@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/types.d.ts

@@ -0,0 +1,757 @@
+import { AuthenticatorOptions, UserVerificationPolicy, OriginPolicyInput } from '../../../shared-ts/src/utils/authenticatorOptions';
+import type { InitInput } from '../../../../wasm/near_signer/pkg/wasm_signer_worker.js';
+import type { Logger } from './logger';
+import type { RuntimePolicyScope } from '../../../shared-ts/src/threshold/signingRootScope';
+import type { EcdsaClientRootPublicKey33B64u, DerivationClientSharePublicKey33B64u, EcdsaDerivationRelayerPublicKey33B64u } from '../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { RouterAbEd25519NormalSigningState } from '../../../shared-ts/src/utils/signingSessionSeal';
+import type { RouterAbEcdsaDerivationNormalSigningScopeV1, RouterAbEcdsaDerivationNormalSigningStateV1 } from '../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { WalletAuthAuthority } from '../../../shared-ts/src/utils/walletAuthAuthority';
+import type { RootShareEpoch, WebAuthnRpId } from '../../../shared-ts/src/utils/domainIds';
+import type { EvmFamilySigningKeySlotId } from '../../../shared-ts/src/signing-lanes';
+import type { WalletSessionOperationCredentialV1 } from '../../../shared-ts/src/device-linking';
+import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../shared-ts/src/authorization/capabilityKinds';
+/**
+ * WASM Bindgen generates a `free` method and a `[Symbol.dispose]` method on all structs.
+ * Strip both so we can pass plain objects to the worker.
+ */
+export type StripFree<T> = T extends object ? {
+    [K in keyof T as K extends 'free' | symbol ? never : K]: StripFree<T[K]>;
+} : T;
+export interface ServerRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: string;
+}
+export interface ServerResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+export type SignerWasmModuleSupplier = InitInput | Promise<InitInput> | (() => InitInput | Promise<InitInput>);
+export interface SignerWasmConfig {
+    /**
+     * Optional override for locating the signer WASM module. Useful for serverless
+     * runtimes (e.g. Workers) where filesystem-relative URLs are unavailable.
+     * Accepts any value supported by `initSignerWasm({ module_or_path })` or a
+     * function that resolves to one.
+     */
+    moduleOrPath?: SignerWasmModuleSupplier;
+}
+export type ThresholdEd25519KeyStoreKind = 'in-memory' | 'upstash-redis-rest' | 'redis-tcp' | 'cloudflare-do';
+export interface CloudflareDurableObjectStubLike {
+    fetch(input: RequestInfo, init?: RequestInit): Promise<Response>;
+}
+export interface CloudflareDurableObjectNamespaceLike {
+    idFromName(name: string): unknown;
+    get(id: unknown): CloudflareDurableObjectStubLike;
+}
+export type ThresholdStoreConfig = {
+    kind: 'in-memory';
+} | {
+    kind: 'upstash-redis-rest';
+    url: string;
+    token: string;
+    keyPrefix?: string;
+} | {
+    kind: 'redis-tcp';
+    redisUrl: string;
+    keyPrefix?: string;
+} | {
+    kind: 'cloudflare-do';
+    /**
+     * Durable Object namespace binding (e.g. `env.THRESHOLD_STORE`).
+     * Must point to a DO class implementing the SDK's threshold store protocol.
+     */
+    namespace: CloudflareDurableObjectNamespaceLike;
+    /**
+     * Optional DO instance name. Defaults to `threshold-store`.
+     * Use different names to isolate environments within the same Worker script.
+     */
+    name?: string;
+};
+/**
+ * Env-shaped input for threshold key store selection.
+ * - Upstash REST (Cloudflare-friendly): UPSTASH_REDIS_REST_URL + UPSTASH_REDIS_REST_TOKEN
+ * - Redis TCP (Node-only): REDIS_URL
+ */
+export type ThresholdStoreEnvInput = {
+    UPSTASH_REDIS_REST_URL?: string;
+    UPSTASH_REDIS_REST_TOKEN?: string;
+    REDIS_URL?: string;
+    /**
+     * Optional global base prefix for all threshold keyspaces.
