@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/ThresholdService/stores/KeyStore.d.ts

@@ -0,0 +1,39 @@
+import type { NormalizedLogger } from '../../logger';
+import type { ThresholdEd25519AuthorityScope, ThresholdStoreConfigInput } from '../../types';
+export type ThresholdEd25519ProvisioningKeyRecord = {
+    kind: 'provisioning';
+    walletId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    publicKey: string;
+    keyVersion: string;
+    routerMaterial?: never;
+    recoveryExportCapable?: never;
+};
+export type ThresholdEd25519ReadyKeyRecord = {
+    kind: 'ready';
+    walletId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    publicKey: string;
+    routerMaterial: {
+        signingShareB64u: string;
+        verifyingShareB64u: string;
+    };
+    keyVersion: string;
+    recoveryExportCapable: true;
+};
+export type ThresholdEd25519KeyRecord = ThresholdEd25519ProvisioningKeyRecord | ThresholdEd25519ReadyKeyRecord;
+export interface ThresholdEd25519KeyStore {
+    get(relayerKeyId: string): Promise<ThresholdEd25519ReadyKeyRecord | null>;
+    put(relayerKeyId: string, record: ThresholdEd25519ReadyKeyRecord): Promise<void>;
+    del(relayerKeyId: string): Promise<void>;
+}
+export declare function createThresholdEd25519KeyStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): ThresholdEd25519KeyStore;
+//# sourceMappingURL=KeyStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/SessionStore.d.ts

@@ -0,0 +1,102 @@
+import type { NormalizedLogger } from '../../logger';
+import type { ThresholdEd25519AuthorityScope, ThresholdEcdsaSigningRootMetadata, ThresholdStoreConfigInput } from '../../types';
+export type ThresholdEd25519Commitments = {
+    hiding: string;
+    binding: string;
+};
+export type ThresholdEd25519CommitmentsById = Record<string, ThresholdEd25519Commitments>;
+export type ThresholdEd25519SigningShareMaterial = {
+    kind: 'key_store';
+} | {
+    kind: 'embedded_cosigner_share';
+    relayerSigningShareB64u: string;
+};
+export type ThresholdEd25519MpcSessionRecord = {
+    expiresAtMs: number;
+    ecdsaThresholdKeyId?: string;
+    keyHandle?: string;
+    relayerKeyId: string;
+    purpose: string;
+    intentDigestB64u: string;
+    signingDigestB64u: string;
+    userId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    clientVerifyingShareB64u?: string;
+    participantIds: number[];
+} & Partial<ThresholdEcdsaSigningRootMetadata>;
+export type ThresholdEcdsaMpcSessionRecord = {
+    expiresAtMs: number;
+    ecdsaThresholdKeyId?: string;
+    keyHandle?: string;
+    relayerKeyId: string;
+    purpose: string;
+    intentDigestB64u: string;
+    signingDigestB64u: string;
+    walletId: string;
+    clientVerifyingShareB64u?: string;
+    participantIds: number[];
+} & Partial<ThresholdEcdsaSigningRootMetadata>;
+export type ThresholdMpcSessionRecord = ThresholdEd25519MpcSessionRecord | ThresholdEcdsaMpcSessionRecord;
+export type ThresholdReadMpcSessionResult<TRecord extends ThresholdMpcSessionRecord> = {
+    record: TRecord;
+    version: string;
+};
+export type ThresholdClaimMpcSessionResult<TRecord extends ThresholdMpcSessionRecord> = {
+    ok: true;
+    record: TRecord;
+} | {
+    ok: false;
+    code: 'not_found' | 'expired' | 'version_mismatch' | 'invalid_record';
+};
+export type ThresholdEd25519SigningSessionRecord = {
+    expiresAtMs: number;
+    mpcSessionId: string;
+    relayerKeyId: string;
+    signingDigestB64u: string;
+    userId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    commitmentsById: ThresholdEd25519CommitmentsById;
+    signingShare: ThresholdEd25519SigningShareMaterial;
+    relayerNoncesB64u: string;
+    participantIds: number[];
+};
