@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/authorization/capabilityPolicy.d.ts

@@ -0,0 +1,45 @@
+import { type AuthorizationEvidenceKind, type AuthorizationEvidenceRequirement } from '../../../shared-ts/src/authorization/capabilityKinds';
+import type { VerifiedAuthorizationEvidenceSet } from './domain';
+export type ParseAuthorizationEvidenceRequirementResult = {
+    readonly kind: 'parsed';
+    readonly requirement: AuthorizationEvidenceRequirement;
+} | {
+    readonly kind: 'rejected';
+    readonly reason: {
+        readonly kind: 'invalid_requirement';
+        readonly message: string;
+    } | {
+        readonly kind: 'unsupported_evidence_kind';
+        readonly evidenceKind: string;
+    };
+};
+export type AuthorizationEvidenceRequirementEvaluation = {
+    readonly kind: 'satisfied';
+    readonly mode: AuthorizationEvidenceRequirement['mode'];
+    readonly matchedEvidenceKinds: readonly [
+        AuthorizationEvidenceKind,
+        ...AuthorizationEvidenceKind[]
+    ];
+} | {
+    readonly kind: 'unsatisfied';
+    readonly mode: 'all';
+    readonly missingEvidenceKinds: readonly [
+        AuthorizationEvidenceKind,
+        ...AuthorizationEvidenceKind[]
+    ];
+} | {
+    readonly kind: 'unsatisfied';
+    readonly mode: 'any';
+    readonly acceptableEvidenceKinds: readonly [
+        AuthorizationEvidenceKind,
+        ...AuthorizationEvidenceKind[]
+    ];
+};
+export interface CapabilityPolicyPort {
+    parseEvidenceRequirement(value: unknown): ParseAuthorizationEvidenceRequirementResult;
+    evaluateEvidenceRequirement(requirement: AuthorizationEvidenceRequirement, evidenceSet: VerifiedAuthorizationEvidenceSet): AuthorizationEvidenceRequirementEvaluation;
+}
+export declare function parseAuthorizationEvidenceRequirement(value: unknown): ParseAuthorizationEvidenceRequirementResult;
+export declare function evaluateAuthorizationEvidenceRequirement(requirement: AuthorizationEvidenceRequirement, evidenceSet: VerifiedAuthorizationEvidenceSet): AuthorizationEvidenceRequirementEvaluation;
+export declare const capabilityPolicyPort: CapabilityPolicyPort;
+//# sourceMappingURL=capabilityPolicy.d.ts.map

package/dist/types/wallet-server/src/authorization/capabilityPolicy.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capabilityPolicy.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.d.ts

@@ -0,0 +1,454 @@
+import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from '../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationRef, AuthorizationAuditEventId, AuthorizationGrantRef, AuthorizedOperationId, WalletSessionAuthorizationId, AuthorizationEvidenceId, AuthorizationEvidenceKind, HostedWalletSessionExchangeCodeId, MpcWalletSigningQuotaId, PrincipalId, WalletSessionMintId, TenantId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
+export { parseMpcWalletSigningQuotaId, parseWalletSessionId, } from '../../../shared-ts/src/authorization/capabilityKinds';
+export type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId, } from '../../../shared-ts/src/authorization/capabilityKinds';
+import type { CapabilityOperationEnvelope, CapabilityOperationFingerprintDigest } from '../../../shared-ts/src/authorization/operationFingerprint';
+import { type DomainId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../../../shared-ts/src/utils/domainIds';
+import type { ProviderSubject, WebAuthnCredentialIdB64u } from '../../../shared-ts/src/utils/domainIds';
+import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import type { AuthFactorIdentity, WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ActiveWalletAuthorityV1, WalletSignerActivationSetV1 } from '../../../shared-ts/src/authorization/walletAuthority';
+import { type ActiveWalletSessionV1, type WalletSessionOperationCredentialV1 } from '../../../shared-ts/src/device-linking';
+/** A server-only identity for one consumed owner authentication result. */