+     *
+     * When set, and the more specific `THRESHOLD_ED25519_*_PREFIX` variables are not set,
+     * the SDK derives:
+     * - `THRESHOLD_ED25519_WALLET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:wallet-session:`
+     * - `THRESHOLD_ED25519_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:sess:`
+     * - `THRESHOLD_ED25519_KEYSTORE_PREFIX` = `${THRESHOLD_PREFIX}:threshold-ed25519:key:`
+     * - `THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX` = `${THRESHOLD_PREFIX}:wallet-session:budget:`
+     *
+     * Trailing `:` is optional.
+     */
+    THRESHOLD_PREFIX?: string;
+    THRESHOLD_ED25519_KEYSTORE_PREFIX?: string;
+    THRESHOLD_ED25519_SESSION_PREFIX?: string;
+    THRESHOLD_ED25519_WALLET_SESSION_PREFIX?: string;
+    THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX?: string;
+    /**
+     * Ed25519 relayer-share source mode. This remains Ed25519-specific because
+     * it controls the Ed25519 threshold signing protocol, not the shared store.
+     */
+    THRESHOLD_ED25519_SHARE_MODE?: string;
+    /**
+     * Optional prefixes for threshold ECDSA key/session/Wallet Session storage.
+     * Defaults derive from `THRESHOLD_PREFIX` with a `threshold-ecdsa:*` namespace when unset.
+     */
+    THRESHOLD_ECDSA_KEYSTORE_PREFIX?: string;
+    THRESHOLD_ECDSA_SESSION_PREFIX?: string;
+    THRESHOLD_ECDSA_WALLET_SESSION_PREFIX?: string;
+    /**
+     * Optional prefix for threshold ECDSA presignature pool storage.
+     * Defaults derive from `THRESHOLD_PREFIX` with a `threshold-ecdsa:*` namespace when unset.
+     */
+    THRESHOLD_ECDSA_PRESIGN_PREFIX?: string;
+    /**
+     * Optional override for the client FROST participant identifier (u16, >= 1).
+     * Must be distinct from `THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID`.
+     */
+    THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID?: string;
+    /**
+     * Optional override for the relayer FROST participant identifier (u16, >= 1).
+     * Must be distinct from `THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID`.
+     */
+    THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID?: string;
+    /**
+     * Threshold node role.
+     * - "coordinator" (default): exposes public registration/session routes and Router A/B bridge handlers.
+     * - "cosigner": exposes internal relayer-fleet t-of-n cosigning endpoints when configured.
+     */
+    THRESHOLD_NODE_ROLE?: string;
+    /**
+     * 32-byte base64url shared secret used to authenticate coordinator→peer calls.
+     *
+     * When set, cosigner relayers can expose internal endpoints that accept
+     * coordinator-signed grants (HMAC-SHA256).
+     */
+    THRESHOLD_COORDINATOR_SHARED_SECRET_B64U?: string;
+    /**
+     * Stable identifier for this coordinator instance.
+     *
+     * Used to pin Router A/B ECDSA derivation pool-fill sessions to the instance that
+     * created the live in-memory WASM session object.
+     */
+    THRESHOLD_COORDINATOR_INSTANCE_ID?: string;
+    /**
+     * Optional coordinator peer list (JSON) for cross-instance presign-step forwarding.
+     *
+     * Example:
+     * `THRESHOLD_COORDINATOR_PEERS=[{"instanceId":"coordinator-a","relayerUrl":"https://relay-a.internal"},{"instanceId":"coordinator-b","relayerUrl":"https://relay-b.internal"}]`
+     */
+    THRESHOLD_COORDINATOR_PEERS?: string;
+    /**
+     * Optional relayer-fleet cosigner list (JSON) for internal t-of-n cosigning.
