@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/core/utils.d.ts

@@ -0,0 +1,3 @@
+export declare function formatGasToTGas(gasString: string): string;
+export declare function formatYoctoToNear(yoctoAmount: string | bigint): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/types/wallet-server/src/delegateAction/index.d.ts

@@ -0,0 +1,88 @@
+import type { FinalExecutionOutcome } from '@near-js/types';
+import type { NearClient, SignedTransaction } from '../core/rpcClients/near/NearClient';
+import { type NearTransactionActionArgsWasm } from '../../../shared-ts/src/near/actions';
+import type { RelayedSignedDelegate } from '../../../shared-ts/src/near/delegate';
+export type { RelayedSignedDelegate } from '../../../shared-ts/src/near/delegate';
+export interface DelegateActionPolicy {
+    /** Optional allowlist of receiver account IDs. If empty/omitted, any receiver is allowed. */
+    allowedReceivers?: string[];
+    /** Optional allowlist of function call method names. Empty = any method. */
+    allowedMethods?: string[];
+    /**
+     * Optional maximum total attached deposit (yoctoNEAR) across all actions.
+     * Represented as decimal string to avoid BigInt JSON issues.
+     */
+    maxTotalDepositYocto?: string;
+    /**
+     * Optional custom predicate for additional checks.
+     * Return false or throw to reject.
+     */
+    allow?: (input: {
+        hash: string;
+        delegate: RelayedSignedDelegate['delegateAction'];
+        signedDelegate: RelayedSignedDelegate;
+    }) => boolean | Promise<boolean>;
+}
+export interface ExecuteSignedDelegateRequest {
+    hash: string;
+    signedDelegate: RelayedSignedDelegate;
+    /**
+     * Optional policy configuration. If omitted, only basic hash/signature/expiry checks
+     * should be enforced by the caller.
+     */
+    policy?: DelegateActionPolicy;
+}
+export interface ExecuteSignedDelegateResult {
+    ok: boolean;
+    transactionHash?: string;
+    outcome?: FinalExecutionOutcome;
+    error?: string;
+    code?: string;
+}
+/**
+ * Normalize hash input (hex string with or without `0x` prefix) to a 32-byte Uint8Array.
+ */
+export declare function normalizeHashToBytes(hash: string): Uint8Array;
+/**
+ * Validate delegate nonce and expiry against current chain height.
+ * The actual SignedDelegate hashing and signature verification is done in the signer worker;
+ * this helper only enforces basic replay/expiry constraints expected of a relayer.
+ */
+export declare function validateDelegateExpiryAndNonce(params: {
+    nearClient: NearClient;
+    signedDelegate: RelayedSignedDelegate;
+}): Promise<void>;
+/**
+ * Enforce a simple policy over the delegate action:
+ * - Receiver allowlist
+ * - FunctionCall method allowlist
+ * - Total attached deposit limit
+ */
+export declare function enforceDelegatePolicy(input: {
+    hash: string;
+    signedDelegate: RelayedSignedDelegate;
+    policy?: DelegateActionPolicy;
+}): Promise<void>;
+/**
+ * Build a relayer transaction that wraps the SignedDelegate in a NEP-461
+ * SignedDelegate action. The relayer account is the signer and receiver.
+ *
+ * This helper only builds and sends the outer transaction; it assumes that:
+ * - hash/signature/expiry checks have already been performed, and
+ * - nonce/replay protection is implemented by the caller if needed.
+ */
+export declare function executeSignedDelegateWithRelayer(params: {
+    nearClient: NearClient;
+    relayerAccount: string;
+    relayerPublicKey: string;
+    hash: string;
+    signedDelegate: RelayedSignedDelegate;
+    policy?: DelegateActionPolicy;
+    signGasRelayerNearTransaction: (input: {
+        receiverId: string;
+        nonce: string;
+        blockHash: string;
+        actions: NearTransactionActionArgsWasm[];
+    }) => Promise<SignedTransaction>;
+}): Promise<ExecuteSignedDelegateResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/wallet-server/src/hosted-wallet-gateway-worker.d.ts

@@ -0,0 +1,10 @@
+import { type CloudflareD1GatewayEnv } from './hosted-wallet-gateway';
+import type { CfExecutionContext, CfScheduledEvent } from './router/cloudflare/runtime/cloudflare.types';
+declare function fetch(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext): Promise<Response>;
+declare function scheduled(event: CfScheduledEvent, env: CloudflareD1GatewayEnv, _ctx: CfExecutionContext): Promise<void>;
+declare const _default: {
+    fetch: typeof fetch;
+    scheduled: typeof scheduled;
+};
+export default _default;
+//# sourceMappingURL=hosted-wallet-gateway-worker.d.ts.map