+export type VerifiedOwnerProofId = DomainId<'VerifiedOwnerProofId'>;
+export type HostedWalletSeamsSessionExchangeCode = DomainId<'HostedWalletSeamsSessionExchangeCode'>;
+export type HostedWalletSeamsSessionExchangeNonce = DomainId<'HostedWalletSeamsSessionExchangeNonce'>;
+export type HostedWalletSessionCredentialId = DomainId<'HostedWalletSessionCredentialId'>;
+export type PrimaryWalletSessionOperationCredentialToken = DomainId<'PrimaryWalletSessionOperationCredentialToken'>;
+export type HostedWalletSessionOperationCredentialToken = DomainId<'HostedWalletSessionOperationCredentialToken'>;
+export type SessionOrigin = DomainId<'SessionOrigin'>;
+export type { CapabilityOperationEnvelope, CapabilityOperationFingerprintDigest, } from '../../../shared-ts/src/authorization/operationFingerprint';
+export type OwnerOperationBinding = {
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly operation: CapabilityOperationRef;
+    readonly laneDigest: DigestB64u;
+    readonly intentDigest: DigestB64u;
+    readonly displayDigest: DigestB64u;
+};
+export type VerifiedOwnerProofMethod = AuthFactorIdentity['kind'];
+export type VerifiedOwnerProofCommon = {
+    readonly kind: 'verified_owner_proof_v1';
+    readonly proofId: VerifiedOwnerProofId;
+    readonly method: VerifiedOwnerProofMethod;
+    readonly authSource: {
+        readonly kind: 'passkey';
+        readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    } | {
+        readonly kind: 'oidc_provider';
+        readonly providerId: 'google_oidc' | 'oidc';
+        readonly providerSubject: ProviderSubject;
+    };
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authority: WalletAuthAuthorityRef;
+    readonly origin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly replayIdentity: string;
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type VerifiedOwnerProofFields = VerifiedOwnerProofCommon & ({
+    readonly purpose: 'wallet_session';
+    readonly operation?: never;
+} | {
+    readonly purpose: 'operation';
+    readonly operation: OwnerOperationBinding;
+});
+export type { VerifiedOwnerProof } from './factorEvidence';
+export type IssuedHostedWalletSeamsSessionExchangeV2 = {
+    readonly kind: 'issued_hosted_wallet_session_exchange_v2';
+    readonly tenantId: TenantId;
+    readonly exchangeCodeId: HostedWalletSessionExchangeCodeId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly codeHash: DigestB64u;
+    readonly nonceDigest: DigestB64u;
+    readonly appOrigin: SessionOrigin;
+    readonly walletOrigin: SessionOrigin;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type HostedWalletSeamsSessionExchangeDeliveryV2 = {
+    readonly kind: 'hosted_wallet_session_exchange_delivery_v2';
+    readonly exchangeCode: HostedWalletSeamsSessionExchangeCode;
+    readonly nonce: HostedWalletSeamsSessionExchangeNonce;
+    readonly appOrigin: SessionOrigin;
+    readonly walletOrigin: SessionOrigin;
+    readonly expiresAtMs: number;
+};
+export type HostedWalletSeamsSessionExchangeRejectionV2 = {
+    readonly kind: 'invalid_code' | 'expired' | 'already_consumed' | 'nonce_mismatch' | 'app_origin_mismatch' | 'wallet_origin_mismatch' | 'wallet_session_unavailable';
+};
+export type PersistedHostedWalletSeamsSessionExchangeV2Result = {
+    readonly kind: 'redeemed';
+    readonly tenantId: TenantId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly hostedCredentialId: HostedWalletSessionCredentialId;
+    readonly expiresAtMs: number;
+} | HostedWalletSeamsSessionExchangeRejectionV2;
+export type RedeemHostedWalletSeamsSessionExchangeV2Result = {
+    readonly kind: 'redeemed';
+    readonly walletSessionId: WalletSessionId;
+    readonly operationCredential: HostedWalletSessionOperationCredentialV1;
+    readonly expiresAtMs: number;
+} | HostedWalletSeamsSessionExchangeRejectionV2;
+export type RedeemHostedWalletSeamsSessionExchangeV2Input = {
