@seams/wallet-server 0.5.0

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationAdmission.d.ts

@@ -0,0 +1,56 @@
+import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { WalletCustodyEnvelopeFactor } from '../../../../../shared-ts/src/passkey-custody';
+import { type WalletCustodyCeremonyCommitPayload, type WalletCustodyRegistrationCommitOutcome } from './walletCustodyRegistrationCommit';
+import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
+/**
+ * Admits one ceremony's custody commit against a registration this server has
+ * already verified.
+ *
+ * The custody commit has no route of its own. It rides the registration's
+ * activate/finalize leg, because what may establish custody for a wallet is
+ * exactly what may create that wallet: the verified signed setup plus that
+ * leg's own auth proof. A separate endpoint would be a second, weaker way in.
+ *
+ * This module is where that decision is enforced, and it is deliberately the
+ * only path to `commitWalletCustodyRegistration` from a route. Two checks, both
+ * cheap and both load-bearing:
+ *
+ * 1. **The payload names the wallet the registration named.** A ceremony
+ *    payload is client-supplied; without this, a caller holding a valid
+ *    registration for their own wallet could commit an envelope under someone
+ *    else's `walletId`.
+ * 2. **The factor comes from the credential this server just verified**, never
+ *    from the payload. The factor is what the envelope's AAD binds the seed to,
+ *    so a payload-supplied factor could address a wallet's custody to a
+ *    credential its owner does not control.
+ *
+ * A joining run commits nothing here: its output is a manifest digest that
+ * rides the key set's own registration state, so it is admitted and reported
+ * without touching the custody store.
+ */
+export type WalletCustodyRegistrationAdmissionOutcome = WalletCustodyRegistrationCommitOutcome
+/**
+ * The run joined custody that already existed. Nothing to write — the wallet
+ * already has its seed envelope and recovery set, and this key set's manifest
+ * digest belongs on its registration state.
+ */
+ | {
+    readonly kind: 'no_custody_records';
+    readonly keyManifestDigestB64u: string;
+};
+export type WalletCustodyRegistrationAdmissionInput = {
+    /** What the ceremony produced. Client-supplied, therefore untrusted. */
+    readonly payload: WalletCustodyCeremonyCommitPayload;
+    /** The wallet this server verified the registration for. */
+    readonly verifiedWalletId: WalletId;
+    /**
+     * Built from the credential the registration leg verified — the WebAuthn
+     * credential just created, or the Email OTP enrollment just proved. Never
+     * read off the payload.
+     */
+    readonly verifiedFactor: WalletCustodyEnvelopeFactor;
+    readonly nowMs: number;
+    readonly store: CloudflareD1WalletCustodyCommitStore;
+};
+export declare function admitWalletCustodyRegistrationCommit(input: WalletCustodyRegistrationAdmissionInput): Promise<WalletCustodyRegistrationAdmissionOutcome>;
+//# sourceMappingURL=walletCustodyRegistrationAdmission.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletCustodyRegistrationCommit.d.ts

@@ -0,0 +1,65 @@
+import { type PasskeyCustodyEnvelopeRecord, type WalletCustodyCeremonyCommitPayload } from '../../../../../shared-ts/src/passkey-custody';
+import { type WalletRecoveryEnvelopeSetRecord } from '../../../../../shared-ts/src/wallet-recovery';
+import { buildWalletRecoveryBackupAcknowledgementV1 } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodes';
+import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+export type { WalletCustodyCeremonyCommitPayload };
+import type { CloudflareD1WalletCustodyCommitStore, WalletRecoveryCodeLocatorRecord, WalletCustodyRegistrationCommitResult } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
+/**
+ * Turns a ceremony's commit payload into the two records the store writes.
+ *
+ * The payload is what `wallet_custody_ceremony`'s `seal` returned: ciphertext
+ * and public facts only. This module adds nothing cryptographic — it parses the
+ * payload through the same boundary parsers every other reader uses, and
+ * assembles records. Anything it cannot parse is rejected here rather than
+ * stored for a later reader to choke on.
+ *
+ * The ten recovery-code wraps and the single seed entry arrive together because
+ * the ceremony produced them under one manifest KEK. Splitting that across two
+ * requests would let a wallet exist with a partial code set.
