@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnRecords.d.ts

@@ -0,0 +1,135 @@
+import { type PasskeyEnvelopeId, type WalletAuthorityId, type WalletAuthMethodId, type WalletId, type WalletRecoveryOperationId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from '../../../../../../shared-ts/src/utils/domainIds';
+import { type DeviceId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
+import { type ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
+import { type EnvelopeRevision, type PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
+import { type WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import { type RecoveryCodeReservationId } from '../../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../../shared-ts/src/utils/webauthnDeviceInfo';
+import type { WebAuthnCredentialBindingRecord as CoreWebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
+export type D1AuthenticatorRow = {
+    readonly credential_id_b64u?: unknown;
+    readonly credential_public_key_b64u?: unknown;
+    readonly counter?: unknown;
+    readonly created_at_ms?: unknown;
+    readonly updated_at_ms?: unknown;
+    readonly device_info_json?: unknown;
+};
+export type D1RecordJsonRow = {
+    readonly record_json?: unknown;
+};
+export type WebAuthnCredentialBindingRecord = CoreWebAuthnCredentialBindingRecord;
+export type WebAuthnSyncWalletBinding = {
+    readonly walletId: string;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+    readonly signerSlot: number;
+};
+export type NearPublicKeyAuthBinding = {
+    readonly kind: 'passkey';
+    readonly rpId: WebAuthnRpId;
+    readonly credentialIdB64u: string;
+};
+export type NearPublicKeyRecord = {
+    readonly publicKey: string;
+    readonly kind: 'threshold' | 'local' | 'backup' | 'ephemeral';
+    readonly signerSlot?: number;
+    readonly authBinding?: NearPublicKeyAuthBinding;
+    readonly credentialIdB64u?: never;
+    readonly rpId?: never;
+    readonly createdAtMs?: number;
+    readonly updatedAtMs?: number;
+};
+export type WebAuthnAuthenticatorRecord = {
+    readonly credentialIdB64u: string;
+    readonly credentialPublicKeyB64u: string;
+    readonly counter: number;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+    readonly deviceInfo: WebAuthnAuthenticatorDeviceInfo;
+};
+export declare function parseWebAuthnAuthenticatorRowDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo;
+export type WebAuthnLoginChallengeRecord = {
+    readonly version: 'webauthn_login_challenge_v1';
+    readonly challengeId: string;
+    readonly userId: string;
+    readonly rpId: string;
+    readonly challengeB64u: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+export type WebAuthnSyncChallengeRecord = {
+    readonly version: 'webauthn_sync_challenge_v1';
+    readonly challengeId: string;
+    readonly rpId: string;
+    readonly expectedUserId?: string;
+    readonly challengeB64u: string;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+/**
+ * The exact continuity snapshot selected by prepare. The snapshot is stored
+ * inside the one-shot challenge so finalization cannot silently switch to a
+ * different active method or envelope after the code is reserved.
+ */
+export type WebAuthnRecoveryContinuityAnchorRecord = {
+    readonly kind: 'wallet_recovery_continuity_anchor_v1';
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly method: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+    readonly envelope: WebAuthnRecoveryContinuityEnvelopeAnchorRecord;
+};
+export type WebAuthnRecoveryContinuityEnvelopeAnchorRecord = {
+    readonly kind: 'passkey';
+    readonly envelopeId: PasskeyEnvelopeId;
+    readonly walletId: WalletId;
+    readonly rpId: WebAuthnRpId;
+    readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    readonly envelopeRevision: EnvelopeRevision;
+    readonly updatedAtMs: number;
+    readonly bindingKind: 'wallet_custody_seed_v1';
+} | {
+    readonly kind: 'email_otp';
+    readonly envelopeId: PasskeyEnvelopeId;
+    readonly walletId: WalletId;
+    readonly enrollmentId: string;
+    readonly enrollmentSealKeyVersion: string;
+    readonly envelopeRevision: EnvelopeRevision;
+    readonly updatedAtMs: number;
+    readonly bindingKind: 'wallet_custody_seed_v1';
+};
+/** A one-shot passkey registration ceremony bound to a wallet recovery hold. */
+export type WebAuthnRecoveryRegistrationChallengeRecord = {
+    readonly version: 'webauthn_recovery_registration_challenge_v2';
+    readonly challengeId: string;
+    readonly walletId: WalletId;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly recoveryOperationId: WalletRecoveryOperationId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetAuthorityId: WalletAuthorityId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly origin: string;
+    readonly rpId: WebAuthnRpId;
+    readonly replacementId: string;
+    readonly challengeB64u: string;
+    readonly continuityAnchor: WebAuthnRecoveryContinuityAnchorRecord;
+    readonly createdAtMs: number;
+    readonly expiresAtMs: number;
+};
+export declare function parseWebAuthnLoginChallengeRecord(input: unknown): WebAuthnLoginChallengeRecord | null;
+export declare function parseWebAuthnSyncChallengeRecord(input: unknown): WebAuthnSyncChallengeRecord | null;
+export declare function parseWebAuthnRecoveryRegistrationChallengeRecord(input: unknown): WebAuthnRecoveryRegistrationChallengeRecord | null;
+export declare function buildWebAuthnRecoveryContinuityAnchorRecord(input: {
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly method: Extract<WalletAuthMethodRecordV2, {
+        readonly status: 'active';
+    }>;
+    readonly envelope: PasskeyCustodyEnvelopeRecord;
+}): WebAuthnRecoveryContinuityAnchorRecord;
+export declare function parseWebAuthnAuthenticator(row: D1AuthenticatorRow | null): WebAuthnAuthenticatorRecord | null;
+export declare function parseWebAuthnBinding(row: D1RecordJsonRow): WebAuthnCredentialBindingRecord | null;
+export declare function webAuthnSyncWalletBindingFromCredentialBinding(binding: WebAuthnCredentialBindingRecord): WebAuthnSyncWalletBinding | null;
+export declare function parseNearPublicKey(row: D1RecordJsonRow): NearPublicKeyRecord | null;
+//# sourceMappingURL=d1WebAuthnRecords.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/webauthn/d1WebAuthnStore.d.ts

