@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/RegistrationCeremonyStore.d.ts

@@ -0,0 +1,551 @@
+import type { EcdsaDerivationServerBootstrapResponse } from './types';
+import type { AddAuthMethodIntentGrant, AddAuthMethodIntentV1, AddSignerIntentGrant, AddSignerIntentV1, RegistrationIntentV1, WalletAddSignerStartResponse, WalletAddSignerFinalizeRequest, WalletAddAuthMethodFinalizeResponse, WalletAddSignerFinalizeResponse, WalletAddAuthMethodRegistrationOptions, WalletRegistrationStartResponse, WalletId } from './registrationContracts';
+import type { RegistrationAuthority, RegistrationSignerPlan, RegistrationSignerBranchKey } from '../../../shared-ts/src/utils/registrationIntent';
+import { type PasskeyCustodyEnvelopeRecord } from '../../../shared-ts/src/passkey-custody';
+import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../shared-ts/src/utils/domainIds';
+import { type DeviceId } from '../../../shared-ts/src/authorization/capabilityKinds';
+import type { NormalizedLogger } from './logger';
+import { type DigestB64u } from '../../../shared-ts/src/utils/canonicalPrimitives';
+import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
+import { type ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoActivationResultV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
+import type { RouterAbEcdsaDerivationPublicCapabilityV1, RouterAbEcdsaRegistrationActivationReceiptV1, RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaStrictForwardedRegistrationResponseV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RouterAbEcdsaPendingActivationV1 } from '../router/domains/ecdsa/routerAbEcdsaStrictRegistration';
+import type { WalletEd25519SignerRecord } from './WalletStore';
+import { type WalletAuthAuthorityRef } from '../../../shared-ts/src/utils/walletAuthAuthority';
+export type StoredAddSignerIntent = {
+    kind: 'add_signer_intent_allocated';
+    grant: AddSignerIntentGrant;
+    intent: AddSignerIntentV1;
+    digestB64u: string;
+    orgId: string;
+    signingRootId?: string;
+    signingRootVersion?: string;
+    expectedOrigin?: string;
+    expiresAtMs: number;
+    consumedAtMs?: never;
+};
+export type ConsumedAddSignerIntent = Omit<StoredAddSignerIntent, 'kind' | 'consumedAtMs'> & {
+    kind: 'add_signer_intent_consumed';
+    consumedAtMs: number;
+};
+export type StoredAddAuthMethodIntent = {
+    kind: 'add_auth_method_intent_allocated';
+    grant: AddAuthMethodIntentGrant;
+    intent: AddAuthMethodIntentV1;
+    digestB64u: string;
+    orgId: string;
+    signingRootId?: string;
+    signingRootVersion?: string;
+    expectedOrigin?: string;
+    expiresAtMs: number;
+    consumedAtMs?: never;
+};
+export type ConsumedAddAuthMethodIntent = Omit<StoredAddAuthMethodIntent, 'kind' | 'consumedAtMs'> & {
+    kind: 'add_auth_method_intent_consumed';
+    consumedAtMs: number;
+};
+export type StoredRegistrationWebAuthnCredential = {
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+};
+export type StoredRegistrationAuthority = RegistrationAuthority;
+type WalletRegistrationEcdsaStartPayload = NonNullable<Extract<WalletRegistrationStartResponse, {
+    ok: true;
+}>['ecdsa']>;
+type WalletAddSignerEcdsaStartPayload = Omit<NonNullable<Extract<WalletAddSignerStartResponse, {
+    ok: true;
+}>['ecdsa']>, 'custodyEnvelope'>;
+export type StoredWalletRegistrationRuntimePolicyContext = {
+    kind: 'runtime_policy_scope';
+    scope: RuntimePolicyScope;
+} | {
+    kind: 'signing_root_only';
+    scope?: never;
+};
+export type StoredWalletRegistrationEcdsaPreparedContext = {
+    kind: 'evm_family_ecdsa_requested';
+    chainTargets: readonly ThresholdEcdsaChainTarget[];
+} | {
+    kind: 'evm_family_ecdsa_absent';
+    chainTargets?: never;