+export type ThresholdEd25519CoordinatorSigningSessionRecord = {
+    mode: 'cosigner';
+    expiresAtMs: number;
+    mpcSessionId: string;
+    relayerKeyId: string;
+    signingDigestB64u: string;
+    userId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    commitmentsById: ThresholdEd25519CommitmentsById;
+    participantIds: number[];
+    groupPublicKey: string;
+    cosignerIds: number[];
+    cosignerRelayerUrlsById: Record<string, string>;
+    cosignerCoordinatorGrantsById: Record<string, string>;
+    relayerVerifyingSharesById: Record<string, string>;
+};
+export interface ThresholdMpcSessionStore<TRecord extends ThresholdMpcSessionRecord> {
+    putMpcSession(id: string, record: TRecord, ttlMs: number): Promise<void>;
+    readMpcSession(id: string): Promise<ThresholdReadMpcSessionResult<TRecord> | null>;
+    claimMpcSession(id: string, version: string): Promise<ThresholdClaimMpcSessionResult<TRecord>>;
+    takeMpcSession(id: string): Promise<TRecord | null>;
+}
+export interface ThresholdEd25519SessionStore extends ThresholdMpcSessionStore<ThresholdEd25519MpcSessionRecord> {
+    putSigningSession(id: string, record: ThresholdEd25519SigningSessionRecord, ttlMs: number): Promise<void>;
+    takeSigningSession(id: string): Promise<ThresholdEd25519SigningSessionRecord | null>;
+    putCoordinatorSigningSession(id: string, record: ThresholdEd25519CoordinatorSigningSessionRecord, ttlMs: number): Promise<void>;
+    takeCoordinatorSigningSession(id: string): Promise<ThresholdEd25519CoordinatorSigningSessionRecord | null>;
+}
+export type ThresholdEcdsaSessionStore = ThresholdMpcSessionStore<ThresholdEcdsaMpcSessionRecord>;
+export declare function createThresholdEd25519SessionStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): ThresholdEd25519SessionStore;
+export declare function createThresholdEcdsaSessionStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): ThresholdEcdsaSessionStore;
+//# sourceMappingURL=SessionStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/StoreConfig.d.ts

@@ -0,0 +1,3 @@
+export type NonDurableObjectThresholdStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp';
+export declare function readNonDurableObjectThresholdStoreKind(config: Record<string, unknown>, storeLabel: string): NonDurableObjectThresholdStoreKind | null;
+//# sourceMappingURL=StoreConfig.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/ThresholdStoreConfig.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ThresholdStoreConfig.typecheck.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/stores/WalletSessionStore.d.ts

@@ -0,0 +1,98 @@
+import type { NormalizedLogger } from '../../logger';
+import type { ThresholdEd25519AuthorityScope, ThresholdEcdsaSigningRootMetadata, ThresholdStoreConfigInput } from '../../types';
+import { WALLET_SESSION_FAILURE_CODES, type WalletSessionFailureCode } from '../../../../../shared-ts/src/utils/walletSessionFailure';
+import type { EcdsaKeyHandle } from '../../keyMaterialBrands';
+export type Ed25519WalletSessionRecord = {
+    expiresAtMs: number;
+    relayerKeyId: string;
+    userId: string;
+    walletId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    participantIds: number[];
+} & Partial<ThresholdEcdsaSigningRootMetadata>;
+type EcdsaWalletSessionRecordCore = {
+    expiresAtMs: number;
+    relayerKeyId: string;
+    walletId: string;
+    keyHandle: EcdsaKeyHandle;
+    participantIds: number[];
+};
+export type EcdsaWalletSessionRecord = EcdsaWalletSessionRecordCore & ({
+    signingRootId?: never;
+    signingRootVersion?: never;
+    walletKeyVersion?: never;
+    derivationVersion?: never;
+} | ThresholdEcdsaSigningRootMetadata);