+    readonly codeHash: DigestB64u;
+    readonly nonceDigest: DigestB64u;
+    readonly appOrigin: SessionOrigin;
+    readonly walletOrigin: SessionOrigin;
+    readonly tokenHash: DigestB64u;
+    readonly hostedCredentialId: HostedWalletSessionCredentialId;
+    readonly redeemedAtMs: number;
+};
+export type HostedWalletSessionOperationCredentialV1 = {
+    readonly kind: 'opaque_hosted_wallet_session_operation_credential_v1';
+    readonly token: HostedWalletSessionOperationCredentialToken;
+    readonly walletSessionId: WalletSessionId;
+};
+export type ResolvedHostedWalletSessionOperationCredentialV2 = {
+    readonly kind: 'resolved_hosted_wallet_session_operation_credential_v2';
+    readonly authorization: IssuedWalletSessionAuthorizationV2;
+    readonly hostedCredentialId: HostedWalletSessionCredentialId;
+    readonly appOrigin: SessionOrigin;
+    readonly walletOrigin: SessionOrigin;
+    readonly expiresAtMs: number;
+};
+export type VerifiedAuthorizationEvidence = {
+    readonly evidenceId: AuthorizationEvidenceId;
+    readonly evidenceKind: AuthorizationEvidenceKind;
+    readonly evidenceDigest: DigestB64u;
+};
+export type { VerifiedAuthorizationEvidenceSet } from './factorEvidence';
+export type ActiveWalletSessionQuota = {
+    readonly kind: 'active_wallet_session_quota';
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly remainingUses: number;
+    readonly expiresAtMs: number;
+};
+export type WalletSessionCapabilitySubjectV1 = {
+    readonly kind: 'sign';
+    readonly keyFamily: 'ed25519';
+    readonly materialActivation: MpcMaterialActivationRef;
+} | {
+    readonly kind: 'sign';
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly materialActivation: MpcMaterialActivationRef;
+} | {
+    readonly kind: 'export_keys';
+    readonly keyFamily: 'ed25519';
+    readonly materialActivation: MpcMaterialActivationRef;
+} | {
+    readonly kind: 'export_keys';
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly materialActivation: MpcMaterialActivationRef;
+} | {
+    readonly kind: 'link_devices';
+    readonly authorityId: WalletAuthorityId;
+} | {
+    readonly kind: 'revoke_devices';
+    readonly authorityId: WalletAuthorityId;
+};
+export type WalletSessionCapabilitySubjectsV1 = readonly [
+    WalletSessionCapabilitySubjectV1,
+    ...WalletSessionCapabilitySubjectV1[]
+];
+export type WalletSessionAuthorizationV2 = {
+    readonly kind: 'wallet_session_authorization_v2';
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly authorityDigestB64u: DigestB64u;
+    readonly authorityRevocationEpoch: number;
+    readonly mintId: WalletSessionMintId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly capabilitySubjects: WalletSessionCapabilitySubjectsV1;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type IssuedWalletSessionAuthorizationV2 = {
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ActiveWalletSessionQuota;
+};
+/**
+ * Quota lifecycle as persistence observes it. `ActiveWalletSessionQuota` cannot
+ * carry an exhausted quota because it requires a positive remaining count, yet
+ * status must still report exhaustion with the quota identity and expiry the
+ * exact authorization committed.
+ */
+export type ExactWalletSessionQuotaProjectionV1 = {
+    readonly kind: 'exact_wallet_session_quota_projection_v1';
+    readonly lifecycle: 'active' | 'exhausted';
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly remainingUses: number;
+    readonly expiresAtMs: number;
+};
+/**
+ * The digest-free exact status projection. Every branch that observed a stored
+ * authorization returns the whole `WalletSessionAuthorizationV2` record; the
+ * primary operation-credential digest that resolved the read never leaves
+ * persistence. Lifecycle outcomes are data — exceptions stay reserved for
+ * corrupt rows, disagreeing columns, broken foreign-key identity, and
+ * impossible state combinations.