@@ -0,0 +1,89 @@
+import type { D1DatabaseLike, D1PreparedStatementLike } from '../../../../storage/tenantRoute';
+import { type WebAuthnCredentialBindingRecord } from '../../../../core/WebAuthnCredentialBindingStore';
+import { type D1AuthenticatorRow, type WebAuthnAuthenticatorRecord, type WebAuthnRecoveryRegistrationChallengeRecord, type WebAuthnLoginChallengeRecord, type WebAuthnSyncChallengeRecord } from './d1WebAuthnRecords';
+type WebAuthnChallengeKind = 'login' | 'sync' | 'recovery_registration';
+export type D1WebAuthnStoreScope = {
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+};
+export declare function prepareD1WebAuthnAuthenticatorPutStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WebAuthnStoreScope;
+    readonly userId: string;
+    readonly record: WebAuthnAuthenticatorRecord;
+}): D1PreparedStatementLike;
+/** Insert-only variant used by recovery promotion. A credential collision must
+ * abort the surrounding envelope/code transaction instead of reassigning an
+ * existing authenticator's public key. */
+export declare function prepareD1WebAuthnAuthenticatorInsertStatement(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1WebAuthnStoreScope;
+    readonly userId: string;
+    readonly record: WebAuthnAuthenticatorRecord;
+}): D1PreparedStatementLike;
+export declare class CloudflareD1WebAuthnStore {
+    private readonly database;
+    private readonly namespace;
+    private readonly orgId;
+    private readonly projectId;
+    private readonly envId;
+    constructor(input: {
+        readonly database: D1DatabaseLike;
+        readonly namespace: string;
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly envId: string;
+    });
+    writeChallenge(input: {
+        readonly challengeId: string;
+        readonly challengeKind: WebAuthnChallengeKind;
+        readonly record: WebAuthnLoginChallengeRecord | WebAuthnSyncChallengeRecord | WebAuthnRecoveryRegistrationChallengeRecord;
+        readonly createdAtMs: number;
+        readonly expiresAtMs: number;
+    }): Promise<void>;
+    consumeLoginChallenge(challengeId: string): Promise<WebAuthnLoginChallengeRecord | null>;
+    consumeSyncChallenge(challengeId: string): Promise<WebAuthnSyncChallengeRecord | null>;
+    readRecoveryRegistrationChallenge(challengeId: string, nowMs: number): Promise<WebAuthnRecoveryRegistrationChallengeRecord | null>;
+    /** Delete is paired with a CAS guard in the recovery commit batch. */
+    prepareRecoveryRegistrationChallengeDeleteStatement(input: {
+        readonly challengeId: string;
+        readonly record: WebAuthnRecoveryRegistrationChallengeRecord;
+        readonly nowMs: number;
+    }): D1PreparedStatementLike;
+    readAuthenticator(input: {
+        readonly userId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<WebAuthnAuthenticatorRecord | null>;
+    writeAuthenticator(input: {
+        readonly userId: string;
+        readonly record: WebAuthnAuthenticatorRecord;
+    }): Promise<void>;
+    prepareAuthenticatorInsertStatement(input: {
+        readonly userId: string;
+        readonly record: WebAuthnAuthenticatorRecord;
+    }): D1PreparedStatementLike;
+    prepareCredentialBindingInsertStatement(record: WebAuthnCredentialBindingRecord): D1PreparedStatementLike;
+    updateAuthenticatorCounter(input: {
+        readonly userId: string;
+        readonly credentialIdB64u: string;
+        readonly newCounter: number;
+        readonly updatedAtMs: number;
+    }): Promise<void>;
+    readBindingByCredential(input: {
+        readonly rpId: string;
+        readonly credentialIdB64u: string;
+    }): Promise<WebAuthnCredentialBindingRecord | null>;
+    /** Resolves a credential without trusting a caller-supplied relying party. */
+    readBindingByCredentialId(credentialIdB64u: string): Promise<WebAuthnCredentialBindingRecord | null>;
+    readAuthenticatorRows(userId: string): Promise<D1AuthenticatorRow[]>;
+    readBindingRows(input: {
+        readonly userId: string;
+        readonly rpId?: string;
+    }): Promise<WebAuthnCredentialBindingRecord[]>;
+    private consumeChallenge;
+    private prepare;
+}
+export {};
+//# sourceMappingURL=d1WebAuthnStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/durableObjects/thresholdStore.d.ts