+export type WalletSessionRecord = Ed25519WalletSessionRecord | EcdsaWalletSessionRecord;
+export type WalletSessionConsumeUsesResult = {
+    ok: true;
+    remainingUses: number;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type WalletSessionConsumedUseResult = {
+    ok: true;
+    consumed: boolean;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type WalletSessionReplayGuardResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type WalletSessionStatus<TRecord extends WalletSessionRecord> = {
+    record: TRecord;
+    expiresAtMs: number;
+    remainingUses: number;
+};
+export type WalletSessionStatusLookupResult<TRecord extends WalletSessionRecord> = {
+    ok: true;
+    status: WalletSessionStatus<TRecord>;
+} | {
+    ok: false;
+    code: Extract<WalletSessionFailureCode, typeof WALLET_SESSION_FAILURE_CODES.missing | typeof WALLET_SESSION_FAILURE_CODES.expired | typeof WALLET_SESSION_FAILURE_CODES.unavailable>;
+};
+export type Ed25519WalletSessionStatus = WalletSessionStatus<Ed25519WalletSessionRecord>;
+export type EcdsaWalletSessionStatus = WalletSessionStatus<EcdsaWalletSessionRecord>;
+export interface WalletSessionStore<TRecord extends WalletSessionRecord> {
+    putSession(id: string, record: TRecord, opts: {
+        ttlMs: number;
+        remainingUses: number;
+    }): Promise<void>;
+    getSession(id: string): Promise<TRecord | null>;
+    getSessionStatus(id: string): Promise<WalletSessionStatusLookupResult<TRecord>>;
+    /**
+     * Consume one use from the session counter without fetching the session record.
+     *
+     * This enables session-token-only authorization flows where scope/expiry are enforced from
+     * signed JWT claims instead of a KV-stored record, reducing KV read-after-write consistency issues.
+     */
+    consumeUseCount(id: string): Promise<WalletSessionConsumeUsesResult>;
+    consumeUseCountOnce(id: string, idempotencyKey: string): Promise<WalletSessionConsumeUsesResult>;
+    hasConsumedUseCountOnce(id: string, idempotencyKey: string): Promise<WalletSessionConsumedUseResult>;
+    reserveReplayGuard(scopeId: string, replayKey: string, expiresAtMs: number): Promise<WalletSessionReplayGuardResult>;
+}
+export type Ed25519WalletSessionStore = WalletSessionStore<Ed25519WalletSessionRecord>;
+export type EcdsaWalletSessionStore = WalletSessionStore<EcdsaWalletSessionRecord>;
+export type WalletSessionRecordParser<TRecord extends WalletSessionRecord> = (raw: unknown) => TRecord | null;
+export declare function createEd25519WalletSessionStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): Ed25519WalletSessionStore;
+export declare function createEcdsaWalletSessionStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): EcdsaWalletSessionStore;
+export {};
+//# sourceMappingURL=WalletSessionStore.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/thresholdEd25519AuthorityScope.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=thresholdEd25519AuthorityScope.typecheck.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/validation.d.ts

@@ -0,0 +1,193 @@
+import { type WalletAuthAuthority } from '../../../../shared-ts/src/utils/walletAuthAuthority';
+import { type RouterAbEcdsaDerivationNormalSigningScopeV1 } from '../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { EcdsaDerivationClientBootstrapRequest, EcdsaDerivationPublicIdentity, ThresholdEd25519AuthorityScope } from '../types';
+import { type EcdsaKeyHandle } from '../keyMaterialBrands';
+export type ThresholdValidationOk = {
+    ok: true;
+};
+export type ThresholdValidationErr = {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type ThresholdValidationResult = ThresholdValidationOk | ThresholdValidationErr;