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -0,0 +1,126 @@
+import { type D1DatabaseLike } from './cloud-host';
+import { type WalletConsoleServiceBinding } from './cloud-host';
+import { type WalletControlRuntimeBindings } from './cloud-host';
+import { createCloudflareD1RouterApiAuthService, type CloudflareD1RouterApiAuthServiceOptions } from './cloud-host';
+import type { SigningSessionSealRoutesOptions } from './cloud-host';
+import type { CfExecutionContext, FetchHandler } from './cloud-host';
+import { type RouterAbEd25519YaoTenantRootResolverV1 } from './cloud-host';
+import { type RouterAbEd25519YaoProductRegistrationRuntimeV1 } from './cloud-host';
+import { CloudflareD1RouterAbEd25519YaoCapabilityPersistence } from './cloud-host';
+import { type RouterAbServiceBindingEnv } from './cloud-host';
+import { createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1 } from './cloud-host';
+import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from './cloud-host';
+import { RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter } from './cloud-host';
+import type { WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './cloud-host';
+export interface CloudflareD1GatewayBaseEnv extends Readonly<Record<string, unknown>>, RouterAbServiceBindingEnv {
+    readonly SIGNER_DB: D1DatabaseLike;
+    readonly SEAMS_TENANT_STORAGE_NAMESPACE?: string;
+    readonly SEAMS_STAGING_ORG_ID?: string;
+    readonly SEAMS_STAGING_PROJECT_ID?: string;
+    readonly SEAMS_STAGING_ENV_ID?: string;
+    readonly RELAY_SESSION_HMAC_SECRET?: string;
+    readonly SESSION_COOKIE_NAME?: string;
+    readonly RELAY_SESSION_ISSUER?: string;
+    readonly RELAY_SESSION_AUDIENCE?: string;
+    readonly RELAY_CORS_ORIGINS?: string;
+    readonly HOSTED_WALLET_ORIGINS?: string;
+    readonly RELAYER_ACCOUNT_ID?: string;
+    readonly RELAYER_PUBLIC_KEY?: string;
+    readonly RELAYER_PRIVATE_KEY?: string;
+    readonly NEAR_RPC_URL?: string;
+    readonly ARC_RPC_URL?: string;
+    readonly ACCOUNT_INITIAL_BALANCE?: string;
+    readonly ENABLE_IMPLICIT_NEAR_ACCOUNT_TEST_FUNDING?: string;
+    readonly GOOGLE_OIDC_CLIENT_ID?: string;
+    readonly GITHUB_OAUTH_CLIENT_ID?: string;
+    readonly GITHUB_OAUTH_CLIENT_SECRET?: string;
+    readonly GITHUB_OAUTH_CALLBACK_URL?: string;
+    readonly ACCOUNT_ID_DERIVATION_SECRET?: string;
+    readonly ROUTER_AB_NORMAL_SIGNING_WORKER_ID?: string;
+    readonly SIGNING_WORKER_ID?: string;
+    readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
+    readonly ROUTER_AB_PREWARM_ENABLED: string;
+    readonly ROUTER_AB_CEREMONY_JWT_PRIVATE_JWK?: string;
+    readonly ROUTER_AB_CEREMONY_JWT_ISSUER?: string;
+    readonly ROUTER_AB_CEREMONY_JWT_AUDIENCE?: string;
+    readonly ROUTER_AB_CEREMONY_JWT_KEY_ID?: string;
+    readonly ROUTER_AB_ECDSA_REGISTRATION_TOPOLOGY_JSON?: string;
+    readonly ROUTER_AB_PUBLIC_KEYSET_JSON?: string;
+    readonly LINKED_DEVICE_WEBAUTHN_RP_ID?: string;
+    readonly SIGNING_SESSION_SEAL_ROOT_SECRET_B64U?: string;
+    readonly SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION?: string;
+    readonly SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS?: string;
+    readonly EMAIL_OTP_DELIVERY_MODE?: string;
+    readonly EMAIL_OTP_RUNTIME_PROFILE?: string;
+    readonly EMAIL_OTP_PROVIDER?: string;
+    readonly EMAIL_OTP_FROM_ADDRESS?: string;
+    readonly RESEND_API_KEY?: string;
+    readonly EMAIL_OTP_SES_REGION?: string;
+    readonly EMAIL_OTP_SES_ACCESS_KEY_ID?: string;
+    readonly EMAIL_OTP_SES_SECRET_ACCESS_KEY?: string;
+    readonly EMAIL_OTP_DEMO_ALLOWED_ORIGINS?: string;
+    readonly EMAIL_OTP_PRODUCTION?: string;
+    readonly EMAIL_OTP_DEV_OUTBOX_ENABLED?: string;
+    readonly EMAIL_OTP_CHALLENGE_RATE_LIMIT_MAX?: string;
+    readonly EMAIL_OTP_CHALLENGE_RATE_LIMIT_WINDOW_MS?: string;
+    readonly EMAIL_OTP_VERIFY_RATE_LIMIT_MAX?: string;
+    readonly EMAIL_OTP_VERIFY_RATE_LIMIT_WINDOW_MS?: string;
+    readonly EMAIL_OTP_GRANT_RATE_LIMIT_MAX?: string;
+    readonly EMAIL_OTP_GRANT_RATE_LIMIT_WINDOW_MS?: string;
+    readonly EMAIL_OTP_MAX_ATTEMPTS?: string;
+    readonly EMAIL_OTP_LOCKOUT_TTL_MS?: string;
+    readonly EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX?: string;
+    readonly EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS?: string;
+}