@@ -0,0 +1,19 @@
+type DurableObjectStorageLike = {
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown, opts?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    transaction?<T>(fn: (txn: DurableObjectStorageLike) => Promise<T>): Promise<T>;
+};
+type DurableObjectStateLike = {
+    storage: DurableObjectStorageLike;
+};
+export declare class ThresholdStoreDurableObject {
+    private readonly state;
+    private readonly ecdsaPoolFillLiveSessions;
+    constructor(state: DurableObjectStateLike, _env: unknown);
+    fetch(request: Request): Promise<Response>;
+}
+export {};
+//# sourceMappingURL=thresholdStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/durableObjects/versionedJsonRecordStore.d.ts

@@ -0,0 +1,32 @@
+import type { CloudflareDurableObjectNamespaceLike } from '../../../core/types';
+import type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult } from '../../framework/versionedJsonRecordStore';
+export type CloudflareVersionedJsonRecordStoreOptions<T> = {
+    readonly namespace: CloudflareDurableObjectNamespaceLike;
+    /** Return one object name per ceremony key to avoid tenant-wide serialization. */
+    readonly objectNameForKey: (key: string) => string;
+    readonly encode: (value: T) => VersionedJsonObject;
+    readonly parse: (raw: unknown) => T | null;
+    readonly keyPrefix?: string;
+};
+export declare class CloudflareVersionedJsonRecordStoreError extends Error {
+    readonly code: 'invalid_response' | 'invalid_record' | 'request_failed';
+    constructor(code: 'invalid_response' | 'invalid_record' | 'request_failed', message: string);
+}
+export declare class CloudflareDurableObjectVersionedJsonRecordStore<T> {
+    private readonly namespace;
+    private readonly objectNameForKey;
+    private readonly encode;
+    private readonly parse;
+    private readonly keyPrefix;
+    constructor(options: CloudflareVersionedJsonRecordStoreOptions<T>);
+    read(key: string): Promise<VersionedJsonRecordReadResult<T>>;
+    put(key: string, value: T, expectedVersion: string | null, options?: {
+        readonly ttlMs?: number;
+    }): Promise<VersionedJsonRecordPutResult>;
+    private storageKey;
+    private stubForKey;
+    private call;
+}
+export declare function createCloudflareDurableObjectVersionedJsonRecordStore<T>(options: CloudflareVersionedJsonRecordStoreOptions<T>): CloudflareDurableObjectVersionedJsonRecordStore<T>;
+export declare function containsControlCharacter(value: string): boolean;
+//# sourceMappingURL=versionedJsonRecordStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/cloudflare.types.d.ts