+};
+export type StoredWalletRegistrationPreparedContext = {
+    kind: 'wallet_registration_prepared_context_v1';
+    signingRootId: string;
+    signingRootVersion: string;
+    runtimePolicy: StoredWalletRegistrationRuntimePolicyContext;
+    ecdsa: StoredWalletRegistrationEcdsaPreparedContext;
+};
+export declare function buildStoredWalletRegistrationPreparedContext(input: {
+    signingRootId: string;
+    signingRootVersion: string;
+    runtimePolicyScope: RuntimePolicyScope | null;
+    ecdsaChainTargets: readonly ThresholdEcdsaChainTarget[] | null;
+}): StoredWalletRegistrationPreparedContext;
+export declare function storedWalletRegistrationPreparedContextsMatch(left: StoredWalletRegistrationPreparedContext, right: StoredWalletRegistrationPreparedContext): boolean;
+export declare function storedRegistrationAuthoritiesMatch(left: StoredRegistrationAuthority, right: StoredRegistrationAuthority): boolean;
+type StoredEcdsaRegistrationBase = Omit<WalletRegistrationEcdsaStartPayload, 'kind'> & {
+    derivationKind: WalletRegistrationEcdsaStartPayload['kind'];
+    strictRegistrationBindingJson: string;
+};
+export type StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch = StoredEcdsaRegistrationBase & {
+    kind: 'evm_family_ecdsa_prepared';
+    branchKey: RegistrationSignerBranchKey;
+};
+export type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch = StoredEcdsaRegistrationBase & {
+    kind: 'evm_family_ecdsa_pending_activation';
+    branchKey: RegistrationSignerBranchKey;
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    pendingActivation: RouterAbEcdsaPendingActivationV1;
+    publicResponse: RouterAbEcdsaStrictForwardedRegistrationResponseV1;
+};
+export type StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch = StoredEcdsaRegistrationBase & {
+    kind: 'evm_family_ecdsa_response_claimed';
+    branchKey: RegistrationSignerBranchKey;
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+};
+export type StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch = StoredEcdsaRegistrationBase & {
+    kind: 'evm_family_ecdsa_activation_claimed';
+    branchKey: RegistrationSignerBranchKey;
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    pendingActivation: RouterAbEcdsaPendingActivationV1;
+    publicResponse: RouterAbEcdsaStrictForwardedRegistrationResponseV1;
+    publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    activationRequestDigestB64u: string;
+    /**
+     * The activate operation (idempotency key) that claimed this activation.
+     * One owner per ceremony: only the claiming operation may resume the
+     * claim or read its result, so a second activate with a different key
+     * cannot adopt the claim and re-run custody. Empty only on rows written
+     * before this field existed.
+     */
+    activationOwner: string;
+};
+export type StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch = StoredEcdsaRegistrationBase & {
+    kind: 'evm_family_ecdsa_activated';
+    branchKey: RegistrationSignerBranchKey;
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    activation: RouterAbEcdsaRegistrationActivationReceiptV1;
+    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    bootstrap: EcdsaDerivationServerBootstrapResponse;
+    /** Carried from the claim: only the owning operation may read this result back. */
+    activationOwner: string;
+};
+/**
+ * The ECDSA signer is durable and the wallet is usable. Reached only on a plan
+ * that also has an Ed25519 branch: registration returns ECDSA-ready here and
+ * the ceremony stays open for the Ed25519 finalize (Refactor 94 Phase 4+5).
+ * On an ECDSA-only plan the ceremony is deleted instead, so this state never
+ * appears.