+export declare function readStagingHostedWalletOrigins(env: Pick<CloudflareD1GatewayBaseEnv, 'HOSTED_WALLET_ORIGINS'>): string[];
+export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {
+    readonly WALLET_CONSOLE: WalletConsoleServiceBinding;
+}
+export interface HostedWalletGatewayDependenciesV1 {
+    readonly emailOtpDeliveryProvider?: CloudflareD1RouterApiAuthServiceOptions['emailOtpDeliveryProvider'];
+}
+export declare function createStagingEd25519YaoBackend(env: CloudflareD1GatewayBaseEnv, resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1): import("./cloud-host").RouterAbEd25519YaoRegistrationBackend & import("./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery").RouterAbEd25519YaoRecoveryBackend & import("./cloud-host").RouterAbEd25519YaoExportBackend;
+/**
+ * The split Wallet Gateway (R105 Phase 4 cutover target): serves the Wallet
+ * runtime only, holds no Console database binding, and reaches the Wallet
+ * Console deployment exclusively through the exact service-binding ops.
+ * The sponsored-relay route extensions stay on the Wallet Console deployment
+ * until policy/sponsorship resolution operations join the binding.
+ */
+export declare function createHostedWalletGatewayCompositionV1(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<{
+    handler: FetchHandler;
+    service: import("./cloud-host").CloudflareD1RouterApiAuthService;
+    session: import("./cloud-host").SessionAdapter;
+}>;
+export declare function createSplitGatewayRouterHandler(env: CloudflareD1GatewayEnv, dependencies?: HostedWalletGatewayDependenciesV1): Promise<FetchHandler>;
+export declare function handleSplitGatewayWalletRuntimeRequest(request: Request, env: CloudflareD1GatewayEnv & WalletControlRuntimeBindings, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response | null>;
+export declare function handleSplitGatewayRequest(request: Request, env: CloudflareD1GatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
+export declare function stagingSigningSessionSealOptions(env: Pick<CloudflareD1GatewayBaseEnv, 'SIGNING_SESSION_SEAL_ROOT_SECRET_B64U' | 'SIGNING_SESSION_SEAL_CURRENT_KEY_VERSION' | 'SIGNING_SESSION_SEAL_ACCEPTED_WARM_KEY_VERSIONS'>): SigningSessionSealRoutesOptions | undefined;
+declare function createStagingYaoPartitionedStateStore(env: CloudflareD1GatewayBaseEnv): ReturnType<typeof createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1>;
+/**
+ * Builds the recovery request-scoped dependencies from the environment alone.
+ * This is new composition wiring over the existing authorization classes, not a
+ * second authorization implementation: the same adapter the tenant runtime uses
+ * is constructed here against request-scoped state instead of runtime-held
+ * state, which is the dependency Refactor 93 exists to remove.
+ */
+export declare function createStagingRecoveryRequestScopedDependencies(env: CloudflareD1GatewayBaseEnv, tenantRootCustodyLineage: CloudflareD1RouterApiAuthServiceOptions['tenantRootCustodyLineage'], dependencies?: HostedWalletGatewayDependenciesV1): {
+    readonly store: ReturnType<typeof createStagingYaoPartitionedStateStore>;
+    readonly backend: ReturnType<typeof createStagingEd25519YaoBackend>;
+    readonly authorization: RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter;
+    readonly capabilityPersistence: CloudflareD1RouterAbEd25519YaoCapabilityPersistence;
+    readonly capabilities: RouterAbEd25519YaoProductRegistrationRuntimeV1;
+    readonly linkedAuthorities: WarmBootstrapLinkedEd25519AuthorityReaderV1;
+};
+/**
+ * Builds export request-scoped state while reusing the request's authoritative
+ * Router API factor and owner-proof services.
+ */
+export declare function createStagingExportRequestScopedDependencies(env: CloudflareD1GatewayBaseEnv, service: ReturnType<typeof createCloudflareD1RouterApiAuthService>, tenantRootCustodyLineage: CloudflareD1RouterApiAuthServiceOptions['tenantRootCustodyLineage']): {
+    readonly store: ReturnType<typeof createStagingYaoPartitionedStateStore>;
+    readonly backend: ReturnType<typeof createStagingEd25519YaoBackend>;
+    readonly authorization: RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter;
+    readonly capabilities: RouterAbEd25519YaoProductRegistrationRuntimeV1;
+};
+export {};
+//# sourceMappingURL=hosted-wallet-gateway.d.ts.map