+     *
+     * When configured on a coordinator node, the coordinator can fan out to relayer cosigners
+     * (internal-only nodes) and combine their partials into a single outer relayer signature share.
+     *
+     * Example:
+     * `THRESHOLD_ED25519_RELAYER_COSIGNERS=[{"cosignerId":1,"relayerUrl":"https://cosigner-a.internal"},{"cosignerId":2,"relayerUrl":"https://cosigner-b.internal"},{"cosignerId":3,"relayerUrl":"https://cosigner-c.internal"}]`
+     */
+    THRESHOLD_ED25519_RELAYER_COSIGNERS?: string;
+    /**
+     * Internal relayer cosigner id for this node (u16, >= 1).
+     * Required when running `THRESHOLD_NODE_ROLE=cosigner`.
+     */
+    THRESHOLD_ED25519_RELAYER_COSIGNER_ID?: string;
+    /**
+     * Internal relayer cosigner threshold `T` (integer, >= 1).
+     * When set together with `THRESHOLD_ED25519_RELAYER_COSIGNERS`, the coordinator will wait for
+     * `T` cosigners per signing round.
+     */
+    THRESHOLD_ED25519_RELAYER_COSIGNER_T?: string;
+    /**
+     * Optional Router A/B Ed25519 normal-signing SigningWorker id accepted by
+     * threshold session policy. When unset, Router A/B normal-signing session
+     * policy is rejected.
+     */
+    ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
+    /** Private Router A/B SigningWorker base URL. */
+    ROUTER_AB_SIGNING_WORKER_URL?: string;
+    /** Secret value sent in `x-router-ab-internal-service-auth` to private workers. */
+    ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
+    /** Fetch transport for hosted runtimes that reach the SigningWorker through a service binding. */
+    routerAbSigningWorkerFetch?: typeof globalThis.fetch;
+    /** Signing-session seal root plus public rotation configuration. */
+    SIGNING_SESSION_SEAL_ROOT_SECRET_B64U?: string;
+    SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION?: string;
+    SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS?: string;
+    /** Optional signing session-seal idempotency backend configuration. */
+    SIGNING_SESSION_SEAL_IDEMPOTENCY_KIND?: string;
+    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_URL?: string;
+    SIGNING_SESSION_SEAL_IDEMPOTENCY_UPSTASH_TOKEN?: string;
+    SIGNING_SESSION_SEAL_IDEMPOTENCY_REDIS_URL?: string;
+    SIGNING_SESSION_SEAL_IDEMPOTENCY_KEY_PREFIX?: string;
+    SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS?: string;
+};
+/**
+ * Threshold key store config input.
+ *
+ * Accepts either:
+ * - an env-shaped object (for ergonomics in server examples), or
+ * - an explicit `kind` object, optionally augmented with env-shaped overrides
+ *   (useful when wiring via code but still wanting env vars like THRESHOLD_NODE_ROLE).
+ */
+export type ThresholdStoreConfigInput = ThresholdStoreEnvInput | (ThresholdStoreConfig & Partial<ThresholdStoreEnvInput>);
+export interface AuthServiceConfig {
+    relayerAccount: string;
+    relayerPrivateKey: string;
+    nearRpcUrl: string;
+    networkId: string;
+    accountInitialBalance: string;
+    createAccountAndRegisterGas: string;
+    signerWasm?: SignerWasmConfig;
+    /**
+     * Optional persistence for relayer-held threshold signing shares.
+     * Defaults to in-memory unless env-shaped config enables Redis/Upstash.
+     */
+    thresholdStore?: ThresholdStoreConfigInput;
+    /**
+     * Optional logger. When unset, the server SDK is silent (no `console.*`).
+     * Pass `logger: console` to enable default logging.
