@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceManagement.d.ts

@@ -0,0 +1,137 @@
+import type { LinkedDeviceListRequestV1, LinkedDeviceListResultV1, LinkedDeviceRevokeRequestV1, LinkedDeviceRevokeResultV1 } from '../../../../shared-ts/src/device-linking/contracts';
+import { type DelegatedWalletAuthorityV1 } from '../../../../shared-ts/src/authorization/delegatedAuthority';
+import type { ActiveWalletAuthorityV1, WalletAuthorityV1 } from '../../../../shared-ts/src/authorization/walletAuthority';
+import type { AuthorizationService } from '../../authorization/service';
+import type { OrdinaryInactiveSignerMaterialDeactivationPortV1 } from '../signingMaterial/ordinaryInactiveSignerMaterialReservation';
+import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../shared-ts/src/utils/domainIds';
+import type { TenantId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../shared-ts/src/authorization/capabilityKinds';
+import type { WalletAuthMethodRecordV2 } from '../../../../shared-ts/src/utils/registrationIntent';
+import type { WebAuthnAuthenticatorDeviceInfo } from '../../../../shared-ts/src/utils/webauthnDeviceInfo';
+export declare const MAX_LINKED_DEVICE_LIST_LIMIT_V1 = 50;
+export type LinkedDeviceManagementListCursorV1 = {
+    readonly kind: 'wallet_authority_v1';
+    readonly updatedAtMs: number;
+    readonly authorityId: WalletAuthorityId;
+};
+export declare class LinkedDeviceListCursorError extends Error {
+    readonly kind = "linked_device_list_cursor_error_v1";
+}
+/** Identity supplied by the bearer boundary; authority and method are reread from D1. */
+export type LinkedDeviceManagementSourceV1 = {
+    readonly walletId: WalletId;
+    readonly walletSessionId: WalletSessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly expiresAtMs: number;
+};
+/** A fresh factor proof is produced by the request boundary after verification. */
+export type LinkedDeviceManagementFreshProofV1 = {
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly verifiedAtMs: number;
+};
+export type LinkedDeviceManagementRevocationSourceV1 = LinkedDeviceManagementSourceV1 & {
+    readonly freshProof: LinkedDeviceManagementFreshProofV1;
+};
+export type LinkedDeviceManagementSourceResolutionV1 = {
+    readonly session: LinkedDeviceManagementOwnerSessionV1;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+    readonly permission: DelegatedWalletAuthorityV1;
+};
+export type LinkedDeviceManagementAuthorityPageV1 = {
+    readonly records: readonly ActiveWalletAuthorityV1[];
+    readonly nextCursor: LinkedDeviceManagementListCursorV1 | null;
+};
+export type LinkedDeviceManagementAuthorityPortV1 = {
+    listActiveForWalletV1(input: {
+        readonly walletId: WalletId;
+        readonly limit: number;
+        readonly cursor: LinkedDeviceManagementListCursorV1 | null;
+    }): Promise<LinkedDeviceManagementAuthorityPageV1>;
+    readByIdV1(authorityId: WalletAuthorityId): Promise<WalletAuthorityV1 | null>;
+    revokeWalletAuthMethodV1(input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+        readonly walletAuthMethodId: WalletAuthMethodId;
+        readonly expectedAuthorityRevocationEpoch: number;
+        readonly requestedAtMs: number;
+    }): Promise<{
+        readonly kind: 'revoked_method';
+        readonly authMethod: Extract<WalletAuthMethodRecordV2, {
+            readonly status: 'revoked';
+        }>;
+        readonly authority: WalletAuthorityV1;
+    } | {
+        readonly kind: 'would_remove_last_wallet_auth_method';
+    } | {
+        readonly kind: 'conflict';
+    }>;
+};
+export type LinkedDeviceManagementAuthMethodPortV1 = {
+    listForAuthorityV1(input: {
+        readonly walletId: WalletId;
+        readonly authorityId: WalletAuthorityId;
+    }): Promise<readonly WalletAuthMethodRecordV2[]>;
+    readByIdV1(input: {
+        readonly walletAuthMethodId: WalletAuthMethodId;
+    }): Promise<WalletAuthMethodRecordV2 | null>;
+};
+export type LinkedDeviceManagementOwnerSessionV1 = {
+    readonly walletId: WalletId;