package/dist/types/wallet-server/src/index.d.ts

@@ -0,0 +1,34 @@
+export * from './core/types';
+export * from './core/config';
+export * from './core/defaultConfigsServer';
+export { formatSigningSessionSealKeyVersionForWire, parseSigningSessionSealKeyVersion, type SigningSessionSealKeyVersion, } from './core/keyMaterialBrands';
+export { AuthService } from './core/AuthService';
+export * from './authorization/domain';
+export * from './authorization/service';
+export * from './authorization/vaultProxyUse';
+export { SessionService, parseCsvList, buildCorsOrigins } from './core/SessionService';
+export type { SessionConfig } from './core/SessionService';
+export { createThresholdEd25519KeyStore, createThresholdEd25519SessionStore, createEd25519WalletSessionStore, createEcdsaWalletSessionStore, } from './core/ThresholdService';
+export { createRouterAbSigningRuntimes, type RouterAbSigningRuntimeBundle, } from './core/routerAbSigning/createRouterAbSigningRuntimes';
+export { RouterAbEcdsaPresignRuntime } from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
+export { ensureEvmCryptoWasm, computeEip1559TxHash, signSecp256k1Recoverable, encodeEip1559SignedTxFromSignature65, secp256k1PrivateKey32ToPublicKey33, secp256k1PublicKey33ToEthereumAddress, } from './core/ThresholdService/evmCryptoWasm';
+export type { ServerEip1559UnsignedTx } from './core/ThresholdService/evmCryptoWasm';
+export type { ThresholdEd25519KeyStore, ThresholdEd25519KeyRecord, ThresholdEd25519SessionStore, ThresholdEd25519MpcSessionRecord, ThresholdEd25519SigningSessionRecord, ThresholdEd25519Commitments, Ed25519WalletSessionStore, Ed25519WalletSessionRecord, } from './core/ThresholdService';
+export * from './core/signingMaterial/ordinaryInactiveSignerMaterialReservation';
+export { D1WalletAuthMethodStore, createWalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, normalizeWalletAuthMethod, resolveWalletAuthMethodStoreNamespace, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, type D1WalletAuthMethodStoreOptions, type D1WalletAuthMethodStoreSchemaOptions, type WalletAuthMethodRecord, type WalletAuthMethodStore, } from './core/WalletAuthMethodStore';
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ensureWalletStoreD1Schema, resolveWalletStoreNamespace, type D1WalletStoreOptions, type D1WalletStoreSchemaOptions, type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord, type WalletRecord, type WalletSignerRecord, type WalletStore, } from './core/WalletStore';
+export { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace, type D1WebAuthnAuthenticatorStoreOptions, type D1WebAuthnAuthenticatorStoreSchemaOptions, type WebAuthnAuthenticatorRecord, type WebAuthnAuthenticatorStore, } from './core/WebAuthnAuthenticatorStore';
+export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, resolveWebAuthnCredentialBindingStoreNamespace, type D1WebAuthnCredentialBindingStoreOptions, type D1WebAuthnCredentialBindingStoreSchemaOptions, type WebAuthnCredentialBindingRecord, type WebAuthnCredentialBindingStore, } from './core/WebAuthnCredentialBindingStore';
+export { D1WebAuthnLoginChallengeStore, WEBAUTHN_LOGIN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnLoginChallengeStore, ensureWebAuthnLoginChallengeStoreD1Schema, type D1WebAuthnLoginChallengeStoreOptions, type D1WebAuthnLoginChallengeStoreSchemaOptions, type WebAuthnLoginChallengeRecord, type WebAuthnLoginChallengeStore, } from './core/WebAuthnLoginChallengeStore';
+export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema, type D1WebAuthnSyncChallengeStoreOptions, type D1WebAuthnSyncChallengeStoreSchemaOptions, type WebAuthnSyncChallengeRecord, type WebAuthnSyncChallengeStore, } from './core/WebAuthnSyncChallengeStore';
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace, type D1IdentityStoreOptions, type D1IdentityStoreSchemaOptions, type IdentityStore, type IdentitySubjectRecord, type IdentityUserRecord, type LinkIdentityResult, type UnlinkIdentityResult, } from './core/IdentityStore';
+export { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema, type D1NearPublicKeyStoreOptions, type D1NearPublicKeyStoreSchemaOptions, type NearPublicKeyKind, type NearPublicKeyRecord, type NearPublicKeyStore, } from './core/NearPublicKeyStore';
+export { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter, type RouterAbNormalSigningAbuseDecision, type RouterAbNormalSigningAbuseProvider, type RouterAbNormalSigningAdmissionStore, type RouterAbNormalSigningProjectPolicyDecision, type RouterAbNormalSigningProjectPolicyProvider, } from './router/domains/signingOperations/routerAbNormalSigningAdmissionCore';
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore, type CloudflareD1RouterAbNormalSigningAdmissionStoreOptions, } from './router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore';
+export * from './threshold/session/signingSessionSeal';
+export type { RouterApiModule, RouterApiModuleKind, RouterApiModuleOptions, } from './router/framework/modules';
+export { createRouterApiModule } from './router/framework/modules';
+export type { RouterApiFetchRouteExtension, RouterApiFetchRouteExtensionInput, RouterApiRouteExtension, RouterApiRouteExtensionTransport, } from './router/framework/routeExtensions';
+export * from './router/framework/ror';
+export * from './storage/tenantRoute';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/wallet-server/src/local-hosted-wallet-gateway-worker.d.ts