+ */
+export type ExactWalletSessionStatusV2 = {
+    readonly kind: 'active' | 'exhausted' | 'expired' | 'authority_unavailable' | 'method_unavailable' | 'capability_unavailable';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ExactWalletSessionQuotaProjectionV1;
+    readonly retiredAtMs?: never;
+} | {
+    readonly kind: 'retired';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ExactWalletSessionQuotaProjectionV1;
+    readonly retiredAtMs: number;
+} | {
+    readonly kind: 'missing';
+    readonly session?: never;
+    readonly quota?: never;
+};
+export declare function buildExactWalletSessionQuotaProjectionV1(fields: Omit<ExactWalletSessionQuotaProjectionV1, 'kind'>): ExactWalletSessionQuotaProjectionV1;
+/**
+ * Every capability subject must resolve through the authoritative active
+ * authority that the authorization names. A signing or export subject resolves
+ * only when its key family is activated and names the same material the
+ * authority currently holds; an administration subject resolves only when it
+ * names that same authority. Anything else is a capability the caller can no
+ * longer exercise, not a corrupt row.
+ */
+export declare function exactWalletSessionCapabilitySubjectsResolveAuthority(input: {
+    readonly session: WalletSessionAuthorizationV2;
+    readonly signerActivations: WalletSignerActivationSetV1;
+}): boolean;
+/**
+ * The digest-free authorization projection published to the browser. It carries
+ * the exact wallet, authority, method, capability, and lifetime identity a
+ * reader needs to reconcile its own record, and never the credential digest.
+ */
+export declare function projectExactWalletSessionAuthorizationV1(session: WalletSessionAuthorizationV2): ActiveWalletSessionV1;
+export declare function projectActiveWalletSession(issued: IssuedWalletSessionAuthorizationV2): ActiveWalletSessionV1;
+/**
+ * The server-side aggregate that is safe to expose to persistence code after
+ * an exact Wallet Session commit. The credential digest never crosses the
+ * browser or wire response boundary.
+ */
+export type PersistedActiveWalletSessionAuthorizationV2 = {
+    readonly kind: 'persisted_active_wallet_session_authorization_v2';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ActiveWalletSessionQuota;
+    readonly primaryOperationCredentialDigestB64u: DigestB64u;
+    readonly retiredAtMs?: never;
+};
+export type WalletSessionAuthorizationV2MintLookup = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly mintId: WalletSessionMintId;
+};
+/**
+ * A credential-free readback of one committed issuance attempt. It remains
+ * readable after retirement so a retry can identify the original commit.
+ */
+export type WalletSessionAuthorizationV2MintRead = {
+    readonly kind: 'committed';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly primaryOperationCredentialDigestB64u: DigestB64u;
+    readonly retiredAtMs: number | null;
+};
+export type DirectV2CommitResult = {
+    readonly kind: 'inserted';
+} | {
+    readonly kind: 'already_committed';
+    readonly committed: WalletSessionAuthorizationV2MintRead;
+};
+export type DirectV2IssueResult = {
+    readonly kind: 'issued';
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ActiveWalletSessionQuota;
+    readonly operationCredential: WalletSessionOperationCredentialV1;
+} | {
+    readonly kind: 'already_committed';
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly mintId: WalletSessionMintId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly next: 'unlock_exact_method';
+};
+export declare function buildPersistedActiveWalletSessionAuthorizationV2(fields: {
+    readonly session: WalletSessionAuthorizationV2;
+    readonly quota: ActiveWalletSessionQuota;
+    readonly primaryOperationCredentialDigestB64u: DigestB64u;
+}): PersistedActiveWalletSessionAuthorizationV2;
+export declare function buildWalletSessionCapabilitySubjectsV1(authority: ActiveWalletAuthorityV1): WalletSessionCapabilitySubjectsV1;