+ */
+export type StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch = StoredEcdsaRegistrationBase & {
+    kind: 'evm_family_ecdsa_finalized';
+    branchKey: RegistrationSignerBranchKey;
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    activation: RouterAbEcdsaRegistrationActivationReceiptV1;
+    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    bootstrap: EcdsaDerivationServerBootstrapResponse;
+    finalizedAtMs: number;
+};
+export type StoredWalletRegistrationNearEd25519YaoAuthorizedBranch = {
+    kind: 'near_ed25519_yao_authorized';
+    branchKey: RegistrationSignerBranchKey;
+    admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+};
+export type StoredWalletRegistrationSignerBranch = StoredWalletRegistrationNearEd25519YaoAuthorizedBranch | StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch | StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch | StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch | StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
+export type StoredWalletRegistrationSignerSetState = {
+    kind: 'signer_set_registration';
+    branches: readonly StoredWalletRegistrationSignerBranch[];
+};
+export type StoredWalletRegistrationEvmFamilyEcdsaBranch = StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch | StoredWalletRegistrationEvmFamilyEcdsaResponseClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch | StoredWalletRegistrationEvmFamilyEcdsaActivationClaimedBranch | StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch | StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
+export declare function buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch(input: {
+    readonly activated: StoredWalletRegistrationEvmFamilyEcdsaActivatedBranch;
+    readonly finalizedAtMs: number;
+}): StoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch;
+export declare function buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch(input: {
+    readonly branchKey: RegistrationSignerBranchKey;
+    readonly ecdsa: {
+        readonly kind: StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch['derivationKind'];
+        readonly chainTargets: StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch['chainTargets'];
+        readonly prepare: StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch['prepare'];
+        readonly strictRegistration: StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch['strictRegistration'];
+        readonly strictRegistrationBindingJson: string;
+    };
+}): StoredWalletRegistrationEvmFamilyEcdsaPreparedBranch;
+export declare function buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch(input: {
+    readonly branchKey: RegistrationSignerBranchKey;
+    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+}): StoredWalletRegistrationNearEd25519YaoAuthorizedBranch;
+export declare function findStoredWalletRegistrationNearEd25519YaoBranch(state: StoredWalletRegistrationSignerSetState): StoredWalletRegistrationNearEd25519YaoAuthorizedBranch | null;
+export declare function findStoredWalletRegistrationEvmFamilyEcdsaBranch(state: StoredWalletRegistrationSignerSetState): StoredWalletRegistrationEvmFamilyEcdsaBranch | null;
+export declare function replaceStoredWalletRegistrationSignerBranch(input: {
+    readonly state: StoredWalletRegistrationSignerSetState;
+    readonly replacement: StoredWalletRegistrationSignerBranch;
+}): StoredWalletRegistrationSignerSetState;
+export type StoredWalletRegistrationFailed = {
+    kind: 'registration_failed';
+    failedAtMs: number;
+    failure: {
+        code: string;
+        message: string;
+    };
+    ceremonyHandle?: never;
+    preparedSession?: never;
+    clientOtOfferMessageB64u?: never;
+    prepare?: never;
+    walletKeys?: never;
+    responded?: never;
+    completed?: never;
+};
+export type StoredWalletRegistrationSignerState = StoredWalletRegistrationSignerSetState | StoredWalletRegistrationFailed;
+/**
+ * Refactor 94C. A registration ceremony now exists before its authority proof
+ * does.
+ *
+ * `/wallets/register/setup` issues the challenge the client's WebAuthn create
+ * must sign, so the ceremony — and the Router preparation work bound to it —
+ * is necessarily created *before* the user has touched the sensor. The proof
+ * arrives one leg later, on `/wallets/register/respond`, which binds it.
+ *
+ * This is a union rather than an optional field so that no reader can consume
+ * an authority that has not been verified: the awaiting arm carries only the
+ * requested auth method, which is public intent data, and offers no
+ * `authority` to read.