+ */
+export type WalletCustodyRegistrationRecords = {
+    readonly envelope: PasskeyCustodyEnvelopeRecord;
+    readonly recoverySet: WalletRecoveryEnvelopeSetRecord;
+    readonly recoveryCodeLocators: readonly WalletRecoveryCodeLocatorRecord[];
+    readonly recoveryBackupAcknowledgement: ReturnType<typeof buildWalletRecoveryBackupAcknowledgementV1>;
+};
+export type WalletCustodyRegistrationCommitOutcome = ({
+    readonly kind: 'committed';
+} & Omit<Extract<WalletCustodyRegistrationCommitResult, {
+    kind: 'committed';
+}>, 'kind'>) | {
+    readonly kind: 'already_exists';
+    readonly key: string;
+}
+/**
+ * Another ceremony established this wallet's custody first. The route should
+ * tell the client to discard its run's seed and re-enter as a join of the
+ * existing envelope — the key set it was provisioning is still unrecorded.
+ */
+ | {
+    readonly kind: 'custody_already_established';
+    readonly walletId: WalletId;
+} | {
+    readonly kind: 'rejected';
+    readonly reason: string;
+};
+export declare function buildWalletCustodyRegistrationRecords(args: {
+    readonly payload: WalletCustodyCeremonyCommitPayload;
+    readonly factor: unknown;
+    readonly nowMs: number;
+}): WalletCustodyRegistrationRecords;
+/**
+ * Builds and commits in one call.
+ *
+ * A payload this server cannot parse becomes `rejected` rather than an
+ * exception, so a malformed ceremony result is a request outcome and not a
+ * route crash. Nothing is written in that case: the records are built before
+ * the store is touched.
+ */
+export declare function commitWalletCustodyRegistration(input: {
+    readonly payload: WalletCustodyCeremonyCommitPayload;
+    readonly factor: unknown;
+    readonly nowMs: number;
+    readonly store: CloudflareD1WalletCustodyCommitStore;
+}): Promise<WalletCustodyRegistrationCommitOutcome>;
+//# sourceMappingURL=walletCustodyRegistrationCommit.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryAttempt.d.ts

@@ -0,0 +1,59 @@
+import type { DerivedWalletRecoveryKeyId } from '../../../../../shared-ts/src/wallet-recovery/recoveryKeyId';
+import { type RecoveryCodeReservationId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import type { WalletRecoveryEnvelopeSetRecord } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet';
+import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
+/**
+ * Preparing one recovery code for an admitted recovery operation.
+ *
+ * **The server never learns the seed.** It returns the wrapped manifest KEK
+ * and the entry ciphertexts; opening them needs the code, which stays with the
+ * user. So this flow is bookkeeping around an opaque payload — which is what
+ * makes the bookkeeping the only thing that can go wrong, and worth the care.
+ *
+ * **A code is single-use, and that is a concurrency property.** Reserving one
+ * is a read-modify-write on the wallet's shared recovery set. The
+ * version-guard ensures two simultaneous attempts cannot both hold it.
+ *
+ * A consumed locator remains as a tombstone so a caller presenting that exact
+ * secret receives a useful terminal result. Unknown codes remain opaque.