+     */
+    logger?: Logger | null;
+    /**
+     * Optional Google OIDC configuration for verifying Google `id_token` login sessions.
+     */
+    googleOidc?: GoogleOidcConfig;
+    /**
+     * Optional GitHub OAuth configuration for exchanging authorization codes.
+     */
+    githubOAuth?: GithubOAuthConfig;
+}
+export type GoogleOidcConfig = {
+    /** Allowed OAuth client ids (audiences) for Google ID tokens. */
+    clientIds: string[];
+    /** Optional hosted domain allowlist (the `hd` claim). */
+    hostedDomains?: string[];
+};
+export interface GoogleOidcConfigEnvInput {
+    /** Single client id convenience. */
+    GOOGLE_OIDC_CLIENT_ID?: string;
+    /** Comma-separated client ids. */
+    GOOGLE_OIDC_CLIENT_IDS?: string;
+    /** Optional comma-separated hosted domains (`hd` claim). */
+    GOOGLE_OIDC_HOSTED_DOMAINS?: string;
+}
+export type GoogleOidcConfigInput = GoogleOidcConfig | GoogleOidcConfigEnvInput;
+export type GithubOAuthConfig = {
+    clientId: string;
+    clientSecret: string;
+    callbackUrl: string;
+};
+export interface GithubOAuthConfigEnvInput {
+    GITHUB_OAUTH_CLIENT_ID?: string;
+    GITHUB_OAUTH_CLIENT_SECRET?: string;
+    GITHUB_OAUTH_CALLBACK_URL?: string;
+}
+export type GithubOAuthConfigInput = GithubOAuthConfig | GithubOAuthConfigEnvInput;
+/**
+ * User-facing input shape for `AuthService`. Fields that have SDK defaults are optional here.
+ *
+ * Defaults are applied by `createAuthServiceConfig(...)` and the AuthService constructor.
+ */
+export type AuthServiceConfigInput = Omit<AuthServiceConfig, 'nearRpcUrl' | 'networkId' | 'accountInitialBalance' | 'createAccountAndRegisterGas' | 'thresholdStore' | 'googleOidc' | 'githubOAuth'> & {
+    nearRpcUrl?: string;
+    networkId?: string;
+    accountInitialBalance?: string;
+    createAccountAndRegisterGas?: string;
+    thresholdStore?: ThresholdStoreConfigInput;
+    googleOidc?: GoogleOidcConfigInput;
+    githubOAuth?: GithubOAuthConfigInput;
+};
+export interface AccountCreationRequest {
+    accountId: string;
+    publicKey: string;
+    recoveryPublicKey?: string;
+}
+export interface AccountCreationResult {
+    success: boolean;
+    transactionHash?: string;
+    accountId?: string;
+    error?: string;
+    message?: string;
+}
+export interface FundImplicitNearAccountRequest {
+    walletId: string;
+    nearAccountId: string;
+    nearPublicKeyStr: string;
+}
+export type FundImplicitNearAccountResult = {
+    ok: true;
+    walletId: string;
+    nearAccountId: string;
+    fundedAmountYocto: string;
+    transactionHash?: string;
+    message?: string;
+} | {
+    ok: false;
+    code: 'not_configured' | 'invalid_request' | 'funding_failed';
+    message: string;
+};
+export interface NearActionErrorKind {
+    AccountAlreadyExists?: {
+        accountId: string;
+    };
+    AccountDoesNotExist?: {
+        account_id: string;
+    };
+    InsufficientStake?: {
+        account_id: string;
+        stake: string;
+        minimum_stake: string;
+    };
+    LackBalanceForState?: {
+        account_id: string;
+        balance: string;
+    };
+    [key: string]: any;
+}
+export interface NearActionError {
+    kind: NearActionErrorKind;
+    index: string;
+}
+export interface NearExecutionFailure {
+    ActionError?: NearActionError;
+    [key: string]: any;
+}
+export interface NearReceiptStatus {
+    SuccessValue?: string;
+    SuccessReceiptId?: string;
+    Failure?: NearExecutionFailure;
+}
+export interface NearReceiptOutcomeWithId {
+    id: string;
+    outcome: {
+        logs: string[];
+        receipt_ids: string[];
+        gas_burnt: number;
+        tokens_burnt: string;
+        executor_id: string;
+        status: NearReceiptStatus;
+    };
+}
+export type { AuthenticatorOptions, UserVerificationPolicy, OriginPolicyInput };