+    readonly walletSessionId: WalletSessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly authorityDigestB64u: import('../../../../shared-ts/src/utils/canonicalPrimitives').DigestB64u;
+    readonly expiresAtMs: number;
+};
+export type LinkedDeviceManagementAuthenticatorPortV1 = {
+    readActiveOwnerWalletSessionV1(input: {
+        readonly tenantId: TenantId;
+        readonly walletId: WalletId;
+        readonly walletSessionId: WalletSessionId;
+        readonly authorizationId: WalletSessionAuthorizationId;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceManagementOwnerSessionV1 | null>;
+};
+export type LinkedDeviceManagementSessionRetirementPortV1 = Pick<AuthorizationService, 'retireWalletSessionAuthorizationsForAuthMethod'>;
+export type LinkedDeviceManagementCredentialMetadataPortV1 = {
+    readPasskeyDeviceInfoV1(input: {
+        readonly walletId: WalletId;
+        readonly credentialIdB64u: string;
+    }): Promise<WebAuthnAuthenticatorDeviceInfo | null>;
+    /**
+     * The wallet's verified Email OTP address, from its canonical enrollment.
+     * Served only inside the owner-scoped management projection, which is why the
+     * plaintext address (not the hash) is acceptable here: the reader is the
+     * wallet owner who enrolled it.
+     */
+    readEmailOtpAddressV1(input: {
+        readonly walletId: WalletId;
+    }): Promise<string | null>;
+};
+export type LinkedDeviceManagementServiceOptionsV1 = {
+    readonly tenantId: TenantId;
+    readonly authenticator: LinkedDeviceManagementAuthenticatorPortV1;
+    readonly authority: LinkedDeviceManagementAuthorityPortV1;
+    readonly authMethod: LinkedDeviceManagementAuthMethodPortV1;
+    readonly sessions: LinkedDeviceManagementSessionRetirementPortV1;
+    readonly credentials: LinkedDeviceManagementCredentialMetadataPortV1;
+    readonly materialDeactivation?: OrdinaryInactiveSignerMaterialDeactivationPortV1;
+};
+export type LinkedDeviceManagementServiceResultV1 = LinkedDeviceListResultV1 | {
+    readonly kind: 'unauthorized';
+};
+export declare class LinkedDeviceManagementServiceV1 {
+    private readonly options;
+    constructor(options: LinkedDeviceManagementServiceOptionsV1);
+    listLinkedDevicesV1(request: LinkedDeviceListRequestV1, source: LinkedDeviceManagementSourceV1, requestedAtMs: number): Promise<LinkedDeviceManagementServiceResultV1>;
+    revokeLinkedDeviceV1(request: LinkedDeviceRevokeRequestV1, source: LinkedDeviceManagementRevocationSourceV1): Promise<LinkedDeviceRevokeResultV1>;
+    private resolveSourceV1;
+    private deactivateSignerMaterialV1;
+    private buildLinkedDeviceSummaryV1;
+    private buildOwnerDeviceSummaryV1;
+}
+export declare function encodeLinkedDeviceListCursorV1(cursor: LinkedDeviceManagementListCursorV1): string;
+export declare function decodeLinkedDeviceListCursorV1(raw: string | null): LinkedDeviceManagementListCursorV1 | null;
+//# sourceMappingURL=linkedDeviceManagement.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/linkedDeviceSession.d.ts

@@ -0,0 +1,462 @@
+import { type DelegatedWalletAuthorityV1 } from '../../../../shared-ts/src/authorization/delegatedAuthority';
+import type { LinkPrecommitFailureV1, LinkSessionStateV1, LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceApprovedTargetFactorV1, QrLinkedDeviceSessionPayloadV5 } from '../../../../shared-ts/src/device-linking/contracts';
+import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type WalletAuthorityId, type WalletId } from '../../../../shared-ts/src/utils/domainIds';
+import type { WalletSessionAuthorizationId, WalletSessionId } from '../../../../shared-ts/src/authorization/capabilityKinds';
+import { type LinkedDeviceEnrollmentId, type LinkedDeviceId, type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+import { type ExactAdministeredSignerV1, type ExactAdministeredSignerManifestV1 } from '../../../../shared-ts/src/device-linking/delegatedActivationPlan';
+type LinkedDeviceClaimV1 = LinkedDeviceSessionClaimV1;