+ */
+export type WalletRecoveryPreparationResult = {
+    readonly kind: 'prepared';
+    readonly walletId: WalletId;
+    /** Opaque to the server: the client opens these with the code. */
+    readonly wrap: {
+        readonly nonceB64u: string;
+        readonly wrappedManifestKekB64u: string;
+        readonly aadHashB64u: string;
+    };
+    readonly entries: WalletRecoveryEnvelopeSetRecord['entries'];
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly reservationExpiresAtMs: number;
+    readonly storeVersion: string;
+}
+/** No such wallet or no such code. */
+ | {
+    readonly kind: 'refused';
+    readonly reason: string;
+} | {
+    readonly kind: 'reserved';
+} | {
+    readonly kind: 'consumed';
+}
+/** Another attempt changed the shared set first. The caller may retry. */
+ | {
+    readonly kind: 'conflict';
+};
+export declare function prepareWalletRecoveryWithCodeV1(input: {
+    readonly store: CloudflareD1WalletCustodyCommitStore;
+    readonly walletId: WalletId;
+    /** The key id recorded beside the code-only locator. */
+    readonly expectedRecoveryKeyId: DerivedWalletRecoveryKeyId;
+    /** The user's code, decoded. Never logged, never stored. */
+    readonly recoveryCodeBytes: Uint8Array;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly nowMs: number;
+    readonly reservationTtlMs: number;
+}): Promise<WalletRecoveryPreparationResult>;
+//# sourceMappingURL=walletRecoveryAttempt.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryFinalization.d.ts

@@ -0,0 +1,81 @@
+import { type PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/passkey-custody';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletRecoveryOperationId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type RecoveryCodeReservationId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import type { DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
+import type { CloudflareD1PasskeyCustodyEnvelopeStore } from '../../cloudflare/d1/passkeyCustody/d1PasskeyCustodyEnvelopeStore';
+import type { CloudflareD1WalletCustodyCommitStore } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
+import type { CloudflareD1WebAuthnStore } from '../../cloudflare/d1/webauthn/d1WebAuthnStore';
+import type { D1WalletStore } from '../../../core/d1WalletStore';
+import type { D1WalletAuthorityStore } from '../../cloudflare/d1/wallet/d1WalletAuthorityStore';
+import type { WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
+export type WalletRecoveryFinalizationResult = {
+    readonly kind: 'promoted';
+    readonly storeVersion: string;
+    readonly credential: {
+        readonly credentialIdB64u: string;
+        readonly credentialPublicKeyB64u: string;
+        readonly counter: number;
+    };
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletAuthorityId: WalletAuthorityId;
+} | {
+    readonly kind: 'refused';
+    readonly reason: string;
+} | {
+    readonly kind: 'conflict';
+    readonly reason: string;
+} | {
+    readonly kind: 'envelope_rejected';
+    readonly reason: string;
+} | {
+    readonly kind: 'registration_rejected';
+    readonly reason: string;
+};
+export declare function finalizeRecoveredWalletCredentialV1(input: {
+    readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
+    readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;
+    readonly walletAuthorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly walletId: string;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly recoveryOperationId: WalletRecoveryOperationId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetAuthorityId: WalletAuthorityId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+    readonly challengeId: string;
+    readonly replacementId: string;
+    readonly webauthnRegistration: unknown;
+    readonly expectedOrigin: string;
+    readonly webAuthnStore: CloudflareD1WebAuthnStore;
+    readonly walletStore: D1WalletStore;
+    readonly ecdsaMaterialPossessionProofs: readonly {
+        readonly keySetId: string;
+        readonly proof: WalletRecoveryEcdsaPossessionProofV1;
+    }[];
+    readonly nowMs: number;
+}): Promise<WalletRecoveryFinalizationResult>;
+type RecoveryReplayResolution = Extract<WalletRecoveryFinalizationResult, {
+    readonly kind: 'promoted';