+export interface WebAuthnAuthenticationCredential {
+    id: string;
+    rawId: string;
+    type: string;
+    authenticatorAttachment: string | null;
+    response: {
+        clientDataJSON: string;
+        authenticatorData: string;
+        signature: string;
+        userHandle: string | null;
+    };
+    clientExtensionResults: any | null;
+}
+export interface VerifyAuthenticationResponse {
+    success: boolean;
+    verified?: boolean;
+    code?: string;
+    message?: string;
+}
+export type ThresholdRuntimePolicyScope = RuntimePolicyScope;
+export type ThresholdEcdsaSigningRootMetadata = {
+    signingRootId: string;
+    signingRootVersion?: string;
+    walletKeyVersion: string;
+    derivationVersion: number;
+};
+export type ThresholdRuntimeSnapshotExpectation = {
+    snapshotId?: string;
+    version?: number;
+    checksum?: string;
+};
+export type ThresholdEd25519Purpose = 'near_tx' | 'nep461_delegate' | 'nep413' | string;
+export type ThresholdEd25519AuthorityScope = {
+    kind: 'passkey_rp';
+    rpId: WebAuthnRpId;
+    proofKind?: never;
+    email?: never;
+    provider?: never;
+    providerUserId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    provider: 'google' | 'email';
+    providerUserId: string;
+    proofKind?: never;
+    rpId?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+};
+export type Ed25519SessionPolicy = {
+    version: 'threshold_session_v1';
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authority: WalletAuthAuthority;
+    relayerKeyId: string;
+    thresholdSessionId: string;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    routerAbNormalSigning?: RouterAbEd25519NormalSigningState;
+    /** Optional participant ids that scope the session to a signer set. */
+    participantIds?: number[];
+    ttlMs: number;
+    remainingUses: number;
+};
+export type ThresholdEd25519VerifiedWalletAuth = {
+    kind: 'threshold_ecdsa_session';
+    claims: {
+        sub: string;
+        walletId: string;
+        kind: 'router_ab_ecdsa_derivation_wallet_session_v1';
+        thresholdSessionId: string;
+        walletSessionId: WalletSessionId;
+        quotaId: MpcWalletSigningQuotaId;
+        keyScope: 'evm-family';
+        keyHandle: string;
+        relayerKeyId: string;
+        evmFamilySigningKeySlotId: string;
+        runtimePolicyScope?: ThresholdRuntimePolicyScope;
+        thresholdExpiresAtMs: number;
+        participantIds: number[];
+    };
+};
+export type ThresholdEd25519SessionAuth = {
+    kind: 'verified_wallet';
+    walletAuth: ThresholdEd25519VerifiedWalletAuth;
+} | {
+    kind: 'passkey';
+    webauthn_authentication: WebAuthnAuthenticationCredential;
+    expected_origin: string;
+};
+export interface ThresholdEd25519SessionRequest {
+    relayerKeyId: string;
+    sessionPolicy: Ed25519SessionPolicy;
+    projectEnvironmentId?: string;
+    auth: ThresholdEd25519SessionAuth;
+}
+export interface ThresholdEd25519SessionResponse {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    walletId?: string;
+    nearAccountId?: string;
+    nearEd25519SigningKeyId?: string;
+    authorityScope?: ThresholdEd25519AuthorityScope;
+    thresholdSessionId?: string;
+    walletSessionId?: WalletSessionId;
+    quotaId?: MpcWalletSigningQuotaId;
+    /** Server-enforced expiry (ms since epoch). */
+    expiresAtMs?: number;
+    expiresAt?: string;
+    /** Signer-set binding (sorted unique participant ids) when available. */
+    participantIds?: number[];
+    remainingUses?: number;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    routerAbNormalSigning?: RouterAbEd25519NormalSigningState;
+}
+export interface ThresholdEd25519CosignInitRequest {
+    coordinatorGrant: string;
+    signingSessionId: string;
+    /**
+     * Base64url-encoded 32-byte relayer cosigner signing share (a secret share; unweighted).