@@ -0,0 +1,13 @@
+import { type CloudflareD1GatewayBaseEnv } from './hosted-wallet-gateway';
+import type { CfExecutionContext, CfScheduledEvent } from './router/cloudflare/runtime/cloudflare.types';
+type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
+    readonly WALLET_LOCAL_DEPLOYMENT_JSON: string;
+};
+declare function fetch(request: Request, env: LocalHostedWalletGatewayEnv, ctx: CfExecutionContext): Promise<Response>;
+declare function scheduled(event: CfScheduledEvent, env: LocalHostedWalletGatewayEnv, _ctx: CfExecutionContext): Promise<void>;
+declare const _default: {
+    fetch: typeof fetch;
+    scheduled: typeof scheduled;
+};
+export default _default;
+//# sourceMappingURL=local-hosted-wallet-gateway-worker.d.ts.map

package/dist/types/wallet-server/src/router/auth/authRequestValidation.d.ts

@@ -0,0 +1,97 @@
+import type { WebAuthnAuthenticationCredential } from '../../core/types';
+export type AuthProviderActionRoute = {
+    kind: 'passkey_options';
+} | {
+    kind: 'passkey_verify';
+} | {
+    kind: 'google_options';
+} | {
+    kind: 'google_verify';
+} | {
+    kind: 'github_options';
+};
+export type PasskeyLoginOptionsRequest = {
+    user_id: string;
+    rp_id: string;
+    ttl_ms?: number;
+};
+export type PasskeyLoginVerifyRequest = {
+    challengeId: string;
+    webauthn_authentication: WebAuthnAuthenticationCredential;
+    expected_origin: string;
+};
+export type GoogleLoginVerifyRequest = {
+    idToken: string;
+    accountMode: 'login' | 'register';
+    projectEnvironmentId: string;
+    /** Exact locally selected wallet for login. Register mode is discoverable only. */
+    loginWalletId?: string;
+    /**
+     * Register-mode only: start a fresh registration offer even when this Google
+     * subject already holds an Email OTP wallet. Completing that registration
+     * retires the previous enrollment (the old wallet loses its email factor),
+     * so the flag must always be an explicit caller choice — never a default.
+     */
+    restartRegistrationOffer: boolean;
+};
+export type AuthPasskeyStepUpRequest = {
+    challengeId: string;
+    webauthn_authentication: WebAuthnAuthenticationCredential;
+    expected_origin: string;
+};
+export type AuthLinkIdentityRequest = {
+    provider: 'google';
+    idToken: string;
+    stepUp: AuthPasskeyStepUpRequest;
+};
+export type AuthUnlinkIdentityRequest = {
+    subject: string;
+    stepUp: AuthPasskeyStepUpRequest;
+};
+export type AuthIdentityMutationRequest = {
+    kind: 'link';
+    source: 'auth.link';
+    request: AuthLinkIdentityRequest;
+} | {
+    kind: 'unlink';
+    source: 'auth.unlink';
+    request: AuthUnlinkIdentityRequest;
+};
+export type AuthRouteErrorBody = {
+    ok: false;
+    code: 'invalid_body';
+    message: string;
+};
+export type AuthRouteParseResult<T> = {
+    ok: true;
+    request: T;
+} | {
+    ok: false;
+    status: 400;
+    body: AuthRouteErrorBody;
+};
+export declare function parseAuthProviderAction(input: {
+    provider: unknown;
+    action: unknown;
+}): AuthProviderActionRoute | null;
+export declare function parseAuthProviderActionPath(pathname: string): AuthProviderActionRoute | null;
+export declare function parsePasskeyLoginOptionsRequest(raw: unknown): AuthRouteParseResult<PasskeyLoginOptionsRequest>;
+export declare function parsePasskeyLoginVerifyRequest(input: {
+    body: unknown;
+    origin: unknown;
+}): AuthRouteParseResult<PasskeyLoginVerifyRequest>;
+export declare function parseGoogleLoginVerifyRequest(raw: unknown): AuthRouteParseResult<GoogleLoginVerifyRequest>;
+export declare function parseAuthLinkIdentityRequest(input: {
+    body: unknown;
+    origin: unknown;
+}): AuthRouteParseResult<AuthLinkIdentityRequest>;
+export declare function parseAuthUnlinkIdentityRequest(input: {
+    body: unknown;
+    origin: unknown;
+}): AuthRouteParseResult<AuthUnlinkIdentityRequest>;
+export declare function parseAuthIdentityMutationRequest(input: {
+    pathname: unknown;
+    body: unknown;
+    origin: unknown;
+}): AuthRouteParseResult<AuthIdentityMutationRequest> | null;
+//# sourceMappingURL=authRequestValidation.d.ts.map