+}> | Extract<WalletRecoveryFinalizationResult, {
+    readonly kind: 'conflict';
+}> | {
+    readonly kind: 'rejected';
+    readonly reason: string;
+};
+type RecoveryReplayInput = {
+    readonly envelopeStore: CloudflareD1PasskeyCustodyEnvelopeStore;
+    readonly walletCustodyCommits: CloudflareD1WalletCustodyCommitStore;
+    readonly walletAuthorityStore: Pick<D1WalletAuthorityStore, 'readById'>;
+    readonly webAuthnStore: CloudflareD1WebAuthnStore;
+    readonly walletId: string;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly recoveryOperationId: WalletRecoveryOperationId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetAuthorityId: WalletAuthorityId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly replacementId: string;
+    readonly replacementEnvelope: PasskeyCustodyEnvelopeRecord;
+};
+export declare function resolveCommittedRecoveryReplayV1(input: RecoveryReplayInput): Promise<RecoveryReplayResolution>;
+export {};
+//# sourceMappingURL=walletRecoveryFinalization.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryKeyManifest.d.ts

@@ -0,0 +1,184 @@
+import type { EcdsaClientRootPublicKey33B64u } from '../../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap';
+import type { EcdsaServerGeneration } from '../../../../../shared-ts/src/utils/ecdsaCapabilityActivation';
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { ThresholdEcdsaChainTarget } from '../../../core/thresholdEcdsaChainTarget';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbEcdsaDerivationPublicCapabilityV1, type RouterAbEcdsaRegistrationActivationReceiptV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import { type WalletEcdsaSignerRecord, type WalletEd25519SignerRecord } from '../../../core/WalletStore';
+import type { D1WalletStore } from '../../../core/d1WalletStore';
+import { type RecoveryCodeReservationId, type WalletRecoveryKeySetId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+import type { WalletRecoveryEcdsaPossessionChallengeV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
+import { type WalletRecoveryEcdsaPossessionProofV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession';
+import type { WalletAuthAuthorityRef } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
+export type { WalletRecoveryKeySetId } from '../../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation';
+export type WalletRecoveryKeyManifestEntryV1 = {
+    readonly kind: 'near_ed25519';
+    readonly keySetId: `near_ed25519:${string}`;
+    readonly signerId: string;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly publicKey: string;
+    readonly registeredPublicKeyB64u: string;
+    readonly recordedKeyManifestDigestB64u: string;
+    readonly recoveryBasis: {
+        readonly capabilityKind: 'registration' | 'recovery';
+        readonly activeCapabilityBinding: readonly number[];
+        readonly activeMaterialActivation: WalletEd25519SignerRecord['activeYaoCapability']['activationResult']['public_receipt']['material_activation'];
+        readonly scope: WalletEd25519SignerRecord['activeYaoCapability']['admissionRequest']['scope'];
+        readonly applicationBinding: WalletEd25519SignerRecord['activeYaoCapability']['admissionRequest']['application_binding'];
+        readonly participantIds: readonly [number, number];
+        readonly registeredPublicKey: readonly number[];
+        readonly runtimePolicyScope: WalletEd25519SignerRecord['runtimePolicyScope'];
+        readonly activationTranscript: readonly number[];
+        readonly activationStateEpoch: number;
+        readonly signingWorkerVerifyingShare: readonly number[];
+    };
+} | {
+    readonly kind: 'evm_family_ecdsa';
+    readonly keySetId: `evm_family_ecdsa:${string}`;
+    readonly keyHandle: string;
+    readonly evmFamilySigningKeySlotId: string;
+    readonly recordedKeyManifestDigestB64u: string;
+    readonly clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
+    readonly chainTargets: readonly ThresholdEcdsaChainTarget[];
+    readonly chainTargetKeys: readonly string[];
+    readonly ecdsaThresholdKeyId: WalletEcdsaSignerRecord['walletKey']['ecdsaThresholdKeyId'];
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly participantIds: readonly [number, number];
+};
+export type WalletRecoveryKeyManifestV1 = {