+export declare function buildWalletSessionAuthorizationV2(fields: Omit<WalletSessionAuthorizationV2, 'kind'>): WalletSessionAuthorizationV2;
+export declare function walletSessionCapabilitySubjectsV1Equal(left: WalletSessionCapabilitySubjectsV1, right: WalletSessionCapabilitySubjectsV1): boolean;
+export declare function walletSessionAuthorizationV2RecordsEqual(left: WalletSessionAuthorizationV2, right: WalletSessionAuthorizationV2): boolean;
+export declare function parseWalletSessionAuthorizationV2(value: unknown): WalletSessionAuthorizationV2;
+export type OperationAuthorizationSource = {
+    readonly kind: 'authorization_grant';
+    readonly authorizationGrantRef: AuthorizationGrantRef;
+    readonly evidenceSetDigest?: never;
+} | {
+    readonly kind: 'verified_step_up';
+    readonly authorizationGrantRef?: never;
+    readonly evidenceSetDigest: DigestB64u;
+};
+export type OwnerOperationStepUpReason = 'wallet_session_missing' | 'wallet_session_expired' | 'wallet_session_exhausted' | 'wallet_session_ended' | 'wallet_session_superseded';
+export type OwnerOperationAuthorizationDenial = {
+    readonly code: 'invalid_identity' | 'invalid_authority' | 'invalid_operation' | 'inactive_material' | 'replayed_step_up' | 'authorization_unavailable';
+    readonly message: string;
+};
+export type OwnerOperationAuthorizationSource = {
+    readonly kind: 'authorization_grant';
+    readonly authorizationGrantRef: Extract<AuthorizationGrantRef, {
+        readonly kind: 'wallet_session_authorization';
+    }>;
+    readonly evidenceSetDigest?: never;
+} | Extract<OperationAuthorizationSource, {
+    readonly kind: 'verified_step_up';
+}>;
+export type OwnerOperationAuthorizationDecision<TStepUpPreparation> = {
+    readonly kind: 'authorized';
+    readonly operation: AuthorizedOperation & {
+        readonly lifecycle: 'claimed';
+    };
+    readonly source: OwnerOperationAuthorizationSource;
+    readonly stepUp?: never;
+    readonly denial?: never;
+} | {
+    readonly kind: 'step_up_required';
+    readonly reason: OwnerOperationStepUpReason;
+    readonly stepUp: TStepUpPreparation;
+    readonly operation?: never;
+    readonly source?: never;
+    readonly denial?: never;
+} | {
+    readonly kind: 'denied';
+    readonly denial: OwnerOperationAuthorizationDenial;
+    readonly operation?: never;
+    readonly source?: never;
+    readonly stepUp?: never;
+};
+type AuthorizedOperationLifecycle = {
+    readonly lifecycle: 'claimed';
+    readonly result?: never;
+    readonly response?: never;
+    readonly resultDigest?: never;
+    readonly completedAtMs?: never;
+} | {
+    readonly lifecycle: 'completed';
+    readonly result: CompletedCapabilityOperationResult;
+    readonly response: AuthorizedOperationReplayResponse;
+    readonly resultDigest: DigestB64u;
+    readonly completedAtMs: number;
+};
+export type AuthorizedOperation = AuthorizedOperationLifecycle & {
+    readonly kind: 'authorized_operation';
+    readonly tenantId: TenantId;
+    readonly authorizedOperationId: AuthorizedOperationId;
+    readonly auditEventId: AuthorizationAuditEventId;
+    readonly claimedAtMs: number;
+    readonly operation: CapabilityOperationEnvelope;
+    readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
+    readonly authorization: OperationAuthorizationSource;
+    readonly quota: {
+        readonly kind: 'consume_reusable_wallet_session';
+        readonly quotaId: MpcWalletSigningQuotaId;
+    } | {
+        readonly kind: 'quota_neutral';
+        readonly quotaId?: never;
+    };
+};
+type AuthorizedOperationInputFields = {
+    readonly tenantId: TenantId;
+    readonly authorizedOperationId: AuthorizedOperationId;
+    readonly auditEventId: AuthorizationAuditEventId;
+    readonly claimedAtMs: number;
+};
+type NearOperationRef = Extract<CapabilityOperationRef, {
+    readonly capabilityKind: typeof CAPABILITY_KINDS.nearEd25519MpcSigning;
+}>;
+type EvmOperationRef = Extract<CapabilityOperationRef, {
+    readonly capabilityKind: typeof CAPABILITY_KINDS.evmEcdsaMpcSigning;
+}>;