package/dist/types/wallet-server/src/router/auth/commonRouterUtils.d.ts

@@ -0,0 +1,142 @@
+import type { ThresholdRuntimePolicyScope } from '../../core/types';
+import type { RouterApiAuthorizationSessionService } from '../framework/authServicePort';
+import type { RouterApiWalletSessionAuthorizationV2AdmissionContext } from '../framework/authServicePort';
+import type { RouterApiProjectEnvironmentResolver, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
+import { type WalletSessionFailureCode } from './walletSessionFailure';
+import { type WalletSessionAuthorizationV2AdministrationAdmissionResult, type WalletSessionAuthorizationV2AdministrationOperation, type WalletSessionAuthorizationV2AdmissionResult, type WalletSessionAuthorizationV2RequestedOperation } from '../domains/signingOperations/walletExecutionAdmission';
+type AuthorizeErr = {
+    ok: false;
+    code: 'sessions_disabled' | WalletSessionFailureCode;
+    message: string;
+};
+export type WalletSessionOperationCredentialAdmission = {
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly curve: 'ed25519';
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly admission: Extract<WalletSessionAuthorizationV2AdmissionResult, {
+        readonly ok: true;
+        readonly keyFamily: 'ed25519';
+    }>;
+} | {
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly curve: 'ecdsa';
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly admission: Extract<WalletSessionAuthorizationV2AdmissionResult, {
+        readonly ok: true;
+        readonly keyFamily: 'ecdsa_secp256k1';
+    }>;
+};
+export type WalletSessionOperationCredentialResolution = {
+    readonly kind: 'not_found';
+} | {
+    readonly kind: 'rejected';
+} | {
+    readonly kind: 'admitted';
+    readonly admission: WalletSessionOperationCredentialAdmission;
+};
+type WalletSessionOperationCredentialRequest = Pick<Extract<WalletSessionAuthorizationV2RequestedOperation, {
+    readonly keyFamily: 'ed25519';
+}>, 'keyFamily' | 'operationKind'> | Pick<Extract<WalletSessionAuthorizationV2RequestedOperation, {
+    readonly keyFamily: 'ecdsa_secp256k1';
+}>, 'keyFamily' | 'operationKind'>;
+export declare function resolveWalletSessionOperationCredentialAdmissionFromContext(input: {
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly nowMs: number;
+    readonly operation: WalletSessionOperationCredentialRequest;
+}): Exclude<WalletSessionOperationCredentialResolution, {
+    readonly kind: 'not_found';
+}>;
+export declare function resolveWalletSessionOperationCredentialAdmission(input: {
+    readonly authorizationSessions: RouterApiAuthorizationSessionService;
+    readonly token: string;
+    readonly nowMs: number;
+    readonly operation: WalletSessionOperationCredentialRequest;
+}): Promise<WalletSessionOperationCredentialResolution>;
+export type WalletSessionAdministrationRequest = Pick<WalletSessionAuthorizationV2AdministrationOperation, 'kind' | 'walletId'>;
+export type WalletSessionAdministrationAdmission = {
+    readonly kind: 'wallet_session_administration_v1';
+    readonly operationKind: 'link_devices';
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+    readonly admission: Extract<WalletSessionAuthorizationV2AdministrationAdmissionResult, {
+        readonly ok: true;
+    }>;
+};
+export type WalletSessionAdministrationResolution = {
+    readonly kind: 'not_found';
+} | {
+    readonly kind: 'rejected';
+} | {
+    readonly kind: 'admitted';
+    readonly admission: WalletSessionAdministrationAdmission;
+};
+export declare function resolveWalletSessionAdministrationAdmission(input: {
+    readonly authorizationSessions: RouterApiAuthorizationSessionService;
+    readonly token: string;
+    readonly nowMs: number;
+    readonly operation: WalletSessionAdministrationRequest;
+}): Promise<WalletSessionAdministrationResolution>;
+export type ThresholdEd25519SessionInputs = {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
+        readonly curve: 'ed25519';
+    }>;
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+} | AuthorizeErr;
+export declare function validateRouterAbEd25519WalletSessionInputs(input: {
+    headers: Record<string, string | string[] | undefined>;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    nowMs?: () => number;
+    operationKind: Extract<WalletSessionAuthorizationV2RequestedOperation, {
+        readonly keyFamily: 'ed25519';
+    }>['operationKind'];
+}): Promise<ThresholdEd25519SessionInputs>;
+export type ThresholdEcdsaSessionInputs = {
+    readonly ok: true;
+    readonly kind: 'wallet_session_operation_credential_v1';
+    readonly admission: Extract<WalletSessionOperationCredentialAdmission, {
+        readonly curve: 'ecdsa';
+    }>;
+    readonly context: RouterApiWalletSessionAuthorizationV2AdmissionContext;
+} | AuthorizeErr;
+export declare function validateRouterAbEcdsaDerivationWalletSessionInputs(input: {
+    headers: Record<string, string | string[] | undefined>;
+    authorizationSessions: RouterApiAuthorizationSessionService | null | undefined;
+    nowMs?: () => number;
+    operationKind: Extract<WalletSessionAuthorizationV2RequestedOperation, {
+        readonly keyFamily: 'ecdsa_secp256k1';
+    }>['operationKind'];
+}): Promise<ThresholdEcdsaSessionInputs>;
+export type ThresholdRuntimePolicyScopeResolution = {
+    ok: true;
+    scope?: ThresholdRuntimePolicyScope;
+} | {
+    ok: false;
+    status: 401 | 403 | 500;
+    code: 'route_auth_not_configured' | 'unauthorized' | 'forbidden';
+    message: string;
+};
+export declare function resolveThresholdRuntimePolicyScope(input: {
+    explicitScopeRaw: unknown;
+    projectEnvironmentIdRaw?: unknown;
+    headers: Headers | Record<string, string | string[] | undefined>;
+    origin?: string | null;
+    publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
+    orgProjectEnv?: RouterApiProjectEnvironmentResolver | null;
+}): Promise<ThresholdRuntimePolicyScopeResolution>;
+export declare function resolveActiveRuntimePolicyScopeFromFields(input: {
+    orgProjectEnv: RouterApiProjectEnvironmentResolver | null;
+    fields: Omit<ThresholdRuntimePolicyScope, 'signingRootVersion'> & {
+        readonly signingRootVersion?: string;
+    };
+}): Promise<ThresholdRuntimePolicyScope>;
+export declare function resolveActiveRuntimePolicyScopeForEnvironment(input: {
+    orgProjectEnv: RouterApiProjectEnvironmentResolver | null;
+    orgId: string;
+    environmentId?: string;
+    projectId?: string;
+    envId?: string;
+    fallbackSigningRootVersion?: string;
+}): Promise<ThresholdRuntimePolicyScope | undefined>;
+export {};
+//# sourceMappingURL=commonRouterUtils.d.ts.map