+export type { LinkSessionStateV1, QrLinkedDeviceSessionPayloadV5, } from '../../../../shared-ts/src/device-linking/contracts';
+export type LinkedDeviceSessionListCursorV1 = {
+    readonly updatedAtMs: number;
+    readonly linkSessionId: LinkDeviceSessionId;
+};
+export type LinkedDeviceSessionListPageV1 = {
+    readonly records: readonly LinkedDeviceSessionRecordV1[];
+    readonly nextCursor: LinkedDeviceSessionListCursorV1 | null;
+};
+export type LinkedDeviceClaimTranscriptV1 = {
+    readonly digestB64u: DigestB64u;
+    readonly value: LinkedDeviceClaimV1;
+};
+export type LinkedDeviceSourceKeyManifestDigestsV1 = {
+    readonly ed25519: DigestB64u;
+    readonly ecdsa_secp256k1?: never;
+} | {
+    readonly ed25519?: never;
+    readonly ecdsa_secp256k1: DigestB64u;
+} | {
+    readonly ed25519: DigestB64u;
+    readonly ecdsa_secp256k1: DigestB64u;
+};
+export type LinkedDeviceApprovalTranscriptV1 = {
+    readonly digestB64u: DigestB64u;
+    readonly value: LinkedDeviceApprovalV1;
+    readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
+    readonly sourceKeyManifestDigestsB64u: LinkedDeviceSourceKeyManifestDigestsV1;
+    /** Authority digest at approval time; rotation advances it, so use must re-approve. */
+    readonly sourceAuthorityDigestB64u: DigestB64u;
+};
+export declare function sourceKeyManifestDigestForFamilyV1(digests: LinkedDeviceSourceKeyManifestDigestsV1, keyFamily: ExactAdministeredSignerV1['keyFamily']): DigestB64u | null;
+export type LinkedDeviceSourceContributionTranscriptV1 = LinkedDeviceApprovalTranscriptV1;
+type LinkedDeviceEmailOtpChallengeV1 = {
+    readonly state: 'available';
+    readonly maskedEmailHint: string;
+} | {
+    readonly state: 'sent';
+    readonly challengeId: string;
+    readonly workerEphemeralPublicKey65B64u: string;
+    readonly maskedEmailHint: string;
+    readonly expiresAtMs: number;
+    readonly resendAvailableAtMs: number;
+};
+type LinkedDeviceTargetFactorRecordV1 = {
+    readonly targetFactor: Extract<LinkedDeviceApprovedTargetFactorV1, {
+        readonly kind: 'passkey_prf';
+    }>;
+    readonly emailOtpChallenge?: never;
+} | {
+    readonly targetFactor: Extract<LinkedDeviceApprovedTargetFactorV1, {
+        readonly kind: 'email_otp';
+    }>;
+    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
+};
+type LinkedDeviceSessionRecordBaseV1 = {
+    readonly version: 'linked_device_session_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly qrPayload: QrLinkedDeviceSessionPayloadV5;
+    readonly revision: number;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+type LinkedDeviceSessionUnclaimedRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'displaying_qr';
+    }>;
+    readonly claimTranscript?: never;
+    readonly approvalTranscript?: never;
+    readonly targetFactor?: never;
+    readonly emailOtpChallenge?: never;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+    readonly sourceContributionPreparation?: never;
+    readonly sourceContributionTranscript?: never;
+};
+type LinkedDeviceSessionClaimedRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'claimed';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript?: never;
+    readonly targetFactor?: never;
+    readonly emailOtpChallenge?: never;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+    readonly sourceContributionPreparation?: never;
+    readonly sourceContributionTranscript?: never;
+};
+type LinkedDeviceSessionApprovedRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'awaiting_target_factor';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+    readonly sourceContributionPreparation?: never;
+    readonly sourceContributionTranscript?: never;
+};
+type LinkedDeviceSessionSourceContributionRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'awaiting_source_contribution';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript?: never;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+};
+type LinkedDeviceSessionProvisioningRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'provisioning';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+};
+type LinkedDeviceSessionPendingRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'authority_pending_local_install';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+};
+type LinkedDeviceSessionActiveRecordV1 = LinkedDeviceSessionRecordBaseV1 & LinkedDeviceTargetFactorRecordV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'active';
+    }>;
+    readonly claimTranscript: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript: LinkedDeviceApprovalTranscriptV1;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+};
+type LinkedDeviceSessionTerminalRecordV1 = LinkedDeviceSessionRecordBaseV1 & {
+    readonly state: Extract<LinkSessionStateV1, {
+        readonly state: 'failed_before_commit' | 'cancelled' | 'expired';
+    }>;
+    readonly claimTranscript?: LinkedDeviceClaimTranscriptV1;
+    readonly approvalTranscript?: LinkedDeviceApprovalTranscriptV1;
+    readonly targetFactor?: LinkedDeviceApprovedTargetFactorV1;
+    readonly emailOtpChallenge?: LinkedDeviceEmailOtpChallengeV1;
+    readonly sourceContributionPreparation?: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly sourceContributionTranscript?: LinkedDeviceSourceContributionTranscriptV1;
+    readonly authorityId?: never;
+    readonly packageSetDigestB64u?: never;
+};
+export type LinkedDeviceSessionRecordV1 = LinkedDeviceSessionUnclaimedRecordV1 | LinkedDeviceSessionClaimedRecordV1 | LinkedDeviceSessionApprovedRecordV1 | LinkedDeviceSessionSourceContributionRecordV1 | LinkedDeviceSessionProvisioningRecordV1 | LinkedDeviceSessionPendingRecordV1 | LinkedDeviceSessionActiveRecordV1 | LinkedDeviceSessionTerminalRecordV1;
+export type LinkedDeviceSessionClaimIdentityV1 = {
+    readonly walletId: WalletId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly claimExpiresAtMs: number;
+};
+export type LinkedDeviceOwnerAuthorizationDeniedV1 = {
+    readonly kind: 'denied';
+    readonly code: 'unauthorized' | 'expired' | 'invalid';
+    readonly message: string;
+};
+export type LinkedDeviceOwnerAuthorizationContextV1 = {
+    readonly walletId: WalletId;
+    readonly walletSessionId: WalletSessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly expiresAtMs: number;
+    readonly permission: DelegatedWalletAuthorityV1;
+    readonly curve: 'ed25519' | 'ecdsa';
+    readonly keyManifestDigestB64u: DigestB64u;
+};
+export type LinkedDeviceOwnerAuthorizationPortV1 = {
+    authorizeOwnerClaimV1(input: {
+        readonly payload: QrLinkedDeviceSessionPayloadV5;
+        readonly requestedAtMs: number;
+        readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
+    }): Promise<{
+        readonly kind: 'authorized';
+        readonly identity: LinkedDeviceSessionClaimIdentityV1;
+    } | LinkedDeviceOwnerAuthorizationDeniedV1>;
+    authorizeOwnerApprovalV1(input: {
+        readonly session: LinkedDeviceSessionRecordV1;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly requestedAtMs: number;
+        readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
+    }): Promise<{
+        readonly kind: 'authorized';
+        readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
+        readonly sourceKeyManifestDigestsB64u: LinkedDeviceSourceKeyManifestDigestsV1;
+        readonly sourceAuthorityDigestB64u: DigestB64u;
+    } | LinkedDeviceOwnerAuthorizationDeniedV1>;
+};
+export type LinkedDeviceSessionStoreV1 = {
+    createUnclaimedSessionV1(record: LinkedDeviceSessionRecordV1): Promise<LinkedDeviceSessionMutationResultV1>;
+    getSessionV1(linkSessionId: LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;
+    listSessionsForWalletV1(input: {
+        readonly walletId: WalletId;
+        readonly limit: number;
+        readonly cursor: LinkedDeviceSessionListCursorV1 | null;
+    }): Promise<LinkedDeviceSessionListPageV1>;
+    claimSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly claim: LinkedDeviceClaimV1;