+     * The cosigner derives its effective outer-protocol share from this and the selected cosigner set.
+     */
+    cosignerShareB64u: string;
+    clientCommitments: {
+        hiding: string;
+        binding: string;
+    };
+}
+export interface ThresholdEd25519CosignInitResponse {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    relayerCommitments?: {
+        hiding: string;
+        binding: string;
+    };
+}
+export interface ThresholdEd25519CosignFinalizeRequest {
+    coordinatorGrant: string;
+    signingSessionId: string;
+    /**
+     * The selected cosigner id set used for internal Lagrange interpolation.
+     * Must include this cosigner's configured id.
+     */
+    cosignerIds: number[];
+    /** NEAR ed25519 public key string (`ed25519:<base58>`). */
+    groupPublicKey: string;
+    /**
+     * The combined outer-protocol relayer commitments (sum across the selected cosigners).
+     * This must match what the client used for its signing transcript.
+     */
+    relayerCommitments: {
+        hiding: string;
+        binding: string;
+    };
+}
+export interface ThresholdEd25519CosignFinalizeResponse {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    relayerSignatureShareB64u?: string;
+}
+export type ThresholdEcdsaPurpose = string;
+export type EcdsaThresholdKeyId = string;
+export type ThresholdEcdsaChainTarget = import('./thresholdEcdsaChainTarget').ThresholdEcdsaChainTarget;
+export type RegistrationPreparationId = string & {
+    readonly __brand: 'RegistrationPreparationId';
+};
+export declare function registrationPreparationIdFromString(value: string): RegistrationPreparationId;
+export type WalletKeyFactsInventoryAuth = {
+    kind: 'webauthn_assertion';
+    credential: WebAuthnAuthenticationCredential;
+    expectedChallengeDigestB64u: string;
+    serverNonceB64u: string;
+    runtimePolicyScope?: RuntimePolicyScope;
+    curve?: never;
+} | {
+    kind: WalletSessionOperationCredentialV1['kind'];
+    walletSessionId: WalletSessionId;
+} | {
+    kind: 'opaque_hosted_wallet_session_operation_credential_v1';
+    walletSessionId: WalletSessionId;
+};
+export interface ThresholdEcdsaDerivationFinalizeResponse {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    keyHandle?: string;
+    ecdsaThresholdKeyId?: EcdsaThresholdKeyId;
+    clientVerifyingShareB64u?: string;
+    clientAdditiveShare32B64u?: string;
+    thresholdEcdsaPublicKeyB64u?: string;
+    ethereumAddress?: string;
+    participantIds?: number[];
+    relayerKeyId?: string;
+    relayerVerifyingShareB64u?: string;
+    chainId?: number;
+    thresholdSessionId?: string;
+    chainTarget?: ThresholdEcdsaChainTarget;
+    expiresAtMs?: number;
+    expiresAt?: string;
+    remainingUses?: number;
+    signingRootId?: string;
+    signingRootVersion?: string;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    canonicalPublicKeyHex?: string;
+    privateKeyHex?: string;
+    canonicalEthereumAddress?: string;
+}
+export type EcdsaDerivationErrorCode = 'invalid_body' | 'unauthorized' | 'forbidden' | 'not_found' | 'stale_state' | 'relayer_key_mismatch' | 'context_mismatch' | 'public_key_invalid' | 'identity_mismatch' | 'zero_canonical_key' | 'export_authorization_invalid' | 'export_authorization_expired' | 'export_nonce_replay' | 'presign_session_invalid' | 'presign_session_burned' | 'pool_empty' | 'internal';
+export type EcdsaDerivationRouteResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    code: EcdsaDerivationErrorCode;