+type ReusableSigningOperationRef = (NearOperationRef & {
+    readonly operationKind: Exclude<NearOperationRef['operationKind'], (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['exportKey']>;
+}) | (EvmOperationRef & {
+    readonly operationKind: Exclude<EvmOperationRef['operationKind'], (typeof EVM_ECDSA_MPC_OPERATION_KINDS)['exportKey']>;
+});
+type QuotaNeutralOperationRef = Extract<CapabilityOperationRef, {
+    readonly capabilityKind: typeof CAPABILITY_KINDS.vaultAccess;
+}> | (NearOperationRef & {
+    readonly operationKind: (typeof NEAR_ED25519_MPC_OPERATION_KINDS)['exportKey'];
+}) | (EvmOperationRef & {
+    readonly operationKind: (typeof EVM_ECDSA_MPC_OPERATION_KINDS)['exportKey'];
+});
+type AuthorizationGrantSource = Extract<OperationAuthorizationSource, {
+    readonly kind: 'authorization_grant';
+}>;
+type VerifiedStepUpSource = Extract<OperationAuthorizationSource, {
+    readonly kind: 'verified_step_up';
+}>;
+type ConsumingQuota = {
+    readonly kind: 'consume_reusable_wallet_session';
+    readonly quotaId: MpcWalletSigningQuotaId;
+};
+type QuotaNeutral = {
+    readonly kind: 'quota_neutral';
+    readonly quotaId?: never;
+};
+export type AuthorizedOperationInput = (AuthorizedOperationInputFields & {
+    readonly operation: CapabilityOperationEnvelope<ReusableSigningOperationRef>;
+    readonly authorization: AuthorizationGrantSource;
+    readonly quota: ConsumingQuota;
+}) | (AuthorizedOperationInputFields & {
+    readonly operation: CapabilityOperationEnvelope<QuotaNeutralOperationRef>;
+    readonly authorization: AuthorizationGrantSource;
+    readonly quota: QuotaNeutral;
+}) | (AuthorizedOperationInputFields & {
+    readonly operation: CapabilityOperationEnvelope;
+    readonly authorization: VerifiedStepUpSource;
+    readonly quota: QuotaNeutral;
+});
+export declare function buildAuthorizedOperation(input: AuthorizedOperationInput): Promise<AuthorizedOperation>;
+export type CompletedCapabilityOperationResult = 'succeeded' | 'failed_before_side_effect' | 'failed_after_side_effect';
+export type AuthorizedOperationReplayResponse = {
+    readonly status: number;
+    readonly contentType: string;
+    readonly bodyText: string;
+};
+export declare const AUTHORIZED_OPERATION_REPLAY_BODY_MAX_BYTES: number;
+export declare function parseAuthorizedOperationReplayResponse(value: unknown): AuthorizedOperationReplayResponse;
+export declare function authorizedOperationReplayBodyInit(response: AuthorizedOperationReplayResponse): string | null;
+export declare function computeAuthorizedOperationResultDigest(response: AuthorizedOperationReplayResponse): Promise<DigestB64u>;
+export declare function parseHostedWalletSeamsSessionExchangeCode(value: unknown): HostedWalletSeamsSessionExchangeCode;
+export declare function parseVerifiedOwnerProofId(value: unknown): VerifiedOwnerProofId;
+export declare function parseHostedWalletSeamsSessionExchangeNonce(value: unknown): HostedWalletSeamsSessionExchangeNonce;
+export declare function parseHostedWalletSessionCredentialId(value: unknown): HostedWalletSessionCredentialId;
+export declare function parseHostedWalletSessionOperationCredentialV1(raw: unknown): HostedWalletSessionOperationCredentialV1;
+export declare function parsePrimaryWalletSessionOperationCredentialToken(value: unknown): PrimaryWalletSessionOperationCredentialToken;
+export declare function parseHostedWalletSessionOperationCredentialToken(value: unknown): HostedWalletSessionOperationCredentialToken;
+export declare function parseSessionOrigin(value: unknown): SessionOrigin;
+export declare function buildActiveWalletSessionQuota(fields: Omit<ActiveWalletSessionQuota, 'kind'>): ActiveWalletSessionQuota;
+//# sourceMappingURL=domain.d.ts.map

package/dist/types/wallet-server/src/authorization/domain.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=domain.typecheck.d.ts.map

package/dist/types/wallet-server/src/authorization/factorEvidence.d.ts

@@ -0,0 +1,165 @@