+export declare function isObject(v: unknown): v is Record<string, unknown>;
+export declare function isValidNumber(v: unknown): v is number;
+export type ParsedThresholdEcdsaSigningRootMetadata = {
+    signingRootId: string;
+    signingRootVersion?: string;
+    walletKeyVersion: string;
+    derivationVersion: number;
+};
+export declare function toPrefixWithColon(prefix: unknown, defaultPrefix: string): string;
+export declare function toThresholdEd25519KeyPrefix(prefix: unknown): string;
+export declare function toThresholdEd25519SessionPrefix(prefix: unknown): string;
+export declare function toThresholdEd25519WalletSessionPrefix(prefix: unknown): string;
+export declare function toThresholdEd25519PrefixFromBase(basePrefix: unknown, kind: 'key' | 'sess' | 'wallet-session'): string;
+export declare function canonicalThresholdEd25519RelayerKeyId(relayerKeyId: unknown): string;
+export declare function toThresholdEcdsaKeyPrefix(prefix: unknown): string;
+export declare function toThresholdEcdsaSessionPrefix(prefix: unknown): string;
+export declare function toThresholdEcdsaWalletSessionPrefix(prefix: unknown): string;
+export declare function toThresholdEcdsaPresignPrefix(prefix: unknown): string;
+export declare function toThresholdEcdsaPrefixFromBase(basePrefix: unknown, kind: 'key' | 'sess' | 'wallet-session' | 'presign'): string;
+export type ParsedThresholdEd25519RouterMaterial = {
+    signingShareB64u: string;
+    verifyingShareB64u: string;
+};
+export type ParsedThresholdEd25519ProvisioningKeyRecord = {
+    kind: 'provisioning';
+    walletId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    publicKey: string;
+    keyVersion: string;
+    routerMaterial?: never;
+    recoveryExportCapable?: never;
+};
+export type ParsedThresholdEd25519ReadyKeyRecord = {
+    kind: 'ready';
+    walletId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    publicKey: string;
+    routerMaterial: ParsedThresholdEd25519RouterMaterial;
+    keyVersion: string;
+    recoveryExportCapable: true;
+};
+export type ParsedThresholdEd25519KeyRecord = ParsedThresholdEd25519ProvisioningKeyRecord | ParsedThresholdEd25519ReadyKeyRecord;
+export declare function parseThresholdEd25519ReadyKeyRecord(raw: unknown): ParsedThresholdEd25519ReadyKeyRecord | null;
+export declare function parseThresholdEd25519KeyRecord(raw: unknown): ParsedThresholdEd25519ReadyKeyRecord | null;
+export declare function parseEcdsaDerivationPublicIdentity(raw: unknown): EcdsaDerivationPublicIdentity | null;
+export declare function parseEcdsaDerivationClientBootstrapRequest(raw: unknown): EcdsaDerivationClientBootstrapRequest | null;
+export type ParsedThresholdEd25519Commitments = {
+    hiding: string;
+    binding: string;
+};
+export declare function parseThresholdEd25519Commitments(raw: unknown): ParsedThresholdEd25519Commitments | null;
+export type ParsedThresholdEd25519CommitmentsById = Record<string, ParsedThresholdEd25519Commitments>;
+export declare function parseThresholdEd25519CommitmentsById(raw: unknown): ParsedThresholdEd25519CommitmentsById | null;
+export declare function parseThresholdEd25519AuthorityScope(raw: unknown): ThresholdEd25519AuthorityScope | null;
+export declare function thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority: WalletAuthAuthority): ThresholdEd25519AuthorityScope;
+export declare function thresholdEd25519AuthorityScopesMatch(left: ThresholdEd25519AuthorityScope, right: ThresholdEd25519AuthorityScope): boolean;
+export type ParsedThresholdEd25519MpcSessionRecord = {
+    expiresAtMs: number;
+    ecdsaThresholdKeyId?: string;
+    keyHandle?: string;
+    relayerKeyId: string;
+    purpose: string;
+    intentDigestB64u: string;
+    signingDigestB64u: string;