+        readonly claimDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordOwnerApprovalV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly approvalDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordTargetCredentialV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordSourceContributionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly approval: LinkedDeviceApprovalV1;
+        readonly approvalDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    recordEmailOtpChallengeStateV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    markAuthorityPendingLocalInstallV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    activateSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly activatedAtMs: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    failBeforeCommitV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    cancelSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    expireSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly nextRecord: LinkedDeviceSessionRecordV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+    deleteActiveSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly authorityId: WalletAuthorityId;
+        readonly packageSetDigestB64u: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionMutationResultV1>;
+};
+export type LinkedDeviceSessionMutationResultV1 = {
+    readonly outcome: 'applied' | 'replayed';
+    readonly record: LinkedDeviceSessionRecordV1;
+} | {
+    readonly outcome: 'conflict';
+    readonly expectedRevision: number;
+    readonly actualRevision: number | null;
+    readonly record: LinkedDeviceSessionRecordV1 | null;
+} | {
+    readonly outcome: 'expired';
+    readonly record: LinkedDeviceSessionRecordV1;
+} | {
+    readonly outcome: 'deleted';
+    readonly record: null;
+} | {
+    readonly outcome: 'invalid_state';
+    readonly state: LinkSessionStateV1['state'];
+    readonly record: LinkedDeviceSessionRecordV1;
+} | {
+    readonly outcome: 'integrity_error';
+    readonly reason: 'authority_id_mismatch' | 'package_set_digest_mismatch';
+    readonly record: LinkedDeviceSessionRecordV1;
+};
+export type LinkedDeviceSessionServiceResultV1 = LinkedDeviceSessionMutationResultV1 | {
+    readonly outcome: 'invalid_input';
+    readonly message: string;
+} | {
+    readonly outcome: 'unauthorized';
+    readonly code: string;
+    readonly message: string;
+};
+export type LinkedDeviceTargetCredentialMutationResultV1 = LinkedDeviceSessionMutationResultV1 | {
+    readonly outcome: 'invalid_input';
+    readonly message: string;
+};
+export type LinkedDeviceSessionCreateInputV1 = {
+    readonly payload: QrLinkedDeviceSessionPayloadV5;
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionClaimInputV1 = {
+    readonly payload: QrLinkedDeviceSessionPayloadV5;
+    readonly nowMs: number;
+    readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
+};
+export type LinkedDeviceSessionApprovalInputV1 = {
+    readonly approval: LinkedDeviceApprovalV1;
+    readonly nowMs: number;
+    readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
+};
+export type LinkedDeviceSessionCancelInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionExpireInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionDeleteInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionTargetCredentialInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly sourceContributionPreparation: LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionSourceContributionInputV1 = {
+    readonly approval: LinkedDeviceApprovalV1;
+    readonly nowMs: number;
+    readonly owner: LinkedDeviceOwnerAuthorizationContextV1;
+};
+export type LinkedDeviceSessionEmailOtpChallengeInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly challenge: {
+        readonly challengeId: string;
+        readonly workerEphemeralPublicKey65B64u: string;
+        readonly maskedEmailHint: string;
+        readonly expiresAtMs: number;
+        readonly resendAvailableAtMs: number;
+    };
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionCommitInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly nowMs: number;
+};