+    message: string;
+    retryAfterMs?: number;
+};
+export type EcdsaDerivationRoleLocalFormatVersion = 'ecdsa-derivation-role-local';
+export type EcdsaDerivationKeyScope = 'evm-family';
+export interface EcdsaDerivationPublicIdentity {
+    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
+    relayerPublicKey33B64u: EcdsaDerivationRelayerPublicKey33B64u;
+    groupPublicKey33B64u: string;
+    ethereumAddress: string;
+}
+export interface EcdsaDerivationClientRootProof {
+    version: 'ecdsa-derivation:role-local:first-bootstrap-root-proof:v2';
+    clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    digest32B64u: string;
+    signature65B64u: string;
+}
+export interface EcdsaDerivationPasskeyBootstrapAuthorization {
+    kind: 'passkey_bootstrap';
+    rpId: string;
+    webauthn_authentication: WebAuthnAuthenticationCredential;
+    runtimePolicyScope?: RuntimePolicyScope;
+    projectEnvironmentId?: string;
+}
+interface EcdsaDerivationClientBootstrapRequestBase {
+    formatVersion: EcdsaDerivationRoleLocalFormatVersion;
+    walletId: string;
+    evmFamilySigningKeySlotId: EvmFamilySigningKeySlotId;
+    ecdsaThresholdKeyId: EcdsaThresholdKeyId;
+    signingRootId: string;
+    signingRootVersion: string;
+    keyScope: EcdsaDerivationKeyScope;
+    relayerKeyId: string;
+    registrationPreparationId?: RegistrationPreparationId;
+    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
+    clientShareRetryCounter: number;
+    contextBinding32B64u: string;
+    requestId: string;
+    sessionId: string;
+    ttlMs: number;
+    remainingUses: number;
+    participantIds: number[];
+    runtimePolicyScope?: RuntimePolicyScope;
+}
+export type EcdsaDerivationClientBootstrapRequest = (EcdsaDerivationClientBootstrapRequestBase & {
+    clientRootProof: EcdsaDerivationClientRootProof;
+    passkeyBootstrapAuthorization?: never;
+}) | (EcdsaDerivationClientBootstrapRequestBase & {
+    clientRootProof?: never;
+    passkeyBootstrapAuthorization: EcdsaDerivationPasskeyBootstrapAuthorization;
+}) | (EcdsaDerivationClientBootstrapRequestBase & {
+    clientRootProof?: never;
+    passkeyBootstrapAuthorization?: never;
+});
+export interface EcdsaDerivationServerBootstrapResponse {
+    formatVersion: EcdsaDerivationRoleLocalFormatVersion;
+    walletId: string;
+    evmFamilySigningKeySlotId: string;
+    ecdsaThresholdKeyId: EcdsaThresholdKeyId;
+    relayerKeyId: string;
+    applicationBindingDigestB64u: string;
+    contextBinding32B64u: string;
+    publicIdentity: EcdsaDerivationPublicIdentity;
+    clientShareRetryCounter: number;
+    relayerShareRetryCounter: number;
+    publicTranscriptDigest32B64u: string;
+    keyHandle: string;
+    signingRootId: string;
+    signingRootVersion: string;
+    thresholdEcdsaPublicKeyB64u: string;
+    ethereumAddress: string;
+    relayerVerifyingShareB64u: string;
+    participantIds: number[];
+    thresholdSessionId: string;
+    activationEpoch: RootShareEpoch;
+    expiresAtMs: number;
+    expiresAt: string;
+    remainingUses: number;
+    routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+}
+export type EcdsaSessionPolicy = {
+    version: 'threshold_session_policy_v2';
+    walletId: string;
+    evmFamilySigningKeySlotId: string;
+    relayerKeyId: string;
+    chainTarget: ThresholdEcdsaChainTarget;
+    keyHandle?: string;
+    ecdsaThresholdKeyId?: EcdsaThresholdKeyId;