+ */
+export type StoredWalletRegistrationCeremonyAuthorityState = {
+    kind: 'awaiting_proof';
+    /** The requested method, echoed from the intent; not evidence of anything. */
+    authMethod: RegistrationIntentV1['authMethod'];
+    authority?: never;
+} | {
+    kind: 'verified';
+    authority: StoredRegistrationAuthority;
+    authMethod?: never;
+};
+type StoredWalletRegistrationCeremonyBase = {
+    registrationCeremonyId: string;
+    foundingWalletAuthorityId: WalletAuthorityId;
+    foundingDeviceId: DeviceId;
+    foundingWalletAuthMethodId: WalletAuthMethodId;
+    intent: RegistrationIntentV1;
+    digestB64u: string;
+    signerPlan: RegistrationSignerPlan;
+    preparedContext: StoredWalletRegistrationPreparedContext;
+    orgId: string;
+    signingRootId?: string;
+    signingRootVersion?: string;
+    expectedOrigin?: string;
+    expiresAtMs: number;
+    authorityState: StoredWalletRegistrationCeremonyAuthorityState;
+};
+export type StoredWalletRegistrationCeremony = StoredWalletRegistrationCeremonyBase & {
+    signerState: StoredWalletRegistrationSignerState;
+};
+/**
+ * The verified authority, or `null` while the ceremony is still awaiting its
+ * proof. Legs downstream of respond (activation, finalization, persistence)
+ * require a verified authority and treat `null` as an invalid state rather
+ * than a missing field.
+ */
+export declare function verifiedRegistrationCeremonyAuthority(ceremony: {
+    readonly authorityState: StoredWalletRegistrationCeremonyAuthorityState;
+}): StoredRegistrationAuthority | null;
+export declare function registrationCeremonyAuthorityRpId(authorityState: StoredWalletRegistrationCeremonyAuthorityState): string | null;
+export type TerminalRegistrationCeremonyCancellationResult = {
+    kind: 'cancelled';
+    ceremonyDeleted: true;
+} | {
+    kind: 'not_found';
+    ceremonyDeleted: false;
+};
+export declare function parseTerminalRegistrationCeremonyCancellationResult(value: unknown): TerminalRegistrationCeremonyCancellationResult | null;
+type StoredEcdsaAddSignerBase = Omit<WalletAddSignerEcdsaStartPayload, 'kind'> & {
+    derivationKind: WalletAddSignerEcdsaStartPayload['kind'];
+};
+export type StoredEcdsaAddSignerPrepared = StoredEcdsaAddSignerBase & {
+    kind: 'ecdsa_add_signer_prepared';
+    pendingActivation?: never;
+    publicResponse?: never;
+    publicFacts?: never;
+    activation?: never;
+    bootstrap?: never;
+};
+export type StoredEcdsaAddSignerPendingActivation = StoredEcdsaAddSignerBase & {
+    kind: 'ecdsa_add_signer_pending_activation';
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    pendingActivation: RouterAbEcdsaPendingActivationV1;
+    publicResponse: RouterAbEcdsaStrictForwardedRegistrationResponseV1;
+    publicFacts?: never;
+    activation?: never;
+    bootstrap?: never;
+};
+/**
+ * The prepared activation coordinates, recorded before any Router custody work
+ * runs. The client computed the activation request digest from the canonical
+ * add-signer activation command; a retry after a crash between the Router
+ * commit and the store update finds this claim, must present the exact same
+ * coordinates, and replays the canonical Router activation to completion.