package/dist/types/wallet-server/src/router/auth/routerApiCredentialAuth.d.ts

@@ -0,0 +1,26 @@
+import { type RoutePolicyResolutionResult } from '../framework/enforceRoutePolicy';
+import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter } from '../framework/routerApi';
+import type { HeaderRecord } from '../framework/routeExecutionContext';
+import type { RouteDefinition } from '../framework/routeDefinitions';
+interface ResolvePublishableKeyApiCredentialAuthInput {
+    environmentId?: string | null;
+    headers: HeaderRecord;
+    missingEnvironmentMessage: string;
+    missingOriginMessage: string;
+    missingPublishableKeyMessage: string;
+    origin?: string;
+    publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
+    route: RouteDefinition;
+    routeAuthNotConfiguredMessage: string;
+}
+interface ResolveSecretKeyApiCredentialAuthInput {
+    apiKeyAuth?: RouterApiKeyAuthAdapter | null;
+    headers: HeaderRecord;
+    route: RouteDefinition;
+    sourceIp?: string;
+    routeAuthNotConfiguredMessage: string;
+}
+export declare function resolvePublishableKeyApiCredentialAuth(input: ResolvePublishableKeyApiCredentialAuthInput): Promise<RoutePolicyResolutionResult>;
+export declare function resolveSecretKeyApiCredentialAuth(input: ResolveSecretKeyApiCredentialAuthInput): Promise<RoutePolicyResolutionResult>;
+export {};
+//# sourceMappingURL=routerApiCredentialAuth.d.ts.map