@@ -0,0 +1,30 @@
+import type { CloudflareDurableObjectNamespaceLike } from '../../../core/types';
+import type { D1DatabaseLike } from '../../../storage/tenantRoute';
+export type CfEnv = object;
+export interface RouterApiCloudflareSignerWorkerEnv {
+    RELAYER_ACCOUNT_ID: string;
+    RELAYER_PRIVATE_KEY: string;
+    RELAYER_PUBLIC_KEY?: string;
+    NEAR_RPC_URL?: string;
+    NETWORK_ID?: string;
+    ACCOUNT_INITIAL_BALANCE?: string;
+    CREATE_ACCOUNT_AND_REGISTER_GAS?: string;
+    SESSION_COOKIE_NAME?: string;
+    EXPECTED_ORIGIN?: string;
+    EXPECTED_WALLET_ORIGIN?: string;
+}
+export interface SeamsD1SignerTenantStorageWorkerEnv {
+    SIGNER_DB: D1DatabaseLike;
+    THRESHOLD_STORE: CloudflareDurableObjectNamespaceLike;
+}
+export interface CfExecutionContext {
+    waitUntil(promise: Promise<unknown>): void;
+    passThroughOnException(): void;
+}
+export interface CfScheduledEvent {
+    scheduledTime?: number;
+    cron?: string;
+}
+export type FetchHandler = (request: Request, env?: CfEnv, ctx?: CfExecutionContext) => Promise<Response>;
+export type ScheduledHandler = (event: CfScheduledEvent, env?: CfEnv, ctx?: CfExecutionContext) => Promise<void>;
+//# sourceMappingURL=cloudflare.types.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/cloudflareSignerWasm.d.ts

@@ -0,0 +1,2 @@
+export declare function loadCloudflareSignerWasmModule(): Promise<typeof import("../../../../../../wasm/near_signer/pkg/wasm_signer_worker_bg.wasm")>;
+//# sourceMappingURL=cloudflareSignerWasm.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/createCloudflareRouter.d.ts

@@ -0,0 +1,5 @@
+import type { RouterApiServiceBag } from '../../framework/authServicePort';
+import type { RouterApiOptions } from '../../framework/routerApi';
+import type { FetchHandler } from './cloudflare.types';
+export declare function createCloudflareRouter(service: RouterApiServiceBag, opts?: RouterApiOptions): FetchHandler;
+//# sourceMappingURL=createCloudflareRouter.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.d.ts