+ */
+export type StoredEcdsaAddSignerActivationClaimed = StoredEcdsaAddSignerBase & {
+    kind: 'ecdsa_add_signer_activation_claimed';
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    pendingActivation: RouterAbEcdsaPendingActivationV1;
+    publicResponse: RouterAbEcdsaStrictForwardedRegistrationResponseV1;
+    publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    activationRequestDigestB64u: string;
+    activation?: never;
+    bootstrap?: never;
+};
+export type StoredEcdsaAddSignerActivated = StoredEcdsaAddSignerBase & {
+    kind: 'ecdsa_add_signer_activated';
+    pendingActivation?: never;
+    publicResponse?: never;
+    registrationRequest: RouterAbEcdsaRegistrationRequestV1;
+    publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+    /** Carried from the claim so a replay is judged against what this server
+     * committed to, not against what the Router echoed back. */
+    activationRequestDigestB64u: string;
+    activation: RouterAbEcdsaRegistrationActivationReceiptV1;
+    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    bootstrap: EcdsaDerivationServerBootstrapResponse;
+};
+export type StoredEd25519YaoAddSignerAuthorized = {
+    kind: 'near_ed25519_yao_add_signer_authorized';
+    admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+};
+export type StoredEd25519YaoAddSignerActivation = {
+    finalizeRequest: Extract<StoredWalletAddSignerFinalizeRequest, {
+        kind: 'near_ed25519';
+    }>;
+    activation: {
+        admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+        admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+        result: RouterAbEd25519YaoActivationResultV1<'registration'>;
+    };
+};
+export type StoredEd25519YaoAddSignerActivated = StoredEd25519YaoAddSignerActivation & {
+    kind: 'near_ed25519_yao_add_signer_activated';
+};
+export type StoredEd25519YaoAddSignerFinalizing = StoredEd25519YaoAddSignerActivation & {
+    kind: 'near_ed25519_yao_add_signer_finalizing';
+    response: Extract<Extract<WalletAddSignerFinalizeResponse, {
+        ok: true;
+    }>, {
+        kind: 'near_ed25519';
+    }>;
+    signer: WalletEd25519SignerRecord;
+    finalizingAtMs: number;
+};
+export type StoredWalletAddSignerSignerState = StoredEcdsaAddSignerPrepared | StoredEcdsaAddSignerPendingActivation | StoredEcdsaAddSignerActivationClaimed | StoredEcdsaAddSignerActivated | StoredEd25519YaoAddSignerAuthorized | StoredEd25519YaoAddSignerActivated | StoredEd25519YaoAddSignerFinalizing;
+export type StoredWalletAddSignerCeremony = {
+    addSignerCeremonyId: string;
+    intent: AddSignerIntentV1;
+    digestB64u: string;
+    orgId: string;
+    signingRootId: string;
+    signingRootVersion: string;
+    expiresAtMs: number;
+    auth: {
+        kind: 'webauthn_assertion';
+        rpId: string;
+        credentialIdB64u: string;
+    };
+    signerState: StoredWalletAddSignerSignerState;
+};
+export type StoredWalletAddSignerFinalizeReplay = {
+    kind: 'wallet_add_signer_finalize_replay_v1';
+    addSignerCeremonyId: string;
+    idempotencyKey: string;
+    request: StoredWalletAddSignerFinalizeRequest;
+    response: Extract<WalletAddSignerFinalizeResponse, {
+        ok: true;
+    }>;
+    createdAtMs: number;
+    expiresAtMs: number;
+};
+/**
+ * Refactor 103 Phase 8: an add-auth-method finalize that already succeeded.
+ *
+ * Finalize consumes its ceremony, so a client that lost the response has no way
+ * to ask again — the ceremony is gone and the credential is already registered.
+ * This record is what makes the retry answerable, and it is written in the same
+ * batch as the credential, custody envelope, auth method, and owner binding so
+ * a stored response always describes work that actually landed.
+ *
+ * `requestDigestB64u` covers the ceremony, the normalized request, the
+ * authorization branch, and any linked admission. One comparison therefore
+ * distinguishes an exact retry from a substituted credential, envelope, wallet,
+ * device, enrollment, or key manifest.