+    userId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    clientVerifyingShareB64u?: string;
+    participantIds: number[];
+} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
+export type ParsedThresholdEcdsaMpcSessionRecord = {
+    expiresAtMs: number;
+    ecdsaThresholdKeyId?: string;
+    keyHandle?: string;
+    relayerKeyId: string;
+    purpose: string;
+    intentDigestB64u: string;
+    signingDigestB64u: string;
+    walletId: string;
+    clientVerifyingShareB64u?: string;
+    participantIds: number[];
+} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
+export declare function parseThresholdEd25519MpcSessionRecord(raw: unknown): ParsedThresholdEd25519MpcSessionRecord | null;
+export declare function parseThresholdEcdsaMpcSessionRecord(raw: unknown): ParsedThresholdEcdsaMpcSessionRecord | null;
+export type ParsedThresholdEd25519SigningShareMaterial = {
+    kind: 'key_store';
+} | {
+    kind: 'embedded_cosigner_share';
+    relayerSigningShareB64u: string;
+};
+export type ParsedThresholdEd25519SigningSessionRecord = {
+    expiresAtMs: number;
+    mpcSessionId: string;
+    relayerKeyId: string;
+    signingDigestB64u: string;
+    userId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    commitmentsById: ParsedThresholdEd25519CommitmentsById;
+    signingShare: ParsedThresholdEd25519SigningShareMaterial;
+    relayerNoncesB64u: string;
+    participantIds: number[];
+};
+export declare function parseThresholdEd25519SigningSessionRecord(raw: unknown): ParsedThresholdEd25519SigningSessionRecord | null;
+export type ParsedThresholdEd25519StringById = Record<string, string>;
+export declare function parseThresholdEd25519StringById(raw: unknown): ParsedThresholdEd25519StringById | null;
+export type ParsedThresholdEd25519CoordinatorSigningSessionRecord = {
+    mode: 'cosigner';
+    expiresAtMs: number;
+    mpcSessionId: string;
+    relayerKeyId: string;
+    signingDigestB64u: string;
+    userId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    commitmentsById: ParsedThresholdEd25519CommitmentsById;
+    participantIds: number[];
+    groupPublicKey: string;
+    cosignerIds: number[];
+    cosignerRelayerUrlsById: ParsedThresholdEd25519StringById;
+    cosignerCoordinatorGrantsById: ParsedThresholdEd25519StringById;
+    relayerVerifyingSharesById: ParsedThresholdEd25519StringById;
+};
+export declare function parseThresholdEd25519CoordinatorSigningSessionRecord(raw: unknown): ParsedThresholdEd25519CoordinatorSigningSessionRecord | null;
+export type ParsedEd25519WalletSessionRecord = {
+    expiresAtMs: number;
+    relayerKeyId: string;
+    userId: string;
+    walletId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: ThresholdEd25519AuthorityScope;
+    participantIds: number[];
+} & Partial<ParsedThresholdEcdsaSigningRootMetadata>;
+export declare function parseEd25519WalletSessionRecord(raw: unknown): ParsedEd25519WalletSessionRecord | null;
+type ParsedEcdsaWalletSessionRecordCore = {
+    expiresAtMs: number;
+    relayerKeyId: string;
+    walletId: string;
+    keyHandle: EcdsaKeyHandle;
+    participantIds: number[];
+};
+export type ParsedEcdsaWalletSessionRecord = ParsedEcdsaWalletSessionRecordCore & ({
+    signingRootId?: never;
+    signingRootVersion?: never;
+    walletKeyVersion?: never;
+    derivationVersion?: never;
+} | ParsedThresholdEcdsaSigningRootMetadata);
+export declare function parseEcdsaWalletSessionRecord(raw: unknown): ParsedEcdsaWalletSessionRecord | null;
+export type ParsedRouterAbEcdsaDerivationPoolFillSessionStage = 'triples' | 'triples_done' | 'presign' | 'done';
+export type ParsedRouterAbEcdsaDerivationPoolFillSessionDestination = {