@@ -0,0 +1,23 @@
+import type { RouterApiServiceBag } from '../../framework/authServicePort';
+import type { RouterApiOptions } from '../../framework/routerApi';
+import type { CfEnv, CfExecutionContext, FetchHandler } from './cloudflare.types';
+type SelfHostedWorker<Env> = {
+    fetch(request: Request, env: Env, ctx: CfExecutionContext): Promise<Response>;
+};
+export type SelfHostedCloudflareSigningWorkerFactoryInput<Env extends CfEnv = CfEnv> = {
+    readonly createAuthService: (input: {
+        readonly request: Request;
+        readonly env: Env;
+        readonly ctx: CfExecutionContext;
+    }) => RouterApiServiceBag | Promise<RouterApiServiceBag>;
+    readonly routerOptions?: RouterApiOptions | ((input: {
+        readonly request: Request;
+        readonly env: Env;
+        readonly ctx: CfExecutionContext;
+        readonly service: RouterApiServiceBag;
+    }) => RouterApiOptions | Promise<RouterApiOptions>);
+};
+export declare function createSelfHostedCloudflareSigningRouter(service: RouterApiServiceBag, opts?: RouterApiOptions): FetchHandler;
+export declare function createSelfHostedCloudflareSigningWorker<Env extends CfEnv = CfEnv>(input: SelfHostedCloudflareSigningWorkerFactoryInput<Env>): SelfHostedWorker<Env>;
+export {};
+//# sourceMappingURL=createSelfHostedCloudflareSigningWorker.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/ed25519SessionAdapter.d.ts

@@ -0,0 +1,16 @@
+import type { SessionAdapter } from '../../framework/routerApi';
+export interface Ed25519SessionAdapterOptions {
+    readonly privateJwk: JsonWebKey & {
+        readonly kty: 'OKP';
+        readonly crv: 'Ed25519';
+        readonly x: string;
+        readonly d: string;
+    };
+    readonly keyId: string;
+    readonly cookieName?: string;
+    readonly issuer: string;
+    readonly audience: string;
+    readonly ttlSeconds?: number;
+}
+export declare function createEd25519SessionAdapter(options: Ed25519SessionAdapterOptions): SessionAdapter;
+//# sourceMappingURL=ed25519SessionAdapter.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/environment.d.ts

@@ -0,0 +1,5 @@
+export type CloudflareWorkerEnvironment = Readonly<Record<string, unknown>>;
+export declare function requireEnvironmentString(env: CloudflareWorkerEnvironment, name: string): string;
+export declare function readEnvironmentString(env: CloudflareWorkerEnvironment, name: string): string;
+export declare function readEnvironmentCsv(input: unknown): string[];
+//# sourceMappingURL=environment.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/routerAbPrewarm.d.ts

@@ -0,0 +1,9 @@
+import type { CfScheduledEvent } from './cloudflare.types';
+import { type CloudflareServiceBindingFetcher } from './routerAbServiceBindings';
+export interface RouterAbPrewarmScheduledEnvV1 {
+    readonly MPC_ROUTER: CloudflareServiceBindingFetcher;
+    readonly ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?: string;
+    readonly ROUTER_AB_PREWARM_ENABLED: string;
+}
+export declare function runRouterAbPrewarmScheduledV1(event: CfScheduledEvent, env: RouterAbPrewarmScheduledEnvV1): Promise<void>;
+//# sourceMappingURL=routerAbPrewarm.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/routerAbServiceBindings.d.ts

@@ -0,0 +1,11 @@
+export interface CloudflareServiceBindingFetcher {
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+export interface RouterAbServiceBindingEnv {
+    readonly MPC_ROUTER: CloudflareServiceBindingFetcher;
+    readonly SIGNING_WORKER: CloudflareServiceBindingFetcher;
+}
+export declare const ROUTER_AB_MPC_ROUTER_ORIGIN = "https://mpc-router.router-ab.internal";
+export declare const ROUTER_AB_SIGNING_WORKER_ORIGIN = "https://signing-worker.router-ab.internal";
+export declare function createRouterAbServiceBindingFetch(env: RouterAbServiceBindingEnv): typeof globalThis.fetch;
+//# sourceMappingURL=routerAbServiceBindings.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/sessionAdapterRuntime.d.ts