+export type LinkedDeviceSessionActivationInputV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly expectedRevision: number;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly activatedAtMs: number;
+    readonly nowMs: number;
+};
+export declare class LinkedDeviceSessionServiceV1 {
+    private readonly store;
+    private readonly authorization;
+    constructor(input: {
+        readonly store: LinkedDeviceSessionStoreV1;
+        readonly authorization: LinkedDeviceOwnerAuthorizationPortV1;
+    });
+    createUnclaimedSessionV1(input: LinkedDeviceSessionCreateInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    claimSessionV1(input: LinkedDeviceSessionClaimInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    recordOwnerApprovalV1(input: LinkedDeviceSessionApprovalInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    recordTargetCredentialV1(input: LinkedDeviceSessionTargetCredentialInputV1): Promise<LinkedDeviceTargetCredentialMutationResultV1>;
+    recordSourceContributionV1(input: LinkedDeviceSessionSourceContributionInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    recordEmailOtpChallengeStateV1(input: LinkedDeviceSessionEmailOtpChallengeInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    markAuthorityPendingLocalInstallV1(input: LinkedDeviceSessionCommitInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    activateSessionV1(input: LinkedDeviceSessionActivationInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    failBeforeCommitV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly expectedRevision: number;
+        readonly error: LinkPrecommitFailureV1;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceSessionServiceResultV1>;
+    cancelSessionV1(input: LinkedDeviceSessionCancelInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    expireSessionV1(input: LinkedDeviceSessionExpireInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    deleteActiveSessionV1(input: LinkedDeviceSessionDeleteInputV1): Promise<LinkedDeviceSessionServiceResultV1>;
+    getSessionV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly nowMs: number;
+    } | LinkDeviceSessionId): Promise<LinkedDeviceSessionRecordV1 | null>;
+    listSessionsForWalletV1(input: {
+        readonly walletId: WalletId;
+        readonly nowMs: number;
+        readonly limit: number;
+        readonly cursor: LinkedDeviceSessionListCursorV1 | null;
+    }): Promise<LinkedDeviceSessionListPageV1>;
+    private requireSession;
+}
+export declare function digestTranscriptV1(kind: 'claim', value: LinkedDeviceClaimV1): Promise<DigestB64u>;
+export declare function digestTranscriptV1(kind: 'approval', value: LinkedDeviceApprovalV1): Promise<DigestB64u>;
+export declare function buildUnclaimedSessionRecordV1(payload: QrLinkedDeviceSessionPayloadV5, nowMs: number): LinkedDeviceSessionRecordV1;
+export declare function parseLinkedDeviceSessionRecordV1(raw: unknown): LinkedDeviceSessionRecordV1;
+/** Builds the next linear session record for the authority commit transaction. */
+export declare function buildAuthorityPendingLocalInstallSessionRecordV1(input: {
+    readonly record: LinkedDeviceSessionRecordV1;
+    readonly authorityId: WalletAuthorityId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly nowMs: number;
+}): LinkedDeviceSessionRecordV1;
+/** Builds the next linear session record for the authority activation transaction. */
+export declare function buildAuthorityActiveSessionRecordV1(input: {
+    readonly record: LinkedDeviceSessionRecordV1;
+    readonly activatedAtMs: number;
+    readonly nowMs: number;
+}): LinkedDeviceSessionRecordV1;
+export declare function linkedDeviceQrPayloadsEqualV1(left: QrLinkedDeviceSessionPayloadV5, right: QrLinkedDeviceSessionPayloadV5): boolean;
+/**
+ * A stored transcript no longer parses under the current schema. This class
+ * marks exactly the failures a deployment boundary produces - transcript
+ * shapes are what refactors move - so a store can delete-and-recover them
+ * while every value-consistency failure (tampering) keeps throwing raw.