+import { type AuthFactorId, type CapabilityOperationRef, type AuthorizationEvidenceId, type AuthorizationEvidenceSetId, type PrincipalId, type TenantId } from '../../../shared-ts/src/authorization/capabilityKinds';
+import { type CapabilityOperationEnvelope } from '../../../shared-ts/src/authorization/operationFingerprint';
+import type { DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import { type EmailOtpChallengeId, type WalletId, type WebAuthnCredentialIdB64u } from '../../../shared-ts/src/utils/domainIds';
+import { type WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
+import type { OwnerOperationBinding, SessionOrigin, VerifiedOwnerProofFields, VerifiedAuthorizationEvidence, VerifiedOwnerProofId, VerifiedOwnerProofMethod } from './domain';
+type VerifiedWalletOperationEvidenceSetFields = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly requestOrigin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly evidenceSetId: AuthorizationEvidenceSetId;
+    readonly evidence: readonly [VerifiedAuthorizationEvidence, ...VerifiedAuthorizationEvidence[]];
+    readonly evidenceSetDigest: DigestB64u;
+    readonly operation: CapabilityOperationRef;
+    readonly laneDigest: DigestB64u;
+    readonly intentDigest: DigestB64u;
+    readonly displayDigest: DigestB64u;
+    readonly assurance: 'step_up';
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+};
+declare class VerifiedWalletOperationEvidenceSetProof {
+    readonly kind: "verified_wallet_operation_evidence_set";
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly requestOrigin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly evidenceSetId: AuthorizationEvidenceSetId;
+    readonly evidence: readonly [VerifiedAuthorizationEvidence, ...VerifiedAuthorizationEvidence[]];
+    readonly evidenceSetDigest: DigestB64u;
+    readonly operation: CapabilityOperationRef;
+    readonly laneDigest: DigestB64u;
+    readonly intentDigest: DigestB64u;
+    readonly displayDigest: DigestB64u;
+    readonly assurance: "step_up";
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+    private retainVerifiedEvidenceProof;
+    constructor(fields: VerifiedWalletOperationEvidenceSetFields);
+}
+export type VerifiedAuthorizationEvidenceSet = VerifiedWalletOperationEvidenceSetProof;
+type VerifiedWalletOperationFactorBinding = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly requestOrigin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly factorId: AuthFactorId;
+    readonly operation: CapabilityOperationEnvelope;
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type VerifiedWalletOperationPasskeyFactorResult = VerifiedWalletOperationFactorBinding & {
+    readonly kind: 'verified_wallet_operation_passkey_factor';
+    readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    readonly assertionDigest: DigestB64u;
+};
+export type VerifiedWalletOperationEmailOtpFactorResult = VerifiedWalletOperationFactorBinding & {
+    readonly kind: 'verified_wallet_operation_email_otp_factor';
+    readonly challengeId: EmailOtpChallengeId;
+    readonly verificationReceiptDigest: DigestB64u;
+};
+export type VerifiedWalletOperationFactorResult = VerifiedWalletOperationPasskeyFactorResult | VerifiedWalletOperationEmailOtpFactorResult;
+type VerifiedWalletSessionFactorBinding = {
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly requestOrigin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly factorId: AuthFactorId;
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type VerifiedWalletSessionPasskeyFactorResult = VerifiedWalletSessionFactorBinding & {
+    readonly kind: 'verified_wallet_session_passkey_factor';
+    readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    readonly assertionDigest: DigestB64u;
+};
+export type VerifiedWalletSessionEmailOtpFactorResult = VerifiedWalletSessionFactorBinding & {
+    readonly kind: 'verified_wallet_session_email_otp_factor';
+    readonly challengeId: EmailOtpChallengeId;
+    readonly verificationReceiptDigest: DigestB64u;
+};
+export type VerifiedWalletSessionFactorResult = VerifiedWalletSessionPasskeyFactorResult | VerifiedWalletSessionEmailOtpFactorResult;