@@ -0,0 +1,28 @@
+export type ParsedSessionJwt = {
+    readonly ok: true;
+    readonly headerB64u: string;
+    readonly payloadB64u: string;
+    readonly signatureB64u: string;
+    readonly header: Record<string, unknown>;
+    readonly payload: Record<string, unknown>;
+} | {
+    readonly ok: false;
+};
+export declare class CrossSiteSessionCookieAdapter {
+    private readonly cookieName;
+    private readonly ttlSeconds;
+    constructor(cookieName: string, ttlSeconds: number);
+    buildSetHeader(token: string): string;
+    buildClearHeader(): string;
+}
+export declare function requireNormalizedSessionString(value: unknown, label: string): string;
+export declare function sessionJwtTimeClaims(payload: Record<string, unknown>, nowSeconds: number, ttlSeconds: number): {
+    readonly iat: number;
+    readonly exp: number;
+};
+export declare function normalizeSessionTtlSeconds(input: number | undefined): number;
+export declare function encodeSessionJsonSegment(input: Record<string, unknown>): string;
+export declare function parseSessionJwt(token: string): ParsedSessionJwt;
+export declare function toSessionArrayBufferCopy(bytes: Uint8Array): ArrayBuffer;
+export declare function normalizeSessionString(input: unknown): string;
+//# sourceMappingURL=sessionAdapterRuntime.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/staticWalletConsoleBinding.d.ts

@@ -0,0 +1,27 @@
+import { type RouterApiCredentialScope } from '../../framework/apiCredentialPorts';
+import type { WalletConsoleServiceBinding } from './walletConsoleOpsClient';
+export interface StaticWalletConsoleBindingConfigV1 {
+    readonly credential: {
+        readonly apiKeyId: string;
+        readonly publishableKey: string;
+        readonly secretKey?: string;
+        readonly allowedOrigins: readonly string[];
+        readonly scopes: readonly RouterApiCredentialScope[];
+    };
+    readonly deployment: {
+        readonly orgId: string;
+        readonly projectId: string;
+        readonly environmentId: string;
+        readonly environmentKey: string;
+        readonly signingRootVersion: string;
+    };
+    readonly tenantRoot: {
+        readonly identityDigestB64u: string;
+        readonly custodyLineageB64u: string;
+        readonly signingRootId: string;
+    };
+}
+export declare function parseStaticWalletConsoleBindingConfigV1(value: unknown): StaticWalletConsoleBindingConfigV1;
+export declare function createStaticWalletConsoleBindingV1(config: StaticWalletConsoleBindingConfigV1): WalletConsoleServiceBinding;
+export declare function handleStaticWalletConsoleRequestV1(config: StaticWalletConsoleBindingConfigV1, input: Request | string, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=staticWalletConsoleBinding.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/tenantRootCreationGrant.d.ts

@@ -0,0 +1,24 @@
+import { type TenantRootIdentityV1 } from '../../../../../shared-ts/src/tenant-root/tenantRootIdentity';
+export interface TenantRootCreationGrantSigningInputV1 {
+    readonly identity: TenantRootIdentityV1;
+    readonly custodyLineage: Uint8Array;
+    readonly grantNonce: Uint8Array;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+    readonly grantKeyId: string;
+    readonly signingSeedB64u: string;
+}
+export interface SignedTenantRootCreationGrantV1 {
+    readonly identityDigestB64u: string;
+    readonly custodyLineageB64u: string;
+    readonly grantNonceB64u: string;
+    readonly grantKeyId: string;
+    readonly grantB64u: string;
+    readonly grantDigestB64u: string;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+}
+export declare function tenantRootIdentityDigestB64uV1(identity: TenantRootIdentityV1): Promise<string>;
+export declare function randomTenantRootCreationGrantBytesV1(length: 16 | 32): Uint8Array;
+export declare function signTenantRootCreationGrantV1(input: TenantRootCreationGrantSigningInputV1): Promise<SignedTenantRootCreationGrantV1>;
+//# sourceMappingURL=tenantRootCreationGrant.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOps.d.ts