package/dist/types/wallet-server/src/router/auth/routerApiKeyAuth.d.ts

@@ -0,0 +1,16 @@
+type HeaderBag = Headers | Record<string, unknown>;
+export declare function extractBearerCredential(headers: HeaderBag): string | null;
+export declare function normalizeSourceIp(raw: string | undefined): string | null;
+export declare function extractRouterApiEnvironmentId(headers: HeaderBag): string | null;
+export declare function resolveSourceIpFromExpressRequest(input: {
+    headers: Record<string, unknown>;
+    ip?: string | null;
+}): string | null;
+export declare function resolveSourceIpFromFetchHeaders(headers: HeaderBag): string | null;
+export declare function resolveRequestOriginRateLimitKeyFromExpressRequest(input: {
+    headers: Record<string, unknown>;
+    ip?: string | null;
+}): string;
+export declare function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers: HeaderBag): string;
+export {};
+//# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/wallet-server/src/router/auth/walletSessionFailure.d.ts

@@ -0,0 +1,14 @@
+import type { SessionParseFailureReason } from '../../core/sessionValidation';
+import { WALLET_SESSION_FAILURE_CODES, type WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
+export type { WalletSessionFailureCode } from '../../../../shared-ts/src/utils/walletSessionFailure';
+export type WalletSessionBoundaryFailure = {
+    readonly ok: false;
+    readonly code: WalletSessionFailureCode;
+    readonly message: string;
+};
+export declare function walletSessionFailureCodeFromParseReason(reason: SessionParseFailureReason): Exclude<WalletSessionFailureCode, typeof WALLET_SESSION_FAILURE_CODES.scopeMismatch | typeof WALLET_SESSION_FAILURE_CODES.unavailable | typeof WALLET_SESSION_FAILURE_CODES.budgetExhausted>;
+export declare function walletSessionFailureMessage(code: WalletSessionFailureCode): string;
+export declare function walletSessionFailureStatus(code: WalletSessionFailureCode): 401 | 403 | 409 | 503;
+export declare function walletSessionParseFailure(reason: SessionParseFailureReason): WalletSessionBoundaryFailure;
+export declare function walletSessionFailure(code: WalletSessionFailureCode): WalletSessionBoundaryFailure;
+//# sourceMappingURL=walletSessionFailure.d.ts.map

package/dist/types/wallet-server/src/router/auth/webAuthnCredentialCodecs.d.ts

@@ -0,0 +1,20 @@
+import type { WebAuthnAuthenticationCredential } from '../../core/types';
+export type WebAuthnCredentialIdParseResult = {
+    readonly ok: true;
+    readonly credentialIdB64u: string;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+};
+export type WebAuthnClientDataJson = {
+    readonly challenge: string;
+    readonly origin: string;
+    readonly type: string;
+};
+export declare function decodeWebAuthnBase64UrlOrBase64(input: string, fieldName: string): Uint8Array;
+export declare function parseWebAuthnClientDataJsonBase64url(clientDataJSONB64u: string): WebAuthnClientDataJson;
+export declare function webAuthnOriginHostnameOrEmpty(origin: string): string;
+export declare function webAuthnCredentialIdB64uFromCredential(input: unknown): WebAuthnCredentialIdParseResult;
+export declare function parseWebAuthnAuthenticationCredential(input: unknown): WebAuthnAuthenticationCredential | null;
+//# sourceMappingURL=webAuthnCredentialCodecs.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.d.ts

@@ -0,0 +1,28 @@
+import { type WalletId } from '../../../../../../shared-ts/src/utils/domainIds';
+export type D1BoundaryWalletIdParseResult = {
+    readonly ok: true;
+    readonly value: WalletId;
+} | {
+    readonly ok: false;
+    readonly code: 'missing' | 'invalid';
+};
+export declare function parseD1BoundaryWalletIdResult(raw: unknown): D1BoundaryWalletIdParseResult;
+export declare function parseD1BoundaryWalletId(raw: unknown): WalletId | null;
+export declare function toRecordValue(value: unknown): Record<string, unknown> | null;
+export declare function parseJsonObject(input: unknown): Record<string, unknown> | null;
+export declare function isB64uString(input: string): boolean;
+export declare function positiveInteger(input: unknown): number | null;
+export declare function positiveSafeInteger(input: unknown): number | null;
+export declare function nonNegativeSafeInteger(input: unknown): number | null;
+export declare function optionalNonNegativeInteger(input: unknown): number | undefined;
+export type D1MutationResultLike = {
+    readonly meta?: {
+        readonly changes?: unknown;
+        readonly rows_written?: unknown;
+    } | null;
+};
+export declare function parseD1NonNegativeCount(input: unknown): number;
+export declare function d1MutationChanges(result: D1MutationResultLike): number;
+export declare function toArrayBufferCopy(bytes: Uint8Array): ArrayBuffer;
+export declare function sha256BytesPortable(input: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=d1RouterApiAuthBoundary.d.ts.map