+ */
+export declare class LinkedDeviceRetiredSessionShapeErrorV1 extends Error {
+    constructor(transcript: string, cause: unknown);
+}
+//# sourceMappingURL=linkedDeviceSession.d.ts.map

package/dist/types/wallet-server/src/core/deviceLinking/requestProof.d.ts

@@ -0,0 +1,55 @@
+import { type LinkDeviceSessionId } from '../../../../shared-ts/src/signing-lanes/ids';
+import { type DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
+import { type LinkedDeviceRequestProofV1 } from '../../../../shared-ts/src/device-linking/requestProof';
+export { computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1, LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, type LinkedDeviceRequestProofV1, } from '../../../../shared-ts/src/device-linking/requestProof';
+export type LinkedDeviceRequestProofVerificationInputV1 = {
+    readonly proof: LinkedDeviceRequestProofV1;
+    readonly expectedDevicePublicKeyB64u: string;
+    readonly expectedDevicePublicKeyDigestB64u: DigestB64u;
+    readonly expectedLinkSessionId: LinkDeviceSessionId;
+    readonly expectedMethod: string;
+    readonly expectedCanonicalPath: string;
+    readonly expectedBodyDigestB64u: DigestB64u;
+    readonly nowMs: number;
+};
+export type LinkedDeviceRequestProofNonceStoreV1 = {
+    consumeRequestProofNonceV1(input: {
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly requestNonceB64u: string;
+        readonly proofDigestB64u: DigestB64u;
+        readonly issuedAtMs: number;
+        readonly expiresAtMs: number;
+        readonly consumedAtMs: number;
+    }): Promise<{
+        readonly outcome: 'consumed';
+    } | {
+        readonly outcome: 'already_used';
+    }>;
+};
+export type LinkedDeviceRequestProofVerificationResultV1 = {
+    readonly kind: 'authorized';
+    readonly proofDigestB64u: DigestB64u;
+} | {
+    readonly kind: 'denied';
+    readonly code: 'invalid' | 'expired' | 'replayed';
+    readonly message: string;
+};
+export declare class LinkedDeviceRequestProofVerifierV1 {
+    private readonly nonceStore;
+    constructor(input: {
+        readonly nonceStore: LinkedDeviceRequestProofNonceStoreV1;
+    });
+    verifyV1(input: LinkedDeviceRequestProofVerificationInputV1): Promise<LinkedDeviceRequestProofVerificationResultV1>;
+    verifyPublicCreateV1(input: {
+        readonly proof: LinkedDeviceRequestProofV1;
+        readonly devicePublicKeyB64u: string;
+        readonly devicePublicKeyDigestB64u: DigestB64u;
+        readonly linkSessionId: LinkDeviceSessionId;
+        readonly method: string;
+        readonly canonicalPath: string;
+        readonly bodyDigestB64u: DigestB64u;
+        readonly nowMs: number;
+    }): Promise<LinkedDeviceRequestProofVerificationResultV1>;
+}
+export declare function parseLinkedDeviceRequestProofV1(raw: unknown): LinkedDeviceRequestProofV1;
+//# sourceMappingURL=requestProof.d.ts.map

package/dist/types/wallet-server/src/core/errors.d.ts

@@ -0,0 +1,10 @@
+import type { FinalExecutionOutcome } from '@near-js/types';
+/**
+ * Parse a NEAR FinalExecutionOutcome and surface a human-readable error
+ * string when common contract/account failures are detected.
+ *
+ * This helper is intentionally conservative: it never throws, and returns
+ * null when it cannot confidently extract a useful message.
+ */
+export declare function parseContractExecutionError(result: FinalExecutionOutcome, accountId: string): string | null;
+//# sourceMappingURL=errors.d.ts.map