+    thresholdSessionId: string;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    /** Optional participant ids that scope the session to a signer set. */
+    participantIds?: number[];
+    ttlMs: number;
+    remainingUses: number;
+};
+export type ThresholdEcdsaBootstrapSessionPolicy = {
+    version: 'threshold_session_policy_v2';
+    walletId: string;
+    evmFamilySigningKeySlotId: string;
+    chainTarget: ThresholdEcdsaChainTarget;
+    keyHandle?: string;
+    ecdsaThresholdKeyId?: EcdsaThresholdKeyId;
+    thresholdSessionId: string;
+    runtimePolicyScope?: ThresholdRuntimePolicyScope;
+    /** Optional participant ids that scope the session to a signer set. */
+    participantIds?: number[];
+    ttlMs: number;
+    remainingUses: number;
+};
+export type RouterAbEcdsaDerivationPoolFillInitRequest = {
+    keyHandle?: string;
+    ecdsaThresholdKeyId?: EcdsaThresholdKeyId;
+    /**
+     * Number of presignatures to generate.
+     * v1 supports only `1` (single presignature session).
+     */
+    count?: number;
+    /**
+     * Optional client-provided request classification for logging/observability.
+     * Example: `background_presign_pool_refill`.
+     */
+    requestTag?: string;
+    poolFill: {
+        kind: 'router_ab_ecdsa_derivation_signing_worker_pool';
+        scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
+        expiresAtMs: number;
+    };
+};
+export type RouterAbEcdsaDerivationPoolFillInitResponse = {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    presignSessionId?: string;
+    materialExpiresAtMs?: number;
+    stage?: 'triples' | 'triples_done' | 'presign' | 'done';
+    outgoingMessagesB64u?: string[];
+};
+export type RouterAbEcdsaDerivationPoolFillStepRequest = {
+    presignSessionId: string;
+    /**
+     * The client-requested stage transition:
+     * - `triples`: continue triple generation
+     * - `presign`: start/continue presigning (only valid once server is `triples_done`)
+     */
+    stage: 'triples' | 'presign';
+    outgoingMessagesB64u?: string[];
+    /**
+     * Optional client-provided request classification for logging/observability.
+     * Example: `background_presign_pool_refill`.
+     */
+    requestTag?: string;
+};
+export type RouterAbEcdsaDerivationPoolFillStepResponse = {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    stage?: 'triples' | 'triples_done' | 'presign' | 'done';
+    event?: 'none' | 'triples_done' | 'presign_done';
+    outgoingMessagesB64u?: string[];
+    /** Deterministic id derived from `bigR` (only present when `event==='presign_done'`). */
+    presignatureId?: string;
+    /** Base64url-encoded compressed secp256k1 point (33 bytes) for `R` (only present when `event==='presign_done'`). */
+    bigRB64u?: string;
+};
+export interface ThresholdEcdsaCosignInitRequest {
+    coordinatorGrant: string;
+    signingSessionId: string;
+    cosignerShareB64u: string;
+    clientRound1?: unknown;
+}
+export interface ThresholdEcdsaCosignInitResponse {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    relayerRound1?: unknown;
+}
+export interface ThresholdEcdsaCosignFinalizeRequest {
+    coordinatorGrant: string;
+    signingSessionId: string;
+    cosignerIds: number[];
+    groupPublicKey: string;
+    relayerRound1?: unknown;
+}
+export interface ThresholdEcdsaCosignFinalizeResponse {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    relayerRound2?: unknown;
+}
+//# sourceMappingURL=types.d.ts.map