+ */
+export type StoredWalletAddAuthMethodFinalizeReplay = {
+    kind: 'wallet_add_auth_method_finalize_replay_v1';
+    addAuthMethodCeremonyId: string;
+    requestDigestB64u: string;
+    response: Extract<WalletAddAuthMethodFinalizeResponse, {
+        ok: true;
+    }>;
+    createdAtMs: number;
+    expiresAtMs: number;
+};
+export type StoredWalletAddSignerFinalizeRequest = {
+    kind: 'near_ed25519';
+    addSignerCeremonyId: string;
+    idempotencyKey: string;
+    custodyKeySet: Extract<WalletAddSignerFinalizeRequest, {
+        readonly kind: 'near_ed25519';
+    }>['custodyKeySet'];
+    activationReference: {
+        lifecycleId: string;
+        sessionId: RouterAbEd25519YaoBytes32V1;
+    };
+    expectedKeyHandles?: never;
+} | {
+    kind: 'evm_family_ecdsa';
+    addSignerCeremonyId: string;
+    idempotencyKey: string;
+    custodyKeySet: Extract<WalletAddSignerFinalizeRequest, {
+        readonly kind: 'evm_family_ecdsa';
+    }>['custodyKeySet'];
+    expectedKeyHandles: readonly [string];
+    activationReference?: never;
+};
+type StoredWalletAddAuthMethodCeremonyBase = {
+    addAuthMethodCeremonyId: string;
+    intent: AddAuthMethodIntentV1;
+    digestB64u: string;
+    orgId: string;
+    sourceWalletAuthMethodId: WalletAuthMethodId;
+    sourceWalletAuthorityId: WalletAuthorityId;
+    sourceAuthorityDigestB64u: DigestB64u;
+    sourceAuthorityRevocationEpoch: number;
+    targetWalletAuthMethodId: WalletAuthMethodId;
+    expectedOrigin?: string;
+    expiresAtMs: number;
+    auth: {
+        kind: 'webauthn_assertion';
+        rpId: string;
+        credentialIdB64u: string;
+    } | {
+        kind: 'wallet_session';
+        walletSessionId: string;
+        authorizationId: string;
+        rpId: string;
+        credentialIdB64u: string;
+    } | {
+        kind: 'email_otp';
+        providerUserId: string;
+        enrollmentId: string;
+        enrollmentSealKeyVersion: string;
+        authorityRef: WalletAuthAuthorityRef;
+    };
+};
+export type StoredWalletAddAuthMethodCeremony = (StoredWalletAddAuthMethodCeremonyBase & {
+    kind: 'email_otp';
+    authority: Extract<StoredRegistrationAuthority, {
+        kind: 'email_otp';
+    }>;
+    passkeyRegistration?: never;
+    /**
+     * The SOURCE method's envelope, exactly as the passkey branch below
+     * carries it.
+     *
+     * Refactor 109C adds Email OTP to a wallet that already holds its custody
+     * seed, so the browser has to open this envelope with the source factor
+     * and reseal the same seed under the new Email OTP factor. Without it the
+     * ceremony could only ever create an auth method that unlocks nothing.
+     */
+    custodyEnvelope: PasskeyCustodyEnvelopeRecord;
+}) | (StoredWalletAddAuthMethodCeremonyBase & {
+    kind: 'passkey';
+    authority?: never;
+    passkeyRegistration: {
+        readonly rpId: string;
+        readonly challengeB64u: string;
+        readonly options: WalletAddAuthMethodRegistrationOptions;
+    };
+    custodyEnvelope: PasskeyCustodyEnvelopeRecord;
+});
+export interface RegistrationCeremonyStore {
+    putAddAuthMethodIntent(intent: StoredAddAuthMethodIntent): Promise<void>;
+    getAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<StoredAddAuthMethodIntent | null>;
+    takeAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<ConsumedAddAuthMethodIntent | null>;
+    putAddSignerIntent(intent: StoredAddSignerIntent): Promise<void>;
+    getAddSignerIntent(grant: AddSignerIntentGrant): Promise<StoredAddSignerIntent | null>;
+    takeAddSignerIntent(grant: AddSignerIntentGrant): Promise<ConsumedAddSignerIntent | null>;
+    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
+    getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    updateCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
+    takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    cancelTerminalCeremony(input: {
+        registrationCeremonyId: string;
+        walletId: WalletId;
+    }): Promise<TerminalRegistrationCeremonyCancellationResult>;
+    putAddSignerFinalizeReplay(replay: StoredWalletAddSignerFinalizeReplay): Promise<void>;
+    getAddSignerFinalizeReplay(input: {
+        addSignerCeremonyId: string;
+        idempotencyKey: string;
+    }): Promise<StoredWalletAddSignerFinalizeReplay | null>;