+    readonly version: 'wallet_recovery_key_manifest_v1';
+    readonly walletId: WalletId;
+    readonly entries: readonly WalletRecoveryKeyManifestEntryV1[];
+};
+export type PreparedEd25519RecoveryAdmissionV1 = {
+    readonly kind: 'prepared_ed25519_recovery_admission_v1';
+    readonly walletId: WalletId;
+    readonly reservationId: RecoveryCodeReservationId;
+    readonly entries: readonly Extract<WalletRecoveryKeyManifestEntryV1, {
+        readonly kind: 'near_ed25519';
+    }>[];
+};
+export type WalletRecoveryPreparationKeyManifestEntryV1 = {
+    readonly kind: 'near_ed25519';
+    readonly keySetId: `near_ed25519:${string}`;
+    readonly signerId: string;
+    readonly nearAccountId: string;
+    readonly recordedKeyManifestDigestB64u: string;
+    readonly recoveryBasis: WalletRecoveryPreparationNearRecoveryBasisV1;
+} | {
+    readonly kind: 'evm_family_ecdsa';
+    readonly keySetId: `evm_family_ecdsa:${string}`;
+    readonly keyHandle: string;
+    readonly evmFamilySigningKeySlotId: string;
+    readonly recordedKeyManifestDigestB64u: string;
+    readonly recoveryBasis: WalletRecoveryPreparationEcdsaRecoveryBasisV1;
+};
+export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+    readonly capabilityKind: 'registration' | 'recovery';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
+    readonly activationStateEpoch: number;
+    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
+};
+export type WalletRecoveryPreparationEcdsaRecoveryBasisV1 = {
+    readonly publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+    readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
+    readonly serverGeneration: EcdsaServerGeneration;
+    readonly clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    readonly chainTargets: readonly ThresholdEcdsaChainTarget[];
+    readonly ecdsaThresholdKeyId: WalletEcdsaSignerRecord['walletKey']['ecdsaThresholdKeyId'];
+    readonly signingRootId: string;
+    readonly signingRootVersion: string;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly participantIds: readonly [number, number];
+    readonly possessionChallenge: WalletRecoveryEcdsaPossessionChallengeV1;
+};
+export type WalletUnlockKeyManifestEntryV1 = {
+    readonly kind: 'near_ed25519';
+    readonly keySetId: `near_ed25519:${string}`;
+    readonly signerId: string;
+    readonly nearAccountId: string;
+    readonly nearEd25519SigningKeyId: string;
+    readonly signerSlot: number;
+    readonly registeredPublicKeyB64u: string;
+    readonly recordedKeyManifestDigestB64u: string;
+    readonly activeCapabilityBinding: readonly number[];
+} | {
+    readonly kind: 'evm_family_ecdsa';
+    readonly keySetId: `evm_family_ecdsa:${string}`;
+    readonly keyHandle: string;
+    readonly evmFamilySigningKeySlotId: string;
+    readonly recordedKeyManifestDigestB64u: string;
+    readonly clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
+    readonly applicationBindingDigestB64u: string;
+    readonly chainTargetKeys: readonly string[];
+};
+export type WalletUnlockKeyManifestV1 = {
+    readonly version: 'wallet_custody_unlock_key_manifest_v1';
+    readonly walletId: WalletId;
+    readonly entries: readonly WalletUnlockKeyManifestEntryV1[];
+};
+export type WalletRecoveryPreparationKeyManifestV1 = {
+    readonly version: 'wallet_recovery_preparation_key_manifest_v1';
+    readonly walletId: WalletId;
+    readonly entries: readonly WalletRecoveryPreparationKeyManifestEntryV1[];
+};
+export type WalletRecoveryActivationVerification = {
+    readonly kind: 'verified';
+    readonly keySetIds: readonly WalletRecoveryKeySetId[];
+} | {
+    readonly kind: 'refused';
+    readonly reason: string;
+};
+export type WalletRecoveryEcdsaMaterialPossessionProofInputV1 = {
+    readonly keySetId: string;
+    readonly proof: WalletRecoveryEcdsaPossessionProofV1;
+};
+export type WalletRecoveryEcdsaActivationReceiptInputV1 = {
+    readonly keySetId: string;
+    readonly activationReceipt: RouterAbEcdsaRegistrationActivationReceiptV1;
+};
+/**
+ * Builds the ECDSA possession challenges from server-owned recovery state.
+ * The nonce is derived from the stored WebAuthn challenge, so finalization can
+ * reconstruct the exact challenge without accepting another client field.