+    kind: 'router_ab_ecdsa_derivation_signing_worker_pool';
+    routerAbEcdsaDerivation: {
+        scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
+        expiresAtMs: number;
+    };
+};
+export type ParsedRouterAbEcdsaDerivationPoolFillSessionRecord = {
+    expiresAtMs: number;
+    walletId: string;
+    keyHandle: EcdsaKeyHandle;
+    relayerKeyId: string;
+    presignPoolKey: string;
+    poolFill: ParsedRouterAbEcdsaDerivationPoolFillSessionDestination;
+    ownerInstanceId?: string;
+    participantIds: number[];
+    clientParticipantId: number;
+    relayerParticipantId: number;
+    stage: ParsedRouterAbEcdsaDerivationPoolFillSessionStage;
+    version: number;
+    createdAtMs: number;
+    updatedAtMs: number;
+} & ParsedThresholdEcdsaSigningRootMetadata;
+export declare function parseRouterAbEcdsaDerivationPoolFillSessionRecord(raw: unknown): ParsedRouterAbEcdsaDerivationPoolFillSessionRecord | null;
+export declare function normalizeByteArray32(input: unknown): Uint8Array | null;
+export declare function toNearPublicKeyStr(v: unknown): string;
+export declare function extractAuthorizeSigningPublicKey(purpose: string, signingPayload: unknown): string;
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/dist/types/wallet-server/src/core/WalletAuthMethodStore.d.ts

@@ -0,0 +1,12 @@
+import type { ThresholdStoreConfigInput } from './types';
+import type { NormalizedLogger } from './logger';
+import type { WalletAuthMethodStore } from './d1WalletAuthMethodStore';
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodV2Id, } from './d1WalletAuthMethodStore';
+export type { D1WalletAuthMethodStoreOptions, D1WalletAuthMethodStoreSchemaOptions, WalletAuthMethodRecord, WalletAuthMethodRecordV2Owned, WalletAuthMethodStore, WalletAuthMethodV2Store, } from './d1WalletAuthMethodStore';
+export declare function resolveWalletAuthMethodStoreNamespace(config: Record<string, unknown>): string;
+export declare function createWalletAuthMethodStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): WalletAuthMethodStore;
+//# sourceMappingURL=WalletAuthMethodStore.d.ts.map

package/dist/types/wallet-server/src/core/WalletStore.d.ts

@@ -0,0 +1,143 @@
+import type { NormalizedLogger } from './logger';
+import type { ThresholdEcdsaChainTarget, ThresholdStoreConfigInput } from './types';
+import type { WalletRegistrationEcdsaWalletKey, WalletId } from './registrationContracts';
+import { type EcdsaClientRootPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import { type RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
+import type { RouterAbEd25519YaoActivationResultV1, RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRecoveryAdmissionRequestV1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbMpcMaterialActivationRefWire } from '../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1, type RouterAbEcdsaDerivationActivationRefreshRequestV1, type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, } from './d1WalletStore';
+export type { D1WalletStoreOptions, D1WalletStoreSchemaOptions } from './d1WalletStore';
+export type WalletRecord = {
+    version: 'wallet_v1';
+    walletId: WalletId;
+    createdAtMs: number;
+    updatedAtMs: number;
+};
+export type WalletEd25519YaoActiveCapabilityRecord = {
+    readonly version: 'wallet_ed25519_yao_registration_capability_v1';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly nearAccountId: string;
+    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult: RouterAbEd25519YaoActivationResultV1<'registration'>;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+} | {
+    readonly version: 'wallet_ed25519_yao_recovery_capability_v1';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly nearAccountId: string;