+    getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerFinalizeReplay | null>;
+    putAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
+    getAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
+    updateAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
+    takeAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
+    putAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
+    getAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
+    updateAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
+    takeAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
+}
+export declare class MemoryRegistrationCeremonyStore implements RegistrationCeremonyStore {
+    private readonly addAuthMethodIntents;
+    private readonly addSignerIntents;
+    private readonly ceremonies;
+    private readonly addSignerFinalizeReplays;
+    private readonly addSignerFinalizeReplayClaims;
+    private readonly addAuthMethodCeremonies;
+    private readonly addSignerCeremonies;
+    putAddAuthMethodIntent(intent: StoredAddAuthMethodIntent): Promise<void>;
+    getAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<StoredAddAuthMethodIntent | null>;
+    takeAddAuthMethodIntent(grant: AddAuthMethodIntentGrant): Promise<ConsumedAddAuthMethodIntent | null>;
+    putAddSignerIntent(intent: StoredAddSignerIntent): Promise<void>;
+    getAddSignerIntent(grant: AddSignerIntentGrant): Promise<StoredAddSignerIntent | null>;
+    takeAddSignerIntent(grant: AddSignerIntentGrant): Promise<ConsumedAddSignerIntent | null>;
+    putCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
+    getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    updateCeremony(ceremony: StoredWalletRegistrationCeremony): Promise<void>;
+    takeCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
+    cancelTerminalCeremony(input: {
+        registrationCeremonyId: string;
+        walletId: WalletId;
+    }): Promise<TerminalRegistrationCeremonyCancellationResult>;
+    putAddSignerFinalizeReplay(replay: StoredWalletAddSignerFinalizeReplay): Promise<void>;
+    getAddSignerFinalizeReplay(input: {
+        addSignerCeremonyId: string;
+        idempotencyKey: string;
+    }): Promise<StoredWalletAddSignerFinalizeReplay | null>;
+    getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerFinalizeReplay | null>;
+    putAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
+    getAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
+    updateAddAuthMethodCeremony(ceremony: StoredWalletAddAuthMethodCeremony): Promise<void>;
+    takeAddAuthMethodCeremony(addAuthMethodCeremonyId: string): Promise<StoredWalletAddAuthMethodCeremony | null>;
+    putAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
+    getAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
+    updateAddSignerCeremony(ceremony: StoredWalletAddSignerCeremony): Promise<void>;
+    takeAddSignerCeremony(addSignerCeremonyId: string): Promise<StoredWalletAddSignerCeremony | null>;
+    private pruneExpired;
+}
+export declare function parseStoredRegistrationSignerPlan(value: unknown): RegistrationSignerPlan | null;
+export declare function parseStoredWalletRegistrationPreparedContext(value: unknown): StoredWalletRegistrationPreparedContext | null;
+export declare function storedRegistrationSignerPlansMatch(left: RegistrationSignerPlan, right: RegistrationSignerPlan): boolean;
+export declare function createRegistrationCeremonyStore(input?: {
+    config?: unknown;
+    logger?: NormalizedLogger;
+    isNode?: boolean;
+}): RegistrationCeremonyStore;
+export {};
+//# sourceMappingURL=RegistrationCeremonyStore.d.ts.map

package/dist/types/wallet-server/src/core/SessionService.d.ts

@@ -0,0 +1,70 @@
+import type { SessionParseFailureReason, SessionParseResult } from './sessionValidation';
+export interface SessionConfig {
+    jwt?: {
+        /** Required: JWT signing hook; return a complete token */
+        signToken?: (input: {
+            header: Record<string, unknown>;
+            payload: Record<string, unknown>;
+        }) => Promise<string> | string;
+        /** Required: JWT verification hook */
+        verifyToken?: (token: string) => Promise<{
+            valid: boolean;
+            payload?: any;
+        }> | {
+            valid: boolean;
+            payload?: any;
+        };
+        /** Optional: sliding refresh window (seconds) to allow /session/refresh before exp, default 900 (15 min) */