@@ -0,0 +1,143 @@
+import type { TenantRootIdentityFieldV1, TenantRootIdentityWireV1 } from '../../../../../shared-ts/src/tenant-root';
+import type { RouterApiCredentialScope } from '../../framework/apiCredentialPorts';
+export declare const WALLET_CONSOLE_OPS_BASE_PATH_V1 = "/internal/wallet-console/v1";
+export declare const WALLET_CONSOLE_SERVICE_ORIGIN_V1 = "https://wallet-console.internal";
+export declare const WALLET_CONSOLE_OP_PATHS_V1: {
+    readonly secretKeyAuth: "/internal/wallet-console/v1/secret-key-auth";
+    readonly publishableKeyAuth: "/internal/wallet-console/v1/publishable-key-auth";
+    readonly usageEvents: "/internal/wallet-console/v1/usage-events";
+    readonly projectEnvironments: "/internal/wallet-console/v1/project-environments";
+    readonly tenantRootActiveLineage: "/internal/wallet-console/v1/tenant-root/active-lineage";
+};
+export interface WalletConsoleSecretKeyAuthRequestV1 {
+    readonly secret: string;
+    readonly endpoint: string;
+    readonly requiredScopes: RouterApiCredentialScope[];
+    readonly sourceIp?: string;
+    readonly environmentId?: string;
+}
+export interface WalletConsolePrincipalV1 {
+    readonly apiKeyId: string;
+    readonly orgId: string;
+    readonly projectId?: string;
+    readonly envId?: string;
+    readonly environmentId: string;
+    readonly scopes: readonly RouterApiCredentialScope[];
+}
+export type WalletConsoleSecretKeyAuthResponseV1 = {
+    readonly ok: true;
+    readonly principal: WalletConsolePrincipalV1;
+} | {
+    readonly ok: false;
+    readonly status: 401 | 403;
+    readonly code: string;
+    readonly message: string;
+};
+export interface WalletConsolePublishableKeyAuthRequestV1 {
+    readonly secret: string;
+    readonly origin: string;
+    readonly environmentId: string;
+}
+export type WalletConsolePublishableKeyAuthResponseV1 = WalletConsoleSecretKeyAuthResponseV1;
+export interface WalletConsoleUsageEventV1 {
+    readonly orgId: string;
+    readonly environmentId: string;
+    readonly apiKeyId: string;
+    readonly endpoint: string;
+    readonly walletId: string;
+    readonly action: 'wallet_created';
+    readonly succeeded: boolean;
+    readonly occurredAt?: string;
+    /** Producer-owned idempotency key; replays with the same id must not double-count. */
+    readonly sourceEventId?: string;
+}
+export interface WalletConsoleUsageEventsResponseV1 {
+    readonly ok: boolean;
+    readonly code?: string;
+    readonly message?: string;
+}
+export interface WalletConsoleProjectEnvironmentsRequestV1 {
+    readonly context: {
+        readonly orgId: string;
+        readonly actorUserId: string;
+        readonly roles: readonly string[];
+        readonly environmentId?: string;
+        readonly projectId?: string;
+    };
+    readonly filters?: {
+        readonly status?: string;
+    };
+}
+export interface WalletConsoleProjectEnvironmentV1 {
+    readonly id: string;
+    readonly projectId: string;
+    readonly key: string;
+    readonly signingRootVersion: string;
+    readonly status?: string;
+}
+export interface WalletConsoleProjectEnvironmentsResponseV1 {
+    readonly ok: boolean;
+    readonly environments?: readonly WalletConsoleProjectEnvironmentV1[];
+    readonly code?: string;
+    readonly message?: string;
+}
+export type WalletConsoleTenantRootIdentityField = TenantRootIdentityFieldV1;
+export type WalletConsoleTenantRootActiveLineageRequestV1 = TenantRootIdentityWireV1;
+export interface WalletConsoleTenantRootActiveLineageV1 {
+    readonly identityDigestB64u: string;
+    readonly custodyLineageB64u: string;
+}
+export type WalletConsoleTenantRootActiveLineageResponseV1 = {
+    readonly ok: true;
+    readonly identityDigestB64u: string;
+    readonly custodyLineageB64u: string;
+    readonly code?: never;
+    readonly message?: never;
+} | {
+    readonly ok: false;
+    readonly code: 'invalid_body' | 'tenant_root_active_lineage_not_found';
+    readonly message: string;
+    readonly identityDigestB64u?: never;
+    readonly custodyLineageB64u?: never;
+};
+export type WalletConsoleDecodeResult<T, E> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: E;
+};
+export type WalletConsoleTenantRootActiveLineageRequestDecodeError = {
+    readonly kind: 'invalid_object';
+} | {
+    readonly kind: 'missing_field';
+    readonly field: WalletConsoleTenantRootIdentityField;
+} | {
+    readonly kind: 'unexpected_field';
+    readonly field: string;
+} | {
+    readonly kind: 'invalid_field';
+    readonly field: WalletConsoleTenantRootIdentityField;
+};
+export type WalletConsoleTenantRootActiveLineageResponseField = 'ok' | 'identityDigestB64u' | 'custodyLineageB64u' | 'code' | 'message';
+export type WalletConsoleTenantRootActiveLineageResponseDecodeError = {
+    readonly kind: 'invalid_object';
+} | {
+    readonly kind: 'invalid_discriminant';
+    readonly field: 'ok';
+} | {
+    readonly kind: 'missing_field';
+    readonly field: WalletConsoleTenantRootActiveLineageResponseField;
+} | {
+    readonly kind: 'unexpected_field';
+    readonly field: string;
+} | {
+    readonly kind: 'invalid_field';
+    readonly field: WalletConsoleTenantRootActiveLineageResponseField;
+};
+export declare function decodeWalletConsoleTenantRootActiveLineageRequestV1(value: unknown): WalletConsoleDecodeResult<TenantRootIdentityWireV1, WalletConsoleTenantRootActiveLineageRequestDecodeError>;
+export declare function decodeWalletConsoleTenantRootActiveLineageResponseV1(value: unknown): WalletConsoleDecodeResult<WalletConsoleTenantRootActiveLineageResponseV1, WalletConsoleTenantRootActiveLineageResponseDecodeError>;
+export interface WalletConsoleTenantRootActiveLineageResolverV1 {
+    resolveActiveLineage(identity: TenantRootIdentityWireV1): Promise<WalletConsoleTenantRootActiveLineageV1 | null>;
+}
+//# sourceMappingURL=walletConsoleOps.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleOpsClient.d.ts