+ */
+export declare function buildWalletRecoveryEcdsaPossessionChallengesV1(input: {
+    readonly manifest: WalletRecoveryKeyManifestV1;
+    readonly walletId: WalletId;
+    readonly reservationId: string;
+    readonly replacementId: string;
+    readonly sourceAuthorityDigestB64u: WalletAuthAuthorityRef['authorityDigest'];
+    readonly challengeB64u: string;
+    readonly expiresAtMs: number;
+}): Promise<ReadonlyMap<`evm_family_ecdsa:${string}`, WalletRecoveryEcdsaPossessionChallengeV1>>;
+type WalletRecoveryRegistry = Pick<D1WalletStore, 'listEd25519SignersForWallet' | 'listEcdsaSignersForWallet' | 'listEcdsaPendingSessionActivationsForLifecycle'>;
+export declare function resolveWalletRecoveryKeyManifestV1(input: {
+    readonly registry: WalletRecoveryRegistry;
+    readonly walletId: WalletId;
+}): Promise<WalletRecoveryKeyManifestV1>;
+export declare function projectWalletRecoveryPreparationKeyManifestV1(manifest: WalletRecoveryKeyManifestV1, possessionChallenges: ReadonlyMap<WalletRecoveryKeySetId, WalletRecoveryEcdsaPossessionChallengeV1>): WalletRecoveryPreparationKeyManifestV1;
+export declare function projectWalletUnlockKeyManifestV1(manifest: WalletRecoveryKeyManifestV1): WalletUnlockKeyManifestV1;
+export declare function verifyWalletRecoveryKeyActivationsV1(input: {
+    readonly registry: WalletRecoveryRegistry;
+    readonly walletId: WalletId;
+    readonly recoveryCorrelationId: string;
+    readonly replacementId: string;
+    readonly authorityRef: WalletAuthAuthorityRef;
+    readonly ecdsaPossessionChallenges: readonly WalletRecoveryEcdsaPossessionChallengeV1[];
+    readonly ecdsaActivationReceipts: readonly WalletRecoveryEcdsaActivationReceiptInputV1[];
+    readonly ecdsaMaterialPossessionProofs: readonly WalletRecoveryEcdsaMaterialPossessionProofInputV1[];
+    readonly nowMs: number;
+}): Promise<WalletRecoveryActivationVerification>;
+//# sourceMappingURL=walletRecoveryKeyManifest.d.ts.map

package/dist/types/wallet-server/src/router/domains/passkeyCustody/walletRecoveryRotation.d.ts

@@ -0,0 +1,31 @@
+import { type WalletRecoverySetRotationWireV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet';
+import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { CloudflareD1WalletCustodyCommitStore, WalletRecoveryCodeLocatorRecord } from '../../cloudflare/d1/passkeyCustody/d1WalletCustodyCommitStore';
+/**
+ * Replaces all ten recovery wraps and the seed entry produced by the active
+ * factor's custody worker. The server never opens the ciphertext; it stamps
+ * lifecycle state and commits the set plus its backup acknowledgement together.
+ */
+export type WalletRecoveryRotationResult = {
+    readonly kind: 'rotated';
+    readonly issuedAtMs: number;
+    readonly storeVersion: string;
+} | {
+    readonly kind: 'no_recovery_set';
+} | {
+    readonly kind: 'rejected';
+    readonly reason: string;
+}
+/** Recovery finalization or another rotation landed first; re-read and retry. */
+ | {
+    readonly kind: 'conflict';
+};
+export declare function rotateWalletRecoveryCodesV1(input: {
+    readonly store: CloudflareD1WalletCustodyCommitStore;
+    readonly walletId: WalletId;
+    readonly replacement: WalletRecoverySetRotationWireV1;
+    readonly recoveryCodeLocators: readonly WalletRecoveryCodeLocatorRecord[];
+    readonly expectedStoreVersion: string;
+    readonly nowMs: number;
+}): Promise<WalletRecoveryRotationResult>;
+//# sourceMappingURL=walletRecoveryRotation.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.d.ts

@@ -0,0 +1,32 @@
+export type Ed25519OperationKind = 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
+export type Ed25519ReusableAuthorizedOperationReceipt = {
+    readonly kind: 'reusable_wallet_session_authorized_operation_v1';
+    readonly authorized_operation_id: string;
+    readonly operation_id: string;
+    readonly capability_kind: 'near_ed25519_mpc_signing';
+    readonly operation_kind: Ed25519OperationKind;
+    readonly lane_digest_b64u: string;
+    readonly intent_digest_b64u: string;
+    readonly display_digest_b64u: string;
+    readonly operation_fingerprint_digest: string;