+        refreshWindowSec?: number;
+        /** Optional: build additional claims to include in the payload */
+        buildClaims?: (input: {
+            sub: string;
+            context?: Record<string, unknown>;
+        }) => Promise<Record<string, unknown> | void> | Record<string, unknown> | void;
+    };
+    cookie?: {
+        /** Cookie name. Default: 'seams-jwt' */
+        name?: string;
+        /** Optional override: build Set-Cookie header for a new token */
+        buildSetHeader?: (token: string) => string;
+        /** Optional override: build Set-Cookie header that clears the cookie */
+        buildClearHeader?: () => string;
+        /** Optional override: extract token from headers (Authorization/Cookie) */
+        extractToken?: (headers: Record<string, string | string[] | undefined>, cookieName: string) => string | null;
+    };
+}
+export declare class SessionService<TClaims extends Record<string, unknown> = Record<string, unknown>> {
+    private cfg;
+    constructor(cfg: NonNullable<SessionConfig>);
+    getCookieName(): string;
+    buildSetCookie(token: string): string;
+    buildClearCookie(): string;
+    /** Sign a JWT using the host-provided signing hook. */
+    signJwt(sub: string, extraClaims?: Record<string, unknown>): Promise<string>;
+    /** Verify signature and enforce standard time claims (`exp`/`nbf`) when present. */
+    verifyJwt(token: string): Promise<{
+        readonly valid: true;
+        readonly payload: Record<string, unknown>;
+    } | {
+        readonly valid: false;
+        readonly reason: Exclude<SessionParseFailureReason, 'missing'>;
+    }>;
+    parse(headers: Record<string, string | string[] | undefined>): Promise<SessionParseResult<TClaims>>;
+    extractTokenFromHeaders(headers: Record<string, string | string[] | undefined>): string | null;
+    refresh(headers: Record<string, string | string[] | undefined>): Promise<{
+        ok: boolean;
+        jwt?: string;
+        code?: string;
+        message?: string;
+    }>;
+    nowSeconds(): number;
+    private isWithinRefreshWindow;
+}
+export declare function parseCsvList(input?: string): string[];
+/**
+ * Normalize a single origin for CORS comparisons.
+ * Returns null when the input is empty or not URL-like.
+ */
+export declare function normalizeCorsOrigin(input?: string): string | null;
+export declare function buildCorsOrigins(...inputs: Array<string | undefined>): string[] | '*';
+//# sourceMappingURL=SessionService.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/config.d.ts

@@ -0,0 +1,23 @@
+export type ThresholdNodeRole = 'cosigner' | 'coordinator';
+export declare function coerceThresholdNodeRole(input: unknown): ThresholdNodeRole;
+export type ThresholdRelayerCosignerPeer = {
+    cosignerId: number;
+    relayerUrl: string;
+};
+export type ThresholdCoordinatorPeer = {
+    instanceId: string;
+    relayerUrl: string;
+};
+export declare function parseThresholdRelayerCosigners(input: unknown): ThresholdRelayerCosignerPeer[] | null;
+export declare function parseThresholdCoordinatorPeers(input: unknown): ThresholdCoordinatorPeer[] | null;
+export declare function parseThresholdRelayerCosignerThreshold(input: unknown): number | null;
+export declare function parseThresholdCoordinatorSharedSecretBytes(input: unknown): Uint8Array | null;
+export declare function parseThresholdEd25519ParticipantIds2p(input: {
+    THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: unknown;
+    THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: unknown;
+}): {
+    clientParticipantId: number;
+    relayerParticipantId: number;
+    participantIds2p: number[];
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/ecdsaClientRootProof.d.ts

@@ -0,0 +1,12 @@
+import type { EcdsaClientRootPublicKey33B64u } from '../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { EcdsaDerivationClientRootProof } from '../types';
+export type EcdsaClientRootProofVerificationResult = {
+    ok: true;
+    clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+} | {
+    ok: false;
+    code: 'unauthorized';
+    message: 'Invalid client root proof';
+};
+export declare function verifyEcdsaClientRootProof(proof: EcdsaDerivationClientRootProof): Promise<EcdsaClientRootProofVerificationResult>;
+//# sourceMappingURL=ecdsaClientRootProof.d.ts.map