@@ -0,0 +1,20 @@
+import type { RouterApiKeyAuthAdapter, RouterApiPublishableKeyAuthAdapter, RouterApiProjectEnvironmentResolver, RouterApiUsageMeterAdapter } from '../../framework/apiCredentialPorts';
+import { type WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
+/** The shape of a Cloudflare service binding (`Fetcher`). */
+export interface WalletConsoleServiceBinding {
+    fetch(input: Request | string, init?: RequestInit): Promise<Response>;
+}
+export interface WalletConsoleOpsClient {
+    readonly apiKeyAuth: RouterApiKeyAuthAdapter;
+    readonly publishableKeyAuth: RouterApiPublishableKeyAuthAdapter;
+    readonly usageMeter: RouterApiUsageMeterAdapter;
+    readonly projectEnvironments: RouterApiProjectEnvironmentResolver;
+    readonly tenantRootActiveLineage: WalletConsoleTenantRootActiveLineageResolverV1;
+}
+/**
+ * Gateway-side client for the private Wallet Console service binding. The
+ * Wallet Gateway composes its Router API key auth and usage metering through
+ * this client instead of a Console database binding.
+ */
+export declare function createWalletConsoleOpsClient(service: WalletConsoleServiceBinding): WalletConsoleOpsClient;
+//# sourceMappingURL=walletConsoleOpsClient.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/walletConsoleTenantRootLineage.d.ts

@@ -0,0 +1,7 @@
+import type { RouterApiProjectEnvironmentResolver } from '../../framework/apiCredentialPorts';
+import { type RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { WalletConsoleTenantRootActiveLineageResolverV1 } from './walletConsoleOps';
+export declare function resolveRuntimeTenantRootLineage(environments: RouterApiProjectEnvironmentResolver, roots: WalletConsoleTenantRootActiveLineageResolverV1, scope: RuntimePolicyScope & {
+    readonly signingRootId: string;
+}): Promise<import("./walletConsoleOps").WalletConsoleTenantRootActiveLineageV1 | null>;
+//# sourceMappingURL=walletConsoleTenantRootLineage.d.ts.map