+};
+export type Ed25519VerifiedStepUpAuthorizedOperationReceipt = {
+    readonly kind: 'verified_step_up_authorized_operation_v1';
+    readonly authorization_session_id: string;
+    readonly evidence_set_digest: string;
+    readonly authorized_operation_id: string;
+    readonly operation_id: string;
+    readonly capability_kind: 'near_ed25519_mpc_signing';
+    readonly operation_kind: Ed25519OperationKind;
+    readonly lane_digest_b64u: string;
+    readonly intent_digest_b64u: string;
+    readonly display_digest_b64u: string;
+    readonly operation_fingerprint_digest: string;
+};
+export type Ed25519AuthorizedOperationReceipt = Ed25519ReusableAuthorizedOperationReceipt | Ed25519VerifiedStepUpAuthorizedOperationReceipt;
+export declare function requireEd25519OperationKind(value: unknown): Ed25519OperationKind;
+export declare function requireAuthorizedOperationReceiptString(record: Record<string, unknown>, name: string): string;
+export declare function requireExactAuthorizedOperationReceiptFields(record: Record<string, unknown>, branchFields?: readonly string[]): void;
+export declare function parseEd25519ReusableAuthorizedOperationReceipt(value: unknown): Ed25519ReusableAuthorizedOperationReceipt;
+export declare function parseEd25519VerifiedStepUpAuthorizedOperationReceipt(value: unknown): Ed25519VerifiedStepUpAuthorizedOperationReceipt;
+//# sourceMappingURL=ed25519AuthorizedOperationReceipt.d.ts.map

package/dist/types/wallet-server/src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.d.ts

@@ -0,0 +1,48 @@
+import type { RuntimePolicyScope } from '../../../../../shared-ts/src/threshold/signingRootScope';
+import type { RouterAbNormalSigningAdmissionAdapter, RouterAbNormalSigningAdmissionInput } from './routerAbPrivateSigningWorker';
+export type RouterAbNormalSigningProjectPolicyDecision = {
+    kind: 'allowed';
+} | {
+    kind: 'rejected';
+    retryAfterMs: number;
+};
+export type RouterAbNormalSigningAbuseDecision = {
+    kind: 'allowed';
+} | {
+    kind: 'rate_limited';
+    retryAfterMs: number;
+} | {
+    kind: 'rejected';
+    retryAfterMs: number;
+};
+export interface RouterAbNormalSigningProjectPolicyProvider {
+    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
+}
+export interface RouterAbNormalSigningAbuseProvider {
+    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
+}
+export interface RouterAbNormalSigningAdmissionStore extends RouterAbNormalSigningProjectPolicyProvider, RouterAbNormalSigningAbuseProvider {
+}
+export declare class InMemoryRouterAbNormalSigningAdmissionStore implements RouterAbNormalSigningAdmissionStore {
+    private readonly projectPolicies;
+    private readonly abuseDecisions;
+    setProjectPolicy(scope: RuntimePolicyScope, decision: RouterAbNormalSigningProjectPolicyDecision): void;
+    clearProjectPolicy(scope: RuntimePolicyScope): void;
+    setAbuseDecision(input: RouterAbNormalSigningAdmissionInput, decision: RouterAbNormalSigningAbuseDecision): void;
+    clearAbuseDecision(input: RouterAbNormalSigningAdmissionInput): void;
+    evaluateProjectPolicy(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningProjectPolicyDecision>;
+    evaluateAbuse(input: RouterAbNormalSigningAdmissionInput): Promise<RouterAbNormalSigningAbuseDecision>;
+}
+export declare function createRouterAbNormalSigningAdmissionAdapter(store: RouterAbNormalSigningAdmissionStore, options?: {
+    readonly now?: () => number;
+}): RouterAbNormalSigningAdmissionAdapter;
+export declare function createInMemoryRouterAbNormalSigningAdmissionStore(): InMemoryRouterAbNormalSigningAdmissionStore;
+export declare function createInMemoryRouterAbNormalSigningAdmissionAdapter(options?: {
+    readonly now?: () => number;
+}): {
+    readonly adapter: RouterAbNormalSigningAdmissionAdapter;
+    readonly store: InMemoryRouterAbNormalSigningAdmissionStore;
+};
+export declare function runtimePolicyScopeKey(scope: RuntimePolicyScope): string;
+export declare function abusePrincipalKey(input: RouterAbNormalSigningAdmissionInput): string;
+//# sourceMappingURL=routerAbNormalSigningAdmissionCore.d.ts.map