+    readonly admissionRequest: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
+    readonly activationResult: RouterAbEd25519YaoActivationResultV1<'recovery'>;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+};
+export type WalletEd25519SignerRecord = {
+    version: 'wallet_signer_ed25519_v1';
+    walletId: WalletId;
+    signerId: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    thresholdSessionId: string;
+    signerSlot: number;
+    publicKey: string;
+    signingWorkerId: string;
+    keyVersion: string;
+    recoveryExportCapable: boolean;
+    participantIds: readonly [number, number];
+    signingRootId: string;
+    signingRootVersion: string;
+    runtimePolicyScope: RuntimePolicyScope;
+    activeYaoCapability: WalletEd25519YaoActiveCapabilityRecord;
+    custodyKeyManifestDigestB64u: string;
+    createdAtMs: number;
+    updatedAtMs: number;
+};
+export declare function sameWalletEd25519SignerRecordV1(left: WalletEd25519SignerRecord, right: WalletEd25519SignerRecord): boolean;
+export type WalletEcdsaSignerKey = Omit<WalletRegistrationEcdsaWalletKey, 'evmFamilySigningKeySlotId'> & {
+    evmFamilySigningKeySlotId?: never;
+};
+export type WalletEcdsaSignerRecord = {
+    version: 'wallet_signer_ecdsa_v1';
+    walletId: WalletId;
+    evmFamilySigningKeySlotId?: never;
+    signerId: string;
+    chainTargetKey: string;
+    chainTarget: ThresholdEcdsaChainTarget;
+    walletKey: WalletEcdsaSignerKey;
+    activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
+    runtimePolicyScope: RuntimePolicyScope;
+    custodyKeyManifestDigestB64u: string;
+    custodyClientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    createdAtMs: number;
+    updatedAtMs: number;
+};
+export type WalletSignerRecord = WalletEd25519SignerRecord | WalletEcdsaSignerRecord;
+type WalletEcdsaPostRegistrationProofRecordBase = {
+    version: 'wallet_ecdsa_pending_session_activation_v1';
+    walletId: WalletId;
+    lifecycleId: string;
+    requestId: string;
+    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    createdAtMs: number;
+    expiresAtMs: number;
+};
+export type WalletEcdsaPendingSessionActivationRecord = WalletEcdsaPostRegistrationProofRecordBase & {
+    operation: 'refresh';
+    request: RouterAbEcdsaDerivationActivationRefreshRequestV1;
+    response: RouterAbEcdsaDerivationActivationRefreshForwardedResponseV1;
+};
+export type WalletEcdsaPostRegistrationPublicRequest = RouterAbEcdsaDerivationActivationRefreshRequestV1;
+export interface WalletStore {
+    getWallet(input: {
+        walletId: WalletId;
+    }): Promise<WalletRecord | null>;
+    getEcdsaSignerByKeyHandle(input: {
+        walletId: WalletId;
+        keyHandle: string;
+        chainTarget: ThresholdEcdsaChainTarget;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    getEcdsaSignerByPublicCapability(input: {
+        walletId: WalletId;
+        publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    getEcdsaSignerByMaterialActivation(input: {
+        walletId: WalletId;
+        materialActivation: RouterAbMpcMaterialActivationRefWire;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    getEcdsaSignerByPostRegistrationRequest(input: {
+        walletId: WalletId;
+        request: WalletEcdsaPostRegistrationPublicRequest;
+    }): Promise<WalletEcdsaSignerRecord | null>;
+    listEcdsaSignersForWallet(input: {
+        walletId: WalletId;
+    }): Promise<readonly WalletEcdsaSignerRecord[]>;
+    /**
+     * The wallet's Ed25519 signer for one key-creation slot. Callers that need
+     * the manifest a NEAR key set was registered against read it from here — it
+     * is recorded on the signer and nowhere else.