+export type VerifiedWalletOperationFactorEvidenceSetInput = {
+    readonly operation: CapabilityOperationEnvelope;
+    readonly evidenceId: AuthorizationEvidenceId;
+    readonly evidenceSetId: AuthorizationEvidenceSetId;
+    readonly factor: VerifiedWalletOperationFactorResult;
+};
+export type VerifiedOwnerProofInput = {
+    readonly purpose: 'wallet_session';
+    readonly proofId: VerifiedOwnerProofId;
+    readonly factor: VerifiedWalletSessionFactorResult;
+} | {
+    readonly purpose: 'operation';
+    readonly proofId: VerifiedOwnerProofId;
+    readonly factor: VerifiedWalletOperationFactorResult;
+};
+export declare function buildVerifiedWalletOperationPasskeyFactorResult(fields: Omit<VerifiedWalletOperationPasskeyFactorResult, 'kind'>): VerifiedWalletOperationPasskeyFactorResult;
+export declare function buildVerifiedWalletOperationEmailOtpFactorResult(fields: Omit<VerifiedWalletOperationEmailOtpFactorResult, 'kind'>): VerifiedWalletOperationEmailOtpFactorResult;
+export declare function buildVerifiedWalletSessionPasskeyFactorResult(fields: Omit<VerifiedWalletSessionPasskeyFactorResult, 'kind'>): VerifiedWalletSessionPasskeyFactorResult;
+export declare function buildVerifiedWalletSessionEmailOtpFactorResult(fields: Omit<VerifiedWalletSessionEmailOtpFactorResult, 'kind'>): VerifiedWalletSessionEmailOtpFactorResult;
+/** Nominal server-only owner proofs; private constructors block browser forgery. */
+declare class VerifiedOwnerWalletSessionProof {
+    private readonly __proofBrand;
+    readonly kind: "verified_owner_proof_v1";
+    readonly proofId: VerifiedOwnerProofId;
+    readonly method: VerifiedOwnerProofMethod;
+    readonly authSource: VerifiedOwnerProofFields['authSource'];
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authority: WalletAuthAuthorityRef;
+    readonly origin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly replayIdentity: string;
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+    readonly purpose: "wallet_session";
+    readonly operation?: never;
+    constructor(fields: Extract<VerifiedOwnerProofFields, {
+        readonly purpose: 'wallet_session';
+    }>);
+}
+declare class VerifiedOwnerOperationProof {
+    private readonly __proofBrand;
+    readonly kind: "verified_owner_proof_v1";
+    readonly proofId: VerifiedOwnerProofId;
+    readonly method: VerifiedOwnerProofMethod;
+    readonly authSource: VerifiedOwnerProofFields['authSource'];
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly walletId: WalletId;
+    readonly authority: WalletAuthAuthorityRef;
+    readonly origin: SessionOrigin;
+    readonly audience: SessionOrigin;
+    readonly replayIdentity: string;
+    readonly verifiedAtMs: number;
+    readonly expiresAtMs: number;
+    readonly purpose: "operation";
+    readonly operation: OwnerOperationBinding;
+    constructor(fields: Extract<VerifiedOwnerProofFields, {
+        readonly purpose: 'operation';
+    }>);
+}
+export type VerifiedOwnerProof = VerifiedOwnerWalletSessionProof | VerifiedOwnerOperationProof;
+export declare function buildVerifiedOwnerProof(input: Extract<VerifiedOwnerProofInput, {
+    readonly purpose: 'wallet_session';
+}>): Promise<VerifiedOwnerWalletSessionProof>;
+export declare function buildVerifiedOwnerProof(input: Extract<VerifiedOwnerProofInput, {
+    readonly purpose: 'operation';
+}>): Promise<VerifiedOwnerOperationProof>;
+export declare function buildVerifiedOwnerProof(input: VerifiedOwnerProofInput): Promise<VerifiedOwnerProof>;
+export declare function buildVerifiedWalletOperationFactorEvidenceSet(input: VerifiedWalletOperationFactorEvidenceSetInput): Promise<VerifiedAuthorizationEvidenceSet>;
+export declare function parseVerifiedAuthorizationEvidenceSetFromPersistence(raw: unknown): VerifiedAuthorizationEvidenceSet;
+export {};
+//# sourceMappingURL=factorEvidence.d.ts.map

package/dist/types/wallet-server/src/authorization/factorEvidence.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=factorEvidence.typecheck.d.ts.map