonly __brand: 'EcdsaClientRootPublicKey33B64u';
+};
+export declare function ecdsaClientRootPublicKey33B64uFromString(value: string): EcdsaClientRootPublicKey33B64u;
+export type DerivationClientSharePublicKey33B64u = string & {
+    readonly __brand: 'DerivationClientSharePublicKey33B64u';
+};
+export declare function derivationClientSharePublicKey33B64uFromString(value: string): DerivationClientSharePublicKey33B64u;
+export type EcdsaDerivationRelayerPublicKey33B64u = string & {
+    readonly __brand: 'EcdsaDerivationRelayerPublicKey33B64u';
+};
+export type EcdsaThresholdKeyId = string & {
+    readonly __brand: 'EcdsaThresholdKeyId';
+};
+export type SigningRootId = string & {
+    readonly __brand: 'SigningRootId';
+};
+export type SigningRootVersion = string & {
+    readonly __brand: 'SigningRootVersion';
+};
+export type EcdsaDerivationRoleLocalFirstBootstrapRootProof = {
+    version: typeof ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION;
+    clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    digest32B64u: string;
+    signature65B64u: string;
+};
+export type EcdsaDerivationRoleLocalBootstrapIdentity = {
+    walletId: string;
+    evmFamilySigningKeySlotId: string;
+    ecdsaThresholdKeyId: string;
+    signingRootId: string;
+    signingRootVersion: string;
+    keyScope: 'evm-family';
+    relayerKeyId: string;
+    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
+    clientShareRetryCounter: number;
+    contextBinding32B64u: string;
+    requestId: string;
+    sessionId: string;
+    ttlMs: number;
+    remainingUses: number;
+    participantIds: number[];
+};
+export type EcdsaDerivationRoleLocalPasskeyBootstrapIdentity = Omit<EcdsaDerivationRoleLocalBootstrapIdentity, 'derivationClientSharePublicKey33B64u' | 'clientShareRetryCounter' | 'contextBinding32B64u'> & {
+    rpId: string;
+};
+export type SdkEcdsaDerivationBindingFacts = {
+    walletId: WalletId;
+    ecdsaThresholdKeyId: EcdsaThresholdKeyId;
+    signingRootId: SigningRootId;
+    signingRootVersion: SigningRootVersion;
+};
+export declare function parseSdkEcdsaDerivationThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
+export declare function parseSdkEcdsaDerivationSigningRootId(value: unknown): SigningRootId;
+export declare function parseSdkEcdsaDerivationSigningRootVersion(value: unknown): SigningRootVersion;
+export declare function encodeSdkEcdsaDerivationBindingFactsV1(input: SdkEcdsaDerivationBindingFacts): Uint8Array;
+export declare function computeSdkEcdsaDerivationApplicationBindingDigest32(input: SdkEcdsaDerivationBindingFacts): Promise<Uint8Array>;
+export declare function computeSdkEcdsaDerivationApplicationBindingDigestB64u(input: SdkEcdsaDerivationBindingFacts): Promise<string>;
+export declare function computeEcdsaDerivationRoleLocalThresholdKeyId(input: {
+    walletId: string;
+    evmFamilySigningKeySlotId: string;
+    signingRootId: string;
+    signingRootVersion: string;
+}): Promise<string>;
+export declare function computeEcdsaDerivationRoleLocalRelayerKeyId(input: {
+    walletId: string;
+    signingRootId: string;
+    signingRootVersion: string;
+}): Promise<string>;
+export declare function computeEcdsaDerivationRoleLocalFirstBootstrapRootProofDigest32(input: EcdsaDerivationRoleLocalBootstrapIdentity): Promise<Uint8Array>;
+export declare function computeEcdsaDerivationRoleLocalFirstBootstrapRootProofDigest32B64u(input: EcdsaDerivationRoleLocalBootstrapIdentity): Promise<string>;
+export declare function computeEcdsaDerivationRoleLocalPasskeyBootstrapAuthDigest32(input: EcdsaDerivationRoleLocalPasskeyBootstrapIdentity): Promise<Uint8Array>;
+export declare function computeEcdsaDerivationRoleLocalPasskeyBootstrapAuthDigest32B64u(input: EcdsaDerivationRoleLocalPasskeyBootstrapIdentity): Promise<string>;
+//# sourceMappingURL=ecdsaDerivationRoleLocalBootstrap.d.ts.map