+     */
+    getEd25519SignerBySlot(input: {
+        walletId: WalletId;
+        signerSlot: number;
+    }): Promise<WalletEd25519SignerRecord | null>;
+    putEcdsaPendingSessionActivation(record: WalletEcdsaPendingSessionActivationRecord): Promise<void>;
+    putSubject(record: WalletRecord): Promise<void>;
+    putSigner(record: WalletSignerRecord): Promise<void>;
+    putSigners(records: readonly WalletSignerRecord[]): Promise<void>;
+}
+export declare function parseWalletEcdsaPendingSessionActivationRecord(raw: unknown): WalletEcdsaPendingSessionActivationRecord | null;
+export declare function ecdsaPostRegistrationRequestMatchesCapability(input: {
+    request: WalletEcdsaPostRegistrationPublicRequest;
+    capability: RouterAbEcdsaDerivationPublicCapabilityV1;
+}): boolean;
+export declare function resolveWalletStoreNamespace(config: Record<string, unknown>): string;
+export declare function parseWalletEcdsaSignerRecord(raw: unknown): WalletEcdsaSignerRecord | null;
+export declare function buildWalletEd25519SignerId(input: {
+    nearAccountId: string;
+    signerSlot: number;
+}): string;
+export declare function createWalletStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): WalletStore;
+//# sourceMappingURL=WalletStore.d.ts.map

package/dist/types/wallet-server/src/core/WalletStore.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=WalletStore.typecheck.d.ts.map

package/dist/types/wallet-server/src/core/WebAuthnAuthenticatorStore.d.ts

@@ -0,0 +1,62 @@
+import type { NormalizedLogger } from './logger';
+import type { ThresholdStoreConfigInput } from './types';
+import { type WebAuthnAuthenticatorDeviceInfo } from '../../../shared-ts/src/utils/webauthnDeviceInfo';
+import type { D1DatabaseLike } from '../storage/tenantRoute';
+export type WebAuthnAuthenticatorRecord = {
+    version: 'webauthn_authenticator_v1';
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    createdAtMs: number;
+    updatedAtMs: number;
+    /**
+     * Server-derived device metadata captured at registration verification.
+     * Required so the authenticator listing can promise it; rows written before
+     * device capture parse back as `Unknown device` at the store boundary.
+     */
+    deviceInfo: WebAuthnAuthenticatorDeviceInfo;
+};
+export interface WebAuthnAuthenticatorStore {
+    get(userId: string, credentialIdB64u: string): Promise<WebAuthnAuthenticatorRecord | null>;
+    put(userId: string, record: WebAuthnAuthenticatorRecord): Promise<void>;
+    del(userId: string, credentialIdB64u: string): Promise<void>;
+    /**
+     * List all authenticators for a user.
+     *
+     * Optional because not all backing stores can efficiently enumerate keys.
+     */
+    list?(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
+}
+export interface D1WebAuthnAuthenticatorStoreSchemaOptions {
+    readonly database: D1DatabaseLike;
+}
+export interface D1WebAuthnAuthenticatorStoreOptions {
+    readonly database: D1DatabaseLike;
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly ensureSchema?: boolean;
+}
+export declare const WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS webauthn_authenticators (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      credential_id_b64u TEXT NOT NULL,\n      credential_public_key_b64u TEXT NOT NULL,\n      counter INTEGER NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      device_info_json TEXT NOT NULL DEFAULT '{}',\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, credential_id_b64u),\n      CHECK (length(user_id) > 0),\n      CHECK (length(credential_id_b64u) > 0),\n      CHECK (length(credential_public_key_b64u) > 0),\n      CHECK (counter >= 0),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS webauthn_authenticators_user_idx\n      ON webauthn_authenticators (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        created_at_ms\n      )\n  "];
+export declare function ensureWebAuthnAuthenticatorStoreD1Schema(options: D1WebAuthnAuthenticatorStoreSchemaOptions): Promise<void>;
+export declare function resolveWebAuthnAuthenticatorStoreNamespace(config: Record<string, unknown>): string;
+export declare class D1WebAuthnAuthenticatorStore implements WebAuthnAuthenticatorStore {
+    readonly adapterKind = "d1";
+    private readonly database;
+    private readonly scope;
+    private readonly ensureSchemaOnUse;
+    private schemaReady;
+    constructor(input: D1WebAuthnAuthenticatorStoreOptions);
+    private ensureSchema;
+    get(userId: string, credentialIdB64u: string): Promise<WebAuthnAuthenticatorRecord | null>;
+    put(userId: string, record: WebAuthnAuthenticatorRecord): Promise<void>;
+    del(userId: string, credentialIdB64u: string): Promise<void>;
+    list(userId: string): Promise<WebAuthnAuthenticatorRecord[]>;
+}
+export declare function createWebAuthnAuthenticatorStore(input: {
+    config?: ThresholdStoreConfigInput | null;
+    logger: NormalizedLogger;
+    isNode: boolean;
+}): WebAuthnAuthenticatorStore;
+//# sourceMappingURL=WebAuthnAuthenticatorStore.d.ts.map